30. z\u00e1\u0159\u00ed v 17:01 moskevsk\u00e9ho \u010dasu vypr\u0161\u00ed platnost ko\u0159enov\u00e9ho certifik\u00e1tu spole\u010dnosti IdenTrust (DST Root CA X3), kter\u00fd byl pou\u017eit k k\u0159\u00ed\u017eov\u00e9mu podeps\u00e1n\u00ed ko\u0159enov\u00e9ho certifik\u00e1tu certifika\u010dn\u00ed autority Let’s Encrypt (ISRG Root X1), spravovan\u00e9 komunitou a poskytuj\u00edc\u00ed certifik\u00e1ty bez\u00faplatn\u011b komukoli. K\u0159\u00ed\u017eov\u00e9 podeps\u00e1n\u00ed zaji\u0161\u0165ovalo d\u016fv\u011bru k certifik\u00e1t\u016fm Let’s Encrypt na \u0161irok\u00e9 \u0161k\u00e1le za\u0159\u00edzen\u00ed, opera\u010dn\u00edch syst\u00e9m\u016f a prohl\u00ed\u017ee\u010d\u016f b\u011bhem integrace vlastn\u00edho ko\u0159enov\u00e9ho certifik\u00e1tu Let’s Encrypt do \u00falo\u017ei\u0161\u0165 ko\u0159enov\u00fdch certifik\u00e1t\u016f. <\/p>\n
P\u016fvodn\u011b se pl\u00e1novalo, \u017ee po vypr\u0161en\u00ed platnosti DST Root CA X3 projekt Let’s Encrypt p\u0159ejde na vytv\u00e1\u0159en\u00ed podpis\u016f pouze s vlastn\u00edm ko\u0159enov\u00fdm certifik\u00e1tem, ale takov\u00fd krok by vedl ke ztr\u00e1t\u011b kompatibility s mnoha star\u00fdmi syst\u00e9my, kter\u00e9 nep\u0159idaly ko\u0159enov\u00fd certifik\u00e1t Let’s Encrypt do sv\u00fdch \u00falo\u017ei\u0161\u0165. Konkr\u00e9tn\u011b p\u0159ibli\u017en\u011b 30 % b\u011b\u017en\u011b pou\u017e\u00edvan\u00fdch za\u0159\u00edzen\u00ed s Androidem nem\u00e1 informace o ko\u0159enov\u00e9m certifik\u00e1tu Let’s Encrypt, jeho\u017e podpora za\u010dala teprve od platformy Android 7.1.1, vydan\u00e9 koncem roku 2016. <\/p>\n
Let’s Encrypt nepl\u00e1noval uzav\u0159\u00edt novou dohodu o k\u0159\u00ed\u017eov\u00e9m podeps\u00e1n\u00ed, proto\u017ee to ukl\u00e1d\u00e1 dodate\u010dnou odpov\u011bdnost \u00fa\u010dastn\u00edk\u016fm dohody, zbavuje je samostatnosti a svazuje ruce co do dodr\u017eov\u00e1n\u00ed v\u0161ech procedur a pravidel jin\u00e9ho certifika\u010dn\u00edho centra. Ale kv\u016fli vzniku potenci\u00e1ln\u00edch probl\u00e9m\u016f na velk\u00e9m po\u010dtu za\u0159\u00edzen\u00ed s Androidem byl pl\u00e1n p\u0159ehodnocen. S certifika\u010dn\u00ed autoritou IdenTrust byla uzav\u0159ena nov\u00e1 dohoda, v jej\u00edm\u017e r\u00e1mci byl vytvo\u0159en alternativn\u00ed k\u0159\u00ed\u017eov\u011b podepsan\u00fd mezipatikaov\u00fd certifik\u00e1t Let’s Encrypt. K\u0159\u00ed\u017eov\u00e9 podeps\u00e1n\u00ed bude platn\u00e9 t\u0159i roky a umo\u017en\u00ed zachovat podporu za\u0159\u00edzen\u00ed Android od verze 2.3.6. <\/p>\n
Nov\u00fd mezipatikaov\u00fd certifik\u00e1t v\u0161ak nepokr\u00fdv\u00e1 mnoho dal\u0161\u00edch zastaral\u00fdch syst\u00e9m\u016f. Nap\u0159\u00edklad po vypr\u0161en\u00ed certifik\u00e1tu DST Root CA X3 30. z\u00e1\u0159\u00ed p\u0159estanou b\u00fdt certifik\u00e1ty Let’s Encrypt akceptov\u00e1ny v ji\u017e nepodporovan\u00fdch firmwarov\u00fdch a opera\u010dn\u00edch syst\u00e9mech, kde bude nutn\u00e9 pro zaji\u0161t\u011bn\u00ed d\u016fv\u011bry k certifik\u00e1t\u016fm Let’s Encrypt ru\u010dn\u011b p\u0159idat certifik\u00e1t ISRG Root X1 do \u00falo\u017ei\u0161t\u011b ko\u0159enov\u00fdch certifik\u00e1t\u016f. Probl\u00e9my se projevuj\u00ed v: <\/p>\n
V p\u0159\u00edpad\u011b OpenSSL 1.0.2 je probl\u00e9m zp\u016fsoben chybou, kter\u00e1 neumo\u017e\u0148uje spr\u00e1vn\u011b zpracovat k\u0159\u00ed\u017eov\u011b podepsan\u00e9 certifik\u00e1ty, pokud dojde k zastar\u00e1n\u00ed jednoho z ko\u0159enov\u00fdch certifik\u00e1t\u016f pou\u017e\u00edvan\u00fdch p\u0159i podpisu, i kdy\u017e z\u016fst\u00e1vaj\u00ed jin\u00e9 platn\u00e9 \u0159et\u011bzce d\u016fv\u011bry. Probl\u00e9m se poprv\u00e9 objevil loni po zastar\u00e1n\u00ed certifik\u00e1tu AddTrust, pou\u017e\u00edvan\u00e9ho pro k\u0159\u00ed\u017eov\u00e9 podepisov\u00e1n\u00ed certifik\u00e1t\u016f certifika\u010dn\u00ed autority Sectigo (Comodo). Podstata probl\u00e9mu spo\u010d\u00edv\u00e1 v tom, \u017ee OpenSSL zpracov\u00e1valo certifik\u00e1t jako line\u00e1rn\u00ed \u0159et\u011bzec, zat\u00edmco podle RFC 4158 m\u016f\u017ee certifik\u00e1t p\u0159edstavovat orientovan\u00fd distribuovan\u00fd cyklick\u00fd graf s n\u011bkolika uzly d\u016fv\u011bry, kter\u00e9 je t\u0159eba vz\u00edt v \u00favahu. <\/p>\n
U\u017eivatel\u016fm star\u00fdch distribuc\u00ed z\u00e1visl\u00fdch na OpenSSL 1.0.2 se navrhuj\u00ed t\u0159i alternativn\u00ed zp\u016fsoby \u0159e\u0161en\u00ed probl\u00e9mu: <\/p>\n
D\u00e1le je t\u0159eba zm\u00ednit, \u017ee projekt Let's Encrypt p\u0159ekonal hranici dvou miliard vygenerovan\u00fdch certifik\u00e1t\u016f. Hranice jedn\u00e9 miliardy byla dosa\u017eena v \u00fanoru lo\u0148sk\u00e9ho roku. Denn\u011b se generuje 2,2-2,4 milionu nov\u00fdch certifik\u00e1t\u016f. Po\u010det aktivn\u00edch certifik\u00e1t\u016f \u010din\u00ed 192 milion\u016f (certifik\u00e1t plat\u00ed t\u0159i m\u011bs\u00edce) a pokr\u00fdv\u00e1 p\u0159ibli\u017en\u011b 260 milion\u016f. dom\u00e9n.<\/a> (p\u0159ed rokem bylo pokryto 195 milion\u016f dom\u00e9n, p\u0159ed dv\u011bma lety \u2014 150 milion\u016f, p\u0159ed t\u0159emi lety \u2014 60 milion\u016f). Podle statistik slu\u017eby Firefox Telemetry \u010din\u00ed celosv\u011btov\u00fd pod\u00edl po\u017eadavk\u016f na str\u00e1nky p\u0159es HTTPS 82% (p\u0159ed rokem \u2014 81%, p\u0159ed dv\u011bma lety \u2014 77%, p\u0159ed t\u0159emi lety \u2014 69%, p\u0159ed \u010dty\u0159mi lety \u2014 58%). 30 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f \u0432 17:01 \u043f\u043e \u043c\u043e\u0441\u043a\u043e\u0432\u0441\u043a\u043e\u043c\u0443 \u0432\u0440\u0435\u043c\u0435\u043d\u0438 \u0438\u0441\u0442\u0435\u043a\u0430\u0435\u0442 \u0432\u0440\u0435\u043c\u044f \u0436\u0438\u0437\u043d\u0438 \u043a\u043e\u0440\u043d\u0435\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 IdenTrust (DST Root CA X3), \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0441\u044f \u0434\u043b\u044f \u043a\u0440\u043e\u0441\u0441-\u043f\u043e\u0434\u043f\u0438\u0441\u0438 \u043a\u043e\u0440\u043d\u0435\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 \u0443\u0434\u043e\u0441\u0442\u043e\u0432\u0435\u0440\u044f\u044e\u0449\u0435\u0433\u043e \u0446\u0435\u043d\u0442\u0440\u0430 Let’s Encrypt (ISRG Root X1), \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u043e\u0433\u043e \u0441\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e\u043c \u0438 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0439 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u044b \u0431\u0435\u0437\u0432\u043e\u0437\u043c\u0435\u0437\u0434\u043d\u043e \u0432\u0441\u0435\u043c \u0436\u0435\u043b\u0430\u044e\u0449\u0438\u043c. \u041f\u0435\u0440\u0435\u043a\u0440\u0451\u0441\u0442\u043d\u0430\u044f \u043f\u043e\u0434\u043f\u0438\u0441\u044c \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u043b\u0430 \u0434\u043e\u0432\u0435\u0440\u0438\u0435 \u043a \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430\u043c Let’s Encrypt \u043d\u0430 \u0448\u0438\u0440\u043e\u043a\u043e\u043c \u0441\u043f\u0435\u043a\u0442\u0440\u0435 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432, \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u0438 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u043e\u0432 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-101436","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Zastar\u00e1n\u00ed ko\u0159enov\u00e9ho certifik\u00e1tu IdenTrust povede ke ztr\u00e1t\u011b d\u016fv\u011bry k Let's Encrypt na star\u00fdch za\u0159\u00edzen\u00edch | ProHoster","description":"30. z\u00e1\u0159\u00ed v 17:01 moskevsk\u00e9ho \u010dasu vypr\u0161\u00ed platnost ko\u0159enov\u00e9ho certifik\u00e1tu spole\u010dnosti IdenTrust (DST Root CA X3), kter\u00fd byl pou\u017eit pro k\u0159\u00ed\u017eov\u00e9 podepisov\u00e1n\u00ed ko\u0159enov\u00e9ho certifik\u00e1tu certifika\u010dn\u00ed autority Let's.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/ustarevanie-kornevogo-sertifikata-identrust-privedyot-k-potere-doveriya-k-lets-encrypt-na-staryh-ustrojstvah","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u0441\u0442\u0430\u0440\u0435\u0432\u0430\u043d\u0438\u0435 \u043a\u043e\u0440\u043d\u0435\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 IdenTrust \u043f\u0440\u0438\u0432\u0435\u0434\u0451\u0442 \u043a \u043f\u043e\u0442\u0435\u0440\u0435 \u0434\u043e\u0432\u0435\u0440\u0438\u044f \u043a Let's Encrypt \u043d\u0430 \u0441\u0442\u0430\u0440\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445 | ProHoster","og:description":"30 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f \u0432 17:01 \u043f\u043e \u043c\u043e\u0441\u043a\u043e\u0432\u0441\u043a\u043e\u043c\u0443 \u0432\u0440\u0435\u043c\u0435\u043d\u0438 \u0438\u0441\u0442\u0435\u043a\u0430\u0435\u0442 \u0432\u0440\u0435\u043c\u044f \u0436\u0438\u0437\u043d\u0438 \u043a\u043e\u0440\u043d\u0435\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 IdenTrust (DST Root CA X3), \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0441\u044f \u0434\u043b\u044f \u043a\u0440\u043e\u0441\u0441-\u043f\u043e\u0434\u043f\u0438\u0441\u0438 \u043a\u043e\u0440\u043d\u0435\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 \u0443\u0434\u043e\u0441\u0442\u043e\u0432\u0435\u0440\u044f\u044e\u0449\u0435\u0433\u043e \u0446\u0435\u043d\u0442\u0440\u0430 Let's.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/ustarevanie-kornevogo-sertifikata-identrust-privedyot-k-potere-doveriya-k-lets-encrypt-na-staryh-ustrojstvah","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-09-27T14:22:56+00:00","article:modified_time":"2021-09-27T14:22:56+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"101436","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-09-27 14:30:20","updated":"2026-02-11 11:12:05","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/101436","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=101436"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/101436\/revisions"}],"predecessor-version":[{"id":160560,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/101436\/revisions\/160560"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=101436"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=101436"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=101436"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"