Following recent third-party domain hijacks affecting the .gh, .sl, and .as country-code top-level domains (ccTLDs), Chrome immediately blocked unauthorized HTTPS certif…

Cet article décrit la réponse de Chrome à une série de détournements de registres ccTLD affectant les extensions nationales .gh (Ghana), .sl (Sierra Leone) et .as (Samoa américaines).

The big change that's happened in the CRL ecosystem in the last few years is that clients do not directly fetch CRLs from CAs. Instead, the major browsers operate "push" systems, which condense CRLs across the entire CA ecosystem and push them to clients out-of-band. The best documented of these system's is Mozilla's, called CRLite. Chrome's is called CRLSets. Apple also operates a system that isn't very documented, but is known as "Valid" because it uses the hostname valid.apple.com. Of course not all systems support these, so some clients may still fetch CRLs. Unlike OCSP, there's a small number of CRLs that cover all certificates, so caching them is much more readily feasible. One of the original (in the 90s) blockers for this was the size of CRLs, but modern end-user systems typically can support this, except for the smallest embedded devices - which often have no revocation checking anyways. Short-lived certificates without revocation information are the other option, which are logically equivalent to a certificate plus OCSP staple. These are coming, but we can't support them at the same time as OSCP due to the scale of our CA.

I don’t like Brave, and I also don’t like that it connects to all these domains without my permission: > go-updater.brave.com > > brave.com > > account.brave.com > > accounts.brave.com > > ads-admin.brave.com > > ads-help.brave.com > > ads-serve.brave.com > > ads.brave.com > > analytics.brave.com > > api.rewards.brave.com > > assets.brave.com > > blog.brave.com > > brave-core-ext.s3.brave.com > > ci.brave.com > > code.brave.com > > community.brave.com > > componentupdater.brave.com > > crlsets.brave.com > > dl.brave.com > > feedback.brave.com > > grant.rewards.brave.com > > laptop-updates.brave.com > > location.brave.com > > mainnet-beta-solana.brave.com > > mainnet-infura-api.brave.com > > mainnet-infura.brave.com > > mainnet-polygon.brave.com > > matomo.brave.com > > metrics.brave.com > > mobile-data.s3.brave.com > > mumbai-polygon.brave.com > > mywallet.ads.brave.com > > newsletter.brave.com > > offers.brave.com > > p2a-origin.brave.com > > p2a.brave.com > > p3a-json.brave.com > > p3a.brave.com > > payment.rewards.brave.com > > pcdn-origin.brave.com > > pcdn.brave.com > > prometheus.brave.com > > promo-services-staging.brave.com > > promo-services.brave.com > > proxy.aws-internal.brave.com > > proxy.brave.com > > publishers-staging.brave.com > > publishers.brave.com > > ratios.rewards.brave.com > > redirector.brave.com > > redis.promo-services-staging.brave.com > > redis.promo-services.brave.com > > referrals.brave.com > > repsys.rewards.brave.com > > reputation.rewards.brave.com > > rewards.brave.com > > rewards.grant.aws-internal.brave.com > > rinkeby-infura-api.brave.com > > ropsten-infura-api.brave.com > > ropsten-infura.brave.com > > rust-pkg-brave-core.s3.brave.com > > safebrowsing.brave.com > > safebrowsing2.brave.com > > sb-ssl.brave.com > > search-dev.brave.com > > search.anonymous.ads.brave.com > > search.brave.com > > staging.brave.com > > star-randsrv.bsg.brave.com > > static.ads.brave.com > > static.brave.com > > static1.brave.com > > stats.brave.com > > status.brave.com > > store.brave.com > > support.brave.com > > survey.brave.com > > sync-v2.brave.com > > tiles-alb.search.brave.com > > tiles.search.brave.com > > together.brave.com > > translate.brave.com > > updates-alb.brave.com > > updates-cdn.brave.com > > updates-panel.brave.com > > updates.brave.com > > upload-support.brave.com > > usage-ping.brave.com > > variations.brave.com > > vpn-internal.brave.com > > vpn.brave.com > > wallet-docs.brave.com > > webcompat.brave.com And this is just a small sample of domains it connects to, but there are many more. I read somewhere that their servers are compromised with spyware. Maybe it’s true, I don’t know.

2023 年 8 月，CA/Browser Forum 通过了一项投票——不再强制要求 Let’s Encrypt 等公开信任的 CA 设立 OCSP Server 2024 年 7 月，Let’s Encrypt 发布博客，披露其计划关闭 OCSP Server 同年 12 月，Let’s Encrypt 发布其关闭 OCSP Server 的时间计划表，大致情况如下： 2025 年 1 月

2023 年 8 月，CA/Browser Forum 通过了一项投票——不再强制要求 Let’s Encrypt 等公开信任的 CA 设立 OCSP Server 2024 年 7 月，Let’s Encrypt 发布博客，披露其计划关闭 OCSP Server 同年 12 月，Let’s Encrypt 发布其关闭 OCSP Server 的时间计划表，大致情况如下： 2025 年 1 月