4 ms·
this sounds identical to google CRLSet. Basically a list of pinned certs inside source code. > In the future, we would like to support dynamic pinsets rather t
by eplsaft 12y ago
this sounds identical to google CRLSet. Basically a list of pinned certs inside source code.
> In the future, we would like to support dynamic pinsets rather than relying on built-in ones. HTTP Public Key Pinning (HPKP) [1] is an HTTP header that allows sites to announce their pinset.
ok cool. Requires initial safe connection once. Like HSTS.
- reedloden 12y agoThis is nothing like Google CRLSet. CRLSet is just a way of collecting the CRLs from a ton of different CAs and having a way to push those out to Chrome browsers easily without users having to individually download them all from the CAs. Chrome has its own TLS pinning implementation that basically works the same way as Firefox's. See https://src.chromium.org/chrome/trunk/src/net/http/transport_security_state_static.json https://src.chromium.org/chrome/trunk/src/net/http/transport...