---
title: 'Certificate Transparency'
date: 2025-07-30
url: /s/ct
---

{{< image width="10em" float="right" src="/assets/ctlog/ctlog-logo-ipng.png" alt="ctlog logo" >}}

Certificate Transparency logs are "append-only" and publicly-auditable ledgers of certificates being
created, updated, and expired. This is the homepage for IPng Networks' Certificate Transparency
project.

Certificate Transparency [[CT](https://certificate.transparency.dev)] is a system for logging and
monitoring certificate issuance. It greatly enhances everyone’s ability to monitor and study
certificate issuance, and these capabilities have led to numerous improvements to the CA ecosystem
and Web security. As a result, it is rapidly becoming critical Internet infrastructure. Originally
developed by Google, the concept is now being adopted by many _Certification Authorities_ who log
their certificates, and professional _Monitoring_ companies who observe the certificates and
report anomalies.

IPng Networks runs our logs under the domain `ct.ipng.ch`, split into a `*.log.ct.ipng.ch` for the
write-path, and `*.mon.ct.ipng.ch` for the read-path.

We are [[tracking](https://issues.chromium.org/issues/437003344)] our logs for inclusion in the
approved log lists for Google Chrome and Apple Safari. As of Oct'25, our logs have been added
to these trusted lists and that change will propagate to people’s browsers with subsequent browser
version releases.

We operate two popular implementations of Static Certificate Transparency software.

## Sunlight

{{< image width="10em" float="right" src="/assets/ctlog/sunlight-logo.png" alt="sunlight logo" >}}

[[Sunlight](https://sunlight.dev)] was designed by Filippo Valsorda for the needs of the WebPKI
community, through the feedback of many of its members, and in particular of the Sigsum, Google
TrustFabric, and ISRG teams. It is partially based on the Go Checksum Database. Sunlight's
development was sponsored by Let's Encrypt.

Our Sunlight logs:
*    A staging log called [[Rennet](https://rennet2025h2.log.ct.ipng.ch/)], incepted 2025-07-28,
     starting from temporal shard `rennet2025h2`.
*    A production log called [[Gouda](https://gouda2025h2.log.ct.ipng.ch/)], incepted 2025-07-30,
     starting from temporal shard `gouda2025h2`.

## TesseraCT

{{< image width="10em" float="right" src="/assets/ctlog/tesseract-logo.png" alt="tesseract logo" >}}

[[TesseraCT](https://github.com/transparency-dev/tesseract)] is a Certificate Transparency (CT) log
implementation by the TrustFabric team at Google. It was built to allow log operators to run
production static-ct-api CT logs starting with temporal shards covering 2026 onwards, as the
successor to Trillian's CTFE.

Our TesseraCT logs:
*    A staging log called [[Lipase](https://lipase2025h2.log.ct.ipng.ch/)], incepted 2025-08-22,
     starting from temporal shard `lipase2025h2`.
*    A production log called [[Halloumi](https://halloumi2025h2.log.ct.ipng.ch/)], incepted 2025-08-24,
     starting from temporal shard `halloumi2025h2`.
     *   Shard `halloumi2026h2` incorporated incorrect data into its Merkle Tree at entry 4357956 and
         4552365, due to a [[TesseraCT bug](https://github.com/transparency-dev/tesseract/issues/553)]
         and was retired on 2025-09-08, to be replaced by temporal shard `halloumi2026h2a`.

We also submit them to [[github.com/geomys/ct-archive](https://github.com/geomys/ct-archive)].

## Operational Details

You can read more details about our infrastructure on:
*   **[[TesseraCT]({{< ref 2025-07-26-ctlog-1 >}})]** -  published on 2025-07-26.
*   **[[Sunlight]({{< ref 2025-08-10-ctlog-2 >}})]** -  published on 2025-08-10.
*   **[[Operations]({{< ref 2025-08-24-ctlog-3 >}})]** -  published on 2025-08-24.

The operators of this infrastructure are **Antonis Chariton**, **Jeroen Massar** and **Pim van Pelt**. \
You can reach us via e-mail at [[<ct-ops@ipng.ch>](mailto:ct-ops@ipng.ch)].

## Archived logs

Logs are archived in the [[c2sp.org/static-ct-api@v1.0.0](https://c2sp.org/static-ct-api@v1.0.0)] format,
although if they were originally served through RFC 6962 APIs, leaves might miss the LeafIndex extension.
IPng archives its static log shards at least two weeks after the _notafterlimit_, and removes the DNS
entries at least two weeks after archiving.

Our archived logs are:

*   halloumi2026h2.log.ct.ipng.ch - [[S3](https://ct.ipng.ch/archive/halloumi2026h2/)] - [[log.v3.json]](https://halloumi2026h2.mon.ct.ipng.ch/log.v3.json)]
*   halloumi2025h2.log.ct.ipng.ch - [[S3](https://ct.ipng.ch/archive/halloumi2025h2/)] - [[log.v3.json]](https://halloumi2025h2.mon.ct.ipng.ch/log.v3.json)]
*   lipase2025h2.log.ct.ipng.ch - [[S3](https://ct.ipng.ch/archive/lipase2025h2/)] - [[log.v3.json]](https://lipase2025h2.mon.ct.ipng.ch/log.v3.json)]
*   gouda2025h2.log.ct.ipng.ch - [[S3](https://ct.ipng.ch/archive/gouda2025h2/)] - [[log.v3.json]](https://gouda2025h2.mon.ct.ipng.ch/log.v3.json)]
*   rennet2025h2.log.ct.ipng.ch - [[S3](https://ct.ipng.ch/archive/rennet2025h2/)] - [[log.v3.json]](https://rennet2025h2.mon.ct.ipng.ch/log.v3.json)]

