Google Certificate Logs Unavoidable
. I had problems with roflfaucet.com ssl cert (it had expired) and I was looking at the cert in the browser, and I noticed this: Embedded SCTs Log Name Google ‘Argon2026h1’ log Log ID 0E:57:94:BC:F3:AE:A9:3E:33:1B:2C:99:07:B3:F7:90:DF:9B:C2:3D:71:32:25:DD:21:A9:25:AC:61:C5:4E:21 Signature Algorithm SHA-256 ECDSA How can I get rid of google ?
Certificate Transparency (CT) and SCTs
What you’re seeing is an embedded SCT (Signed Certificate Timestamp) — proof that your certificate was logged in a public Certificate Transparency log. This is required by Chrome (and others) for a cert to be trusted. The CA submits your cert to logs automatically when issuing it.
You don’t control which logs the CA uses. Your CA (likely Let’s Encrypt, given the faucet context) decides which CT logs to submit to.
Options to Reduce/Eliminate Google Log Involvement
| Option | Practical? | Notes |
|---|---|---|
| Ask CA to avoid Google logs | Very limited | CAs choose logs; Let’s Encrypt uses Google + non-Google logs |
| Switch to a CA that uses non-Google logs only | Possible but risky | Chrome’s policy requires at least one SCT from a Google-operated log for certs issued to the public |
| Use a non-publicly-trusted cert (self-signed + custom CA) | Yes, if controlled audience | Completely avoids CT, but visitors must manually trust your CA |
| Use a private PKI | Yes, for internal use | Same as above |
The Hard Constraint
Google’s Chrome CT policy explicitly requires at least one SCT from a Google-operated log for a certificate to pass CT compliance in Chrome. So for a public website like roflfaucet.com, you cannot fully remove Google from the picture without breaking Chrome trust.
The embedded SCT is not tracking — it’s a cryptographic promise that your cert was publicly logged before issuance (anti-fraud mechanism). Google sees the cert, not your traffic.
If your goal is reducing Google’s ecosystem footprint on infrastructure you control, the SCTs in a publicly-trusted cert are unfortunately not something you can opt out of today. The most realistic move would be a private CA if your user base is small/controlled enough to install a custom root cert.