PostgreSQL Support for Certificate Transparency Logs Now Available

#1

Post by tracymiranda » Tue, Jan 07, 2025, 6:08 PM UTC

PostgreSQL Support for Certificate Transparency Logs Now Available
blog.transparency.dev

Re: PostgreSQL Support for Certificate Transparency Logs Now Available

#2

Post by dboreham » Tue, Jan 07, 2025, 7:34 PM UTC

Translation: we had data loss and had to change storage provider to one that works.

Re: PostgreSQL Support for Certificate Transparency Logs Now Available

#3

Post by remram » Tue, Jan 07, 2025, 7:50 PM UTC

> a CT log failure earlier this year due to MariaDB corruption after disk space exhaustion provided the motivation for a change.

Re: PostgreSQL Support for Certificate Transparency Logs Now Available

#4

Post by politelemon » Tue, Jan 07, 2025, 7:53 PM UTC

This title reads strange to me, as though postgres certificates, used when connecting using TLS, will be visible in the CTL.

Better would be: CTL can now use a postgres backend.

Re: PostgreSQL Support for Certificate Transparency Logs Now Available

#5

Post by [deleted] » Tue, Jan 07, 2025, 7:55 PM UTC

remram wrote: post #3

> a CT log failure earlier this year due to MariaDB corruption after disk space exhaustion provided the motivation for a change.

[deleted]

Re: PostgreSQL Support for Certificate Transparency Logs Now Available

#6

Post by phoronixrly » Tue, Jan 07, 2025, 8:35 PM UTC

dboreham wrote: post #2

Translation: we had data loss and had to change storage provider to one that works.

Where works means "does not eat data"... A very basic requirement for storage :)

Re: PostgreSQL Support for Certificate Transparency Logs Now Available

#7

Post by nijave » Tue, Jan 07, 2025, 9:18 PM UTC

remram wrote: post #3

> a CT log failure earlier this year due to MariaDB corruption after disk space exhaustion provided the motivation for a change.

That seems like a rather serious bug. Disappointing there's not more follow up with MariaDB

Re: PostgreSQL Support for Certificate Transparency Logs Now Available

#8

Post by chatmasta » Tue, Jan 07, 2025, 9:39 PM UTC

Semi-relatedly, you can connect to the crt.sh Postgres instance and query it directly with SQL:

    psql -h crt.sh -p 5432 -U guest certwatch

To generate the SQL queries in the web UI, simply click “advanced” and then the “Show SQL” checkbox, or append it to the URL, like so:

    https://crt.sh/?q=www.comodo.com&showSQL=Y

(Note the generated SQL at the bottom of that page.)

Steampipe also has a crt.sh connector: https://hub.steampipe.io/plugins/turbot/crtsh/tables/crtsh_c...

Re: PostgreSQL Support for Certificate Transparency Logs Now Available

#9

Post by mobilemidget » Tue, Jan 07, 2025, 9:57 PM UTC

nijave wrote: post #7

remram wrote: post #3

> a CT log failure earlier this year due to MariaDB corruption after disk space exhaustion provided the motivation for a change.

That seems like a rather serious bug. Disappointing there's not more follow up with MariaDB

If you let a disk run full weird shit happens.

But it reads to me as _we_, not mariadb, made a big oopsie and TADA \o/ now we change software. So I do strongly hope that besides changing software, they added some disk space monitoring.

Re: PostgreSQL Support for Certificate Transparency Logs Now Available

#10

Post by westurner » Tue, Jan 07, 2025, 10:07 PM UTC

Are there Merkle hashes between the rows in the PostgreSQL CT store like there are in the Trillian CT store?

Sigstore Rekor also has centralized Merkle hashes.