Right, but you don't have to wait for some hapless random browser to check; you can write your own monitor, and people do that.

▲

tux3 an hour ago | parent [-]

I hold eMudhra's private key. I generate a cert signed by their intermediate on my box. eMudhra didn't issue the cert, so it is not sent to any CT logs, and I have no SCT to put in the cert.

Am I missing what you mean by monitor?

▲

tptacek an hour ago | parent [-]

I think I might just be talking past you. If your point is "anyone with these broken eMudhra keys can attack users without caring about CT", that's totally true --- it's just that browser/no-browser doesn't factor into it. I'm really only on this subthread because of the notion that CT enforcement requires browsers.

	▲	tux3 31 minutes ago \| parent [-]
		Right, I think I'm with you that browser/no browser shouldn't be a factor. I think I'd like to hear from Rust and Go webpki people on whether we could help the ecosystem enforce CT. My point is more that as a user of a high-level library like reqwest, I'd like to talk safer defaults when root CAs are in use