logoalt Hacker News

gnabgib • today at 4:25 AM • 1 reply • view on HN

A CT log isn't super relevant (it's not the CRL, it's just a log), but it's maintained/delivered by the CA not the leaf. Never the leaf.

If you mean CRL/Revocation list, everything but the root [you can't revoke a root] is maintained by the tier above. Leaf -> intermediate (these), [Intermediate -> Intermediate*], Intermediate -> Root.

Not sure why you're mentioning transparency logs, they have nothing to do with this (nor help).


Replies

lmz • today at 4:47 AM

Because the thread: "a lot of non-browser software doesn't check CT logs", you replied saying it's a reason to use the OS trust store, not sure how that fixes things? Maybe it would relieve them of the responsibility of pushing out a distrust update?

➕ show 1 reply