<!DOCTYPE html><html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body>
<p>Hello Ivan,</p>
<p>You bring up an interesting idea, and it comes at a good time
because we've been going back and taking another look at CT and
SunJSSE. What you are suggesting would be a useful addition, and
could also be a step towards a full implementation. I have
created <a class="moz-txt-link-freetext" href="https://bugs.openjdk.org/browse/JDK-8351001">https://bugs.openjdk.org/browse/JDK-8351001</a> to track
this. It will need a CSR if we decide to go the
ExtendedSSLSession route as you were suggesting.<br>
</p>
<p>A question, since we're on the topic: Is there any value to
separating out somehow 1.0 and 2.0 SCTs? Or would a simple
List<byte[]> that just contains each SCT be sufficient?</p>
<p>Thanks,</p>
<p>--Jamil<br>
</p>
<div class="moz-cite-prefix">On 2/28/2025 12:35 AM, Ivan Ristic
wrote:<br>
</div>
<blockquote type="cite" cite="mid:CANHgQ8Gkrj2BdstCQ5h6vNNL+pF-U5_9ALb84NE6zXseXt6iqw@mail.gmail.com">
<div dir="ltr">
<div>Hello group,</div>
<div><br>
</div>
<div>From what I can tell, it's currently not possible to
consume CT information from Java reliably because there is no
way to indicate support for the CT TLS extension [1] in the
handshake as well as get the data sent back by a compatible
server.</div>
<div><br>
</div>
<div>The work involved would be small, for example just grab the
raw data and expose it via ExtendedSSLSession, in the same way
stapled OCSP responses are currently handled.</div>
<div><br>
</div>
<div>However, the improvements would be significant, as this
change would enable Java applications to use CT if they so
wish.</div>
<div><br>
</div>
<div>Apologies as I am not familiar with how things are done;
what's the process to make this happen?</div>
<div><br>
</div>
<div>[1] <a href="https://datatracker.ietf.org/doc/html/rfc6962#section-3.3" moz-do-not-send="true" class="moz-txt-link-freetext">https://datatracker.ietf.org/doc/html/rfc6962#section-3.3</a><br clear="all">
</div>
<div><br>
</div>
<span class="gmail_signature_prefix">-- </span><br>
<div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature">Ivan</div>
</div>
</blockquote>
</body>
</html>