Search code examples
google-chromesslssl-certificatecertificate-transparency

Certificate transparency and privately installed certs


Does anyone know whether the certificate transparency feature as promoted by Google can/will apply to private installed CAs?

It seems like Chrome is already enforcing CT in some situations, presumably by auditing public CA logs. For private CAs that do legitimate Man-in-the-middle, there obviously won't be public CA auditing information, and it would be good to know that Chrome won't balk at that.


Solution

  • The CT enforcement policy applies only to public CAs, not self-signed or private CAs. The closest thing I could find confirming this was this tweet from Google's Ryan Sleevi.

    Image of Ryan Sleevi's tweet