Chrome and Safari require proof that a publicly trusted certificate was logged in Certificate Transparency. Most certificates carry that proof as SCTs in this extension: the CA submits a precertificate, marked by the poison extension 1.3.6.1.4.1.11129.2.4.3 (RFC 6962 §3.1), and embeds the logs' signed timestamps in the final certificate. Decode it with the SCT decoder.
1.3.6.1.4.1.11129.2.4.2
embedded-scts
The extension that embeds Signed Certificate Timestamps in a certificate (RFC 6962).
1.3.6.1.4.1.11129.2.4.2 identifies embedded-scts, a certificate or CRL extension. DER: 060a2b06010401d679020402.
- Dotted notation
1.3.6.1.4.1.11129.2.4.2- DER encoding
060a2b06010401d679020402- Category
- a certificate or CRL extension
- Also known as
SignedCertificateTimestampList, CT Precertificate SCTs, ct_precert_scts- OpenSSL short name
ct_precert_scts- OpenSSL long name
CT Precertificate SCTs- Parent
- 1.3.6.1.4.1.11129 google
- Listed by
- the ecdsa.com catalog