IPng Networks

Certificate Transparency

ctlog logo

Certificate Transparency logs are “append-only” and publicly-auditable ledgers of certificates being created, updated, and expired. This is the homepage for IPng Networks’ Certificate Transparency project.

Certificate Transparency [CT] is a system for logging and monitoring certificate issuance. It greatly enhances everyone’s ability to monitor and study certificate issuance, and these capabilities have led to numerous improvements to the CA ecosystem and Web security. As a result, it is rapidly becoming critical Internet infrastructure. Originally developed by Google, the concept is now being adopted by many Certification Authorities who log their certificates, and professional Monitoring companies who observe the certificates and report anomalies.

IPng Networks runs our logs under the domain ct.ipng.ch, split into a *.log.ct.ipng.ch for the write-path, and *.mon.ct.ipng.ch for the read-path.

We are [tracking] our logs for inclusion in the approved log lists for Google Chrome and Apple Safari. As of Oct'25, our logs have been added to these trusted lists and that change will propagate to people’s browsers with subsequent browser version releases.

We operate two popular implementations of Static Certificate Transparency software.

Sunlight

sunlight logo

[Sunlight] was designed by Filippo Valsorda for the needs of the WebPKI community, through the feedback of many of its members, and in particular of the Sigsum, Google TrustFabric, and ISRG teams. It is partially based on the Go Checksum Database. Sunlight’s development was sponsored by Let’s Encrypt.

Our Sunlight logs:

  • A staging log called [Rennet], incepted 2025-07-28, starting from temporal shard rennet2025h2.
  • A production log called [Gouda], incepted 2025-07-30, starting from temporal shard gouda2025h2.

TesseraCT

tesseract logo

[TesseraCT] is a Certificate Transparency (CT) log implementation by the TrustFabric team at Google. It was built to allow log operators to run production static-ct-api CT logs starting with temporal shards covering 2026 onwards, as the successor to Trillian’s CTFE.

Our TesseraCT logs:

  • A staging log called [Lipase], incepted 2025-08-22, starting from temporal shard lipase2025h2.
  • A production log called [Halloumi], incepted 2025-08-24, starting from temporal shard halloumi2025h2.

We also submit them to [github.com/geomys/ct-archive].

Operational Details

You can read more details about our infrastructure on:

We publish an [Operator List]. The operators of this infrastructure are Antonis Chariton, Jeroen Massar and Pim van Pelt. You can reach us via e-mail at [ct-ops@ipng.ch].

Archived logs

Logs are archived in the [c2sp.org/static-ct-api@v1.0.0] format, although if they were originally served through RFC 6962 APIs, leaves might miss the LeafIndex extension. IPng archives its static log shards at least two weeks after the notafterlimit, and removes the DNS entries at least two weeks after archiving.

We serve our archived logs from both S3 as well as [ct-archive-serve]:

Witnesses

As a courtesy to the Transparency Developer ecosystem, IPng Networks additionally provides a set of Transparency Log Witnesses, running [Omniwitness].

Our witnesses are:

We monitor these witnesses at [juf.ct.ipng.ch], but operate them on a best-effort basis. Each witness has a support-horizon that is at least three years into the future, and commitments are updated on a yearly basis. End-to-end observability is work in progress and is planned to be ready in time for our production witness.

Our names are taken from Dutch: kladje means a scrap of paper, krabbel is the word for a scribble, and paraaf is a formal set of initials. Your juf is a (elementary school) teacher who checks your work. The names follow the witnesses from scratch work, through an informal signature, to an official sign-off including their observability.