3 ms·
There is a major distinction between root store policy and CT policy which you are missing. Root store policy contains requirements which are enforced by audit
by agwa 3y ago
There is a major distinction between root store policy and CT policy which you are missing.
Root store policy contains requirements which are enforced by audits, and if a CA violates the root store policy it is considered misissuance requiring them to revoke the offending certificates and file an incident report. Neither Chrome nor Apple root store policies require CT.
CT policy describes what CAs must do for their certificates to be accepted by the certificate validation code. CT policy is enforced entirely by code. It is not an incident if a CA doesn't comply with CT policy; it just means their certificates won't be accepted.