search

SSLMate / certspotter

Certificate Transparency Log Monitor
https://sslmate.com/certspotter
Mozilla Public License 2.0
983 stars 84 forks source link

Yeti2022-2 #48

Closed Jcpetrucci closed 3 years ago

Jcpetrucci commented 3 years ago

I'm seeing many warnings in the log such as this:

2021/10/12 12:02:09 https://yeti2022-2.ct.digicert.com/log/: Unable to verify consistency of STH 3 (/home/sa.certspotter/.certspotter/logs/BZwB0yDgB4QTlYBJjRF8kDJmr69yULWvO0akPhGEDUo/unverified_sths/3-yD2lvdIhe0VuTmA0lq3io1QpC0Q8ocb90DMs7vhH5kA.json) (if this error persists, it should be construed as misbehavior by the log): Error fetching consistency proof: GET https://yeti2022-2.ct.digicert.com/log/ct/v1/get-sth-consistency?first=0&second=3: 400 BAD REQUEST ()

I suspect it is due to this problem in DigiCert's Yeti2022 log: https://groups.google.com/a/chromium.org/g/ct-policy/c/hxNohyZncfQ

Is there anything we can do to mitigate this via configuration, or does there need to be an update to certspotter?

AGWA commented 3 years ago

This is a dupe of #47 and can be fixed by updating certspotter.

Jcpetrucci commented 3 years ago

Thank you, that appears to have worked. If I may provide some feedback, a -version flag to certspotter would be helpful because I thought that I was already running the latest version. Thanks for making this cool tool!

AGWA commented 3 years ago

Good idea about a -version flag. I'll add it to the next version.