2 ms·
Yes but how does your browser trust it? it has to check the cert log. who has the server for the cert log. for chrome this is google. Did you reach a different
by somat 3y ago
Yes but how does your browser trust it? it has to check the cert log. who has the server for the cert log. for chrome this is google. Did you reach a different conclusion from the big table in the wikipeda page where it requires "1 SCT from a google log" ?
- aaomidi 3y ago> Did you reach a different conclusion from the big table in the wikipeda page where it requires "1 SCT from a google log" ? I've worked at both Let's Encrypt and Google Trust Services. CT is something I'm intimately familiar with. > it has to check the cert log. No, it does not. > Yes but how does your browser trust it? Your browser ships with a log list: https://source.chromium.org/chromium/chromium/src/+/main:components/certificate_transparency/data/log_list.json https://source.chromium.org/chromium/chromium/src/+/main:com... The public key of the log is included there. It's checked to see if the SCT is signed with the correct public key.
- charcircuit 3y agoChrome hasn't required "1 SCT from a google log" since April 15th 2022