4 ms·
(To be clear, they weren't forced to run their own CT log, they just had to have CT set up, however setting up their own log in light of these restrictions is a
by Manishearth 10y ago
(To be clear, they weren't forced to run their own CT log, they just had to have CT set up, however setting up their own log in light of these restrictions is a business decision and not an indication of commitment to CT -- paying someone to run a CT log for them would probably be more expensive. By the end of this year we may see more/cheaper options for CAs who need to log their certs.)
- Buge 10y agoDo CAs have to pay the log providers? From this article it sounds like Google is adding certs to their own log for free. https://www.certificate-transparency.org/faq https://www.certificate-transparency.org/faq Also >Anyone can submit a certificate to a log, although most certificates will be submitted by certificate authorities and server operators. https://www.certificate-transparency.org/how-ct-works https://www.certificate-transparency.org/how-ct-works
- Manishearth 10y agoI was under the impression that there wasn't any "free to use" log out there, at least not for someone with the volume of a CA. I could be wrong / this might have changed since last year.
- tialaramex 10y agoGoogle's logs are free to use, everybody can shove whatever they like into the Google logs if it chains to a relevant CA. Most logs don't talk to random civilians about this, but at the ct-policy meeting the one log which did speak about their policies said that they either cut a $$$ deal OR they accept a mutual logging arrangement, on the rationale that if you eat the cost of logging their stuff and they eat the cost of logging your stuff, that works out fine for everybody.