If a CA is behaving in a bad way why would they include a bad cert they issued in certificate transparency logs?
I don't understand what CT accomplishes since it places the onus of reporting on the party that CT is supposed to monitor.
I don't understand what CT accomplishes since it places the onus of reporting on the party that CT is supposed to monitor.
The net result is that CT gives us visibility into all web certificates (and more).
And it's true that CT is one of the various ways people might discover that although it's probably not even the easiest.
But honestly did you consider calling that purpose-of-software.internal.corp.example instead? And maybe at least use code names for projects that are actually secret?
Instead of normandy-invasion.corp.example at least call it overlord.corp.example and now it's not obvious where you're landing and I won't have lined up all the tanks and guns ready.
Low level first. CT logs produce a cryptographic "receipt" for the logged item. This receipt is a promise to report the item to anybody who asks within 24 hours. Web browsers, including Chrome, Edge and Safari, want to see the receipt. They may collect some receipts and check the logs did indeed publish these items. So, technically to make your certificate work in those browsers you need to log the certificate and the log you use needs to publish it.
Very high level. Logging and obtaining receipts, then providing the receipt to a browser is extra work. So, if you sell certificates it makes sense to do this work for all your customers by default and just bake the receipts into the data they have. It's extra trouble to build a mechanism to sidestep this, and so there's often no reason to do so.
Because secure browsers like Chrome require certificate transparency for it to trust the cert.
Unfortunately there still exist insecure browsers like Firefox which leaves a percentage of the population vulnerable to bad certs that aren't logged.
And if it was found out to be fraudulent? "Secure" Chrome would do f***all unless you're PayPal while "insecure" Firefox always checks if the certificate is still valid.