ctl

Documentation

Index

• func ContainsSCT(cert []byte) (bool, error)
• func VerifyEmbeddedSCT(ctx context.Context, chain []*x509.Certificate) error
• func VerifySCT(ctx context.Context, certPEM, chainPEM, rawSCT []byte) error

Functions

func ContainsSCT

func ContainsSCT(cert []byte) (bool, error)

ContainsSCT checks if the certificate contains embedded SCTs. cert can either be DER or PEM encoded.

func VerifyEmbeddedSCT

func VerifyEmbeddedSCT(ctx context.Context, chain []*x509.Certificate) error

VerifyEmbeddedSCT verifies an embedded SCT in a certificate.

func VerifySCT

func VerifySCT(ctx context.Context, certPEM, chainPEM, rawSCT []byte) error

VerifySCT verifies SCTs against the Fulcio CT log public key.

The SCT is a `Signed Certificate Timestamp`, which promises that the certificate issued by Fulcio was also added to the public CT log within some defined time period.

VerifySCT can verify an SCT list embedded in the certificate, or a detached SCT provided by Fulcio.

By default the public keys comes from TUF, but you can override this for test purposes by using an env variable `SIGSTORE_CT_LOG_PUBLIC_KEY_FILE`. If using an alternate, the file can be PEM, or DER format.