-
Notifications
You must be signed in to change notification settings - Fork 7
/
Copy pathREADME
68 lines (44 loc) · 2.26 KB
/
README
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
The Certificate Transparency Honeybee (ct-honeybee) is a lightweight
program that retrieves signed tree heads (STHs) from Certificate
Transparency logs and uploads them to auditors.
You can help strengthen the integrity of the Certificate Transparency
ecosystem by running ct-honeybee on your workstation/server/toaster every
hour or so (pick a random minute so that not everyone runs ct-honeybee
at the same time). Running ct-honeybee from many different Internet
vantage points increases the likelihood of detecting a misbehaving log
which has presented a different view of the log to different clients.
INSTALLATION
Python 3 is required.
Install ct-honeybee and put it in a cron job to run once an hour or so
(pick a random minute so that not everyone runs ct-honeybee at the
same time).
ct-honeybee is stateless and won't write to your filesystem.
LOGS
All logs trusted or pending inclusion by Chrome are audited by
ct-honeybee. Currently the list is hard-coded in the source code.
AUDITORS
ct-honeybee uploads STHs to the following auditors:
certspotter.com
ct.grahamedgecombe.com
If you run an auditor that implements the sth-pollination endpoint
described in Section 8.2 of draft-ietf-trans-gossip-00, please get in
touch <[email protected]> and we will add you to ct-honeybee.
TECHNICAL OPERATION
1. For each log: fetch the latest STH and add it to the list of STHs.
For simplicity, signatures are not checked; we leave this job to the
auditors.
2. Shuffle the list of auditors.
3. For each auditor: upload the list of STHs to the auditor using the
protocol described in Section 8.2 of draft-ietf-trans-gossip-00.
Add each returned STH to the list of STHs so they get pollinated
to subsequent auditors. Since we shuffle the list of auditors,
we will pollinate in a different order each time ct-honeybee is run.
LEGALESE
Written in 2017 by Opsmate, Inc. d/b/a SSLMate <[email protected]>
To the extent possible under law, the author(s) have dedicated all
copyright and related and neighboring rights to this software to the
public domain worldwide. This software is distributed without any
warranty.
You should have received a copy of the CC0 Public
Domain Dedication along with this software. If not, see
<http://creativecommons.org/publicdomain/zero/1.0/>.