Unlike Mozilla Firefox, I've always assumed that Google Chrome does not come with its own certificate trust store, but uses that of the OS. At least on Windows 7 any certificate management related tasks seem to redirect to the same dialog as IE.

But in this case how can Google as a browser vendor announce that they are revoking trust for certain CAs (e.g. WoSign, or more recently Symantec) from Chrome? Isn't the trust store managed and updated by the OS vendor (e.g. Microsoft)?

up vote 7 down vote accepted

As noted in the Chromium documentation (on which Google Chrome is based) on the Root Certificate Policy, chrome has a list of "not trusted" root ca to which Google can add the incriminated CA.

In the case of a compromise of a root certificate authority, Google reserves the right to add that root certificate to the list of root certificates that Google Chrome will not trust

(emphasis mine)

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.