Certificate Transparency Ecosystem

Disclaimer: The information on this page is provided on an "as is" and "as available" basis with no guarantees of completeness, accuracy, usefulness, or timeliness. Opsmate, Inc. assumes no responsibility or liability for any errors or omissions in the information. To the fullest extent permitted under applicable law, Opsmate, Inc. disclaims all warranties of any kind, express or implied, with regard to the information, including, but not limited to, that the information will be provided uninterrupted, error-free, omission-free, or free of viruses or other harmful items.

Logs

Log Status

Operational

The log is up and running normally.

Frozen

The log is up but is no longer accepting new entries or producing new STHs.

Dead

The log is no longer running.

Forked

The log has presented more than one view. Information about each branch is displayed in a separate row.

Log Scope

Trusted

The log is intended for WebPKI certificates trusted by TLS clients. (Note: although the log accepts trusted certificates, the log itself may be intended for testing - see comments.)

Untrusted

The log is intended for WebPKI certificates that are not presently trusted by TLS clients, but may be trusted in the future, or were trusted in the past.

Expired

The log is intended for expired WebPKI certificates.

Testing

The log is intended for untrusted WebPKI test certificates.

RPKI

The log is intended for RPKI certificates.

BIMI

The log is intended for BIMI certificates.

Log Software

Trillian (41)

Google's latest open source log implementation (Apache-2)

Trillian-CF (8)

Trillian, with Cloudflare patches (Proprietary)

DigiCert-HP (8)

DigiCert's new high performance log implementation (Proprietary)

SuperDuper (4)

Google's original open source log implementation (Apache-2)

DigiCert (1)

DigiCert's original log implementation (Proprietary)

Google (0)

Google's original closed source log implementation (Proprietary)

Catlfish (0)

Experimental log implementation by NORDUNet (BSD)

sslwatcher (0)

Defunct log implementation written in Ruby (GPLv3)

TLS Client Status

Pending

The log is applying for inclusion.

Qualified

The log has qualified for inclusion but is not yet usable by CAs and TLS server operators because some clients may still be using an out-of-date log list and won't recognize SCTs from the log.

Usable

The log is included in the client and can be used by CAs and TLS server operators. All SCTs from the log will be recognized by clients.

<TREE_SIZE

The log became read-only at the given tree size. SCTs previously issued by the log can still be used, but CAs and TLS server operators cannot submit new certificates to the log.

Retired

(Formerly disqualified.) The log was included, but has been retired. Embedded SCTs issued before retirement can generally still be used, subject to caveats as explained in the Chrome CT Policy. Other SCTs are treated the same as SCTs from unusable logs. CAs and TLS server operators should no longer submit certificates to the log.

Rejected

The log was rejected before it was included, or was included and then removed. The client will not recognize SCTs from the log.

Monitor Status

Monitored

The log is monitored by this monitor service.

Known

The monitor service knows about the log but does not monitor it.

<TREE_SIZE

The log was previously monitored by this monitor service up to TREE_SIZE entries.

sth-pollination Endpoints

• certspotter.com
• ct.grahamedgecombe.com

Resources

• Certificate Transparency
• CT Mailing List
• RFC 6962
• RFC 6962-bis
• IETF Public Notary Transparency (trans) Working Group
• Chrome CT Log Policy
• Chrome CT Policy (May 2016)
• Chrome CT Policy Mailing List
• Apple CT Policy
• CT Log Growth
• Chrome Uptime Measurements