我看了一下 chromium 代码，发现了不知道算不算是一个大新闻：
翻了一下返回“ ERR_CERTIFICATE_TRANSPARENCY_REQUIRED ”只有两处，两处代码都一样，以 net/sock/
ssl_client_socket_impl.cc 为例
......
ct_verify_result_.cert_policy_compliance =
policy_enforcer_->DoesConformToCertPolicy(
server_cert_verify_result_.verified_cert.get(), verified_scts,
net_log_);
if (ct_verify_result_.cert_policy_compliance !=
ct::CertPolicyCompliance::CERT_POLICY_COMPLIES_VIA_SCTS &&
transport_security_state_->ShouldRequireCT(
host_and_port_.host(), server_cert_verify_result_.verified_cert.get(),
server_cert_verify_result_.public_key_hashes)) {
server_cert_verify_result_.cert_status |=
CERT_STATUS_CERTIFICATE_TRANSPARENCY_REQUIRED;
return ERR_CERTIFICATE_TRANSPARENCY_REQUIRED;
}
如果 ct_verify_result_.cert_policy_compliance 不是 CERT_POLICY_COMPLIES_VIA_SCTS ，则 ShouldRequireCT 就会走一个好像 host 的黑白名单的东西，而默认返回 true （
v2ex.com:443 的情况确定不会返回 false ），接下来就返回 ERR_CERTIFICATE_TRANSPARENCY_REQUIRED ，就像 LZ 看到的那样。
所以前面的 DoesConformToCertPolic 返回什么就变的很重要了 ：
ct::CertPolicyCompliance CTPolicyEnforcer::DoesConformToCertPolicy(
X509Certificate* cert,
const ct::SCTList& verified_scts,
const NetLogWithSource& net_log) {
// If the build is not timely, no certificate is considered compliant
// with CT policy. The reasoning is that, for example, a log might
// have been pulled and is no longer considered valid; thus, a client
// needs up-to-date information about logs to consider certificates to
// be compliant with policy.
bool build_timely = IsBuildTimely();
ct::CertPolicyCompliance compliance;
if (!build_timely) {
compliance = ct::CertPolicyCompliance::CERT_POLICY_BUILD_NOT_TIMELY;
} else {
compliance = CheckCertPolicyCompliance(*cert, verified_scts);
}
......
CheckCertPolicyCompliance()就是验证 sct 的代码，很长，先不管了，看看前面那个要命 IsBuildTimely():
bool IsBuildTimely() {
const base::Time build_time = base::GetBuildTime();
// We consider built-in information to be timely for 10 weeks.
return (base::Time::Now() - build_time).InDays() < 70 /* 10 weeks */;
}
我 cao ，如果版本编译于 70 天前就返回 CERT_POLICY_BUILD_NOT_TIMELY ，我改了下，改成 1 天（内），跑了一下，所有带 SCT 的 https 都歇菜了。
chrome53 应该就是 2 月前的吧，超过 70 天了。这很可怕啊，国内有多少 chrome 能方便更新呢。
