# Certificate Transparency Published articles for Certificate Transparency. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Кому верит Яндекс Браузер и как попасть в этот список: запускаем Yandex Browser Root Certificate Program DevFeed: [Кому верит Яндекс Браузер и как попасть в этот список: запускаем Yandex Browser Root Certificate Program]() Original publisher: [Read original article]() Author: Ilya\_Golubtsov (Яндекс) Published: 2026-08-28T08:00:27Z Content type: release Language: ru Sources: [Яндекс - Как мы делаем Яндекс / Статьи]() Topics: [browser](), [яндекс](), [Certificate Transparency](), [Chromium](), [API]() Tags: [api](), [browser](), [certificate-transparency](), [chromium](), [tag-2b4427fb2566](), [tag-4004cf5948d3](), [tag-4d5248fd6bfe](), [tag-d8952f30fc4a](), [tag-dfac9042ce7b]() ### AI overview Yandex opens the Yandex Browser Root Certificate Program, a public process for adding root certificates to the browser's trust store. The article explains its participation requirements, auditing process, WebPKI controls, and the browser's use of Chromium-derived trust data and separate Certificate Transparency logs. ### Source excerpt За 15 лет WebPKI -- экосистема доверия между сайтами и пользователями -- сильно выросла. Появились технологии, которые делают это доверие более прозрачным и проверяемым, изменились подходы к управлению, а многие процессы стали автоматическими: выпуск и обновление сертификатов, публичный аудит через Certificate Transparency и другие механизмы. И, конечно, в истории WebPKI были серьёзные инциденты безопасности, которые показали: правила доверия должны быть публичными, прозрачными и проверяемыми. Однако один вопрос не решается автоматически: кому браузер должен доверять и на каких условиях. Каждый вендор определяет это сам. Поэтому мы открываем Yandex Browser Root Certificate Program -- публичную программу добавления корневых сертификатов в хранилище Яндекс Браузера. В ней описаны требования к участникам, аудит и понятная процедура подачи заявки. Под катом рассказываем, какие требования нужно выполнить и как в Браузере устроены WebPKI и связанные с ними контроли безопасности. Читать далее ## Certificate Transparency Monitoring is now generally available DevFeed: [Certificate Transparency Monitoring is now generally available]() Original publisher: [Read original article]() Author: Pravallika Nakarikanti Published: 2026-08-13T13:00:00Z Content type: release Language: en Sources: [Cloudflare Blog]() Topics: [Certificate Transparency]() Tags: [certificate-transparency](), [cloudflare](), [monitoring](), [ssl](), [tls]() ### AI overview Cloudflare has made Certificate Transparency Monitoring generally available. It now filters certificates Cloudflare issued for a domain, reducing renewal-alert noise and highlighting unexpected external certificates. ### Source excerpt Cloudflare's Certificate Transparency Monitoring is now generally available. The biggest change: we no longer email you about certificates Cloudflare issued for your domain, so when an alert lands in your inbox, it's worth a look. ## Factoring "short-sleeve" RSA keys with polynomials DevFeed: [Factoring "short-sleeve" RSA keys with polynomials]() Original publisher: [Read original article]() Author: "Keegan Ryan" Published: 2026-06-12T11:00:00Z Content type: article Language: en Sources: [The Trail of Bits Blog](), [The Trail of Bits Blog]() Topics: [Vulnerabilities](), [Certificate Transparency](), [TLS (Transport Layer Security)](), [ssh](), [Open Source](), [Code]() Tags: [attacks](), [bug](), [certificate-transparency](), [code](), [cryptography](), [exploits](), [internet](), [open-source](), [software](), [ssh](), [tls](), [vulnerabilities]() ### AI overview Researchers found hundreds of weak RSA and DSA keys whose structured zero-bit patterns made them quickly factorable with a polynomial-based cryptanalytic technique. They linked many of the keys to a type mismatch in older CompleteFTP big-integer code and recovered 603 RSA private keys and 74 DSA keys from internet scans. ### Source excerpt What happens when the bits of an RSA private key are heavily biased toward 0 instead of being randomly generated? The public key's bits could be biased enough for us to detect these incorrectly generated keys in the wild. Together with Hanno Böck of the badkeys project, we found hundreds of unique keys that not only have this property, but can be quickly factored. We also found the bug that led to many of these keys and analyzed historical data to track the issue over time. Surprisingly, the pattern of 0 bits is often highly structured, allowing us to develop a powerful polynomial-based cryptanalytic technique that exploits the pattern. Figure 1: Two patterns of RSA moduli with repeated blocks of 0 bits seen in real-world examples. These "short-sleeve" keys, named for how the 0 bits don't fully cover the limbs of the big integers, largely fell into two patterns. Pattern 1 remains unexplained, but we traced pattern 2 to a type mismatch in big-integer code from old versions of the CompleteFTP file transfer software. The CompleteFTP bug also generated vulnerable short-sleeve DSA keys, and we recovered 603 unique RSA private keys and 74 DSA keys from internet scans. If you used CompleteFTP to generate host keys between December 2016 and December 2023, CompleteFTP has released a tool to check whether your keys need to be regenerated. How we found the weak keys The badkeys project is an open-source service that checks public keys for known vulnerabilities. While developing this tool, Hanno collected a massive number of real-world keys from public sources, including Certificate Transparency logs, internet-wide TLS and SSH scans, PGP keys, and many others. By searching this dataset for unexpectedly sparse RSA moduli, we uncovered a large number of keys in the wild with the patterns in Figure 1. Both patterns include several regularly spaced blocks of all zeros interleaved with seemingly random data. Pattern 1 appears in CT logs for certificates issued to several large organ ## Chrome develops Merkle Tree Certificates for quantum-resistant HTTPS DevFeed: [Chrome develops Merkle Tree Certificates for quantum-resistant HTTPS]() Original publisher: [Read original article]() Author: Google (noreply@blogger.com) Published: 2026-02-27T17:01:00Z Content type: release Language: en Sources: [Google Online Security]() Topics: [Chrome](), [Post-quantum cryptography](), [Certificate Transparency](), [Internet Engineering Task Force (IETF)](), [TLS (Transport Layer Security)](), [Scalability](), [Security](), [Cryptography]() Tags: [certificate-transparency](), [chrome](), [ietf](), [none](), [post-quantum-cryptography](), [scalability](), [security](), [tls](), [web]() ### AI overview Chrome is developing Merkle Tree Certificates with partners through the IETF PLANTS working group to support quantum-resistant HTTPS while reducing the bandwidth and performance costs of larger post-quantum certificate chains. Chrome says it has no immediate plan to add traditional post-quantum X.509 certificates to the Chrome Root Store and is experimenting with MTCs using real internet traffic. ### Source excerpt Posted by Chrome Secure Web and Networking Team Today we're announcing a new program in Chrome to make HTTPS certificates secure against quantum computers. The Internet Engineering Task Force (IETF) recently created a working group, PKI, Logs, And Tree Signatures ("PLANTS"), aiming to address the performance and bandwidth challenges that the increased size of quantum-resistant cryptography introduces into TLS connections requiring Certificate Transparency (CT). We recently shared our call to action to secure quantum computing and have written about challenges introduced by quantum-resistant cryptography and some of the steps we've taken to address them in earlier blog posts. To ensure the scalability and efficiency of the ecosystem, Chrome has no immediate plan to add traditional X.509 certificates containing post-quantum cryptography to the Chrome Root Store. Instead, Chrome, in collaboration with other partners, is developing an evolution of HTTPS certificates based on Merkle Tree Certificates (MTCs), currently in development in the PLANTS working group. MTCs replace the heavy, serialized chain of signatures found in traditional PKI with compact Merkle Tree proofs. In this model, a Certification Authority (CA) signs a single "Tree Head" representing potentially millions of certificates, and the "certificate" sent to the browser is merely a lightweight proof of inclusion in that tree. Why MTCs? MTCs enable the adoption of robust post-quantum algorithms without incurring the massive bandwidth penalty of classical X.509 certificate chains. They also decouple the security strength of the corresponding cryptographic algorithm from the size of the data transmitted to the user. By shrinking the authentication data in a TLS handshake to the absolute minimum, MTCs aim to keep the post-quantum web as fast and seamless as today's internet, maintaining high performance even as we adopt stronger security. Finally, with MTCs, transparency is a fundamental property of issuance: ## CRLite: Fast, private, and comprehensive certificate revocation checking in Firefox DevFeed: [CRLite: Fast, private, and comprehensive certificate revocation checking in Firefox]() Original publisher: [Read original article]() Author: John Schanck Published: 2025-08-19T16:03:19Z Content type: article Language: en Sources: [Mozilla Hacks - the Web developer blog]() Topics: [Certificate Transparency](), [Cryptography]() Tags: [browser](), [certificate-transparency](), [encryption](), [feature](), [firefox](), [http](), [linux](), [macos](), [performance](), [privacy](), [security](), [tls](), [windows]() ### AI overview Firefox's CRLite locally checks revoked TLS certificates using a compact, periodically updated encoding derived from Certificate Transparency logs. The article contrasts this approach with real-time OCSP checks, emphasizing privacy, reliability, and performance. ### Source excerpt Firefox is now the first and the only browser to deploy fast and comprehensive certificate revocation checking that does not reveal your browsing activity to anyone (not even to Mozilla). Tens of millions of TLS server certificates are issued each day to secure communications between browsers and websites. These certificates are the cornerstones of ubiquitous [...] The post CRLite: Fast, private, and comprehensive certificate revocation checking in Firefox appeared first on Mozilla Hacks - the Web developer blog. ## Real World Crypto 2024 DevFeed: [Real World Crypto 2024]() Original publisher: [Read original article]() Published: 2024-05-07T11:00:17Z Content type: article Language: en Sources: [Latacora]() Topics: [Cryptography](), [Certificate Transparency](), [Security, Privacy and Abuse Prevention](), [Post-Quantum]() Tags: [browsers](), [certificate-transparency](), [cryptography](), [internet](), [post-quantum](), [privacy](), [public-key](), [security]() ### AI overview A blog post records notes from Real World Crypto 2024 in Toronto, discussing applied cryptography trends including post-quantum messaging, key transparency, and privacy-enhancing technologies. It also describes Certificate Transparency's Levchin Prize recognition and its role in improving accountability for the Web Public Key Infrastructure. ### Source excerpt We traveled to Toronto this year to attend RWC 2024. The conference was held in TIFF Lightbox located in the city's downtown; the venue is the headquarters for the Toronto Film Festival and contains five cinema rooms. RWC is a single-tracked conference and there's no hard requirement that talks are backed by papers. Each RWC includes the Levchin prize ceremony for major achievements in applied cryptography, several invited talks and the lightning talks session. ## Chrome 99 expands Certificate Transparency on Android, affecting HTTPS interception and debugging tools DevFeed: [Chrome 99 expands Certificate Transparency on Android, affecting HTTPS interception and debugging tools]() Original publisher: [Read original article]() Author: HTTP Toolkit; Tim Perry Published: 2022-05-11T16:00:00Z Content type: tutorial Language: en Sources: [HTTP Toolkit]() Topics: [Certificate Transparency](), [Chrome](), [Android](), [Security](), [Tooling]() Tags: [android](), [browsers](), [certificate-transparency](), [chrome](), [developer-tools](), [interception](), [security](), [tls]() ### AI overview This article explains how Chrome 99's expansion of Certificate Transparency to all Android Chrome users affects HTTPS interception with trusted system CA certificates, including developer debugging tools. It describes why Certificate Transparency exists and discusses workarounds for debugging Chrome traffic on Android. ### Source excerpt Certificate transparency is superb improvement to HTTPS certificate security on the web that's great for users and businesses, but on Android it creates a huge problem for the many developer tools like HTTP Toolkit which install trusted system certificates into Android to intercept & debug app traffic. This doesn't appear in the main announcements anywhere, but buried deep in the enterprise release notes for Chrome v99 there's a small note that says: Certificate transparency is already enforced on desktop platforms, and for some Android users. Chrome 99 expands certificate transparency to all Android Chrome users. And with that small note, Chrome on Android become uninterceptable for all HTTP Toolkit users using rooted devices, and anybody else who actively installs and trusts their own system CA certificates. If you're running into an ERR_CERTIFICATE_TRANSPARENCY_REQUIRED error in Chrome while trying to debug your HTTPS traffic with some MitM debugging proxy, then this is affecting you too. Let's talk about how certificate transparency works, why this breaks, and how you can work around it to keep debugging HTTPS from Chrome on your Android device regardless. Certificate Transparency (CT) HTTPS certificates are issued and signed by Certificate Authorities (CAs) who are trusted by your browser & OS. That's great when it works, but sometimes it doesn't. CAs can make mistakes when issuing certificates, when verifying a client's identity beforehand, or through malice somewhere, and issue fraudulent certificates to people who shouldn't have them. For example, let's say a trusted CA issues a certificate for google.com to the wrong person (this actually happened, repeatedly). That issued certificate is incredibly powerful - whoever has it can freely intercept all traffic sent by anybody to Google.com and both see & modify that traffic, whilst browsers will show all users a padlock and tell them everything is totally fine & secure. Even worse though: attacks like this were ## Firebase Realtime Database Supports SSL Certificate Transparency DevFeed: [Firebase Realtime Database Supports SSL Certificate Transparency]() Original publisher: [Read original article]() Author: Jamie Niemasik Published: 2019-03-12T00:00:00Z Content type: release Language: en Sources: [Firebase Blog]() Topics: [Certificate Transparency](), [Firebase](), [Realtime Database](), [SSL](), [TLS (Transport Layer Security)](), [Security]() Tags: [certificate-transparency](), [certificates](), [chrome](), [firebase](), [launch](), [news](), [realtime-database](), [security](), [ssl](), [tls](), [updates]() ### AI overview Firebase announces that Realtime Database now implements Certificate Transparency. Responses always include a Signed Certificate Timestamp, helping detect mistakenly issued or maliciously issued SSL certificates. The change adds slight response-size and possible bandwidth costs. ### Source excerpt News, tutorials, and updates from the Firebase team.