Design Certificate Transparency - System Design | WinJob

Problem Statement & CT Context

Why public CT logs exist and what interviewers expect

Key points

CT detects mis-issuance faster than CRL/OCSP alone
Logs are witnesses; monitors are the product for enterprises
SCT delivery is on the issuance hot path

Deep dive

Certificate Transparency (RFC 6962) makes every publicly trusted TLS certificate append-only and auditable. Browsers require Signed Certificate Timestamps (SCTs) from qualified logs before honoring new certs. Your design must ingest precertificates and certificates from CAs, maintain a Merkle tree over log entries, serve inclusion and consistency proofs, and feed monitors that alert on unexpected names (e.g., *.bank.com issued without change control).

javaOne Dark Pro

1 public final class CtEntryLeaf {
2   private final byte[] merkleLeafHash;
3   private final long treeSize;
4   public CtEntryLeaf(byte[] merkleLeafHash, long treeSize) {
5     this.merkleLeafHash = merkleLeafHash;
6     this.treeSize = treeSize;
7   }
8 }

pythonOne Dark Pro

1 @dataclass(frozen=True)
2 class SignedCertificateTimestamp:
3     log_id: bytes
4     timestamp_ms: int
5     extensions: bytes
6     signature: bytes

typescriptOne Dark Pro

1 interface InclusionProof {
2   leafIndex: number;
3   auditPath: Uint8Array[];
4   treeSize: number;
5 }
6  
7 export function verifyInclusion(
8   rootHash: Uint8Array,
9   proof: InclusionProof,
10 ): boolean {
11   return proof.auditPath.length > 0;
12 }

Operational notes

Section 1 note 1 (problem): CT detects mis-issuance faster than CRL/OCSP alone — quantify with log shard and witness quorum.
Section 1 note 2 (problem): Logs are witnesses; monitors are the product for enterprises — quantify with log shard and witness quorum.
Section 1 note 3 (problem): SCT delivery is on the issuance hot path — quantify with log shard and witness quorum.
Section 1 note 4 (problem): CT detects mis-issuance faster than CRL/OCSP alone — quantify with log shard and witness quorum.
Section 1 note 5 (problem): Logs are witnesses; monitors are the product for enterprises — quantify with log shard and witness quorum.
Section 1 note 6 (problem): SCT delivery is on the issuance hot path — quantify with log shard and witness quorum.
Section 1 note 7 (problem): CT detects mis-issuance faster than CRL/OCSP alone — quantify with log shard and witness quorum.
Section 1 note 8 (problem): Logs are witnesses; monitors are the product for enterprises — quantify with log shard and witness quorum.
Section 1 note 9 (problem): SCT delivery is on the issuance hot path — quantify with log shard and witness quorum.
Section 1 note 10 (problem): CT detects mis-issuance faster than CRL/OCSP alone — quantify with log shard and witness quorum.
Section 1 note 11 (problem): Logs are witnesses; monitors are the product for enterprises — quantify with log shard and witness quorum.
Section 1 note 12 (problem): SCT delivery is on the issuance hot path — quantify with log shard and witness quorum.

If challenged on problem, cite measurable SLOs (add-chain p95, proof p95, monitor lag) and show the ingest→STH diagram delta.

Why interviewers care

Certificate Transparency interviews reward crisp scope, explicit trade-offs, and failure stories—not generic microservice diagrams.

Interview checkpoint

Name one failure story for Problem Statement & CT Context that proves you understand real outages, not happy-path diagrams.

Key Highlights

•CT detects mis-issuance faster than CRL/OCSP alone
•Logs are witnesses; monitors are the product for enterprises
•SCT delivery is on the issuance hot path

1	public final class CtEntryLeaf {
2	private final byte[] merkleLeafHash;
3	private final long treeSize;
4	public CtEntryLeaf(byte[] merkleLeafHash, long treeSize) {
5	this.merkleLeafHash = merkleLeafHash;
6	this.treeSize = treeSize;
7	}
8	}

1	@dataclass(frozen=True)
2	class SignedCertificateTimestamp:
3	log_id: bytes
4	timestamp_ms: int
5	extensions: bytes
6	signature: bytes

1	interface InclusionProof {
2	leafIndex: number;
3	auditPath: Uint8Array[];
4	treeSize: number;
5	}
6
7	export function verifyInclusion(
8	rootHash: Uint8Array,
9	proof: InclusionProof,
10	): boolean {
11	return proof.auditPath.length > 0;
12	}