PKI:CT

This page documents Mozilla's plans regarding how we support Certificate Transparency.

Mis-issuance of certificates is a major risk in today's Web PKI. Certificate Transparency (CT) is a technology that has the potential to greatly increase the Web's ability to detect and respond to mis-issuance, if a sufficiently robust ecosystem develops around it.

In the CT ecosystem, browsers are supposed to require that a secure website provide proof that its certificate has been logged in a public CT log. The idea is that if enough browsers require a cert to be logged, this provides an incentive for sites/CAs to make sure this happens. The Chrome team has announced their intent to begin requiring CT for all EV certificates in the near future.

While Mozilla supports the objective of reducing the risk of mis-issuance, we are taking a gradual approach to CT implementation due to some ongoing uncertainty around CT. Since so many of the security benefits of CT rest on the development of an ecosystem of browsers, logs, monitors, and CA interactions, it is not yet clear whether CT will be a viable solution for the whole Web PKI. The standards for CT are also currently under discussion by the IETF trans working group, and may evolve before they are finished.

With help from the Google CT team, we are currently planning to add code to Firefox and/or NSS that will check for CT information in a TLS handshake. We will create preferences that allow the user to apply these checks to TLS handshakes (either all or a subset), but these preferences will be off by default.

To emphasize: The current CT implementation will have no impact on users who do not explicitly enable it. Before any action is taken to apply CT by default, there will need to be extensive discussion of where it should be applied, and how the results of CT should impact the Firefox user experience.

Having this initial implementation in place will facilitate experimentation by early adopters, and give us a baseline for implementing the final CT protocol agreed by the IETF. It will allow us to collect telemetry on how well CT works in the wild. It will put us in a position to react more quickly if we eventually want to enforce CT. And it can be removed if CT turns out to be unsuccessful.