arf-topic-s-certificate-transparency

Certificate Transparency for EUDI access certificates is a framework ensuring all issued access certificates are publicly logged and auditable. It provides accountability by enabling monitors and auditors to detect mis-issued certificates within the EUDI ecosystem.

To implement CT log registration for a Certificate Authority, you must log issued access certificates to CT logs and ensure Signed Certificate Timestamp (SCT) verification. This process aligns with RFC 9162 and Commission Implementing Regulation (EU) 2025/848 requirements.

Yes, EUDI Certificate Transparency requires compliance with RFC 9162. The framework details high-level requirements for CAs and Wallet Units regarding CT log registration and SCT verification, explicitly referencing RFC 9162 and Commission Implementing Regulation (EU) 2025/848.

You need to verify Signed Certificate Timestamps (SCTs) in EUDI Wallet Units during access certificate validation to confirm transparency. This verification ensures the certificate was publicly logged in a CT log, preventing the use of unlogged or mis-issued certificates.

Certificate Transparency addresses security threats like mis-issued certificates and log integrity compromises for EUDI access certificates. It outlines incident response procedures and uses monitors and auditors to detect unauthorized certificate issuance within the infrastructure.

Yes, you can use this guidance for building an EU CT log infrastructure. It details legal requirements and discussion points on EU CT log infrastructure, outlining the necessary components and security measures for CAs and Wallet Units.