Avatar for Username

搜尋 Mozilla 技術支援網站

防止技術支援詐騙。我們絕對不會要求您撥打電話或發送簡訊，或是提供個人資訊。請用「回報濫用」功能回報可疑的行為。

Learn More

此討論串已被封存。 如果您有需要幫助，請新增一個新問題

when will Mozilla support Expect-CT, a new security header

  • 1 回覆
  • 1 有這個問題
  • 196 次檢視
  • 最近回覆由 cor-el

fndtn357
fndtn357
more options

"Expect-CT is a new security header which is, at the moment, only supported by Chrome and Opera browsers. It allows a website to instruct the browser to reject any certificate not found in Certificate Transparency, a read-only public log of certificates which can be audited. Because Expect-CT is an HTTP header, it is a trust-on-first-use protocol that relies on long-term caching to ensure security. While Expect-CT does not prevent a compromised Certificate Authority from issuing a fake certificate, it does limit the damage by forcing the addition of the certificate to the log. The domain owner can then report the fake certificate and attempt to get it revoked." [Protonmail]

"Expect-CT is a new security header which is, at the moment, only supported by Chrome and Opera browsers. It allows a website to instruct the browser to reject any certificate not found in Certificate Transparency, a read-only public log of certificates which can be audited. Because Expect-CT is an HTTP header, it is a trust-on-first-use protocol that relies on long-term caching to ensure security. While Expect-CT does not prevent a compromised Certificate Authority from issuing a fake certificate, it does limit the damage by forcing the addition of the certificate to the log. The domain owner can then report the fake certificate and attempt to get it revoked." [Protonmail]

被選擇的解決方法

Expect-CT (Certificate Transparency) isn't really a new concept as it goes back to 2014.

Certificate Transparency has been implemented in Firefox for telemetry, but is disabled because of negative impact on the performance.

If you want to spend some time on reading:

security.pki.certificate_transparency.mode (0 | 1)

Some related bug reports:

  • Bug 1281469 - Implement Certificate Transparency support (RFC 6962)
  • Bug 1349941 - Support Expect-CT for Opting-in to Certificate Transparency [RW]
  • Bug 1353216 - certificate transparency signature verifications negatively impact TLS handshake performance
  • Bug 1355903 - Re-enable Certificate Transparency telemetry collection

(please do not comment in bug reports
https://bugzilla.mozilla.org/page.cgi?id=etiquette.html)

從原來的回覆中察看解決方案 👍 0

所有回覆 (1)

cor-el
cor-el
  • Moderator
  • Top 10 Contributor
more options

選擇的解決方法

Expect-CT (Certificate Transparency) isn't really a new concept as it goes back to 2014.

Certificate Transparency has been implemented in Firefox for telemetry, but is disabled because of negative impact on the performance.

If you want to spend some time on reading:

security.pki.certificate_transparency.mode (0 | 1)

Some related bug reports:

  • Bug 1281469 - Implement Certificate Transparency support (RFC 6962)
  • Bug 1349941 - Support Expect-CT for Opting-in to Certificate Transparency [RW]
  • Bug 1353216 - certificate transparency signature verifications negatively impact TLS handshake performance
  • Bug 1355903 - Re-enable Certificate Transparency telemetry collection

(please do not comment in bug reports
https://bugzilla.mozilla.org/page.cgi?id=etiquette.html)