4 ms·
Certificate transparency doesn’t prevent cert backdating, because certs can be included in logs long after they’re issued. It would be possible to require cert
by mcpherrinm 4y ago
Certificate transparency doesn’t prevent cert backdating, because certs can be included in logs long after they’re issued.
It would be possible to require certs be included in logs before some cutoff time but no browsers do that today.
It does provide a mechanism that cert backdating can be detected, if new never before seen certs keep showing up from a partially distrusted CA.
- jefftk 4y agoYour last paragraph seems pretty key to me.