Given the issues CAs have had on checking sanctioned entities against domains I've put together an automatically updating list of unrevoked, unexpired certificates.
Site: https://sec-wayne.github.io/ct-sanctions-watch/ CSV: https://sec-wayne.github.io/ct-sanctions-watch/sanctions.csv JSON: https://sec-wayne.github.io/ct-sanctions-watch/sanctions.json Commit history: https://github.com/Sec-Wayne/ct-sanctions-watch/commits/main/ I've already been in contact with most of the CAs mentioned to give them a more up to date blocklist. The sources are cited on the page, and certificates are only included if it's under that CA's legal jurisdiction. This will be an undercount, but will be replacing the regular emails CAs have received before. I'll try to keep this up to date going forward. Ideally the CAs will update their blocklists overall and make this a moot project. Revocations are checked regularly, and expired certificates are also removed. There'll be a small lag on inclusion as revocation checks are performed first. This is to cover the case of a post-issuance checks on the CA's side finding the side and immediately revoking. This will be covering any CA chaining to Mozilla, Chrome, Apple, or Microsoft via CCADB checks. Any questions you know how to contact me. - Wayne -- You received this message because you are subscribed to the Google Groups "[email protected]" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion visit https://groups.google.com/a/mozilla.org/d/msgid/dev-security-policy/42474913-5ada-465f-80be-b73c4b216d80n%40mozilla.org.
