Some Rust code for submitting a cert to all of Chrome's trusted CT logs and getting back the SCTs
Usage:
$ cargo run submit path/to/cert-or-chain.pem ....
If the argument is a chain (more than one certificate) ct-tools will
submit that precise chain. If it is a single certificate, ct-tools will
automatically build a chain using crt.sh.
Example:
❯❯❯ cargo run submit example-chain.pem
Finished dev [unoptimized + debuginfo] target(s) in 0.0 secs
Running `target/debug/ct-tools submit example-chain.pem`
Submitting example-chain.pem ...
Find the cert on crt.sh: https://crt.sh?q=96F82FADFE9B285A17FDD7E5B00BB31C7659EF44FB6B00B4C2C7EB08C78FE783
+------------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| Log | SCT |
+------------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| Google 'Icarus' log | ACk8UZZUyDlluqpQ/FgH1Ldvv1h6KXLcpMMM9OVFR/R4AAABW4lgjG4AAAQDAEcwRQIhAL6epRLVUnk7sIrtfc7jXsJFjwQpgz/qVwHsIbB8k3jNAiA/29s01vQBMEez5DhL8SfuIcWX2w1zrIUuUMCM3RjXdQ== |
+------------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| Google 'Pilot' log | AKS5CZC0GFgUh7sTosxncAo8NZgE+RvfuON3zQ7IDdwQAAABW5ONx1gAAAQDAEcwRQIhAMpOkC4QcLa98ks8o3WMSgUaN0h/LYo8Rvc6Z1b6ZiFsAiBf+0Iun0ZVQV6Zkur5aJfWW1/j2gGIwX51mdmrbN6nKw== |
+------------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| Google 'Rocketeer' log | AO5Lvbd1zmC64UJpH6vhnmajD35fsHLYgwDEe4l6qP3LAAABW5YpEWMAAAQDAEgwRgIhAIHTcgnOY6wMIAvfCZgu9XdmmqdaVjqlJA80tMz6q8/IAiEAiM6BcygjOGAaaS/QeH/V34xnBeshUCu2j3F6HdtQ6tw= |
+------------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| WoSign log | AEGy3C6J5jzkrxunuym/aMbe5vnxzAR+MN/647O6JZJjAAABW4lzUiEAAAQDAEYwRAIgat0S/80gyWkMPbWrmmPShx76SYjlCelNyMnZB08oqRUCIDyXxyBGGgdHAGdgwVnnK8ug16XhZGSukzDf5eRE9m2y |
+------------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------+
You can also use it to check if a certificate is already in CT, without submitting it:
❯❯❯ cargo run check example-chain.pem
Finished dev [unoptimized + debuginfo] target(s) in 0.1 secs
Running `target/debug/ct-tools check example-chain.pem`
example-chain.pem was already logged