1

While I was showing this question X.509 certificate giving error in Chrome, works in Firefox to a co-worker using Chrome in Windows, he has shown me that Chrome in Windows is interpreting and showing correctly a "new" X.509 extension for Certificate Transparency, and this is contrary to Chrome behaviour in Linux.

For an example SCT enable domain, say https://www.digicert.com . So whilst in Debian 9, in the current production 69.0.3497.92, beta 70.0.3538.16 and unstable 70.0.3538.16 version of Chrome, it shows like this:

img

While in Windows Chrome 69.0.3497.92, it shows like this:

img2

What is happening here?

3

Finally found out why I was not able to see the SCT extension in Google Chrome for Linux.

Google has not been willing to implement the feature in the Linux version of Chrome.

Apparently and interestingly, the menus appear to be specific code, and not common to all architectures.

So that explains why Chromium in Debian, and Google Chrome current, beta and unstable in the Google repository for Debian do not show the field, 4 months after it has been turned mandatory.

PS I went to the Google Chromium project, as the github for Google is called, to fill a request/bug, and lo and behold, a bug it is already filled:

Issue 853550 - Certificate viewer on ChromeOS does not decode embdedded SCT x.509 extension

Steps to reproduce the problem:
1. Go to a website whose certifcate has embedded SCTs (e.g. github.com)
2. Click on the lock
3. Click certificate
4. Look at the extensions

What is the expected behavior?
The embedded SCT extension has nicely decoded information

The ticket also erroneously has an answer, from the Chromium helpdesk team, that the SCT field is shown in the Security Panel (it is not), so I left there a new comment.

PS Interestingly, Chrome Mac also shows it. So why is the Linux version the ugly duckling and leaving people in the dark?

More interestingly enough, while Safari does not implement Certificate transparency (yet), it already shows the field.

Showing https://www.digicert.com X.509 certificate -> Chrome (MacOS)

chromeMac

Showing https://www.digicert.com X.509 certificate -> Safari (MacOS)

Safari

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.