parent
6ec0ab5b35
commit
6a6f74414a
|
@ -1,7 +1,7 @@
|
||||||
# Cert Spotter - Certificate Transparency Monitor
|
# Cert Spotter - Certificate Transparency Monitor
|
||||||
|
|
||||||
**Cert Spotter** is a Certificate Transparency log monitor from SSLMate that
|
**Cert Spotter** is a Certificate Transparency log monitor from SSLMate that
|
||||||
alerts you when a SSL/TLS certificate is issued for one of your domains.
|
alerts you when an SSL/TLS certificate is issued for one of your domains.
|
||||||
Cert Spotter is easier to use than other open source CT monitors, since it does not require
|
Cert Spotter is easier to use than other open source CT monitors, since it does not require
|
||||||
a database. It's also more robust, since it uses a special certificate parser
|
a database. It's also more robust, since it uses a special certificate parser
|
||||||
that ensures it won't miss certificates.
|
that ensures it won't miss certificates.
|
||||||
|
|
|
@ -123,7 +123,7 @@ func main() {
|
||||||
}
|
}
|
||||||
flag.IntVar(&flags.batchSize, "batch_size", 1000, "Max number of entries to request per call to get-entries (advanced)")
|
flag.IntVar(&flags.batchSize, "batch_size", 1000, "Max number of entries to request per call to get-entries (advanced)")
|
||||||
flag.Func("email", "Email address to contact when matching certificate is discovered (repeatable)", appendFunc(&flags.email))
|
flag.Func("email", "Email address to contact when matching certificate is discovered (repeatable)", appendFunc(&flags.email))
|
||||||
flag.DurationVar(&flags.healthcheck, "healthcheck", 24*time.Hour, "How frequently to perform a healt check")
|
flag.DurationVar(&flags.healthcheck, "healthcheck", 24*time.Hour, "How frequently to perform a health check")
|
||||||
flag.StringVar(&flags.logs, "logs", defaultLogList, "File path or URL of JSON list of logs to monitor")
|
flag.StringVar(&flags.logs, "logs", defaultLogList, "File path or URL of JSON list of logs to monitor")
|
||||||
flag.BoolVar(&flags.noSave, "no_save", false, "Do not save a copy of matching certificates in state directory")
|
flag.BoolVar(&flags.noSave, "no_save", false, "Do not save a copy of matching certificates in state directory")
|
||||||
flag.StringVar(&flags.script, "script", "", "Program to execute when a matching certificate is discovered")
|
flag.StringVar(&flags.script, "script", "", "Program to execute when a matching certificate is discovered")
|
||||||
|
|
|
@ -77,7 +77,7 @@ type LogClient struct {
|
||||||
// These represent the structures returned by the CT Log server.
|
// These represent the structures returned by the CT Log server.
|
||||||
//////////////////////////////////////////////////////////////////////////////////
|
//////////////////////////////////////////////////////////////////////////////////
|
||||||
|
|
||||||
// getSTHResponse respresents the JSON response to the get-sth CT method
|
// getSTHResponse represents the JSON response to the get-sth CT method
|
||||||
type getSTHResponse struct {
|
type getSTHResponse struct {
|
||||||
TreeSize uint64 `json:"tree_size"` // Number of certs in the current tree
|
TreeSize uint64 `json:"tree_size"` // Number of certs in the current tree
|
||||||
Timestamp uint64 `json:"timestamp"` // Time that the tree was created
|
Timestamp uint64 `json:"timestamp"` // Time that the tree was created
|
||||||
|
@ -85,13 +85,13 @@ type getSTHResponse struct {
|
||||||
TreeHeadSignature []byte `json:"tree_head_signature"` // Log signature for this STH
|
TreeHeadSignature []byte `json:"tree_head_signature"` // Log signature for this STH
|
||||||
}
|
}
|
||||||
|
|
||||||
// base64LeafEntry respresents a Base64 encoded leaf entry
|
// base64LeafEntry represents a Base64 encoded leaf entry
|
||||||
type base64LeafEntry struct {
|
type base64LeafEntry struct {
|
||||||
LeafInput []byte `json:"leaf_input"`
|
LeafInput []byte `json:"leaf_input"`
|
||||||
ExtraData []byte `json:"extra_data"`
|
ExtraData []byte `json:"extra_data"`
|
||||||
}
|
}
|
||||||
|
|
||||||
// getEntriesReponse respresents the JSON response to the CT get-entries method
|
// getEntriesReponse represents the JSON response to the CT get-entries method
|
||||||
type getEntriesResponse struct {
|
type getEntriesResponse struct {
|
||||||
Entries []base64LeafEntry `json:"entries"` // the list of returned entries
|
Entries []base64LeafEntry `json:"entries"` // the list of returned entries
|
||||||
}
|
}
|
||||||
|
|
|
@ -156,7 +156,7 @@ func (h HashAlgorithm) String() string {
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
// SignatureAlgorithm from the the DigitallySigned struct
|
// SignatureAlgorithm from the DigitallySigned struct
|
||||||
type SignatureAlgorithm byte
|
type SignatureAlgorithm byte
|
||||||
|
|
||||||
// SignatureAlgorithm constants
|
// SignatureAlgorithm constants
|
||||||
|
@ -301,7 +301,7 @@ type SignedCertificateTimestamp struct {
|
||||||
SCTVersion Version `json:"sct_version"` // The version of the protocol to which the SCT conforms
|
SCTVersion Version `json:"sct_version"` // The version of the protocol to which the SCT conforms
|
||||||
LogID SHA256Hash `json:"id"` // the SHA-256 hash of the log's public key, calculated over
|
LogID SHA256Hash `json:"id"` // the SHA-256 hash of the log's public key, calculated over
|
||||||
// the DER encoding of the key represented as SubjectPublicKeyInfo.
|
// the DER encoding of the key represented as SubjectPublicKeyInfo.
|
||||||
Timestamp uint64 `json:"timestamp"` // Timestamp (in ms since unix epoc) at which the SCT was issued
|
Timestamp uint64 `json:"timestamp"` // Timestamp (in ms since unix epoch) at which the SCT was issued
|
||||||
Extensions CTExtensions `json:"extensions"` // For future extensions to the protocol
|
Extensions CTExtensions `json:"extensions"` // For future extensions to the protocol
|
||||||
Signature DigitallySigned `json:"signature"` // The Log's signature for this SCT
|
Signature DigitallySigned `json:"signature"` // The Log's signature for this SCT
|
||||||
}
|
}
|
||||||
|
@ -324,7 +324,7 @@ type TimestampedEntry struct {
|
||||||
Extensions CTExtensions
|
Extensions CTExtensions
|
||||||
}
|
}
|
||||||
|
|
||||||
// MerkleTreeLeaf represents the deserialized sructure of the hash input for the
|
// MerkleTreeLeaf represents the deserialized structure of the hash input for the
|
||||||
// leaves of a log's Merkle tree. See RFC section 3.4
|
// leaves of a log's Merkle tree. See RFC section 3.4
|
||||||
type MerkleTreeLeaf struct {
|
type MerkleTreeLeaf struct {
|
||||||
Version Version // the version of the protocol to which the MerkleTreeLeaf corresponds
|
Version Version // the version of the protocol to which the MerkleTreeLeaf corresponds
|
||||||
|
|
Loading…
Reference in New Issue