Re:Ask HN: Intercepting HTTPS – How can we trust anything?
by LinuxBender on Saturday December 25, 2021 @09:14AM
(#29683489)
Maybe on some browsers. I've MITM my connections on Firefox for a very long time and have never run into anything related to transparency logs. There must be some setting I have disabled in the browser. The only way I can tell that the cert is not legit is looking at the fingerprint and the only sites I run into issues with are the few still using HPKP. I've never used Chrome. Maybe Chrome checks transparency logs and submits violations?
[ Parent
| on HN ]
Re:Ask HN: Intercepting HTTPS – How can we trust anything?
by gchambert on Saturday December 25, 2021 @11:07AM
(#29684346)
It's not 100% related but certificate pinning (HKPK) is only enforced for CA trusted by browser. It is ignored if the leaf certificate is signed by a user-imported CA (or deployed by enterprise policies). Maybe the same applies for SCT?