Andrew Ayer

DKIM t=s key flag not supported

2

When `s` is in a key's flags list, then: > Any DKIM-Signature header fields using the "i=" tag MUST have the same domain value on the right-hand side of the...

Proposal and discussion: https://groups.google.com/a/chromium.org/forum/#!topic/ct-policy/zVW7lDySFk4

Encode should return an error if input certificate is not initialized

1

If any of the input's `Raw` fields are nil, then `Encode` should return an error Instead of succeeding and returning an invalid PKCS#12 file. Inspired by #11.

By using a match statement, we can avoid a lambda, a Cow, and the chain of combinators, with no loss of efficiency.

Monitoring statistics

6

It should be possible for users to see the current state of monitoring - e.g. which logs are being monitored, how recently they were contacted, what the backlog is Maybe...

Provide better guidance on how to filter legitimate certificates

2

Documentation/README should explain: * You can't compare certificate fingerprints because precertificates have a different fingerprint. * You don't want to compare serial numbers because malicious CAs could reuse the serial...

Suppress alerts for legitimate certificates found on local system

1

For example, in the certbot state directory (inspired by https://mas.to/@zekjur/111273573539477069)

Provide a way to test notifications

2

So users can be sure that they receive notifications Possible ideas: * Command line option * Optional HTTP server with buttons to fire test notifications

certspotter should only notify once for a certificate/precertificate pair. The best way to implement this is probably to use the TBS fingerprint in the filename in the `certs` directory instead...

SSLMate will obtain a new certificate once a week for each of the following domains on the respective day: * sunday.test.certspotter.org * monday.test.certspotter.org * tuesday.test.certspotter.org * wednesday.test.certspotter.org * thursday.test.certspotter.org *...