Notices by Andrew Ayer (agwa@follow.agwa.name)

DO NOT USE THE APPMATTUS CERTIFICATE TRANSPARENCY ANDROID LIBRARY.

Over two years ago the library's developers were warned about the need to monitor the ct-policy mailing list if they were going to consume the Chrome CT log lists.

Over six months ago, an upcoming change to the log lists was announced on ct-policy.

The Appmatus developers ignored this, so when the change was published today, Android apps using Appmatus stopped working. Affected app developers are now flooding CT mailing lists demanding the log list change be reverted. The right fix is to stop using Appmatus - it's clearly not fit for purpose.

As I expected, many clients will accept Entrust certificates issued after Nov 30. But to my surprise, several providers of PEM root bundles, notably Certifi/mkcert and curl, will begin automatically omitting Entrust roots after Nov 30 - meaning previously-issued Entrust certs will stop working! This is a complete misinterpretation of Mozilla's Distrust After attribute, and will cause unexpected breakage. I have opened bugs, but I expect other consumers have also misinterpreted Distrust After, so it would be prudent to replace existing Entrust certs.

Cert Spotter lets you know if any of your certificates will be revoked in the upcoming DigiCert mass revocation. They appear in your Cert Spotter dashboard with the original expiration replaced by the revocation date.

Handy, because if you log into your DigiCert account, they just give you a list of serial numbers and expect you to figure out what certs they correspond to.