This repository has been archived by the owner on Apr 3, 2020. It is now read-only.
crosswalk-23: Stop enforcing Certificate Transparency verification #3966
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Chromium started enforcing some Certificate Transparency policies by default
in M53, and refuses to load certain websites when the CT verification fails
while establishing the TLS connection; this affected Crosswalk because we
were using the default CT verifier and policy enforcer, but we did not add
any of the logs approved by the Chromium project (see
net/cert/ct_known_logs_static-inc.h).
Instead of doing so, stop requiring websites to pass Chromium's Certificate
Transparency checks altogether after getting some clarification from
upstream. The biggest impediment to us following Chromium's policy is that
Crosswalk's release cycle would need to match Chromium's very closely to
avoid two risks:
Crosswalk does not recognize the new logs and refuses to load a website
with a valid certificate.
trusting a certificate that Chromium no longer trusts.
Additionally, the aforementioned list of built-in logs that Chromium uses
stops being recognized 70 days after the build date, which can lead our
users to a false sense of security if they do not update their own apps with
a more recent Crosswalk (which we might not even have released yet).
See the discussion in https://crbug.com/669978 for more information.
BUG=XWALK-7398
(cherry picked from commit 1c749f9)