Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Unlike Mozilla Firefox, I've always assumed that Google Chrome does not come with its own certificate trust store, but uses that of the OS. At least on Windows 7 any certificate management related tasks seem to redirect to the same dialog as IE.
But in this case how can Google as a browser vendor announce that they are revoking trust for certain CAs (e.g. WoSign, or more recently Symantec) from Chrome? Isn't the trust store managed and updated by the OS vendor (e.g. Microsoft)?
As noted in the Chromium documentation (on which Google Chrome is based) on the Root Certificate Policy, chrome has a list of "not trusted" root ca to which Google can add the incriminated CA.
In the case of a compromise of a root certificate authority, Google reserves the right to add that root certificate to the list of root certificates that Google Chrome will not trust
(emphasis mine)
