Hacker News new | past | comments | ask | show | jobs | submit login

> How can they efficiently do that?

The web server sends a Signed Certificate Timestamp in the TLS Handshake¹. The browser will check that.

Apache support is coming², and other web server vendors are probably working on it as well.

¹https://tools.ietf.org/html/rfc6962#page-13

²https://httpd.apache.org/docs/trunk/mod/mod_ssl_ct.html




Even better is embedding the SCTs in the x509 structure itself so that you don't have to rely on obtaining/caching and the sending in the handshake. (Yes, there's some cases where a policy change my require the addition of additional SCTs—or different ones altogether—but this should be the exception not the norm.)




Consider applying for YC's Summer 2025 batch! Applications are open till May 13

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: