1

How would one go about getting in contact with a popular CT logs operator's, let's say Google Pilot, and how would one get a CA root included in their log? Are there open CT logs that allow untrusted roots or don't have a root system/program?

2
  • 2
    I feel like there's a bit of an XY Problem here that would be helped by some extra information. It seems odd to want CT logs for a non-publicly-trusted CA. What are you trying to do? I'm guessing you've added your private CA to Chrome, but it's still giving you cert warnings about CT logs? Nov 12 '20 at 20:45
  • 1
    @MikeOunsworth Currently the CA I represent, which will not be mentioned cause I think its prob consider advertising, is not included in all of the major root stores, just a few smaller ones, but in order to have E.V. certificates show up as valid in browser UIs you have to publish ct log logs and only some are trusted by chrome, so i'm not really sure where to go from here.
    – Nathanna
    Nov 13 '20 at 20:11
3

So your question boils down to this:

We are a small CA supported by some browsers. We are trying to offer EV certs but are running into issues because we're not logging our certs to CT logs. How can we get the CT logs to accept our certs / SCTs?


I agree that it's surprisingly hard to find any information on this. My first hint comes from Chromium docs:

Locally-trusted CAs

For CAs that have been manually installed, provided those certificates are not or have not been publicly-trusted, it‘s not necessary to enable support for Certificate Transparency. Further, Certificate Transparency Logs will not accept certificates from those CAs, thus it’s not possible to support CT.

Alright, that's a hint that CT logs will only accept SCTs from publicly-trusted CAs. But what does that mean? The whole point is that logging to CT will increase your public trustworthiness, so that seems a bit ... circular.


Next bit of useful info: Chromium CT Log Policy:

When applying for your CT log to be included in Chrome the CT Log Operator must provide the following information about the new CT Logs in their application:

  • The set of Accepted Root Certificates of the Logs

So that tells me that each CT log operator gets to decide which CAs to accept into their log. That means each CT log is likely to have their own policies for who they accept.


From the same Chromium CT Log Policy, I see

Logging Submission Policy

Accepted Root Certificates

In order to maintain broad utility to Chrome and its users, CT Logs are expected to accept logging submissions from CAs that are trusted by default in Chrome across all its supported platforms, including ChromeOS, Android, Linux, Windows, macOS, iOS. If a Log Operator plans to restrict the set of Accepted Root Certificates, this should be clearly stated in the CT Log Operator Application as well as the rationale for this restriction. Note: This restriction may prevent a CT Log from being accepted by Chrome for inclusion.

The plot thickens. So while it's technically up to the CT Operator which Root CAs to log for, they had better log for all roots in the Chrome Root Program. It doesn't say that the CT log can only accept submissions from roots in Chrome. So you're not totally out of luck yet.


Here is the official list of CT logs recognized by Chrome.

As per the Chromium CT Policy (see section "Embedded SCTs"), you'll need to get your CA into:

  • 2 CT logs if cert lifetime < 15 months
  • 3 CT logs if cert lifetime >= 15 and <= 27 months
  • 4 CT logs if cert lifetime > 27 and <= 39 months
  • 5 CT logs if cert lifetime > 39 months

Of those at least one must be a Google-operated CT log and at least one must be a non-Google CT log.

Since you asked about Google Pilot in particular, here's a Chromium bug tracker thread that says:

HTTP(S) endpoint: https://ct.googleapis.com/pilot

Description: Google's first CT log, operating since 2013-03-25 (has been monitored by http://ct-watch.tom-fitzhenry.me.uk/#/logserver/google-pilot). Will log any certificate that is anchored in a root trusted by one of the major browser vendors.

Which is again a bit circular; "We'll log for you if the browsers trust you"

Soooooooooooo I think you need to pick some CT logs from that list and start sending emails. I expect you'll get asked A) if you're in the browsers, B) if you're eligible to be in the browsers. Sounds like if you're not compliant with CA/B Baseline Requirements, and have not passed a WebTrust audit, then you'll probably be fighting an up-hill battle to get them to include you.

... which I think doesn't really tell you anything you didn't already know. Sorry if none of this is helpful.

2
  • 1
    Interesting, this post seems to answer most of what I was looking for. I'll have to dive deeper, as I'm sure theres alot still to be uncovered but I think your right. - The CA I represent does have our own type of CT-ish thing that allows any one to see information by just providing a certificate serial so perhaps we'll find some smallers logs to begin with. :) (Tag: @mikeonusworth)
    – Nathanna
    Nov 15 '20 at 2:35
  • @NathannaJames Are you describing OCSP? The purpose of CT is a bit different: for public CAs, Google want to easily be able to list every cert that CA issued in other that 3rd party researchers can can check for certs that were issued incorrectly. That's different from OCSP where, for example the sysadmin decomissions a server and asks the CA to revoke that server's cert. Nov 16 '20 at 3:47
2

As described here:

Google's first CT log.... Will log any certificate that is anchored in a root trusted by one of the major browser vendors.

So I don't believe they'll accept arbitrary CAs.

You could get your root added to Testtube, a test CT log, but that may not be what you're looking for.

3
  • Is Testtube trusted by Chromium browsers and does it function as a normal ct log?
    – Nathanna
    Nov 12 '20 at 20:04
  • @NathannaJames no, it doesn't; that's why I thought it may not be what you're looking for.
    – gowenfawr
    Nov 12 '20 at 23:39
  • ah! i'll look into others then, thanks for your answer.
    – Nathanna
    Nov 13 '20 at 20:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.