Hacker News Reader

Considering I believe one of the writers of this was from Google, I guess we can assume they'll likely follow?

With both Chrome and Firefox no longer allowing certificates from them we can expect customers to no longer buy from them which will result in no more certificates even if Apple/Microsoft don't follow.

View on HN

Does Chrome maintain its own trusted certificate list on any platform?

IIRC, it uses the OS's trust store on Windows and macOS, and NSS (so, Mozilla's trust store) on Linux. So, it's up to Apple and Microsoft to handle this for Chrome users on those platforms.

Yes, Chrome generally uses the OS trust store as "trust roots", however Chrome layers on additional validation and pinning in the Chrome code:

CRLSets: https://dev.chromium.org/Home/chromium-security/crlsets

HSTS Preloading: https://hstspreload.appspot.com/

more: https://www.chromium.org/Home/chromium-security/security-faq...

Chrome uses OS CA store. But, it has 'Removal of Trust' cluase which expects CA store to follow some guidelines. Starcom might be in covered in that guideline. So, blacklisting a CA store is possible.

https://www.chromium.org/Home/chromium-security/root-ca-poli...

Reply on news.ycombinator.com