Certificate Transparency Logs Can Reveal Unauthorized TLS Certs Issued for Your Domain

·3 views

A valid, browser-trusted TLS certificate can be issued for your domain without your knowledge through DNS compromises, subdomain takeovers, or stale third-party access — and standard uptime or SSL monitors will never detect it. Certificate Transparency (CT), defined in RFC 6962, is a public, append-only, cryptographically verifiable record where every certificate authority must log certificates before browsers will trust them. Since 2018, Chrome, Safari, and other major browsers reject any publicly-trusted certificate that lacks a signed certificate timestamp proving it was logged, meaning every working certificate is effectively a public announcement. This architecture reverses the usual security asymmetry: instead of monitoring every CA or DNS provider, domain owners can simply watch the CT logs for any certificate bearing their domain name. Free tools like crt.sh allow anyone to search these logs without an account, making unauthorized certificate discovery accessible to any security team.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Most Security Teams Lack Detection Rules for Cloud IAM Attacks, Experts Warn

Security teams with mature endpoint detection capabilities are often blind to cloud-native attacks because their rules assume a process tree exists, which IAM-based attacks do not have. A stolen AWS access key can enable full account reconnaissance through a burst of IAM API calls that leave no trace in EDR or host-based tools, only in CloudTrail logs. Attackers can escalate privileges by chaining legitimate permissions such as iam:PassRole with lambda:CreateFunction and lambda:InvokeFunction, a well-documented AWS escalation path that triggers no traditional alerts. Experts say effective cloud detection requires understanding normal API behavior per identity and flagging unusual permission combinations across providers including Azure, GCP, and Kubernetes. The same detection engineering discipline used for host and network threats can be applied to audit logs, but that translation must be deliberately built rather than assumed.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How Capgo's Capacitor Updater auto-rolls back broken OTA bundles in 10 seconds

The open-source @capgo/capacitor-updater plugin uses a native handshake mechanism to detect and recover from failed over-the-air JavaScript bundle updates on mobile devices. When a new bundle is deployed, the native layer starts a 10-second timer and waits for the app's JavaScript to call notifyAppReady(), confirming a successful boot. If the call is never made — due to a crash or hang — the timer expires and the plugin automatically restores the last known working bundle without any cloud dashboard intervention. Developers can monitor rollback events via the updateFailed listener and retrieve details of the failed bundle using getFailedUpdate(). Testing is recommended on an isolated channel with a single device before any changes reach the production build.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

One Stopped Container Can Prevent nginx From Starting — Here Is the Fix

A single stopped Docker container can prevent nginx from starting entirely, taking down all proxied services including frontends and APIs. This happens because nginx resolves hostnames literally at config-parse time, making every upstream a hard startup dependency. The fix involves using a variable for proxy_pass targets along with Docker's internal DNS resolver, which defers resolution to request time and limits failures to a 502 on the affected route only. However, switching to variable-based proxy_pass breaks nginx's automatic URI prefix stripping, requiring manual rewrites for location blocks with trailing slashes. A further side effect involves CORS preflight handling, where the interaction between rewrite and if directives can cause subtle, hard-to-diagnose failures.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Timeline Studio: Open-Source AI Video Editor That Runs Entirely in the Browser

A developer has built Timeline Studio, an open-source, local-first AI video editor that processes media directly in the browser rather than uploading footage to remote servers. The tool supports multi-track timelines, captions, voiceovers, visual effects, and offline export, using WebGPU and WebAssembly for AI inference. To manage large AI models efficiently, the editor lazy-loads them only when a feature is first used, caches them via a service worker, and mirrors files across Hugging Face and ModelScope for reliability. Models are pinned to specific versions so upstream changes cannot silently affect editing workflows, and a shared cache identity ensures fallback downloads do not duplicate files on the user's device. Export quality is kept consistent by treating the timeline as declarative state and using a dedicated offline rendering path, rather than simply recording live on-screen playback.

0 comments Read more at DEV Community