Certificate Transparency: Running Static CT Logs#
ZANOG@iWeek 2026 digest Program Core pick 21–23 April 2026
Pim van Pelt - IPng Networks
- Why: CT is the audit layer that makes misissued TLS certificates detectable — core trust/identity infrastructure, and this is a rare operational talk about running it. The PM gets both an architecture update (the new Static-CT log design) and a production postmortem-style account from a small operator doing ecosystem-critical work.
- What: The hands-on experience of IPng Networks operating four production CT logs (Rennet, Lipase, Gouda, Halloumi) using Sunlight and TesseraCT — two open-source implementations of the Static CT protocol — covering technical setup, operational lessons learned, and the role of community-run logs in Internet security (from abstract only).
- How: Static-CT logs replace the classic RFC 6962 continuously-updating Merkle log with a pre-populated, shardable, statically-servable structure; the talk walks deploying the two open-source implementations and the ongoing operational burden of keeping production logs healthy.
- Where applicable: Broadly applicable to anyone operating or auditing certificate-trust infrastructure; both implementations are open source, and the story proves a small community operator can run production-grade trust infrastructure — not a hyperscaler-only or org-specific result.