Hacker News Reader

> these certificates were already being rejected by Chrome and Safari for having invalid SCTs

What's a good way to make an equivalent check from a script, if I want (in future) to be able to check whether I have a website whose certificate has such a problem?

View on HN

Excellent question! The sctcheck command from https://github.com/google/certificate-transparency-go/ can be used to check the signatures of the embedded SCTs in a certificate.

I've also got an online tool which you can use to test a site for CT policy compliance: https://sslmate.com/labs/ct_policy_analyzer/

Example of a working site: https://sslmate.com/labs/ct_policy_analyzer/?sslmate.com

Example of one of the sites affected by the Let's Encrypt incident: https://sslmate.com/labs/ct_policy_analyzer/?thecandyshake.c...

Reply on news.ycombinator.com