Some CT logs include a certificate that our parser rejects as malformed, even though we use the lax certificate-transparency-go/x509 parser. In particular, we're not able to sync logs that include https://crt.sh/?id=6039677462&opt=zlint, which has a non-zero padding bit in its keyUsage extension (03 02 01 81 instead of 03 02 01 80 or even better 03 02 07 80).
I have a patch on certificate-transparency-go which we could use in the short term. Ideally they'll take it upstream.
Steps to reproduce
1) Create config.ini with contents
Some CT logs include a certificate that our parser rejects as malformed, even though we use the lax
certificate-transparency-go/x509
parser. In particular, we're not able to sync logs that include https://crt.sh/?id=6039677462&opt=zlint, which has a non-zero padding bit in its keyUsage extension (03 02 01 81
instead of03 02 01 80
or even better03 02 07 80
).I have a patch on certificate-transparency-go which we could use in the short term. Ideally they'll take it upstream.
Steps to reproduce 1) Create
config.ini
with contents2) Start a redis instance
3) Tweak the log's redis entry so we start downloading at the bad index
4) Run ct-fetch