Advanced › Module 6 › Lesson 2
CT Named
Certificate Transparency literacy — CT logs, SCT, crt.sh monitoring — defender detection vocabulary on public chains.
Visual · t28_ct_named
CT = named transparency logs. Defender literacy. $CRYPTO_LAB. Original Cyberlium.
Opening
CT logs make mis-issued certs visible — learn the named transparency model before you trust a chain on any review.
Certificate Transparency (CT) literacy names: public CT logs, Signed Certificate Timestamp (SCT), embedded vs OCSP-stapled SCT delivery, crt.sh and log-monitor workflows at category level, rogue CA detection use case. Defenders monitor CT for unexpected certs on owned domains — analysts read log entries without operating fake CAs. Cyberlium on $CRYPTO_LAB and public crt.sh queries for example.com-class domains — literacy only, NOT submitting malicious certs to logs, NOT using CT gaps to attack production. Lab row: four CT concepts (log, SCT, monitor, rogue detection) with one defender action each. Pair with Module 6-1 lifecycle — issuance should appear in CT for public CAs.
1. CT concepts named
CT log, SCT, embedded extension, monitor/alert — four literacy anchors for domain owners.
Mis-issued cert may appear in CT before victim notices — defender monitoring value.
Command guide
Try these commands — CT concepts named
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Certificate Transparency — https://certificate.transparency.dev/ crt.sh — https://crt.sh/ (CT log search literacy — public certs only) Let's Encrypt — https://letsencrypt.org/docs/certificate-compatibility/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export CRYPTO_LAB=${CRYPTO_LAB:-$HOME/cyberlium-lab/t28-crypto}
curl -sS 'https://crt.sh/?q=example.com&output=json' | head -20
curl -sS https://certificate.transparency.dev/ | head -10
grep -E 'self-signed|public CA' "$CRYPTO_LAB/notes/aes-modes-literacy.txt" 2>/dev/null || echo 'Lab cert is self-signed — browsers trust public CAs via CT logs'Primary tools to practice this lesson: curl, grep. Reference sites: Certificate Transparency (https://certificate.transparency.dev/); crt.sh (https://crt.sh/); Let's Encrypt (https://letsencrypt.org/docs/certificate-compatibility/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Defender workflow
Subscribe crt.sh or log alerts for owned domains; correlate with expected issuance pipeline.
Unexpected CA or SAN = incident row — not automatic exploit authorization.
3. Scope refuse
No submitting attacker certs to CT as harassment; no CT-based prod MITM cookbooks.
CT literacy supports detection — not unauthorized issuance attacks.
4. What you ship: CT literacy card
Four CT concepts + defender action each + NEVER rogue issuance line.
5. What you record before the next lesson
CT literacy card path.
6. Wrong vs right: prod crypto oracles vs CTF toys
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Use CT monitoring as excuse to MITM production banking TLS.
Right
CT literacy card from public log read. Next: OCSP/CRL.
Mission: CT literacy card
1) Define CT log and SCT. 2) Two SCT delivery methods. 3) One defender monitor action. 4) Write NEVER rogue issuance line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Embedded SCT vs OCSP-stapled — literacy difference?”
Knowledge Check
APPLY: CT literacy helps defenders:
Multiple choice
Knowledge Check
APPLY: True or False: CT enables prod MITM cookbooks on Cyberlium.
True or False
Knowledge Check
APPLY: SCT stands for:
Multiple choice