Metadata and accepted roots for the Certificate Transparency logs SSL.com operates.
SSL.com's CT logs are powered by TesseraCT, which implements the Static CT API on the Tessera library. They run on AWS: S3 holds the tiles, RDS MySQL the sequencing state, and CloudFront serves the monitoring prefix.
Mercury logs accept only Mark Certificates (VMC and CMC) used for BIMI. They are temporally sharded by certificate expiry and are applying for inclusion in the Apple CT log program.
Apollo logs accept publicly trusted TLS certificates. They are temporally sharded by certificate expiry, in half-year shards, and are applying for inclusion in the Chrome and Apple CT log programs.
| File | Schema | Purpose |
|---|---|---|
json/sslcom-operator.json |
operator_list_schema_v1 | Lists every log below; the URL to give CT log programs |
json/mercury2026.json |
log_schema_v2 | Mercury 2026 shard |
json/mercury2027.json |
log_schema_v2 | Mercury 2027 shard |
json/mercury2028.json |
log_schema_v2 | Mercury 2028 shard |
json/apollo2027h1.json |
log_schema_v2 | Apollo 2027h1 shard |
json/apollo2027h2.json |
log_schema_v2 | Apollo 2027h2 shard |
json/apollo2028h1.json |
log_schema_v2 | Apollo 2028h1 shard |
json/apollo2028h2.json |
log_schema_v2 | Apollo 2028h2 shard |
Accepted roots per log family are in pem/ and tsv/, one certificate per file in crt/<family>/. Each log's get-roots endpoint is authoritative; these files are generated from it.
Every change goes through a pull request; CI validates it (scripts/validate.py --live --base <PR base>). Locally: pip install --require-hashes -r scripts/requirements.txt, then scripts/validate.py --live --base origin/main.
- Add a shard: add
json/<log>.json, add its raw URL tojson/sslcom-operator.json, and add a row tocrt/<family>/README.md. - Close a shard: set its
statustoreadonlyand updatestatus_timestamp; move its row to "Inactive log shards". - Roots changed: run
scripts/make_roots.py <family>once every active shard serves the new set, and commit the result.
Never change a published log's key, log_id, endpoints or temporal_interval: they are its identity, and --base fails a change to any of them.