search

ssllabs / ssllabs-scan

A command-line reference-implementation client for SSL Labs APIs, designed for automated and/or bulk testing.
https://www.ssllabs.com/projects/ssllabs-apis/
Apache License 2.0
1.7k stars 242 forks source link

Google Chrome: contstraint based distrust #967

Open lukastribus opened 4 months ago

lukastribus commented 4 months ago

Hello,

Google Chrome implements constrain based CA distrust:

https://source.chromium.org/chromium/chromium/src/+/main:net/cert/root_store.proto;drc=a783c3bab474ff68e675e2753f91c92ca817e072;l=15?q=f:root_store.proto&ss=chromium

which will be used to distrust Entrust Root CA for certificates whose earliest Signed Certificate Timestamp (SCT) is dated after October 31, 2024 (GMT) :

https://security.googleblog.com/2024/06/sustaining-digital-certificate-security.html https://groups.google.com/a/ccadb.org/g/public/c/29CRLOPM6OM/m/-tvW5l-lAAAJ?pli=1

For ssltest I assume it's easier to just remove the Entrust root than it is to implement the same feature.

Thanks in advance

naumanshah03 commented 4 months ago

Hi @lukastribus

Thanks a lot for sharing the resources for the approach followed by Google.

As I read through it if we remove the said Root CAs from trust store then there will be false positive result for certificates issued before 31st October 2024 hence we will come up with the said approach mentioned by Google in https://security.googleblog.com/2024/06/sustaining-digital-certificate-security.html

Regards, Nauman Shah