3 ms·

I picked 10 affected sites at random, and Chrome correctly rejected every one with ERR_CERTIFICATE_TRANSPARENCY_REQUIRED. If Chrome isn't validating SCT signat

by agwa 3y ago

I picked 10 affected sites at random, and Chrome correctly rejected every one with ERR_CERTIFICATE_TRANSPARENCY_REQUIRED. If Chrome isn't validating SCT signatures, that's a serious bug that would enable bypass of CT enforcement, so I'm sure the Chrome team would want to hear more about what you've seen.

mcpherrinm 3y ago
It turns out my test was invalid: I had launched a VM to test, which turns out had an old Chromium installed (via the system package manager, so not self-updating). Chromium disables CT checking if it doesn't have an updated list of CT logs (either by component-updater or updating chrome itself). I see ERR_CERTIFICATE_TRANSPARENCY_REQUIRED after updating.