Expose getCertificateTransparencyLogs for client setup

Author: pimterry

src/main.ts

@@ -73,7 +73,8 @@ export type { ServerMockedEndpoint } from "./server/mocked-endpoint";
 // Export TLS utility methods:
 export {
     generateCACertificate,
-    generateSPKIFingerprint
+    generateSPKIFingerprint,
+    getCertificateTransparencyLogs
 } from './util/certificates';
 
 // Export various referenced utility types:

src/util/certificates.ts

@@ -297,6 +297,29 @@ export async function generateSPKIFingerprint(certPem: string): Promise<string>
     return Buffer.from(hashBuffer).toString('base64');
 }
 
+/**
+ * Derive the Certificate Transparency logs for a given CA certificate.
+ *
+ * When a CA is used with `certificateTransparency` enabled, Mockttp embeds SCTs
+ * signed by two logs deterministically derived from that CA certificate. This
+ * returns those logs' ids & public keys (SPKI, DER) - exactly matching the SCTs
+ * embedded in generated certificates.
+ *
+ * Only the CA certificate is required: derivation is a pure function of the cert's
+ * public key, independent of how the CA private key happens to be encoded.
+ */
+export function getCertificateTransparencyLogs(
+    caCert: string
+): Array<{ logId: Buffer, publicKey: Buffer, usableSince: Date }> {
+    const cert = new x509.X509Certificate(caCert);
+    const usableSince = cert.notBefore;
+    return deriveCTLogOperators(cert).map(op => ({
+        logId: Buffer.from(op.logId),
+        publicKey: Buffer.from(op.publicKey),
+        usableSince
+    }));
+}
+
 // Generates a unique serial number for a certificate as a hex string:
 function generateSerialNumber() {
     return 'A' + crypto.randomUUID().replace(/-/g, '');

test/certificate-transparency.spec.ts

@@ -6,7 +6,7 @@ import * as x509 from '@peculiar/x509';
 
 import { HardenedHttpsAgent } from 'hardened-https-agent';
 
-import { getLocal } from '..';
+import { getLocal, getCertificateTransparencyLogs } from '..';
 import { expect, nodeOnly } from "./test-utils";
 
 import { getCA, CA } from '../src/util/certificates';
@@ -111,6 +111,26 @@ nodeOnly(() => {
             expect(logs8[1].logId).to.deep.equal(logs1[1].logId);
         });
 
+        it("exposes the CA's CT logs publicly (from the cert alone), matching what is embedded", async () => {
+            const cert = await caCert;
+            const ca = await getCA({ key: await caKey, cert, certificateTransparency: true });
+
+            const published = getCertificateTransparencyLogs(cert);
+            const embedded = ca.getCTLogDetails();
+
+            expect(published).to.have.length(2);
+            expect(published[0].logId).to.have.length(32); // SHA-256 of the SPKI
+            expect(published[0].logId).to.deep.equal(embedded[0].logId);
+            expect(published[0].publicKey).to.deep.equal(embedded[0].publicKey);
+            expect(published[1].logId).to.deep.equal(embedded[1].logId);
+            expect(published[1].publicKey).to.deep.equal(embedded[1].publicKey);
+
+            // usableSince is the CA cert's notBefore (safe: <= every backdated SCT):
+            const caNotBefore = new x509.X509Certificate(cert).notBefore;
+            expect(published[0].usableSince.getTime()).to.equal(caNotBefore.getTime());
+            expect(published[1].usableSince.getTime()).to.equal(caNotBefore.getTime());
+        });
+
         it("getCTLogDetails throws when CT is not enabled", async () => {
             const ca = await getCA({ key: await caKey, cert: await caCert });
             expect(() => ca.getCTLogDetails()).to.throw('CT not enabled');