3 ms·

That probably only works if the root cert is mandated in all OEM installs... And still you probably won't find any Linux distros with this support. Note. ince

by jopsen 9y ago

That probably only works if the root cert is mandated in all OEM installs... And still you probably won't find any Linux distros with this support. Note. incepting all traffic sounds expensive and very dangerous, ie. risk or leaking grows when you scale. It's probably better to only use it for select users. Curious, why future versions of chrome would not force CT for official TLDs?

pfg 9y ago
> Curious, why future versions of chrome would not force CT for official TLDs? This would cause all corporate MitM proxies to fail. Certificates generated by these devices cannot be logged to the CT log servers accepted by browsers (they only accept certificates chaining back to a trusted root). Local roots were exempt from HPKP pins as well, so this is just keeping with existing policy.