5 ms·

Certificate Transparency (http://www.certificate-transparency.org http://www.certificate-transparency.org) is a Google initiative working on just that. It's alr

• ikeboy 11y ago
  Have any CAs publically committed to submit all their generated certs to that? Does https://pki.google.com/ https://pki.google.com/ do that?
  • geofft 11y ago
    Chrome currently requires that all extended-validation certs with an issuance date of 1/1/2015 or later be submitted to the CT logs. (Otherwise it will not show up in the UI as an EV cert.) As with all browsers, only a subset of CAs are trusted to provide EV certs in the first place, regardless of whether they include the EV bits in the certificate. And this policy only applies to EV certs, not to all certs by an EV-capable CA.
    • Caer 11y ago
      With some exceptions, at least. For example, twitter.com shows up as an EV green bar while my browser tells me there's no CT information available. The CT website mentions a list of exceptions would be generated but I haven't been able to find any public list, and there's been no update to their rollout plans in over 7 months[1]. Oddly enough I noticed the other day that certificate-transparency.org isn't even accessible over https. [1] http://www.certificate-transparency.org/ev-ct-plan http://www.certificate-transparency.org/ev-ct-plan
      • geofft 11y ago
        The twitter.com cert I see in my browser was issued on 9 September 2014, which is before the 1 January 2015 threshold. (Eventually this should go away because a compromised CA key can obviously just lie about the time, but this is just a migration step.)
        • Caer 11y ago
          You're right, I missed that at the top of the doc. I assumed all of the details would be in the numbered list.