Listening to my podcasts backlog, I found an interesting idea in an episode of 2.5 Admins about following SSL Transparency Logs, a technique I admit I did not know about.

So, as soon as I got to a pc I looked for an open source tool to tail these logs. So this is how I found about certspotter.

In NixOS it’s quite simple, add something like this to your configuration.nix:

  services.certspotter = {
    enable = true;
    startAtEnd = false;
    watchlist = [
      "cheriches.com"
      ".test.certspotter.org"
    ];
    emailRecipients = [
      "emil@cheriches.com"
    ];
    extraFlags = [
      "-verbose"
    ];
    sendmailPath = "/run/wrappers/bin/sendmail";
  };

  services.certspotter = {
    enable = true;
    startAtEnd = false;
    watchlist = [
      "cheriches.com"
      ".test.certspotter.org"
    ];
    emailRecipients = [
      "emil@cheriches.com"
    ];
    extraFlags = [
      "-verbose"
    ];
    sendmailPath = "/run/wrappers/bin/sendmail";
  };

The verbose flag is just to make sure it does something, as “journalctl -fu certspotter.service” is not that chatty, and sendmailPath because i use Postfix MTA.