Hacker News Reader

Does Chrome maintain its own trusted certificate list on any platform?

IIRC, it uses the OS's trust store on Windows and macOS, and NSS (so, Mozilla's trust store) on Linux. So, it's up to Apple and Microsoft to handle this for Chrome users on those platforms.

View on HN

Yes, Chrome generally uses the OS trust store as "trust roots", however Chrome layers on additional validation and pinning in the Chrome code:

CRLSets: https://dev.chromium.org/Home/chromium-security/crlsets

HSTS Preloading: https://hstspreload.appspot.com/

more: https://www.chromium.org/Home/chromium-security/security-faq...

Chrome uses OS CA store. But, it has 'Removal of Trust' cluase which expects CA store to follow some guidelines. Starcom might be in covered in that guideline. So, blacklisting a CA store is possible.

https://www.chromium.org/Home/chromium-security/root-ca-poli...

Reply on news.ycombinator.com