August 2023
To defend against this risk, Chrome contains a pin set for all Google properties, and we only consider an HTTPS input trustworthy if it’s authenticated using a key in this pin set. Chrome contains a pin set for all Google properties, and we only consider an HTTPS input trustworthy if it’s authenticated using a key in this pin set. This protects against malicious certificate issuance by third parties.
https://security.googleblog.com/2023/08/making-chrome-more-secure-by-bringing.html
is the most recent first-source writing a cursory search just found, consistent with pinsets in transport_security_state_static_pins.json
$ grep -n mail src/net/http/transport_security_state_static_pins.json
170: "name": "gmail.com",
185: "name": "googlemail.com",
230: "name": "www.gmail.com",
235: "name": "www.googlemail.com",
1500: "name": "gmail.co.ug",
https://chromium.googlesource.com/chromium/src/+/refs/heads/main/net/http/transport_security_state_static_pins.json
If Google were to ever abdicate their position such that Chromium or Android let a non-Google CA deem a national treasure like mail.google.com valid, especially by some rando chud CA from some third world shithole, oh how crushingly disappointing that would be, a dagger to USA's greatness.
_
If HKP specification had worked out (RIP, lol), that may have over the last decade-ish spared some config lines for CA config behind commands like
browser_organizationFoo.sh
browser_organizationBar.sh
to load browsers with whitelisted CA in Firejail, Capsicum (BSD Jails), or kvm/bhyve/xen/SwiftBoot/whatever.
It's odd how that, for the unwashed masses' use of browsers with the default CA config, high-value clearnet websites' PKI robustness is, from all I've read over the years, more often than not functionally outperformed by prominent LSD/tryptamine vendors of various DarkNet Markets.
LoL
_
A more meaningful answer on the "other organizations" question above, for a project one might get one or more CA and relevant details in a PGP/MIME or S/MIME or by-hand gpg/sq message with the implicit "you already know what to do".
Some commercially operated services, geared more towards high-value customers, have casually offered a first-party CA cert. Perhaps due to being operated by and for relatively higher value demographic (thus, I'll not advertise them here), even at general or low pricing (high trust societies just hit different).
Some "far left" or whatever anarchist-ish communities often not chasing profit casually do first-party CA too, which is no less based than any other subculture doing it.
Any time someone may have ever manually sent you a VPN config file to load, this is in essence sort of what they were doing but without the existing known-pubkey part.
Across the globe, competent IT teams transparently propagate dedicated browser instance profiles with explicitly whitelisted CA that show up in users' toolbar/dock as differently styled icons with appropriate splash images/dialogue when clicked.
The ability to do this correctly and without mistakes, is, as mentioned above, a litmus test for (when asked to do so) if an IT team is legit or not.
This functional pattern of the people who get the real shit done has been in place for more than, as far as I personally for over two decades have happened to know. And, functionally in its substance, no matter what form on the surface, it's not going away, not ever.
At least not until a cosmic event leading to the dissolution of this current run of civilization.
As I imagine, you already probably know. I see your pubkeys on Keybase. Imported.
_
Super lame anecdote: at one hilarious and sad juncture I witnessed a self-titled ""CTO"" at a sham company, self-proclaimed "security guru", expose himself as a total fucking fraud when he announced boldly to a room that all OpenStack APIs functionally (not a directive, but functionally) are unable to use in-house CA, in what was surfaced as a lame attempt to shirk applying a skill he'd hyped everyone up he like totally had fluency in. Then a good chunk his own team on the side derided him as a "fucking LARP" immediately after that before anyone else could have commented.
"The thing about computers are is they are objective"
(roughly accurate quote of)
~ Jonathan Blow