How to specify SCT(Signed Certificate Timestamp) data to send as a TLS extension in openssl?

Question

I want to send SCT(Signed Certificate Timestamp) data on server side as a TLS extension, But I did not find any functions that support this operation in the openssl manpage(https://www.openssl.org/docs/man1.1.1/man3/).Thanks for help if there is any suggesstions.

Answer 1

There is no direct support for sending this. However, you can use the SSL_CTX_use_serverinfo_ex or SSL_CTX_use_serverinfo functions to send arbitrary extensions data which should be sufficient for your purpose.

See:

https://www.openssl.org/docs/man3.0/man3/SSL_CTX_use_serverinfo_ex.html

Answer 2

Why you need SCT extension? there is no any reason to use SCT! chrome work's fine without SCT!
openssl not support SCT extension, but it support adding data by custom OID. so OID of SCT extension is 1.3.6.1.4.1.11129.2.4.2.
example: in config file add

1.3.6.1.4.1.11129.2.4.2 = ASN1:UTF8String:My random DATA

voaliy!