CanuteTheGreat/cert-transparency-watcher
Watch
1
0
Fork
You've already forked cert-transparency-watcher
 0
Code Issues Pull requests Projects Releases 3 Packages Wiki Activity Actions
3 releases 5 tags
  • v1.2.1 dfe3bbac43

    cert-transparency-watcher v1.2.1
    Some checks failed
    tests / test (3.14) (push) Has been cancelled
    Details
    tests / test (3.6-bullseye) (push) Has been cancelled
    Details
    release / release (push) Successful in 14s
    Details
    Stable

    Ghost released this 2026-10-17 01:49:59 -07:00 | 15 commits to main since this release

    • A wildcard certificate is its own subdomain label (*, or *.dev for *.dev.example.com) instead of counting as the apex: with --allow-subdomain @ a new *.example.com certificate (valid for every subdomain) used to pass unflagged. Allow it with --allow-subdomain '*'.
    • Names in FQDN form (trailing dot) are matched like any other name.
    • Tests: accuracy corpus (15 certificates with known verdicts: other CAs, forgotten hosts, wildcards, deeper names, unrelated SANs, precert duplicates, out-of-window and malformed rows), mutation testing (nightly), claims ledger.

    Install

    pipx install git+https://git.canutethegreat.com/CanuteTheGreat/cert-transparency-watcher.git@v1.2.1
# or the wheel attached to this release:
pipx install https://git.canutethegreat.com/CanuteTheGreat/cert-transparency-watcher/releases/download/v1.2.1/cert_transparency_watcher-1.2.1-py3-none-any.whl
# or the single file (stdlib-only Python 3):
curl -fsSLO https://git.canutethegreat.com/CanuteTheGreat/cert-transparency-watcher/releases/download/v1.2.1/cert_transparency_watcher.py

    SHA-256

    9b9000fa4aafeed3db6ac77f76baf1a33388dedf353b3124390068e31d0d0246  cert_transparency_watcher.py
d1ece299c7f11db2cb98f518d68349721ea16323d73767293cee4b5edb454575  cert_transparency_watcher-1.2.1-py3-none-any.whl
85194fc242b7de563837b244835029622d01553b18fe9da6904d5ed7569feb9b  cert_transparency_watcher-1.2.1.tar.gz
    Downloads
  • v1.2.0 6fb5b61cd7

    cert-transparency-watcher v1.2.0
    All checks were successful
    tests / test (3.6-bullseye) (push) Successful in 57s
    Details
    tests / test (3.13) (push) Successful in 1m2s
    Details
    release / release (push) Successful in 23s
    Details
    Stable

    Ghost released this 2026-10-16 19:57:54 -07:00 | 22 commits to main since this release

    • --state FILE: remembers every certificate seen, so only certificates new since the last run are shown and
      flagged (no daily re-alerts from cron); --fail-on-new flags any new certificate even without allow lists.
    • Cert Spotter fallback when crt.sh is down or slow (--source auto|crtsh|certspotter, CERTSPOTTER_API_TOKEN).
    • Alert hooks: --exec CMD (JSON on stdin) and --webhook URL (JSON POST) when something is flagged; a failing
      hook exits 2 and leaves the state unchanged so the alert is retried.
    • JSON output carries source, new per certificate and the tool version.
    • Installable as a package: pipx install git+https://git.canutethegreat.com/CanuteTheGreat/cert-transparency-watcher.git
      puts a cert-transparency-watcher command on PATH (pyproject.toml, MIT license metadata).
    • --version flag.
    • Exit codes follow the shared convention: 0 = clean, 1 = findings at/above the gate, 2 = error or bad usage.
    • Every tag now publishes a Forgejo release with this changelog, the wheel, the sdist and SHA256SUMS.
    • CI installs the package with pip in a clean venv and checks --version/--help on every push.

    Install

    pipx install git+https://git.canutethegreat.com/CanuteTheGreat/cert-transparency-watcher.git@v1.2.0
# or the wheel attached to this release:
pipx install https://git.canutethegreat.com/CanuteTheGreat/cert-transparency-watcher/releases/download/v1.2.0/cert_transparency_watcher-1.2.0-py3-none-any.whl
# or the single file (stdlib-only Python 3):
curl -fsSLO https://git.canutethegreat.com/CanuteTheGreat/cert-transparency-watcher/releases/download/v1.2.0/cert_transparency_watcher.py

    SHA-256

    b22ff4c42c1b20813739eac52fd8acdb074e3082e97ca7c40a83da9956194fbc  cert_transparency_watcher.py
e4f32e4d998ce664861b8e1c0e8eb9ecf32877ee103f956281200cec9f9ac3a4  cert_transparency_watcher-1.2.0-py3-none-any.whl
8d478dce58e04eed2a2a4f668ce9c85f3a37400d00638e10a2963c141dbf92b6  cert_transparency_watcher-1.2.0.tar.gz
    Downloads
  • v1.3.0 e2b0875aab

    cert-transparency-watcher v1.3.0
    All checks were successful
    release / release (push) Successful in 32s
    Details
    tests / test (3.14) (push) Successful in 1m23s
    Details
    tests / test (3.6-bullseye) (push) Successful in 1m30s
    Details
    Stable

    Ghost released this | 4 commits to main since this release

    • --allow-issuer-preset cloudflare: allows every CA Cloudflare issues edge certificates from
      (Cloudflare, Google Trust Services, Let's Encrypt, SSL.com / SSL Corporation). On a Cloudflare-proxied domain
      --allow-issuer Cloudflare alone flagged Cloudflare's own certificates from Google Trust Services
      (e.g. CN=WE1) or Let's Encrypt as an unexpected issuer and exited 1.
    • When --allow-issuer names Cloudflare without the preset and a certificate from one of Cloudflare's other CAs
      is flagged, the text report says so and points at the preset.
    • --help and README explain how issuer substrings are matched and why Cloudflare needs more than one.

    Install

    pipx install git+https://git.canutethegreat.com/CanuteTheGreat/cert-transparency-watcher.git@v1.3.0
# or the wheel attached to this release:
pipx install https://git.canutethegreat.com/CanuteTheGreat/cert-transparency-watcher/releases/download/v1.3.0/cert_transparency_watcher-1.3.0-py3-none-any.whl
# or the single file (stdlib-only Python 3):
curl -fsSLO https://git.canutethegreat.com/CanuteTheGreat/cert-transparency-watcher/releases/download/v1.3.0/cert_transparency_watcher.py

    SHA-256

    f2e97af5d7e743044259d864eed2f560ff4619def2d9806e3b1c3fbe90c4a9be  cert_transparency_watcher.py
aa2619387b2b74a8beb1b184d106b0bc2c0b640256eb95bf9d722a96263a8364  cert_transparency_watcher-1.3.0-py3-none-any.whl
ea939d7d34e07db53cda2285507638c82b793205b44473892f1d1736a3122060  cert_transparency_watcher-1.3.0.tar.gz
    Downloads