Apple's Certificate Transparency policy says that Signed Certificate Timestamps (SCTs) are accepted from TLS extension or OCSP Stapling in addition to the SCTs embedded in the certificate. If we're implementing our own Certificate Transparency enforcement in code written using URLSession, is there a way to obtain SCTs that were presented via TLS extension or OCSP Stapling?
I'm able to get the SCTs from the certificate by calling SecCertificateCopyValues with "1.3.6.1.4.1.11129.2.4.2" inside the urlSession(_:didReceive:completionHandler:) delegate function. I see that there are functions for adding TLS/OCSP SCTs to the ServerTrust, but I don't see any functions for getting them out, and I don't know if URLSession would be including those SCTs in the ServerTrust automatically anyway.
Is there any way to get these other SCTs using URLSession? Or would I have to drop down to Network Framework to do that?
Thanks for any help.