search

SSLMate / certspotter

Certificate Transparency Log Monitor
https://sslmate.com/certspotter
Mozilla Public License 2.0
944 stars 84 forks source link

400 Bad Request when verifying yeti2022-2 #47

Closed imrejonk closed 2 years ago

imrejonk commented 2 years ago

The default monitor.json file contains a DigiCert Yeti2022 Log #2 entry. This CT log currently returns HTTP 400 Bad Request errors, which are logged by certspotter like this:

2021/08/17 13:00:02 https://yeti2022-2.ct.digicert.com/log/: Unable to verify consistency of STH 3 (/var/local/certspotter/.certspotter/logs/BZwB0yDgB4QTlYBJjRF8kDJmr69yULWvO0akPhGEDUo/unverified_sths/3-7q2OCBgybLpAKtVWBbK5Mq2x9sx8wkkLfwFWm87FOzI.json) (if this error persists, it should be construed as misbehavior by the log): Error fetching consistency proof: GET https://yeti2022-2.ct.digicert.com/log/ct/v1/get-sth-consistency?first=0&second=3: 400 BAD REQUEST ()

We are seeing these errors since around two weeks. This CT log is currently not present in Google's log_list.json. I am not sure what the best course of action is, but it might be a good idea to omit this log from the monitor.json file until the log can be used with Certspotter.

AGWA commented 2 years ago

Thanks for reporting this. This appears to be log misbehavior, which I will report to the ct-policy mailing list.

This log is considered qualified by Apple's Certificate Transparency program (https://valid.apple.com/ct/log_list/current_log_list.json) so I'm going to leave it in monitor.json for the time being so people are notified of the certificates which it contains.

imrejonk commented 2 years ago

That sounds like an appropriate solution. Thanks for taking the time to report this to ct-policy. I'll keep an eye on the mailing list.

AGWA commented 2 years ago

It turns out RFC 6962 is ambiguous about what logs should do in this particular case. I just pushed a new release of Cert Spotter, 0.11, which works around the ambiguity and will prevent this error. If you can't immediately upgrade, you can remove the file logs/BZwB0yDgB4QTlYBJjRF8kDJmr69yULWvO0akPhGEDUo/0-47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU.json from your .certspotter directory to suppress the error.

imrejonk commented 2 years ago

We just updated to Cert Spotter 0.11, and I can confirm that we are no longer seeing the HTTP 400 error messages. Thanks for taking the time to resolve this issue!