5 ms·

> Symantec has publicly and strongly committed to Certificate Transparency (CT) logging for Symantec certificates and is one of the few CAs that hosts its own

> Symantec has publicly and strongly committed to Certificate Transparency (CT) logging for Symantec certificates and is one of the few CAs that hosts its own CT servers. Lol. This is like being court-ordered to do community support and then bragging about all the volunteering you do. Symantec was forced by Google to do CT. See https://security.googleblog.com/2015/10/sustaining-digital-certificate-security.html https://security.googleblog.com/2015/10/sustaining-digital-c... , specifically: > Therefore we are firstly going to require that as of June 1st, 2016, all certificates issued by Symantec itself will be required to support Certificate Transparency. (By the end of this year, all CAs will be forced to do CT, but Symantec was forced into this last year, because of the stupid shit they keep doing)

Manishearth 10y ago
(To be clear, they weren't forced to run their own CT log, they just had to have CT set up, however setting up their own log in light of these restrictions is a business decision and not an indication of commitment to CT -- paying someone to run a CT log for them would probably be more expensive. By the end of this year we may see more/cheaper options for CAs who need to log their certs.)
- Buge 10y ago
  Do CAs have to pay the log providers? From this article it sounds like Google is adding certs to their own log for free. https://www.certificate-transparency.org/faq https://www.certificate-transparency.org/faq Also >Anyone can submit a certificate to a log, although most certificates will be submitted by certificate authorities and server operators. https://www.certificate-transparency.org/how-ct-works https://www.certificate-transparency.org/how-ct-works
  - Manishearth 10y ago
    I was under the impression that there wasn't any "free to use" log out there, at least not for someone with the volume of a CA. I could be wrong / this might have changed since last year.
    - tialaramex 10y ago
      Google's logs are free to use, everybody can shove whatever they like into the Google logs if it chains to a relevant CA. Most logs don't talk to random civilians about this, but at the ct-policy meeting the one log which did speak about their policies said that they either cut a $$$ deal OR they accept a mutual logging arrangement, on the rationale that if you eat the cost of logging their stuff and they eat the cost of logging your stuff, that works out fine for everybody.

Manishearth 10y ago

(To be clear, they weren't forced to run their own CT log, they just had to have CT set up, however setting up their own log in light of these restrictions is a business decision and not an indication of commitment to CT -- paying someone to run a CT log for them would probably be more expensive. By the end of this year we may see more/cheaper options for CAs who need to log their certs.)

Buge 10y ago
Do CAs have to pay the log providers? From this article it sounds like Google is adding certs to their own log for free. https://www.certificate-transparency.org/faq https://www.certificate-transparency.org/faq Also >Anyone can submit a certificate to a log, although most certificates will be submitted by certificate authorities and server operators. https://www.certificate-transparency.org/how-ct-works https://www.certificate-transparency.org/how-ct-works
- Manishearth 10y ago
  I was under the impression that there wasn't any "free to use" log out there, at least not for someone with the volume of a CA. I could be wrong / this might have changed since last year.
  - tialaramex 10y ago
    Google's logs are free to use, everybody can shove whatever they like into the Google logs if it chains to a relevant CA. Most logs don't talk to random civilians about this, but at the ct-policy meeting the one log which did speak about their policies said that they either cut a $$$ deal OR they accept a mutual logging arrangement, on the rationale that if you eat the cost of logging their stuff and they eat the cost of logging your stuff, that works out fine for everybody.