3 ms·
But what about Chromium and Mozilla?
by cm2187 6y ago
But what about Chromium and Mozilla?
- lvh 6y agoGenerally speaking locally installed certs have been exempted from most of the requirements levied on public certificates.
- tialaramex 6y agoif (verify_result->is_issued_by_known_root && HasTooLongValidity(*cert)) { verify_result->cert_status |= CERT_STATUS_VALIDITY_TOO_LONG; Chromium's code (linked as the story) only applies these rules to certificates from the Web PKI, not to a private CA. Mozilla has no checks, I presume the story title names them because they've agreed on this policy but they don't actually enforce policy in the browser code itself. Or at least they didn't when I asked them months ago about this topic.
- GordonS 6y ago> verify_result->is_issued_by_known_root Let's take Windows as an example, as it has a root certificate store. Now, if I operate a private CA, I install my private root certificate to the root certificate store - does that make it a "known_root" for Chromium, or does this check only cover a specific set of known-to-Chromium CAs?