Let’s Encrypt Violates 360 Browser CA Policy

Feature Requests
1

360浏览器根证书计划 Says:

所有的终端用户证书必须：

  1. 包含有效的OCSP URL、AIA URL和CRL URL，以及由CA/Browser Forum Baseline Requirements所定义的适用OIDs。

In english:

All subscribers certs must:

  1. Provides valid OCSP URL, AIA URL and CRL URL, and OIDs defined in CA/Browser Forum Baseline Requirements.

But all let’s encrypt subscriber certs provides no OCSP anymore. I think there must be some one is wrong, 360 CA program, or Let’s encrypt.

1 Like
2

LE side didn't do much but 360 browser added it in their trust store 2022 (when LE only had OSCP without CRL)

3 Likes
3

Thanks for bringing this up. It appears that 360 Browser has not updated their root program requirements in many years, and hasn't kept up with the latest changes both to the Baseline Requirements, and to the policies enforced in code by Chromium (on which 360 Browser is based). We'll follow up with them.

7 Likes
4

Well, previously no CRL URL was provided within the subscriber certificates, so it seems LE wasn't compliant to begin with?

I know LE started operating CRLs for end user certs at some point, but these URIs weren't actually embedded in the certs until recently, only published on CCADB.

Edit:
According to Add ISRG Root to 360 Browser trust store - #7 by wordlesswind the CRL was never required for end user certs.. Apparently they never bothered changing their requirements, even when confronted with this. #wouldnottrust

4 Likes