With the recent addition of SCTs [1] in Let’s Encrypt certificates I noted something: The final certificates no longer get logged to Certificate Transparency. Background: When using SCTs embedded in certs Let’s Encrypt first issues a so-called pre-certificate that gets submitted to logs and then th…

I was wondering the same thing. I ask that question there two days ago: https://security.stackexchange.com/questions/182641/certificate-transparency-should-the-certificate-be-submitted-to-ct-logs-if-the/182652 My feeling is that it’s better to log the final certificate too, even if the pre-certifi…

This is also discussed a little bit at [image] How to revoke a cert I did not issue Help H…

Thanks @hannob (and welcome to the forum)! I’m convinced. We’ll pull in https://github.com/letsencrypt/boulder/issues/3605 into our next sprint.

Will Let’s Encrypt also be retrospectively logging the certificates issued in the interim before 3605 is fixed?

Probably! Though rather than deploying temporary code in Boulder, we most likely would write a script that can run in a non-trusted zone, pulling the logged precerts from CT logs, fetching the final certificates by serial number from the ACME API, and logging those final certificates to CT. If that’…

I could do that. I was unaware it was possible to fetch an already-issued cert from an ACME server without authentication, though in retrospect it makes complete sense. Does the https://acme-v02.api.letsencrypt.org/acme/cert/:serial: endpoint have any ratelimits associated with it? How much can I h…

[image] acohn: Does the https://acme-v02.api.letsencrypt.org/acme/cert/:serial: endpoint have any ratelimits associated with it? How much can I hammer on it without affecting other Let’s Encrypt users? You should be pretty safe up to 50 rps. [image] acohn: (Also, just checking: it’s poss…

Update on this: We enabled logging of final certificates, but the load seemed to be causing availability issues for some of our logs, so we disabled it again. We’ll consider on Monday what our strategy will be for possibly turning it back on again.

I’m not sure there’s a logical strategy save for migration to logs that can handle the load. The protocol doesn’t presently provide for declining to accept a new certificate entry which chains to an included root. For obvious reasons. If you’re not logging the final certificates, it must be presu…

[image] mdhardeman: Are there enough sufficiently performant logs running that accept LE certificates that will not buckle under the load? If not, this surfaces significant questions about the feasibility of Certificate Transparency moving forward. It raises questions, but it's not necessari…

Non-logging of final certificates

Issuance Policy

schoen April 2, 2018, 3:29pm 3

This is also discussed a little bit at

Topic		Replies	Views
CTLogs List used by Let's Encrypt Issuance Policy	15	574	August 30, 2024
Certificate Transparency Logs Problem Server	15	6149	April 12, 2016
Which CTL did lets encrypt use Issuance Policy	5	1626	September 30, 2019
Different Timestamps from different Log servers Issuance Tech	1	673	April 18, 2020
Not being accepted by all CTL servers Issuance Policy	12	1445	September 28, 2019

Non-logging of final certificates

Related topics