certwatch | monitor Certificate Transparency logs and to find

certwatch is a Go library. certwatch has no bugs, it has no vulnerabilities, it has a Permissive License and it has low support. You can download it from GitHub.

This application is designed to monitor Certificate Transparency logs and to find any new certificates issued for domain suffix and add them to a Postgresql database. Specifically, once every 24 hours it will fetch the latest list of known CT logs from Google (see jobs/job_update_logs.go) and set up a "cron" such that every 5 minutes a new signed tree head will be fetched (see jobs/job_check_sth.go), and if the tree size has increased, a job will be scheduled for fetch new entries (see jobs/job_get_entries.go). The fetch entries job will try to fetch up to around 1000 entries at once, and if for any reason not all entries are returned (which is permitted per RFC6962), it will reschedule 2 new jobs to fetch half of the remaining entries each. If any requests fail, they will be retried using the que-go library, which handles exponential back-off. Once new certificates of interest are detected, they are written to the Postgresql database, and (if configured) will send a notification to Slack hook, and (if configured) will add an entry to a CKAN data source (such as data.gov.au).