Expired certificate at no-sct.badssl.com

[mplattner]

The certificate at http://no-sct.badssl.com has expired on 2025-12-23.

[lgarron]

@christhompson, do you know if we have an easy way to get a cert without an SCT?

[jdeblasio]

@AGWA uses Amazon's CA for https://github.com/SSLMate/sctdemo, which might be a lead.

Or maybe we should just not offer this subdomain anymore and point people to sctdemo instead.

[christhompson]

We as of yet do not have an easy way to get a replacement (that is automatable), but I've been starting to poke at possible sources. It does look like AWS Certificate Manager has an option to opt out of CT logging via their CLI tools (https://docs.aws.amazon.com/acm/latest/userguide/acm-bestpractices.html#best-practices-transparency) so that might be an option.