How google/certificate-transparency-go works
This repository is a Certificate Transparency toolkit and service implementation. Its main user workflows are querying and scanning CT logs, validating certificate/log data, submitting certificate chains to policy-selected logs, and operating a Trillian-backed CT log. The graph includes documented capabilities whose source was not sampled; their internal wiring is omitted where the excerpts do not establish it.
Main entry points: client Log client library · distributor.go Log distributor · controller.go Migration controller · ctfe CTFE personality
Components 24
CT formats and validation
- CT data types
types.go - ASN.1 encoding
asn1 - Certificate parsing
x509 - TLS encoding
tls - Certificate utilities
x509util
Log clients and monitoring
- CT command client
client/ctclient - Log client library
client - JSON HTTP client
jsonclient - Log scanner
scanner
Multi-log submission
- Submission server
submission/server - Submission proxy
submission/proxy.go - Log distributor
submission/distributor.go
Trillian services
- CTFE personality
trillian/ctfe - CTFE request handlers
trillian/ctfe/handlers.go - Issuance-chain storage
trillian/ctfe/storage/storage.go - SQL storage backends
trillian/ctfe/storage - Log migration runner
trillian/migrillian/main.go - Migration controller
trillian/migrillian/core/controller.go
Utilities and policy
- CT verification tools
ctutil - Log list reader
loglist3 - CT policy rules
ctpolicy
Other components
- Engineer or service
- CT log endpoint
- Trillian log backend
Connections 20
- Engineer or service → CT command client: runs commands
- CT command client → Log client library: dispatches requests
- Log client library → CT log endpoint: queries log
- Log scanner → Log client library: fetches entries
- Engineer or service → Log scanner: starts scan
- Engineer or service → Submission server: submits chains
- Submission server → Submission proxy: serves requests
- Submission proxy → Log distributor: dispatches submissions
- Log distributor → CT policy rules: selects logs by
- Log distributor → CT log endpoint: submits chains
- CTFE personality → CTFE request handlers: serves requests
- CTFE request handlers → Trillian log backend: reads and writes
- CTFE personality → Issuance-chain storage: selects storage
- Issuance-chain storage → SQL storage backends: uses SQL backend
- Log migration runner → Migration controller: runs migrations
- Migration controller → Log client library: fetches source entries
- Migration controller → Trillian log backend: writes leaves
- CT verification tools → CT data types: validates structures
- Certificate utilities → Certificate parsing: uses certificates
- JSON HTTP client → CT log endpoint: sends HTTP requests