logoalt Hacker News

gnabgib • today at 3:55 AM • 2 replies • view on HN

This is why there are OS trust stores. Electron - if you use the system CA [0] and cURL[1] apps use it, which are you talking about?

[0]: https://github.com/electron/electron/issues/45674

[1]: https://curl.se/docs/sslcerts.html

Replies

lmz • today at 4:17 AM

The CT log is a property of the individual leaf certificate not a property of the issuing chain. You could have the same CA in the trust store issue an unlogged certificate and non browsers would trust it.

➕ show 1 reply
thayne • today at 5:30 AM

Curl does not check that certificates have a valid SCT attached. Thus it will accept a certificate that isn't in the CT logs. That's mostly independent of the OS trust stores.