search

appmattus / certificatetransparency

Certificate transparency for Android and JVM
Apache License 2.0
142 stars 29 forks source link

CTPolicy failing with 2.x #81

Closed denzilferreira closed 1 year ago

denzilferreira commented 1 year ago

In development, we are upgrading the library to 2.1.1 (we also tried 2.0.0 and 2.1.0). We are seeing this error on the log, unable to connect to a valid URL:

URL Failure: Too few distinct operators, required 3, found 2 in [7s3QZNXbGs7FXLedtM0TojKHRny87N7DUUhZRnEftZs=:Valid SCT, c9meiRtMlnigIH1HneayxhzQUV5xGSqMa4AQesF3crU=:Valid SCT, SLDja9qmRzQP5WoC+p0w6xxSActW3SyB2bu/qznYhHM=:Valid SCT]

If I'm understanding this correctly, we have 3 valid SCT, but found says it's only 2? Do you know if this is a bug?

denzilferreira commented 1 year ago

@mattmook let me know if you need more info to debug this. Thanks!

denzilferreira commented 1 year ago

For context, v1.1.1 for the same URL reports all OK.

ctl-1 1 1
mattmook commented 1 year ago

hmm, that doesn't read right, let me take a look and see what I can see

mattmook commented 1 year ago

Oh misread the error, this will be because more than one of those SCTs is from the same operator.

Looks like I mis-interpreted the Chrome rules when I implemented the DefaultPolicy. I'm checking for 3 distinct operators, but, re-reading the policy should be only checking for 2 (always).

at least two SCTs must be issued from distinct CT Log Operators as recognized by Chrome.

denzilferreira commented 1 year ago

Thanks!