Subject: [Trans] Can logs return SCTs that correspond to Precerts in response to add-chain?

From: Tom Ritter <[email-masked]>
Date: Fri, 18 Aug 2017 15:15:28 -0500

Ran into a question I didn't know the answer to, hopefully easy.

If a client submits a chain of valid certificates to a log (via
add-chain), but the leaf certificate was already added to the log as a
precert - is the log allowed to return the SCT associated with the
precert rather than the certificate?

-tom

---

From: Rob Stradling <[email-masked]>
Date: Mon, 21 Aug 2017 11:35:20 +0100

> precert rather than the certificate?

Hi Tom.  The specification of the submit-entry endpoint [1] says:

   'Outputs:
       sct:  A base64 encoded "TransItem" of type "x509_sct_v2" or
          "precert_sct_v2", signed by this log, that corresponds to the
          "submission".'

Arguably a precert SCT does "correspond to" a certificate.  However, 
earlier in the document [2] it says:

   '...Note that if a certificate was previously logged as a
    precertificate, then the precertificate's SCT of type
    "precert_sct_v2" would not be appropriate; instead, a fresh
    SCT of type "x509_sct_v2" should be generated.'

[1] https://tools.ietf.org/html/draft-ietf-trans-rfc6962-bis-26#section-5.1

[2] https://tools.ietf.org/html/draft-ietf-trans-rfc6962-bis-26#section-4

-- 
Rob Stradling
Senior Research & Development Scientist
COMODO - Creating Trust Online