Policy change preview (before 2028 shards)

[Hubert Chao]

Hi all,

While Chrome won't put out a call for 2028 log shards until the new year, we want to give a preview on upcoming changes to the CT log policy that will require action before 2028 log shards are accepted.

At present, adding new logs is a manual process. As certificate lifetimes shorten, we're keen to reduce the operational burden both for us and log operators. As a result, we'll be requiring log operators to adopt Apple's proposed JSON metadata to enable automated ingestion of log shards.

We'll make a follow-up announcement when the changes are finalized and live, but log operators should expect that...

• Starting November 1, 2026, logs submitted for inclusion will be required to serve an updated log-specific JSON schema. This is only a small delta from the current requirement.

• Starting February 1, 2027, log operators will be required to host an operator-specific JSON that enumerates their logs. Logs will be submitted for inclusion by updating this file rather than via the existing process in the bug tracker.

Existing log operator bugs will still exist, both as a venue for providing per-operator JSON URLs and as a communication channel between Chrome and the log operator.

Once we announce the policy change (expected in August), we'll be happy to accept per-operator JSON files at any time (preferably long before the February 1 deadline). We're currently expecting to use JSON schemas compatible with those proposed in Apple's document. If you'd like changes to those schemas, now would be a good time to propose them.

We'll follow up with a full announcement in August, but questions are always welcome,

Hubert, on behalf of the Chrome CT Team

[Filippo Valsorda]

Hello!

Sunlight already supports this JSON schema, and I'm happy to see progress in automation of log ingestion.

Our main feedback item is that we wish to submit a list of per-operator JSON URLs, instead of a single one. That will let our CT log software generate the list automatically, making this process automated on both sides.

For example, we are currently serving two per-operator JSON URLs, one for the Tuscolo log series, and one for the new Trastevere log series. The two machines are independent, and getting one to serve the other's URLs would be possible but a bit of a hack.

https://tuscolo.skylight.geomys.org/logs.json

https://trastevere.skylight.geomys.org/logs.json

Cheers,

Filippo

--

You received this message because you are subscribed to the Google Groups "Certificate Transparency Policy" group.

To unsubscribe from this group and stop receiving emails from it, send an email to ct-policy+...@chromium.org.

To view this discussion visit https://groups.google.com/a/chromium.org/d/msgid/ct-policy/CAHEiSH2QYcxABUeiV-xH38O7MCSFUPmVAVJTqmf4B1LjzCFikw%40mail.gmail.com.