3 ms·
The primary purpose of CT is to provide transparency into browser-trusted certificates. Since expired certificates are not trusted by browsers, having them in b
by agwa 1y ago
The primary purpose of CT is to provide transparency into browser-trusted certificates. Since expired certificates are not trusted by browsers, having them in browser-trusted CT logs is purely a liability.
Those who care about expired certificates can archive shards before they are decommissioned, or operate a non-sharded log for expired certificates that isn't trusted by browsers (e.g. Google Daedalus).
Temporal sharding was designed when there were far fewer than a billion certificates and logs weren't struggling with read or write load. The need for sharding will only get greater as lifetimes are capped at 45 days.