agwa 2 days ago

No. The purpose of temporal sharding is to allow log operators to reclaim storage space used for expired certificates, and to save monitors from having to sift through a huge number of expired certificates to get to the unexpired ones.

1
Eikon 2 days ago

> The purpose of temporal sharding is to allow log operators to reclaim storage space used for expired certificates

But you lose historical auditability that way, for arguably very little space reclaimed. I'd say it's not worth it if you can have an implementation that "just works.".

We are not talking about petabytes of data, the total number of certificates logged is around 18B, that's somewhere around 50TB using CompactLog, which fits on ... two hard drives these days? In the real world, that'd be way less for a single log as not every log holds every issued certificate.

agwa 2 days ago

The primary purpose of CT is to provide transparency into browser-trusted certificates. Since expired certificates are not trusted by browsers, having them in browser-trusted CT logs is purely a liability.

Those who care about expired certificates can archive shards before they are decommissioned, or operate a non-sharded log for expired certificates that isn't trusted by browsers (e.g. Google Daedalus).

Temporal sharding was designed when there were far fewer than a billion certificates and logs weren't struggling with read or write load. The need for sharding will only get greater as lifetimes are capped at 45 days.