5 ms·

For the same reason they don't use the CRL, it very hard and expensive to scale, and in any case what to do if you cannot access the CRL/transparency log? An en

by brohee 4y ago

For the same reason they don't use the CRL, it very hard and expensive to scale, and in any case what to do if you cannot access the CRL/transparency log? An entity in position to intercept can simulate an outage as well..

nickf 4y ago
That's not quite how CT works. The client doesn't (currently) need to have any access to the CT logs themselves. Generally, a 'pre' certificate is submitted to a number of logs by the CA. The log returns a signed timestamp. These SCTs (signed certificate timestamps) are embedded in the final certificate provided to the subscriber - and the browser can verify those. (The SCTs can also be stapled, and not signed into the certificate itself).
- brohee 4y ago
  Without access to the CT log, the browser can only check the SCT signature, which offers about the same security level as the certificate itself.
  - nickf 4y ago
    Again, that's really not how it works.