Enterprise edition

Certificate Transparency policy for signing certificates

At a glance

NextPDF Enterprise lets a signing workflow take account of a signing certificate’s Certificate Transparency (CT) posture before it signs. CT is the public-log ecosystem in which certificates are recorded so that mis-issuance is detectable; a certificate logged in CT carries one or more Signed Certificate Timestamps (SCTs). NextPDF Enterprise represents the CT posture of a certificate as a result value — whether the SCT extension is present, how many SCTs are present and valid, and which logs issued them — and offers a minimum-SCT threshold check. This page is behaviour-level: it states what the result carries, how the threshold check works, and what NextPDF does and does not decide.

NextPDF Enterprise represents and threshold-checks a CT result; it is not a CT log, a log auditor, or a monitor. The boundary is stated under Security and compliance.

Prerequisites are stated in the front matter and repeated under Prerequisites.

Availability & licensing

This capability ships in NextPDF Enterprise (nextpdf/enterprise) and activates with an Enterprise-tier license envelope. A deployment without that entitlement does not load the capability’s classes. Compare editions and get a license.

What this capability does

A certificate logged in CT carries SCTs. An SCT carries a version, a log identifier, a timestamp, and the log’s signature over the certificate entry, per RFC 6962 §3.1. A log returns an SCT as its promise to incorporate the certificate into its append-only log, and relying parties reject a certificate that lacks a valid SCT, per RFC 6962 §3. Certificate Transparency version 2.0 keeps the same model: a log returns an SCT on submission, which the submitter validates before relying on it, per RFC 9162 §3.

NextPDF Enterprise represents the CT posture of a certificate as a result value carrying:

whether the certificate contains the SCT extension;
the total number of SCTs found;
the number of SCTs whose signatures are valid;
the log identifiers — SHA-256 hashes — of the logs that issued the SCTs.

The result exposes a minimum-SCT threshold check: it reports whether the count of valid SCTs meets or exceeds a required minimum. You set the minimum to match your policy. A common policy expects at least two SCTs from different logs for shorter-lived certificates and more for longer-lived ones; the threshold value is yours to choose.

Use the threshold check as a gate in a signing workflow: require a CT-logged certificate (a sufficient count of valid SCTs) before you sign, and refuse otherwise.

Why it works this way

Certificate Transparency answers a narrow question: is this certificate publicly logged, and by how many independent logs. NextPDF Enterprise models that answer as a plain result value, not a verdict. The result reports the SCT-extension flag, the SCT counts, and the issuing log identifiers, then stops. It does not decide whether that posture is good enough, because the trust threshold is a relying-party policy that varies by certificate lifetime and risk. So the minimum-SCT count stays yours to set, and NextPDF stays out of the log-operator, auditor, and monitor roles. Certificate Transparency is one check among several in a sound signing decision, and this page makes it an explicit gate before the signer is constructed.

Design background: Validating a signature properly.

Prerequisites

Install NextPDF Core and the Enterprise package, and hold an active Enterprise license.
Have the signing certificate whose CT posture you want to enforce, together with the SCT data your environment extracts from it.
Decide the minimum-SCT threshold your policy requires.

Configuration

Minimum SCT threshold — the number of valid SCTs a certificate must carry to pass your policy. Pass it to the threshold check.
Policy placement — decide where in your signing workflow the gate runs: before constructing the signer, so an under-logged certificate never reaches a signing operation.

Step-by-step

Obtain the CT result for your signing certificate, carrying the SCT-extension flag, the total and valid SCT counts, and the log identifiers.
Decide the minimum-SCT threshold for your policy.
Run the threshold check; treat a pass as “CT policy satisfied” and a fail as “refuse to sign with this certificate”.
Gate the signing workflow on the result before the signer is constructed.

<?php

declare(strict_types=1);

require_once __DIR__ . '/../../vendor/autoload.php';

use NextPDF\Enterprise\Security\CertificateTransparency\CtValidationResult;
use Psr\Log\LoggerInterface;

final readonly class CtSigningPolicy
{
    /**
     * @param int<1, max> $minimumScts The minimum count of valid SCTs your policy requires.
     */
    public function __construct(
        private int $minimumScts,
        private LoggerInterface $logger,
    ) {}

    /**
     * Decide whether a certificate's CT posture satisfies the policy.
     *
     * The gate runs before the signer is constructed, so an under-logged
     * certificate never reaches a signing operation. A missing SCT extension
     * is treated as a policy failure, not an exception.
     *
     * @param CtValidationResult $result The CT posture of the signing certificate.
     *
     * @return bool True when the certificate meets the minimum-SCT threshold.
     */
    public function isAcceptable(CtValidationResult $result): bool
    {
        if (! $result->hasSctsExtension) {
            $this->logger->warning('Signing certificate carries no SCT extension; CT policy not met.');

            return false;
        }

        $acceptable = $result->meetsPolicy($this->minimumScts);

        if (! $acceptable) {
            $this->logger->warning('Signing certificate has too few valid SCTs for the CT policy.', [
                'validScts'   => $result->validScts,
                'minimumScts' => $this->minimumScts,
            ]);
        }

        return $acceptable;
    }
}

Verification

Build a result with the SCT extension present and a valid-SCT count at your threshold, and confirm the threshold check passes.
Build a result one below your threshold and confirm the check fails.
Build a result with the SCT extension absent and confirm the gate refuses regardless of count.
Confirm your signing workflow does not construct a signer when the gate refuses.

Security and compliance

NextPDF represents and threshold-checks; it does not operate logs. NextPDF Enterprise surfaces the CT posture and a minimum-SCT check. It is not a CT log, an auditor, or a monitor, and it does not submit certificates to logs.
The threshold is your policy. The minimum-SCT value is yours to set; NextPDF does not impose a number. A missing SCT extension is a clear policy failure.
Gate before you sign. Run the check before constructing the signer so an under-logged certificate never reaches a signing operation.
SCT semantics follow the standards. An SCT is a log’s promise that relying parties expect to be present and valid (RFC 6962 §3; §3.1 structure; CT v2 RFC 9162 §3).

This page concerns certificate trust. Every normative source is paraphrased; no normative text is reproduced.

Failure handling

No SCT extension. Treat a result without the SCT extension as a policy failure; refuse to sign.
Too few valid SCTs. A valid-SCT count below your threshold fails the check; refuse to sign.
Policy placement. Run the gate before the signer is constructed; a late check that runs after signing does not protect the produced document.

Publication boundary

This page documents externally observable behavior and the supported public API surface only. Internal namespace paths, helper classes, mechanism tables, runbook filenames, and ticket prefixes are out of scope.