3 ms·
Interestingly, Chrome does seem to be accepting the affected certificates based on some limited testing. I'm not sure why that would be, though. Chrome certain
by mcpherrinm 3y ago
Interestingly, Chrome does seem to be accepting the affected certificates based on some limited testing. I'm not sure why that would be, though. Chrome certainly requires SCTs to be present, but perhaps isn't (always?) checking the SCTs signatures over the certificates. Once we've wrapped this incident up, I'll have to follow up on that.
Safari does seem to be rejecting them as expected.
- agwa 3y agoI picked 10 affected sites at random, and Chrome correctly rejected every one with ERR_CERTIFICATE_TRANSPARENCY_REQUIRED. If Chrome isn't validating SCT signatures, that's a serious bug that would enable bypass of CT enforcement, so I'm sure the Chrome team would want to hear more about what you've seen.
- mcpherrinm 3y agoIt turns out my test was invalid: I had launched a VM to test, which turns out had an old Chromium installed (via the system package manager, so not self-updating). Chromium disables CT checking if it doesn't have an updated list of CT logs (either by component-updater or updating chrome itself). I see ERR_CERTIFICATE_TRANSPARENCY_REQUIRED after updating.