Scout — CT log access¶
Scout doubles as a Certificate Transparency client. The scout ct
subcommand is driven by the Hub as a subprocess (single sanctioned wrapper,
HubScout) and streams NDJSON on stdout that the Hub reads line-by-line.
Subcommands¶
| Command | Purpose |
|---|---|
scout ct search [domain] --source crtsh\|direct |
Search one domain — via crt.sh, or directly against a CT log (auto-detects tiled vs RFC 6962), emitting a trailing cursor line with tree_size for incremental resumption |
scout ct scan --domain … --logs … --log-type … |
Fan out a domain search across multiple known logs |
scout ct logs |
Dump the hardcoded known-log registry |
scout ct ingest --log-url … --log-name … |
Stream every entry from one log (domain-agnostic; refuses the crt.sh fallback, which is a hostname index, not a full-log source) |
Sources¶
- crt.sh — the JSON search API; used directly and as a V1 fallback for tiled logs when no log public key is configured.
- Tiled (sunlight / static-CT) — Let's Encrypt Sycamore/Willow etc. Real tile scanning with cryptographic checkpoint verification requires a log public key (the known-log registry ships these).
- RFC 6962 — legacy logs (Google Argon/Xenon, Cloudflare Nimbus, LE Oak, DigiCert Nessie, Sectigo Mammoth), throttled to 2 parallel fetchers.
Precert↔final-cert pairing and domain/eTLD+1 matching are handled by dedicated helpers used by both scanners.
Operational note
The known-log registry is a hardcoded list. It needs periodic manual refresh from the Chrome and Apple log lists to keep the set of trusted logs current; there is no automatic refresh of the registry.