Didn't Chrome Already Have a Root Store?
summary
Chrome launches an official root store in Chrome 105 and ships a built-in certificate verifier, running a dual verifier trial to compare platform vs Chrome verification. Rollout imports Windows’ 13 trust locations, stages per platform, and reduces certificate errors (Windows ~40% drop), speeds pages (≈1% faster First Contentful Paint) and nudges core web vitals (+0.1% pass). Policy changes make OCSP optional, require CRLs, and incentivize automation with 10-day short-lived certs to avoid revocation costs and improve agility under future post-quantum migration.
AI-written summary · about
chapters (13)
- 0:00Chrome's root store
- 8:36Web PKI trust problems
- 10:46Why Chrome moved to own store
- 15:03Launching new verifier
- 17:12Verifier impact validation
- 18:59Chrome's root program
- 20:04How CAs operate today
- 21:32Improving domain validation
- 25:19Detecting rogue certs with transparency
- 26:26Revocation systems failures
- 30:20Simplifying revocation
- 32:23Chrome’s Web PKI goals
- 33:47Q&A on OCSP stapling
related talks
45mWhat’s new in Chrome?
41mhttps://*every site here*
41mChrome Security Secret Sauce
48mVerified Boot on Chrome OS and How to do it yourself
08mMove over certificate pinning. Certificate transparency is here!
41mChrome and the web in 2020
40mWhat’s New with Chrome and the Web
20mTrust Agility in an Era of Transient Ties: Rethinking TLS...