Certificate Transparency — Deep Reference

At a glance

This page is the deep reference for the Certificate Transparency (CT) surface in NextPDF Enterprise. The surface is one immutable value object: NextPDF\Enterprise\Security\CertificateTransparency\CtValidationResult. It summarizes the Signed Certificate Timestamp (SCT) posture of an X.509 signing certificate. It carries the SCT-extension flag, the total and valid SCT counts, and the issuing-log identifiers. It exposes one policy method, meetsPolicy(), which is a minimum-SCT threshold check. The type represents a result; it does not extract SCTs, verify SCT signatures, or contact CT logs. For the workflow-level guide, see Certificate Transparency policy for signing certificates.

Availability & licensing

This capability ships in NextPDF Enterprise (nextpdf/enterprise) and activates with an Enterprise-tier license envelope. A deployment without that entitlement does not load the capability’s classes. Compare editions and get a license.

Public API surface

Symbol	Parameters	Default behavior	Returns	Throws or fails with	Notes
CtValidationResult	—	Immutable value object summarizing a certificate’s SCT posture	—	Does not throw	final readonly; all four constructor-promoted properties are public
CtValidationResult::__construct	bool $hasSctsExtension, int $totalScts, int $validScts, array<string> $logIds	Stores the supplied values as given, without validation or reconciliation	New CtValidationResult instance	No declared @throws; PHP raises TypeError on mismatched argument types under strict_types	Promoted public readonly properties
CtValidationResult::meetsPolicy	int $minimumScts = 2	Compares the valid-SCT count against the threshold: validScts >= $minimumScts	bool	Does not throw	Counts valid SCTs only; it does not check log distinctness or extension presence

final readonly class CtValidationResult

public function __construct(
    public bool $hasSctsExtension,
    public int $totalScts,
    public int $validScts,
    public array $logIds,
) {}

public function meetsPolicy(int $minimumScts = 2): bool

Public readonly properties

Property	Type	Meaning
$hasSctsExtension	bool	Whether the certificate contains the SCT extension
$totalScts	int	Total number of SCTs found in the extension
$validScts	int	Number of SCTs with valid signatures, as determined upstream
$logIds	array<string>	Log identifiers (SHA-256 hashes) of the CT logs that issued the SCTs

Behavior contract

• CtValidationResult is a result value. It represents the outcome of SCT extraction and verification that the caller’s environment performed. It does not parse certificates, verify SCT signatures, query logs, or submit certificates to logs.
• The extension in question is the embedded-SCT X.509v3 certificate extension, identified by OID 1.3.6.1.4.1.11129.2.4.2 — RFC 6962 §3.3. An SCT carries a version, a log identifier, a timestamp, extensions, and the log signature over the entry — RFC 6962 §3.2.
• Each entry in $logIds is a log identifier as defined by RFC 6962 §3.2: the SHA-256 hash of the log public key over its DER-encoded SubjectPublicKeyInfo. The type stores the strings as supplied and does not recompute or validate them.
• meetsPolicy() implements exactly one comparison: the valid-SCT count is greater than or equal to the threshold. The default threshold is 2.
• meetsPolicy() does not consult $hasSctsExtension. A policy that must fail on a missing extension gates on the property separately, before or alongside the threshold check.
• meetsPolicy() does not deduplicate $logIds. A policy that requires SCTs from independent logs checks distinctness through $logIds itself.
• The constructor stores inputs verbatim. It performs no range checks and no cross-field consistency checks.
• Instances are immutable (final readonly). All reads and the threshold check are deterministic and side-effect free.
• The threshold value is the operator’s policy choice; NextPDF imposes no number. The package source annotates one ecosystem reference point: Chrome’s CT policy, as of 2024, expects at least two SCTs from different logs for certificates with lifetimes up to 180 days, and three for longer-lived certificates. That is a browser-program policy, not an IETF requirement.
• The intended placement is a pre-signing gate: a signing workflow refuses to construct a signer when the check fails. The rationale follows the CT trust model: an SCT is the log’s promise to incorporate the certificate, and relying parties reject a certificate that lacks a valid SCT — RFC 6962 §3. CT version 2.0 keeps the same model: a log that accepts a submission returns an SCT, which the submitter validates before relying on it — RFC 9162 §3.

Edge cases & failure modes

• Zero or negative threshold. meetsPolicy(0) returns true for any non-negative $validScts. The method does not reject the value. Choose a threshold of at least 1.
• Extension absent, counts positive. When $hasSctsExtension is false but $validScts meets the threshold, meetsPolicy() still returns true. The gate must check $hasSctsExtension explicitly when absence must fail; the capability page shows this pattern.
• Duplicate log identifiers. N valid SCTs from a single log satisfy a threshold of N. The threshold check makes no independence claim. Log-distinctness policies inspect $logIds.
• Inconsistent counts. A $validScts greater than $totalScts, or a negative count, is stored as supplied. No exception is raised. The upstream extraction step owns input consistency.
• Unvalidated log-identifier strings. The type does not enforce a 32-byte or hexadecimal shape on $logIds entries. Malformed identifiers pass through unchanged.
• No exception path. No method on this surface throws under valid PHP types. The failure mode of the policy check is refusal (false), not an exception. Mismatched argument types raise a PHP TypeError under strict_types, as for any typed PHP API.

FIPS-mode behavior

CtValidationResult performs no cryptographic computation. It computes no digest and verifies no signature. Whether an SCT signature counted as valid is decided upstream, by the component that performed verification before constructing the result. The Enterprise FIPS 140-3 crypto-policy profile, documented with the security module, therefore does not alter this type’s behavior.

Conformance

Claim	Standard	Clause
An SCT is the log’s promise to incorporate the certificate; relying parties reject a certificate lacking a valid SCT.	RFC 6962	§3
An SCT carries a version, a log identifier, a timestamp, extensions, and the log signature over the entry.	RFC 6962	§3.2
The log identifier is the SHA-256 hash of the log public key over its DER-encoded SubjectPublicKeyInfo.	RFC 6962	§3.2
Embedded SCTs ride an X.509v3 certificate extension identified by OID 1.3.6.1.4.1.11129.2.4.2.	RFC 6962	§3.3
In CT version 2.0, a log that accepts a submission returns an SCT, which the submitter validates before relying on it.	RFC 9162	§3

All clauses are paraphrased; NextPDF does not reproduce normative text. NextPDF Enterprise is not a CT log, an auditor, or a monitor. It does not submit certificates to logs and it does not assert a CT-verification outcome. The type represents counts and identifiers the caller’s environment produced, and it evaluates a caller-chosen threshold. Browser CT programs, such as Chrome’s, are ecosystem policies rather than IETF-normative requirements; selecting and satisfying such a policy is the operator’s responsibility.

Development notes

• The value object has no dependencies and no I/O. Construct instances directly in unit tests.
• Recommended boundary tests: valid count exactly at the threshold, one below the threshold, extension absent with counts at the threshold, and duplicate log identifiers against a distinctness policy.
• The class is declared under strict_types=1 with typed promoted properties. Wrong argument types raise a PHP TypeError in the caller.
• The class carries a package @since annotation of 1.0.0 and references RFC 6962 and RFC 9162 in its source documentation.
• The $logIds parameter is documented as array<string>; static analysis treats the property as an array of strings. Preserve that shape when constructing results.
• Place your upstream CT verification and this threshold gate before signer construction, so an under-logged certificate never reaches a signing operation. The capability page documents the workflow and a worked gate example.

See also

• Certificate Transparency policy for signing certificates — the capability page: workflow, configuration, and a worked policy gate.
• Security — NextPDF Enterprise — the combined Enterprise security surface.
• Signature — Deep Reference — the PAdES B-LT and B-LTA long-term producer.
• Security / Signing (Core) — the Core CMS signer and signing-strategy contract.
• Certificate Transparency · SCT — glossary terms.

Publication boundary

This page documents externally observable behavior and the supported public API surface only. Internal namespace paths, helper classes, mechanism tables, runbook filenames, and ticket prefixes are out of scope.