1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
|
.\" XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
.\" DO NOT EDIT! Generated from XML source.
.\" XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
.de Sh \" Subsection
.br
.if t .Sp
.ne 5
.PP
\fB\\$1\fR
.PP
..
.de Sp \" Vertical space (when we can't use .PP)
.if t .sp .5v
.if n .sp
..
.de Ip \" List item
.br
.ie \\n(.$>=3 .ne \\$3
.el .ne 3
.IP "\\$1" \\$2
..
.TH "CTLOGCONFIG" 8 "2018-09-27" "Apache HTTP Server" "ctlogconfig"
.SH NAME
ctlogconfig \- Certificate Transparency log configuration tool
.SH "SYNOPSIS"
.PP
\fB \fBctlogconfig\fR \fI/path/to/db\fR \fBdump\fR \fR
.PP
\fB \fBctlogconfig\fR \fI/path/to/db\fR \fBconfigure-public-key\fR [ \fIlog-id\fR|\fIrecord-id\fR ] \fI/path/to/public-key\&.pem\fR \fR
.PP
\fB \fBctlogconfig\fR \fI/path/to/db\fR \fBconfigure-url\fR [ \fIlog-id\fR|\fIrecord-id\fR ] \fIlog-URL\fR \fR
.PP
\fB \fBctlogconfig\fR \fI/path/to/db\fR \fBvalid-time-range\fR \fIlog-id\fR|\fIrecord-id\fR \fImin-timestamp\fR \fImax-timestamp\fR \fR
.PP
\fB \fBctlogconfig\fR \fI/path/to/db\fR \fBtrust\fR \fIlog-id\fR|\fIrecord-id\fR \fR
.PP
\fB \fBctlogconfig\fR \fI/path/to/db\fR \fBdistrust\fR \fIlog-id\fR|\fIrecord-id\fR \fR
.PP
\fB \fBctlogconfig\fR \fI/path/to/db\fR \fBforget\fR \fIlog-id\fR|\fIrecord-id\fR \fR
.TP
\fIlog-id\fR
This is the id of the log, which is the SHA-256 hash of the log's public key, provided in hexadecimal format\&. This string is 64 characters in length\&.
.TP
\fIrecord-id\fR
This is the record number in the database, as displayed by the \fBdump\fR sub-command, prefixed with \fB#\fR\&. As an example, \fB#4\fR references the fourth record in the database\&. (Use shell escaping as necessary\&.)
.TP
\fI/path/to/public-key\&.pem\fR
This is a file containing the log's public key in PEM format\&. The public key is not stored in the database\&. Instead, a reference to the file is stored\&. Thus, the file cannot be removed until the public key in the database is removed or changed\&.
.TP
\fImin-timestamp\fR, \fImax-timestamp\fR
A timestamp is a time as expressed in the number of milliseconds since the epoch, ignoring leap seconds\&. This is the form of time used in Signed Certificate Timestamps\&. This must be provided as a decimal number\&. Specify \fB\fB-\fR\fR for one of the timestamps if it is unknown\&. For example, when configuring the minimum valid timestamp for a log which remains valid, specify \fB\fB-\fR\fR for \fImax-timestamp\fR\&. SCTs received from this log by the proxy are invalid if the timestamp is older than \fImin-timestamp\fR or newer than \fImax-timestamp\fR\&.
.SH "SUMMARY"
.PP
\fBctlogconfig\fR is a tool for creating and maintaining a log configuration database, for use with mod_ssl_ct\&.
.PP
Refer first to Log configuration in the mod_ssl_ct documentation\&.
.PP
Refer to the examples below for typical use\&.
.SH "SUB-COMMANDS"
.TP
dump
Display configuration database contents\&. The record id shown in the output of this sub-command can be used to identify the affected record in other sub-commands\&.
.TP
configure-public-key
Add a log's public key to the database or set the public key for an existing entry\&. The log's public key is needed to validate the signature of SCTs received by a proxy from a backend server\&. (The database will be created if it does not yet exist\&.)
.TP
configure-url
Add a log's URL to the database or set the URL for an existing entry\&. The log's URL is used when submitting server certificates to logs in order to obtain SCTs to send to clients\&. (The database will be created if it does not yet exist\&.)
.TP
valid-time-range
Set the minimum valid time and/or the maximum valid time for a log\&. SCTs from the log with timestamps outside of the valid range will not be accepted\&. Use \fB-\fR for a time that is not being configured\&. (The database will be created if it does not yet exist\&.)
.TP
trust
Mark a log as trusted, which is the default setting\&. This sub-command is used to reverse a \fIdistrust\fR setting\&. (The database will be created if it does not yet exist\&.)
.TP
distrust
Mark a log as distrusted\&. (The database will be created if it does not yet exist\&.)
.TP
forget
Remove information about a log from the database\&.
.SH "EXAMPLES"
.PP
Consider an Apache httpd instance which serves as a TLS server and a proxy\&. The TLS server needs to obtain SCTs from a couple of known logs in order to pass those to clients, and the proxy needs to be able to validate the signature of SCTs received from backend servers\&.
.PP
First we'll configure the URLs for logs where server certificates are logged:
.nf
$ ctlogconfig /path/to/conf/log-config configure-url http://log1\&.example\&.com/
$ ctlogconfig /path/to/conf/log-config configure-url http://log2\&.example\&.com/
$ ctlogconfig /path/to/conf/log-config dump
Log entry:
Record 1
Log id : (not configured)
Public key file: (not configured)
URL : http://log1\&.example\&.com/
Time range : -INF to +INF
Log entry:
Record 2
Log id : (not configured)
Public key file: (not configured)
URL : http://log2\&.example\&.com/
Time range : -INF to +INF
.fi
.PP
Next we'll set the public key of a log where the certificate of our only backend server is published\&. In this case it is the log with URL http://log2\&.example\&.com/ which has already been configured\&.
.nf
$ ctlogconfig /path/to/conf/log-config configure-public-key \\
$ ctlogconfig /path/to/conf/log-config dump
Log entry:
Record 1
Log id : (not configured)
Public key file: (not configured)
URL : http://log1\&.example\&.com/
Time range : -INF to +INF
Log entry:
Record 2
Log id : (not configured)
Public key file: /path/to/conf/log2-pub\&.pem
URL : http://log2\&.example\&.com/
Time range : -INF to +INF
.fi
|
