How do you get a CA trusted by Certificate Transparency logs?

Question

How would one go about getting in contact with a popular CT logs operator's, let's say Google Pilot, and how would one get a CA root included in their log? Are there open CT logs that allow untrusted roots or don't have a root system/program?

Answer 1

So your question boils down to this:

We are a small CA supported by some browsers. We are trying to offer EV certs but are running into issues because we're not logging our certs to CT logs. How can we get the CT logs to accept our certs / SCTs?

---

I agree that it's surprisingly hard to find any information on this. My first hint comes from Chromium docs:

Locally-trusted CAs

For CAs that have been manually installed, provided those certificates are not or have not been publicly-trusted, it‘s not necessary to enable support for Certificate Transparency. Further, Certificate Transparency Logs will not accept certificates from those CAs, thus it’s not possible to support CT.

Alright, that's a hint that CT logs will only accept SCTs from publicly-trusted CAs. But what does that mean? The whole point is that logging to CT will increase your public trustworthiness, so that seems a bit ... circular.

---

Next bit of useful info: Chromium CT Log Policy:

When applying for your CT log to be included in Chrome the CT Log Operator must provide the following information about the new CT Logs in their application:

• The set of Accepted Root Certificates of the Logs

So that tells me that each CT log operator gets to decide which CAs to accept into their log. That means each CT log is likely to have their own policies for who they accept.

---

From the same Chromium CT Log Policy, I see

Logging Submission Policy

Accepted Root Certificates

In order to maintain broad utility to Chrome and its users, CT Logs are expected to accept logging submissions from CAs that are trusted by default in Chrome across all its supported platforms, including ChromeOS, Android, Linux, Windows, macOS, iOS. If a Log Operator plans to restrict the set of Accepted Root Certificates, this should be clearly stated in the CT Log Operator Application as well as the rationale for this restriction. Note: This restriction may prevent a CT Log from being accepted by Chrome for inclusion.

The plot thickens. So while it's technically up to the CT Operator which Root CAs to log for, they had better log for all roots in the Chrome Root Program. It doesn't say that the CT log can only accept submissions from roots in Chrome. So you're not totally out of luck yet.

---

Here is the official list of CT logs recognized by Chrome.

As per the Chromium CT Policy (see section "Embedded SCTs"), you'll need to get your CA into:

• 2 CT logs if cert lifetime < 15 months
• 3 CT logs if cert lifetime >= 15 and <= 27 months
• 4 CT logs if cert lifetime > 27 and <= 39 months
• 5 CT logs if cert lifetime > 39 months

Of those at least one must be a Google-operated CT log and at least one must be a non-Google CT log.

Since you asked about Google Pilot in particular, here's a Chromium bug tracker thread that says:

HTTP(S) endpoint: https://ct.googleapis.com/pilot

Description: Google's first CT log, operating since 2013-03-25 (has been monitored by http://ct-watch.tom-fitzhenry.me.uk/#/logserver/google-pilot). Will log any certificate that is anchored in a root trusted by one of the major browser vendors.

Which is again a bit circular; "We'll log for you if the browsers trust you"

Soooooooooooo I think you need to pick some CT logs from that list and start sending emails. I expect you'll get asked A) if you're in the browsers, B) if you're eligible to be in the browsers. Sounds like if you're not compliant with CA/B Baseline Requirements, and have not passed a WebTrust audit, then you'll probably be fighting an up-hill battle to get them to include you.

... which I think doesn't really tell you anything you didn't already know. Sorry if none of this is helpful.

Answer 2

As described here:

Google's first CT log.... Will log any certificate that is anchored in a root trusted by one of the major browser vendors.

So I don't believe they'll accept arbitrary CAs.

You could get your root added to Testtube, a test CT log, but that may not be what you're looking for.