OCSP and CRLs both work based on specific serial numbers. Serial numbers are not really sequential either (a portion of it has to be random). The closest thing

OCSP and CRLs both work based on specific serial numbers. Serial numbers are not really sequential either (a portion of it has to be random). The closest thing to what you're describing would be the Expect-CT HTTP header[1] which can be used by site operators to instruct browsers to always expect a CT-logged certificate from the site (or more specifically, to expect qualified SCTs to be provided for the site's certificate). I believe this feature is planned for Chrome 58 if I'm reading the ticket correctly[2]. Presumably, this will be available as a preloaded flag for domains at some point as well (like HSTS preloading). [1]: https://tools.ietf.org/html/draft-stark-expect-ct-01 https://tools.ietf.org/html/draft-stark-expect-ct-01 [2]: https://bugs.chromium.org/p/chromium/issues/detail?id=679012 https://bugs.chromium.org/p/chromium/issues/detail?id=679012