Description

Enable certificate transparency enforcement

Who's implementing?

• I'm willing to implement this feature myself

The problem

Certificate transparency isn't enforced. You can check for this by using a test site like https://no-sct.badssl.com/. On chrome this results in an error, but on ungoogled-chromium it loads fine.

Enabling this enhances security because it makes it more difficult for misissued certificates to go undetected. Most browsers enforce certificate transparency, so ungoogled-chromium benefits from some "herd immunity", but it's still better to enforce it ourselves than to rely on that.

Possible solutions

The comment in chromium source code suggests this requires a bunch of work:

// Enables Certificate Transparency on Desktop and Android Browser (CT is
// disabled in Android Webview, see aw_browser_context.cc).
// Enabling CT enforcement requires maintaining a log policy, and the ability to
// update the list of accepted logs. Embedders who are planning to enable this
// should first reach out to [email protected].

But I toggled that FEATURE_ENABLED_BY_DEFAULT, and it seems to work as expected with no further changes.

Alternatives

No response

Additional context

No response