Subject: [Trans] Open source CT log implementations

From: Tony Arcieri <[email-masked]>
Date: Thu, 2 Apr 2015 12:21:22 -0700

Please let me know if it's way too early to consider this, but...

We run many in-house CA services, and I thought it would be interesting if
they all reported to an in-house CT log each time they signed a CSR which
we could use for record-keeping and auditing purposes.

I saw Google has the appropriate client code to do this (ostensibly
hardcoded to report to Google's CT log), however AFAIK that log
implementation isn't open source.

Are there any open source ones worth using? Are changes to the
specification happening so quickly that this isn't advisable yet?

-- 
Tony Arcieri

---

From: Ben Laurie <[email-masked]>
Date: Thu, 2 Apr 2015 20:40:57 +0100

On 2 April 2015 at 20:21, Tony Arcieri <[email-masked]> wrote:
> they all reported to an in-house CT log each time they signed a CSR which we
> could use for record-keeping and auditing purposes.
>

What implementation do you mean?

We have: https://github.com/google/certificate-transparency

which implements both client and server and is open source.

> Are there any open source ones worth using? Are changes to the specification
> happening so quickly that this isn't advisable yet?
>
> --
> Tony Arcieri
>
> _______________________________________________
> Trans mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/trans
>

---

From: Tomas Gustavsson <[email-masked]>
Date: Thu, 02 Apr 2015 21:53:40 +0200

We use the Google open source code to set up a test CT server when testing EJBCA, and of course the client code to submit. 
I don't see any obstacles to running this in-house? 

Cheers, 
Tomas 

On April 2, 2015 9:21:22 PM GMT+02:00, Tony Arcieri <[email-masked]> wrote:
>------------------------------------------------------------------------
>

---

From: Tony Arcieri <[email-masked]>
Date: Thu, 2 Apr 2015 13:56:27 -0700

> which implements both client and server and is open source.

Orly! Seems I was confused then.

Are there any instructions on how to compile, set up, and and run a log
server?

-- 
Tony Arcieri

---

From: Leif Johansson <[email-masked]>
Date: Fri, 3 Apr 2015 10:16:09 +0200

ct.nordu.net is the home of the catlfish log - BSD licensed

> 2 apr 2015 kl. 21:21 skrev Tony Arcieri <[email-masked]>:
> 
> We run many in-house CA services, and I thought it would be interesting if they all reported to an in-house CT log each time they signed a CSR which we could use for record-keeping and auditing purposes.
> 
> I saw Google has the appropriate client code to do this (ostensibly hardcoded to report to Google's CT log), however AFAIK that log implementation isn't open source.
> 
> Are there any open source ones worth using? Are changes to the specification happening so quickly that this isn't advisable yet?
> 
> -- 
> Tony Arcieri

---

From: Ben Laurie <[email-masked]>
Date: Fri, 3 Apr 2015 10:38:46 +0100

> Are there any instructions on how to compile, set up, and and run a log

Compile, yes. Set up and run, no - probably best to look at the
end-to-end tests for that part.

This test might be the easiest to follow:
https://github.com/google/certificate-transparency/blob/master/cpp/server/ct-dns-server-test.py.

We are working on a more robust, scaleable version in the super_duper
branch, BTW.