Google's RFC 6962 logs stop accepting certificates on 12 November.

What changes on 12 November

On 6 November Google announced that its four production RFC 6962 logs — Argon 2026h2, Argon 2027h1, Xenon 2026h2 and Xenon 2027h1 — stop accepting writes from Thursday, 12 November. Its test logs Solera 2026h2, Solera 2027h1, Testtube and Crucible stop on the same day; Daedalus and Submariner were already read-only because nobody wrote to them.

“Our RFC6962 logs are now requiring an increasing level of manual intervention to keep up with growing traffic.”

— Google, ct-policy, 6 November 2026

Once the four logs are ReadOnly in both Chrome's and Apple's log lists, and after a grace period, Google will archive them and then bring them down. The announcement gives no date for either step.

Certificates that already carry an SCT from Argon or Xenon are not affected. In Chrome a ReadOnly log is “functionally equivalent” to a Usable one “in terms of SCTs from such logs contributing towards CT compliance” (Chrome's log lifecycle). What stops is new SCTs: from 12 November a CA can no longer get one from these logs.

Google's replacements are its static-ct-api logs, ParcelYard and PlumbersArms. They have been Usable in Chrome since 31 August; in Apple's list the 2027 shards are Qualified, and Google hopes to see them Usable in the first quarter of 2027. Until then, in Google's words, “there will not be any Google log USABLE in both log lists”.

Why now

The announcement caps a week in which both browser CT programs moved away from RFC 6962, the original CT protocol, towards the static-ct-api, which serves a log as static tiles that are cheap to cache and to read.

• 2026-08-31 Google's static-ct-api logs ParcelYard and PlumbersArms become Usable in Chrome. — Chrome log list
• 2026-09-16 Their 2027h1 and 2027h2 shards become Qualified in Apple's list. — Apple log list
• 2026-10-30 Chrome: from 1 January 2027 no new RFC 6962 logs are accepted, replacement shards included; from 1 November RFC 6962 logs may reject final certificates and only have to accept precertificates. — ct-policy
• 2026-11-05 Apple publishes CT Policy 1.1, which drops the rule that “at least one SCT must be issued from a log compliant with RFC 6962”. After it, no browser CT policy requires an RFC 6962 SCT. — Apple
• 2026-11-06 Google announces the turn-down of its RFC 6962 logs. — ct-policy
• 2026-11-12 Argon and Xenon stop accepting new entries. — ct-policy
• 2027-01-01 Chrome stops accepting new RFC 6962 logs, and static-ct-api logs must let a single well-behaved client read at least 1.5 times as fast as the log grows. — ct-policy

Who still runs RFC 6962 logs

Usable logs per operator in the two log lists that browsers enforce (Chrome list version 96.2 (2026-11-05), Apple list version 525). After 12 November, Google's four RFC 6962 logs stay in these lists until they are marked ReadOnly, but they no longer issue SCTs.

Without Google, RFC 6962 SCTs come from four operators: Cloudflare, DigiCert, Sectigo and TrustAsia.

Who depends on Argon and Xenon

We ingest every log in both lists. For this table we took the 20,063,352 precertificates first seen in CT on 6 November 2026 (UTC) and, for a uniform 1% sample of them (200,704 precertificates, picked by a hash of the serial number), looked up every log each one went to. The precertificate counts are exact; the shares come from the sample. A CA asks for an SCT by submitting the precertificate, so a precertificate in Argon or Xenon is issuance that, from 12 November, has to get that SCT from another log. The issuer is the organization in the issuing CA's subject.

Issuers with at least 20,000 precertificates that day; the total covers all issuers. A CA may log a precertificate to more logs than it embeds SCTs from, so the shares are an upper bound on the SCTs that have to move.

49.5% of the day's precertificates went to Argon or Xenon. 7 of the 12 largest issuers logged practically every precertificate there: Amazon, GoDaddy, DigiCert, Microsoft, SSL.com, IdenTrust and TrustAsia. From 12 November each of them has to send those submissions to other logs.

Issuers that spread their precertificates across operators lose only part of their pool: Let's Encrypt, the largest issuer, sent 30.5% of its precertificates to Argon or Xenon and none to Google's static-ct-api logs. Google's own CA, Google Trust Services, already sent every one of its precertificates to ParcelYard and PlumbersArms.

Only 0.1% of the day's precertificates went to no RFC 6962 log at all. Apple's policy had required an RFC 6962 SCT until the day before, and the logging habits it shaped were still in place.

The same sample by log: the share of all precertificate entries each log received.

What it means

For CAs: from 12 November a submission to Argon or Xenon gets no SCT. The SCTs have to come from other logs; Chrome's policy still asks for embedded SCTs from at least two log operators. Google notes that until its static-ct-api logs are promoted in Apple's list, none of its logs is Usable in both lists.

For monitors: Google asks monitors to keep reading Argon and Xenon while they accept writes, and says its static-ct-api logs cannot yet replace reading them; reading the static-ct-api logs is what it aims for in 2027. After 12 November the RFC 6962 logs stop growing and stay readable until they are archived.

For site owners: nothing to do. Certificates already issued keep their SCTs, and new ones get theirs from other logs.

ctlogs.dev reads all of these logs, RFC 6962 and static-ct-api alike; coverage and sync status for each is on the monitored logs page.

Sources

• Deprecation of Google's RFC6962 Logs, ct-policy, 6 November 2026
• Changes to Chrome's CT Policy, ct-policy, 30 October 2026, and the Chrome CT log policy
• Apple CT Policy 1.1 and CT Log Program 1.1, ct-policy, 6 November 2026; the documents
• Google on reading Argon and Xenon, ct-policy, 3 November 2026
• Certificate Transparency log lifecycle (Chrome)
• Log lists: Chrome, Apple

Published 7 November 2026 by ctlogs.dev. Data as of 2026-11-07: precertificates first seen on 2026-11-06 UTC in every log we ingest; log shares from a 1% sample.