Subject: [Trans] Log servers by Feb 2015?

From: "Salz, Rich" <[email-masked]>
Date: Wed, 5 Nov 2014 22:19:16 -0500

Are any (other) log servers planning on being up and ready in production by Feb 2015, to meet the schedule requirements described by Google?
(See the PDF file attached here: http://www.certificate-transparency.org/ev-ct-plan)

--
Principal Security Engineer, Akamai Technologies
IM: [email-masked]<mailto:[email-masked]> Twitter: RichSalz

---

From: Matt Palmer <[email-masked]>
Date: Thu, 6 Nov 2014 18:49:04 +1100

On Wed, Nov 05, 2014 at 10:19:16PM -0500, Salz, Rich wrote:
> Are any (other) log servers planning on being up and ready in production
> by Feb 2015, to meet the schedule requirements described by Google?

Define "other".  I've had alpha.ctlogs.org up since August, if I'm not
counted in your initial set.  Code behind it is released, too:
https://github.com/sslwatcher/ct-log-server.

- Matt

-- 
"Left to themselves, [marketers] would butt-tag us like polar bears to track
our buying habits and bombard our phones and emails and computer screens
with ads benefitting them and their clients." --- Tsu Dho Nimh, NANAE

---

From: "Salz, Rich" <[email-masked]>
Date: Thu, 6 Nov 2014 08:05:17 -0500

Thanks Matt (and another private reply I got).

My concern is this: what can Akamai do when we get a new EV cert for a customer on February 2?  If the SCT's (two) are in the certificate, great. If not, where and how can I get them, to present them to Chrome when asked via the s_c_t TLS extension?

There's probably a better list to ask this question; pointers appreciated.

--  
Principal Security Engineer, Akamai Technologies
IM: [email-masked] Twitter: RichSalz

---

From: Rob Stradling <[email-masked]>
Date: Thu, 06 Nov 2014 13:12:54 +0000

> There's probably a better list to ask this question; pointers appreciated.

Rich, see this list...
https://groups.google.com/a/chromium.org/forum/#!forum/ct-policy

...and this page...
http://www.chromium.org/Home/chromium-security/certificate-transparency

-- 
Rob Stradling
Senior Research & Development Scientist
COMODO - Creating Trust Online

---

From: "Salz, Rich" <[email-masked]>
Date: Thu, 6 Nov 2014 10:05:24 -0500

Thanks for the links.  The web page, and the PDF policy it contains, is the main source of my concern.  Neither it, nor the email list discussion, has any info to alleviate that concern.

I'll join the list and post there; thanks.

---

From: Matt Palmer <[email-masked]>
Date: Fri, 7 Nov 2014 06:47:59 +1100

On Thu, Nov 06, 2014 at 08:05:17AM -0500, Salz, Rich wrote:
> My concern is this: what can Akamai do when we get a new EV cert for a
> customer on February 2?  If the SCT's (two) are in the certificate, great. 
> If not, where and how can I get them, to present them to Chrome when asked
> via the s_c_t TLS extension?

You can submit the certificate to alpha.ctlogs.org via the /add-cert-chain
endpoint, and place the resulting SCT in the TLS extension.  Alpha will have
passed its three month probationary period in five days time; it will
(presumably) be included in Chrome as a trusted log in the next release.

> There's probably a better list to ask this question; pointers appreciated.

The main certificate-transparency.org list is probably the best place to ask
these sorts of questions, being of a more implementation-oriented flavour,
but not being particular Chromium-specific (for which [email-masked]
would be most appropriate).

- Matt