4 ms·
I agree that the original article should be updated. The delay seems to be due to some "late-breaking chain building bugs": https://twitter.com/sleevi_/status/5
by vtlynch 12y ago
I agree that the original article should be updated. The delay seems to be due to some "late-breaking chain building bugs": https://twitter.com/sleevi_/status/585429689646260224 https://twitter.com/sleevi_/status/585429689646260224
This older Twitter thread kinda alludes to some problems with CAs being compliant in time: https://twitter.com/sleevi_/status/584010058897293313 https://twitter.com/sleevi_/status/584010058897293313
(Ryan Sleevi works on PKI for Chromium)
- yuhong 12y agoBackground: CAs often provide cross certificates signed with SHA1 to older roots for browsers that don't have the newer roots installed.