2 ms·
I believe Chrome uses the underlying system trust store but also has its own list that it uses where Google wants to be stricter/do its own thing.
by vtlynch 11y ago
I believe Chrome uses the underlying system trust store but also has its own list that it uses where Google wants to be stricter/do its own thing.
- andmarios 11y agoHmm, searched a bit and it seems only on Linux Chrome doesn't respect the system certificates but relies on Mozilla's NSS store. Still, extremely annoying since NSS isn't where system certificates are stored on Linux.
- gsnedders 11y agoIt's too easy to get certs into the root store of most distros, which means they're not practically usable for secure communication. There's often no auditing of the CAs to ensure they are taking due care to minimise risk of a bogus certificate being issued. [1] To be fair, some things have improved: Debian (and maybe Ubuntu) now have the Mozilla trust store plus one additional root (SPI). That said, all you need is one bad actor for the system to fail, and it seems the only reason why SPI is there is Debian infrastructure relies on it—but that doesn't make SPI trustworthy. [2] [1]: https://plus.google.com/105761279104103278252/posts/eVdB6X3NpPg https://plus.google.com/105761279104103278252/posts/eVdB6X3N... [2]: http://anonscm.debian.org/gitweb/?p=collab-maint/ca-certificates.git;a=blob;f=debian/README.Debian http://anonscm.debian.org/gitweb/?p=collab-maint/ca-certific...