4 ms·

I don't believe it's supposed to proactively check the logs as that would inevitably break in the presence of properly configured MITM middleboxes which are pre

I don't believe it's supposed to proactively check the logs as that would inevitably break in the presence of properly configured MITM middleboxes which are present on many (most?) corporate networks. The point of the logs as I understand it is to surface events involving official CAs after the fact.

l2dy 7mo ago
Clients are supposed to check. For example, Apple requires a varying number of SCTs in order for Safari to trust server certificates. https://support.apple.com/en-us/103214 https://support.apple.com/en-us/103214 And yes, it does break MITM use cases, for example on Chrome: https://httptoolkit.com/blog/chrome-android-certificate-transparency/ https://httptoolkit.com/blog/chrome-android-certificate-tran...
- fc417fc802 7mo ago
  So how does that work with middleboxes? Corporate isn't about to forgo egress security (nor should they). I don't currently MITM my LAN but my general attitude is that if something won't accept my own root certificate from the store then it's broken, disrespecting my rights, and I want nothing to do with it. Trust decisions are up to me, not some third party.
  - Gigachad 7mo ago
    Corporate managed machines can control the software running on the computer to do anything. I'm not sure the details, but chrome certainly can support corporate MITM. There's likely some setting you have to configure first. The default should be to reject certificates which aren't being logged, and if you as a user or corporation have a reason to use private certificates, you just configure your computer to do that. Which fully protects against the risk of normal CAs signing fraudulent certificates.
Melatonic 7mo ago
Corporate machines would have the proper certs pushed to them for the MITM box to work though - would that affect this ?
- fc417fc802 7mo ago
  The entire point of transparency logs is to detect a cert issued by a different root CA despite both being trusted. The corporate MITM cert won't be present in the logs by design.

l2dy 7mo ago

Clients are supposed to check. For example, Apple requires a varying number of SCTs in order for Safari to trust server certificates. https://support.apple.com/en-us/103214 https://support.apple.com/en-us/103214 And yes, it does break MITM use cases, for example on Chrome: https://httptoolkit.com/blog/chrome-android-certificate-transparency/ https://httptoolkit.com/blog/chrome-android-certificate-tran...

fc417fc802 7mo ago
So how does that work with middleboxes? Corporate isn't about to forgo egress security (nor should they). I don't currently MITM my LAN but my general attitude is that if something won't accept my own root certificate from the store then it's broken, disrespecting my rights, and I want nothing to do with it. Trust decisions are up to me, not some third party.
- Gigachad 7mo ago
  Corporate managed machines can control the software running on the computer to do anything. I'm not sure the details, but chrome certainly can support corporate MITM. There's likely some setting you have to configure first. The default should be to reject certificates which aren't being logged, and if you as a user or corporation have a reason to use private certificates, you just configure your computer to do that. Which fully protects against the risk of normal CAs signing fraudulent certificates.

Melatonic 7mo ago

Corporate machines would have the proper certs pushed to them for the MITM box to work though - would that affect this ?

fc417fc802 7mo ago
The entire point of transparency logs is to detect a cert issued by a different root CA despite both being trusted. The corporate MITM cert won't be present in the logs by design.