TrustAsia MTC implementation update: public interoperability test site and ACME staging environment

[zoey.wang]

Dear MTCS builders, implementers, and the AIs helping along the way,

We are the TrustAsia MTC team. We have been working on an implementation of Merkle Tree Certificates based on `draft-ietf-plants-merkle-tree-certs-05`, and would like to share our current progress with the community.

We have completed a full implementation of `draft-ietf-plants-merkle-tree-certs-05` and deployed a publicly accessible MTC interoperability testing environment:

https://mtcdemo.trustasia.cn/

The site runs a TLS 1.3 server implementing the X.509 Certificate Representation defined in `draft-ietf-plants-merkle-tree-certs-05`, along with the `trust_anchors` extension in ClientHello. The server is configured with three credential types for the same identity and dynamically negotiates and selects the certificate type based on the `trust_anchors(0xca34)` extension sent by the client:

Landmark-Relative Certificates: If the client's declared trust anchor matches the server's advertised landmark range, the server sends a certificate containing an MTCProof relative to that landmark. In live testing, this certificate is approximately 550 bytes (PEM) / 390 bytes (DER).

Standalone Certificates: If the client declares a Log ID anchor, the server sends a standalone MTC certificate containing Cosignatures for independent verification. In live testing, this is approximately 7 KB (PEM).

Traditional X.509 Certificates: If the client does not include a `trust_anchors` extension, the server falls back to a traditional X.509 certificate chain (~7.2 KB PEM, 3 certificates). Existing clients such as browsers work without any modification.

In other words, MTC-capable clients can receive certificates orders of magnitude smaller than traditional certificate chains, while non-MTC clients experience no disruption. This is exactly the gradual deployment profile MTC is designed to achieve.

The demo page itself operates on top of the negotiation result. Upon loading, it displays the certificate path used in the current connection and provides a full parse of the client's ClientHello — including a highlight of the `trust_anchors` extension if present, to assist with debugging and interop issue identification.

Test MTC CA, OIDs, and Automated Issuance

Behind the demo, we have deployed a complete test CA infrastructure under the TrustAsia PEN `1.3.6.1.4.1.44494`, including:

A 7-day validity CA, for certificates in the revocation-exempt category;

A 47-day validity CA, for certificates under the CQRP-based revocation mechanism;

Each CA paired with an Issuance Log;

One Mirror Cosigner providing Cosigning support.

To facilitate interoperability implementation and configuration, we are publishing the cosigner identifiers used in this test environment:

CA Cosigners

cosigner_id: 44494.3.1.1 — for 7-day certificates

cosigner_id: 44494.3.1.2 — for 47-day certificates

Mirror Cosigner

cosigner_id: 44494.3.2.1

MTC certificates on the demo server are automatically issued from this test CA  environment via ACME. The current test ACME directory endpoint is:

https://acme.mtc-staging.trustasia.com/acme/v2/directory

The issuance pipeline is integrated with the demo server's scheduled task and renews and deploys certificates automatically on a daily basis.

Note: Domain Control Validation (DCV) in the current test environment satisfies only the basic requirements of the ACME flow and does not follow the production-level domain validation requirements specified in the CA/Browser Forum Baseline Requirements. This environment is intended solely for MTC mechanism validation and interoperability testing reference, and carries no production trust.

Invitation for Interoperability Testing

All of the above is a test environment with no production trust implications. If you are implementing an MTC client, we welcome you to use this demo site for interoperability testing. To test MTC certificate issuance via ACME, you may use the staging directory above; please feel free to contact us if you need access or to coordinate testing.

We also very much welcome feedback and discussion on negotiation behavior, encoding, or any discrepancies with your understanding of the draft.

Best regards, 

TrustAsia MTC Team