certificate transparency problem

[lneir]

We have a customer who is having problem with certificate transparency (CT) in our CEF product.

They tried using chrome 56 and still saw the CT warning. Then we ask them to use 'CertificateTransparencyEnforcementDisabledForUrls' registry setting as described here http://www.chromium.org/administrators/ ... ledForUrls and everything worked fine.

So few questions:
1. Does this mechanism work in CEF: http://www.chromium.org/administrators/ ... ledForUrls ? If so, how?
2. If not, how can we disable CT checking for urls or altogether?

Our current build of CEF is from this githash: https://bitbucket.org/chromiumembedded/ ... e5?at=2883 which is 3.2883.1539.gd7f087e

FYI, did see this other discussion https://bitbucket.org/chromiumembedded/ ... ansparency and tried add command line flag --enable-net-security-expiration=false but it no effect.

Thanks.

[magreenblatt]

CT expiration based on build age is disabled in https://bitbucket.org/chromiumembedded/ ... ansparency and you do not need to pass any command-line flags for that behavior. CT checking in general is still enabled. You can use CefRequestHandler::OnCertificateError to allow invalid certificates.

[lneir]

thanks, yes i did find a hook in that callback where i can detect CT errors.