Google Chrome Enforces Strict Certificate Transparency and SCT Audits: chromestatus.com Research

Executive Summary

Google Chrome has enacted stricter Certificate Transparency (CT) enforcement policies requiring diverse, independent Signed Certificate Timestamp (SCT) presentations for all publicly trusted x509 server certificates. The updated policy ensures cryptographic verification of CT logs while deprecating tolerance for uncompressed or single-operator log receipts.

Technical Context & Browser Enforcement

Certificate Transparency ensures that every TLS certificate issued by a publicly trusted Certificate Authority is cryptographically recorded in public, append-only Merkle tree logs. Under the enforced Chrome baseline:

• Log Diversity Requirements: Certificates must contain embedded SCTs or serve SCTs via TLS extension / OCSP stapling from at least two distinct, non-affiliated log operators (e.g., Google, Cloudflare, Let's Encrypt, or DigiCert).
• Temporal Log Qualification: Longer-lived certificates are subject to scaled SCT count requirements based on issuance validity periods.
• Handshake Rejection: If a leaf certificate fails to present qualifying SCTs from trusted CT logs, Chrome terminates the TLS handshake with NET::ERR_CERTIFICATE_TRANSPARENCY_REQUIRED.

Recommended Actions

1. Verify Embedded SCTs: Use OpenSSL or diagnostic inspection tools to verify that issued leaf certificates contain the 1.3.6.1.4.1.11129.2.4.2 X.509 extension with qualifying timestamps.
2. Ensure CA Multi-Log Submission: Verify that your chosen Certificate Authorities actively log pre-certificates across geographically and organizationally diverse CT logs.
3. Monitor CT Log Monitors: Implement proactive Certificate Transparency log monitoring to detect unauthorized certificate issuances or rogue sub-certificates before malicious exploitation.