Introducing GoDaddy Static CT Logs: Peridot and Aquamarine
Lee Sautia
Hi everyone,
We're excited to announce two new Static Certificate Transparency logs operated by GoDaddy, built on the Sunlight implementation.
Staging logs (Peridot):
- https://ct-log-api.ote-godaddy.com/peridot2026h2
- https://ct-log-api.ote-godaddy.com/peridot2027h1
- https://ct-log-api.ote-godaddy.com/peridot2027h2
Production logs (Aquamarine):
- https://ct-log-api.godaddy.com/aquamarine2026h2
- https://ct-log-api.godaddy.com/aquamarine2027h1
- https://ct-log-api.godaddy.com/aquamarine2027h2
Both logs accept all publicly trusted WebPKI roots (all roots in the Google, Apple, and Mozilla root programs).
Peridot is our staging environment — it currently accepts testing roots, and we're happy to add more. We'd welcome monitors and CAs to test against it and share any feedback.
Aquamarine is our production log, which we intend to submit for inclusion in the approved log lists for Google and Apple following validation of Peridot. We are internally targeting 99.9% uptime.
We plan to submit both logs for inclusion once initial testing is complete. Please note that GoDaddy is already submitting all newly issued certificates to the production log (Aquamarine). Feedback is very welcome — feel free to reach out at ct...@godaddy.com or find us on the Transparency Dev Slack.
Best,
Lee Sautia
GoDaddy
Filippo Valsorda
Lee Sautia
Thanks, and thanks for Sunlight.
We are running Sunlight with the S3-compatible object storage backend. We are intentionally keeping the rest of the deployment architecture fairly minimal in public discussion: the logs sit behind standard HTTP serving infrastructure with independent monitoring and operational alerting on our side.
We do not currently plan to publish a home page or Prometheus metrics externally. We agree those can be useful for ecosystem visibility, but for now we are limiting public exposure to the CT API endpoints and the information required for log monitoring and CT program participation.
If we see operational issues that affect availability, correctness, latency, or MMD commitments, we will report those through the usual CT community/program channels.
Best,
Lee Sautia
Lee Sautia
Hi everyone,
Following up on our earlier announcement of GoDaddy Static CT logs, we're also making available Verified Mark Certificate (VMC) specific Static CT logs built on the Sunlight implementation.
Staging VMC logs (Emerald):
- https://ct-log-api-vmark.ote-godaddy.com/emerald2026h2/
- https://ct-log-api-vmark.ote-godaddy.com/emerald2027h1/
- https://ct-log-api-vmark.ote-godaddy.com/emerald2027h2/
Production VMC logs (Garnet):
- https://ct-log-api-vmark.godaddy.com/garnet2026h2/
- https://ct-log-api-vmark.godaddy.com/garnet2027h1/
- https://ct-log-api-vmark.godaddy.com/garnet2027h2/
These logs are for Verified Mark Certificates, not TLS server authentication certificates. They require the VMC EKU:
1.3.6.1.5.5.7.3.31
At minimum we will accept all BIMI approved roots:
https://bimigroup.org/vmc-issuers/
Emerald is our staging environment. Garnet is our production VMC log set. The logs use 60-second MMDs and are temporally sharded across 2026h2, 2027h1, and 2027h2.
Please note that these are mark-certificate-only logs. They reject ordinary TLS certificates, submissions without the VMC EKU, certificates outside the configured shard interval, and chains outside the accepted mark root set.
Best,
Lee Sautia | GoDaddy
r...@sectigo.com
Andrew Ayer
"'r...@sectigo.com' via certificate-transparency"
> > We'd welcome monitors and CAs to test against it and share any
> > feedback.
>
> To enable that testing, are you able to share the public keys for
> each of the Peridot, Aquamarine, Emerald, and Garnet logs?
e.g. https://ct-log-api-vmark.ote-godaddy.com/emerald2026h2/log.v3.json