Sunlight is a production-grade, static Certificate Transparency (CT) log implementation written in Go, sponsored by Let's Encrypt. It implements the C2SP Static CT API and provides both a write-path log server (cmd/sunlight) and a read-path static file server (cmd/skylight). The system accepts certificate submissions via the RFC 6962 add-chain/pre-chain endpoints, sequences them into a Merkle tree using the tlog library, and publishes tiles (hash, data, names) along with signed checkpoints. It also supports the tlog-witness and tlog-mirror protocols for transparency and cross-checking. The architecture is modular: the core log engine lives in internal/ctlog with pluggable backends for storage (local filesystem, S3, in-memory) and distributed locking (SQLite, DynamoDB, ETag-based S3). The sequencer uses a pool of pending entries with low-priority eviction, batched sequencing, and staged uploads via tarballs for crash recovery. Deduplication is handled via a SQLite cache with 256-bit hashes. The system includes extensive observability with Prometheus metrics, structured logging, and debug endpoints for heavy hitters and SSL key logging. Key entry points include the main server binaries (cmd/sunlight, cmd/skylight), a key generation tool (cmd/sunlight-keygen), a partial tile garbage collector (cmd/partial-aftersun), a cache recomputation tool (cmd/recompute-cache), and a names tile generator (cmd/names-prism). The client library (client.go) provides a high-level API for fetching and verifying log entries and inclusion proofs. External dependencies include certificate-transparency-go, torchwood, and golang.org/x/mod/sumdb/tlog. The codebase demonstrates high craftsmanship with several reusable internal packages: durable crash-safe file writes, immutable file flag setting, HyperLogLog cardinality estimation, Space Saving heavy hitters, and a custom XAES-256-GCM implementation. Testing is extensive, including in-memory fake backends, synctest for time-dependent rate limits, and deterministic test data generation.
This is the Dogtag PKI (Red Hat Certificate System) codebase, a comprehensive enterprise-grade Public Key Infrastructure server suite. It provides multiple subsystems: Certificate Authority (CA) for certificate lifecycle management, Key Recovery Authority (KRA) for key archival and recovery, Online Certificate Status Protocol (OCSP) responder, Token Key Service (TKS) for smart card key handling, Token Processing System (TPS) for token management, and ACME/EST responders for automated certificate enrollment. The system exposes REST APIs (both JAX-RS v1 and servlet-based v2), a rich CLI toolset (Java and Python), and a legacy Swing admin console (deprecated). Backend storage primarily uses LDAP (389 Directory Server) for certificates, requests, and configuration, with PostgreSQL optionally used for ACME realms. The architecture follows a modular monolith pattern: each PKI subsystem runs as a separate Java web application deployed on Apache Tomcat, sharing common libraries from base/common and base/server. Cryptographic operations are handled via NSS (Network Security Services) and JSS (Java Security Services). Key patterns include a ConfigStore hierarchy for type-safe configuration access, a JSONSerializer interface for consistent data serialization, a CommandCLI base class for building CLI commands, and a policy/profile framework for certificate issuance rules. The codebase demonstrates strong engineering with extensive test coverage (unit, integration, CI workflows), Docker support, and versioned upgrade scripts. While the codebase is actively maintained with frequent commits and a comprehensive CI pipeline, it shows signs of technical drift: a large volume of deprecated Swing console code marked for removal, persistent use of legacy com.netscape package names alongside newer org.dogtagpki packages, and a polyglot codebase (Java, Python, native C++ for TPS client) that increases maintenance complexity. The quality is solid overall with well-separated concerns and reusable patterns, though the sheer scale and historical accumulation of components prevent it from being considered exceptional.
This repository is a Kotlin/Java library providing Certificate Transparency (CT) verification for Android and JVM applications. It prevents man-in-the-middle attacks by validating TLS certificates against public CT logs. The library offers multiple integration approaches: Java Security Provider, OkHttp interceptors, TrustManager and HostnameVerifier wrappers for HttpURLConnection/Volley/WebView, and direct API usage. Key features include CT log list fetching and parsing, SCT verification, optional CRL-based certificate revocation checking, and configurable caching. The architecture is modular with a core library, Android-specific extensions, and a sample application demonstrating all integration methods. The code employs modern Kotlin idioms (coroutines, sealed classes, builder patterns) and maintains strong separation of concerns between network fetching, policy enforcement, chain cleaning, and verification logic.