Hacker News new | ask | show | jobs
by jrockway 2850 days ago
Perhaps more interesting is that Chrome is happy to send data to google.com without checking the certificate. I'd file a bug.
1 comments

Yep, their not pinning that cert, but I think this is purposeful to continue to function in corporate environments like ours where we deploy our own Cert chain infrastructure. So the OS and transitively the browser is seeing a 'valid' certificate if you're browsing from a company computer.

Firefox on the other hand, you have to import the whole CA chain into the app itself for it to work transparently, since it won't reference the OS cert store.