Hmm, this log seems to periodically return spurious 400s with the message

{ "error_message": "unknown root", "success": false }

to the add-chain endpoint, but resubmitting (sometimes) works fine. If the log is load balanced, are the set of trusted roots the same on all backends?

luk:
    thanks for your reminder, we have fixed the problem.

Getting it in the right queue, although I have not reviewed the application yet.

The ability to remove, for any reason, raises some concerns with respect to operating in the public interest. This creates substantial uncertainty as to whether or not the WoSign log may represent a reliable log for being used.

Have you considered adopting a policy similar to other logs, such as in  Issue 703699  ?

Our desire is to see that each added log provides substantial value to the community, through its demonstration of being operated in the public interest. We think it's a positive improvement to see more logs offering free inclusion, but are wanting to understand more the reasons for requiring contacting and the risk of removal.

An alternative policy that may better demonstrate this public interest is:
- Including the set of roots trusted for server authentication within the respective community root programs (relevant for Chrome, this includes that of Microsoft, Mozilla, Apple, and Google [ChromeOS and Android]) in the initial set
- Rate limiting, either by IP address or by overall CA (or intermediate), with descriptions of those limits
- Clearer policies around removal, such as anticipated reasons, durations of removal, etc

Policy Update:

 
  - Open acceptance policy: This log accepts all roots that are enabled for the server authentication trust purpose in one or more of the Microsoft, Mozilla and Apple root programs. We will update this log's list of accepted roots from time to time in accordance with this policy. 

  - Free: There is no cost to CAs for having a root accepted by this log.  There is also no cost for submitting certificates/precertificates to this log.  There are no contracts to sign at present, but we reserve the right to require contracts in the future.

  - Rate limits: Submissions are rate-limited by IP address.  Upon request, WoSign will consider raising a submitter's rate limit, but WoSign reserves the right to decline such requests (if WoSign does not believe there is sufficient spare capacity) or to charge for this service in the future.

  - Reasonable Commercial Efforts: WoSign expects to be able to accept submissions for newly issued certificates, but WoSign asks that submitters refrain from submitting (to this log) large numbers of certificates that were not recently issued. WoSign reserves the right to remove (temporarily or permanently) any root from this log's list of accepted roots, without prior notice, if WoSign is unable to cope with the rate of submissions associated with that root.

  - Disclaimer: WoSign's CT Log is provided "AS-IS".  The log is an aggregate of information from WoSign and third parties not under WoSign's control and, therefore, WoSign does not guarantee accuracy of information from third party sources or contributors.  Further, WoSign does not guarantee the performance or availability to any end users of the log, whether to certification authorities or other submitters or to any parties or individuals desiring to read the status or the content of the log.  We reserve the right to update this log policy from time to time.

 

Thanks. Assigning to begin monitoring for inclusion.

Thank you for your request, we will start monitoring your log server tomorrow. Should no issues be detected, the initial compliance monitoring phase will be complete on 9th October 2017 and we will update this bug shortly after that date to confirm.

Due to our company had changed company English name to “WoTrus CA Limited”(https://www.wosign.com/english/News/English_name_change_to_WoTrus_2017.htm), so we plan to stop this CT Log server(ctlog2.wosign.com) and re-apply a new one: ctlog.wotrus.com. Could you stop monitor this log and we should reapply with an new domain name.

Please note that we will stop this log in SEP 07， 2017. 

Noted, I'll terminate the compliance monitoring.

Please ensure you notify ct-policy@chromium.org about this change.

As this change does not seem to be for technical reasons, I think it will raise questions as to whether future WoTrus logs will be operating in the public interest and acceptable for inclusion.

The NextAction date has arrived: 2017-09-07