Package: ctutlz
—>`CT Deployment
Study <https://theno.github.io/presi-ct-deployment>`__<—ctutlzPython utils library and tools forCertificate
Transparency.This is the first implementation in Python which scrapes the SCTs at the
TLS handshake bycertificate
extension,
byTLS
extension,
and byOCSP
staplingdirectly using the OpenSSL C-API (without forking subprocesses to call
any OpenSSL commands).*Usage*verify-scts*ctloglist*decompose-cert*API*Installation*Development*Fabfile*Devel-CommandsUsageverify-scts> verify-scts --help

usage: verify-scts [-h] [--short | --debug]
                   [--cert-only | --tls-only | --ocsp-only]
                   [--log-list <filename> | --latest-logs]
                   hostname [hostname ...]

Verify Signed Certificate Timestamps (SCTs) delivered from one or several
hosts by X.509v3 extension, TLS extension, or OCSP stapling

positional arguments:
  hostname              host name of the server (example: 'ritter.vg')

optional arguments:
  -h, --help            show this help message and exit
  --short               show short results and warnings/errors only
  --debug               show more for diagnostic purposes
  --cert-only           only verify SCTs included in the certificate
  --tls-only            only verify SCTs gathered from TLS handshake
  --ocsp-only           only verify SCTs gathered via OCSP request
  --log-list <filename>
                        filename of a log list in JSON format
  --latest-logs         for SCT verification against known CT Logs (compliant
                        with Chrome's CT policy) download latest version of
                        https://www.gstatic.com/
                        ct/log_list/v2/all_logs_list.json -- use built-in log
                        list really_all_logs.json from 2020-04-05 if --latest-
                        logs or --log-list are not setExamples:Simple google.com verification> verify-scts google.com --short

# google.com

* no EV cert
* not issued by Let's Encrypt

## SCTs by Certificate

```
LogID b64 : sh4FzIuizYogTodm+Su5iiUgZ2va+nDnsklTLe+LkF4=
Sign. b64 : MEUCIDsJPECetlDd6KUBhpZFsOfhQYoI45i+T9Lod1wsY8gN
            AiEA/ohyB+GuG+Z4MJNxH94xQUUpd2jpiDbG1r6FneDRpkE=
Log found : Google 'Argon2020' log
Chrome    : True
Result    : Verified OK
```

```
LogID b64 : Xqdz+d9WwOe1Nkh90EngMnqRmgyEoRIShBh1loFxRVg=
Sign. b64 : MEUCIQChTO0dZC+zFcuvt3RPvuvMZ7RohbeizyRy5OhMpC/N
            kgIgTUhJTv5zdKBXDCgrgPoIYarBkYmTsirQDhALSEHHmZU=
Log found : Cloudflare 'Nimbus2020' Log
Chrome    : True
Result    : Verified OK
```

## SCTs by TLS

no SCTs

## SCTs by OCSP

no SCTsDomains to try for different TLS-features>verify-sctsritter.vgsslanalyzer.comodoca.comwww.db.com#   has           ⇧                ⇧                  ⇧
# scts by:   TLS-extension   OCSP-extension   certificate (precert)Output markdown into PDF# nice: convert the markdown formatted output into other formats with pandocdomain=ritter.vgfmt=pdf# {pdf,html,rst,...}verify-scts$domain2>&1|pandoc--from=markdown-o$domain-scts.$fmtctloglist> ctloglist --help

usage: ctloglist [-h] [-v] [--short | --debug] [--json | --schema]

Download, merge and summarize known logs for Certificate Transparency (CT)

optional arguments:
  -h, --help     show this help message and exit
  -v, --version  print version number
  --short        show short results
  --debug        show more for diagnostic purposes
  --json         print merged log lists as json
  --schema       print json schema

Print output to stdout, warning and errors to stderr. Currently there exist
three log lists with differing infos: 1. listing of webpage
https://www.certificate-transparency.org/known-logs 2. log_list.json 3.
all_logs_list.json. This three log lists will be merged into one list in the
future.Discussion:https://groups.google.com/forum/?fromgroups#!topic/certificate-transparency/zBv7EK0522wCreated withctloglist: *really_all_logs.md*really_all_logs.jsonExamples:# list really all known logs
#  infos aggregated from:
#  * log_list.json
#  * all_logs.json
#  * from log list webpage# overview>ctloglist--short# full, aggregated info>ctloglist# write into a json file>ctloglist--json>really_all_logs.json# only show inconsistencies of the ct log lists>ctloglist1>/dev/nulldecompose-cert> decompose-cert --help

usage: decompose-cert [-h] [-v] --cert <filename> [--tbscert <filename>]
                      [--sign-algo <filename>] [--signature <filename>]

Decompose an ASN.1 certificate into its components tbsCertificate in DER
format, signatureAlgorithm in DER format, and signatureValue as bytes
according to https://tools.ietf.org/html/rfc5280#section-4.1

optional arguments:
  -h, --help            show this help message and exit
  -v, --version         print version number
  --tbscert <filename>  write extracted tbsCertificate to this file (DER
                        encoded)
  --sign-algo <filename>
                        write extracted signatureAlgorithm to this file (DER
                        encoded)
  --signature <filename>
                        write extracted signatureValue to this file

required arguments:
  --cert <filename>     Certificate in PEM, Base64, or DER formatAPIImport module in your python code, for example:>python3.6>>>fromctutlz.ctlogimportdownload_log_list>>>fromctutlz.scripts.verify_sctsimportverify_scts_by_tls>>>fromctutlz.tls.handshakeimportdo_handshake>>>>>>ctlogs=download_log_list()>>>handshake_res=do_handshake('google.com')>>>verifications=verify_scts_by_tls(handshake_res,ctlogs)>>>forverinverifications:...print(f'{ver.verified}:{ver.log.description}')...True:Google'Pilot'logTrue:Symanteclog>>>>>>fromctutlz.rfc6962importSignedCertificateTimestamp,MerkleTreeLeafInstallationInstall the latest version of the pypi python packagectutlz:pipinstallctutlzDevelopmentClone the source coderepository:git clone https://github.com/theno/ctutlz.git
cd ctutlzFabfileThefabfile.pycontains devel-tasks to be executed withFabric(maybe you need toinstallit):> fab -l

Available commands:

    clean    Delete temporary files not under version control.
    pypi     Build package and upload to pypi.
    pythons  Install latest pythons with pyenv.
    test     Run unit tests.
    tox      Run tox.

# Show task details, e.g. for task `test`:
> fab -d test

Run unit tests.

    Keyword-Args:
        args: Optional arguments passed to pytest
        py: python version to run the tests against

    Example:

        fab test:args=-s,py=py27At first, set up python versions withpyenvand virtualenvs for
development withtox:fab pythons
fab toxTox creates virtualenvs of different Python versions (if they not exist
already) and runs the unit tests against each virtualenv.On Ubuntu 16.04 you must installlibpython-devandlibpython3-devin order to make the tests passing for Python-2.7 and
Python-3.5:sudoapt-getinstalllibpython-devlibpython3-dev# Then, rebuild the non-working Python-2.7 and Python-3.5 virtualenv and
# run the unit tests:fabtox:'-e py27 -e py35 --recreate'Devel-CommandsRun unit tests against several pythons with tox (needs pythons defined
in envlist oftox.inito be installed with pyenv):python3.6-mtox# only against one python version:python3.6-mtox-epy27# rebuild virtual environments:python3.6-mtox-rRun unit tests with pytest (uses tox virtualenv, replacepy36by
e.g.py27where applicable):PYTHONPATH='.'.tox/py36/bin/python-mpytest# show outputPYTHONPATH='.'.tox/py36/bin/python-mpytest-sRun toolverify-sctsfrom source:PYTHONPATH='.'.tox/py36/bin/pythonctutlz/scripts/verify_scts.py-hUpdate really_all_logs.tox/py36/bin/ctloglist > ctutlz/really_all_logs.md
.tox/py36/bin/ctloglist --json > ctutlz/really_all_logs.json