3 ms·

> CT only covers a small subset of CAs I’m curious what you mean by this. CT is required for a cert to be trusted by Chrome. It seems like most CAs would parti

• tialaramex 7y ago
  All major public CAs participate. There are some smaller subCAs which do not participate at all because they've defined their problem space such that Chrome + Safari is irrelevant, e.g. GlobalSign is responsible for some legacy subCAs that issue for a single company, that company doesn't care about web browsers for these certs and so logging (which isn't required by policy) is not interesting to them. GlobalSign expects these legacies to go away over the next year or so. Some of the large public CAs offer, either explicitly in their ordinary "purchase" journey or by special arrangement, not to log pre-certificates. And a few in-house CAs at very big outfits like Google deliberately don't log pre-certificates. You do NOT need to log pre-certificates to be trusted by Chrome, the reason to do that is to produce a drop-in experience for non-technical subscribers. If you have technical staff (which obviously Google does) you can log certificates retrospectively and staple the SCTs to the TLS setup as needed, allowing you to log on a "just in time" basis at a cost of needing a bunch more smart people to run your web servers. If those servers serve google.com and gmail.com you already needed a large international team anyway. So these latter certs do get logged, but literally it may be seconds before they're used (and inevitably Google has screwed up and not logged one and that broke some of their sites in Chrome briefly... closed course, professional drivers, do not attempt)