12 ms·

Now you depend on CT log providers uptime, which as far as I can tell is worse than LE.

• pests 8mo ago
  Google, Cloudflare, Let's Encrypt, DigiCert, GlobalSign and others run logs. Here is the list Chrome checks: https://www.gstatic.com/ct/log_list/v3/log_list.json https://www.gstatic.com/ct/log_list/v3/log_list.json While they do not have direct SLAs, they still have to comply with rules enforced by browser vendors, as they will remove you from CT checks and you'll be marked retired/untrusted (you can find some in the above list). This means a 99% uptime on a 90 day rolling average, a 1 minute update frequency for new entries (24 hours on an older RFC). No split views, strict append-only, sharding by year, etc. I think OP's original idea would work.
  • plagiat0r 8mo ago
    X509 certificates published in CT logs are "pre-certificates". They contains a poison extension so you don't be able to use them with your private key. The final certificate (without poison and with SCT proof) is usually not published in any CT logs but you can submit it yourself if you wish. OP idea won't work unless OP will submit final certificate himself to CT logs.
    • pests 8mo ago
      I didn't realize this detail, thank you.