Adding the label 'TE-NeedsTriageHelp' as the issue is out of TE's scope.

Is there a planned timescale in which GDCA plans to operate this log, at this IP? For example, is this something GDCA has made plans for only one year of operation, or multiple years?

I ask in light of the discussion surrounding the temporal sharding at https://groups.google.com/a/chromium.org/d/msg/ct-policy/_eXIfMf7LQQ/rt9GG3orAwAJ , which provides for clear timelines for how long a log will operate until it's rotated or gracefully shut down.

Regarding monitoring, I believe this meets sufficient criteria to begin monitoring, although we should wait for further details on policy.

Hi Ryan,

Thanks for your comment.

We read the discussion you referred, and we came up with the following planned timescale after discussion within our team:
Certificate Expiry Range: [2018-01-01 00:00:00 UTC, 2023-01-01 00:00:00 UTC)

Let me know if you have any further questions.

Thanks.

Thank you for providing more feedback. Adding requester "rsleevi@chromium.org" to the cc list and removing "Needs-Feedback" label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

The NextAction date has arrived: 2018-04-20

Hi there, I'm just setting up the monitoring for these Logs, and I notice that the email address provided is what looks to be a personal gmail address.  I also notice that the previously submitted GDCA Logs used a gdca business email address - capoc@gdca.com.cn.  I just wanted to double check that wangsn1206@gmail.com is the contact email address you'd like associated with these Logs?

Hi,thanks for your comments.I am Xiu Lei with GDCA, the reason we put an gmail address is because our corporate email ocasionally blocks e-mails from overseas previously,which has now been fixed, therefore, we would like to update our contact information as follows:

  - Log Operator: GDCA
  - Email: capoc@gdca.com.cn
  - Telephone: +86(20)83487228-864
  - Authorized Personnel: Xiu Lei


Many Thanks!

Thank you for your request, we have started monitoring your Log server.
Should no issues be detected, the initial compliance monitoring phase
will be complete on August 13th 2018 and we will update this bug
shortly after that date to confirm.

Hello Xiu Lei,

Thank you for providing your updated contact information. Could you possibly update this request using an official @gdca.com.cn email address or reach out to me via email using an official address? We just want to ensure that this request (especially the phone number change) is coming from an official GDCA representative and it's difficult to validate this from your gmail account.

Hi Devon,

Many thanks for your comment. I understand your concern, but it seems that only a Google account (which requires a gmail address in our case) can post on this platform. I will reach out to you via our official email address (capoc@gdca.com.cn) to confirm the request. Many thanks!

This log has passed the initial 90 day compliance period and we will start
the process to add this to Chrome.

The log's description states: "Open acceptance policy: This log is hosted on the AWS in the U.S, and accepts all roots that are enabled for the server authentication trust purpose in one or more of the Microsoft, Mozilla, Apple and Google root programs.  We will update this log's list of accepted roots from time to time in accordance with this policy."

However, at the present time only two roots are accepted by this log:

C=CN, O=GUANG DONG CERTIFICATE AUTHORITY CO.,LTD., CN=GDCA TrustAUTH R5 ROOT
C=GB, ST=London, O=Google UK Ltd., OU=Certificate Transparency, CN=Merge Delay Monitor Root

Could GDCA clarify what its acceptance policy is?

Hi

Many thanks for your comments.

The acceptance policy for the GDCA CT Logs remains unchanged, our team is now working to add all the trusted root certificates in NSS and in the Apple Root Certificate Program, we will update here soon. 

Thanks.

Xiu Lei
GDCA

Hi

The accepted roots are updated, and this CT Log now accepts the certificates issued by a total of 527 root certificates. Please see the attached PEM file.

Many thanks!

Xiu Lei
GDCA

Deleted: gdca-ct-trust-roots-updated.pem 1003 KB

gdca-ct-trust-roots-updated.pem 1003 KB Download

Un-incorporated SCTs from this log were found. Please see the discussion at: https://groups.google.com/a/chromium.org/forum/#!topic/ct-policy/Emh3ZaU0jqI

Per our post on the discussion of this incident[1], GDCA Log 1 will not be included as a qualified CT Log in Chrome. GDCA is welcome to apply for qualification with a new CT Log with new key material by filing a new application as described in the Chrome Log Policy and we strongly encourage pursuing the use of an actively maintained CT Log code base.

[1] https://groups.google.com/a/chromium.org/d/msg/ct-policy/Emh3ZaU0jqI/SvnygFVsBAAJ

Hi All,
 
We understand and accept your decision. We are now actively working on a Go-based CT Log, and may re-apply for inclusion in the near future.

Thank you for your time.

Xiu Lei
GDCA