News for hackers. Stuff that matters.

A comment on Mozilla takes action to protect users in Kazakhstan. Parent comment

Re:Mozilla takes action to protect users in Kazakhstan by stordoff on Wednesday August 21, 2019 @01:09PM (#20759136)
As I understand it, if you come across a certificate signed by a CA that claims to follow CT, but isn't in the CT logs, it's a fairly major red flag - at the very least, the certificate has been mis-issued. If the third party _does_ log it in certificate transparency, a site owner can check if any certificates have been issued that they did not ask for.

Question for those with a fuller understanding: How can a browser verify this without leaking knowledge about every SSL certificate (and thus a significant percentage of browsing history) they have seen?

[ Parent | on HN ]
Re:Mozilla takes action to protect users in Kazakhstan by kam on Wednesday August 21, 2019 @01:24PM (#20759270)
When issuing the certificate, the CA submits a pre-certificate to the CT logs, and the final certificate includes a cryptographic proof that the certificate was included in the log. The browser can check that proof without needing to query a 3rd party.
[ Parent | on HN ]