Does Sema Validate Certificate Chains or Only CT Log Inclusion?

Direct answer

Sema does not perform full X.509 path validation against a root trust store when it answers domain queries. It validates the transparency log itself—Merkle tree consistency and signed certificate timestamps—and indexes certificates by DNS name. A certificate can appear in Sema results even if it is self-signed, expired, revoked, or issued by a CA that is not trusted.

Likely explanation versus confirmed facts

Likely explanation: Sema is designed as a discovery and monitoring tool for Certificate Transparency logs. Its goal is comprehensive visibility of what has been logged, not a determination of whether a certificate is safe to trust in a TLS handshake.

Confirmed facts from the repository documentation referenced in the request:

• Sema checks CT log signatures and Merkle consistency.
• Sema does not check revocation status, expiration, or CA trustworthiness.
• Sema indexes certificates by DNS name regardless of trust status.

Unverified: whether a specific released version loads Mozilla’s root list or any other trust store. The research brief flags this as requiring current verification against the repository.

Steps for this case

1. Run a domain query for a certificate you know is logged but untrusted, such as a self-signed certificate or one issued by a private CA.
2. If the certificate appears in the response, Sema is not filtering by chain validation.
3. Inspect the ingestion code for trust-store loading or X.509 path-validation libraries; absence of those confirms chain validation is out of scope.

If Sema adds trusted-root filtering

Filtering by Mozilla’s root list or a similar store would change Sema from a transparency monitor into a validation service. Existing API contracts would break because results would no longer include all logged certificates for a domain. Untrusted but legitimately logged certificates would disappear from queries.

Adding OCSP or CRL revocation checks would introduce network latency per certificate, require caching or stapling to avoid blocking queries, and increase storage if CRL lists are retained locally. It would also shift Sema’s privacy profile because the client or service would contact CA infrastructure.

Missing diagnostic detail

Do you need Sema to return only certificates suitable for TLS trust, or do you need it to continue listing every logged certificate for audit purposes? That answer determines whether you should post-process Sema results with a separate X.509 validation library rather than changing Sema’s ingestion pipeline.