Neziskov\u00e1 certifika\u010dn\u00ed autorita Let's Encrypt, \u0159\u00edzen\u00e1 komunitou a poskytuj\u00edc\u00ed certifik\u00e1ty bezplatn\u011b v\u0161em z\u00e1jemc\u016fm, se rozhodla ukon\u010dit podporu protokolu OCSP (Online Certificate Status Protocol), kter\u00fd se pou\u017e\u00edv\u00e1 k ov\u011b\u0159ov\u00e1n\u00ed odvol\u00e1n\u00ed certifik\u00e1t\u016f. M\u00edsto protokolu OCSP se doporu\u010duje pou\u017e\u00edvat seznamy odvolan\u00fdch certifik\u00e1t\u016f (CRL - Certificate Revocation List), kter\u00e9 za\u010dne slu\u017eba Let's Encrypt publikovat od roku 2022. Dne 7. kv\u011btna 2025 Let's Encrypt vypne p\u0159id\u00e1v\u00e1n\u00ed odkaz\u016f na adresy OCSP do vyd\u00e1van\u00fdch certifik\u00e1t\u016f a p\u0159estane zpracov\u00e1vat po\u017eadavky souvisej\u00edc\u00ed s pou\u017eit\u00edm roz\u0161\u00ed\u0159en\u00ed \u201eOCSP Must Staple\u201c. Dne 6. srpna 2025 budou na serverech vypnuty zpracovatele OCSP po\u017eadavk\u016f. <\/p>\n
Jako d\u016fvod pro ukon\u010den\u00ed podpory OCSP se uv\u00e1d\u00ed p\u00e9\u010de o soukrom\u00ed. Pou\u017eit\u00ed OCSP vede k tomu, \u017ee p\u0159i ka\u017ed\u00e9m nav\u00e1z\u00e1n\u00ed zabezpe\u010den\u00e9ho p\u0159ipojen\u00ed k ov\u011b\u0159en\u00ed platnosti certifik\u00e1tu klientsk\u00fd syst\u00e9m odes\u00edl\u00e1 \u017e\u00e1dost na OCSP server certifika\u010dn\u00ed autority, kter\u00e1 certifik\u00e1t vygenerovala. V reakci server poskytuje informace o tom, zda lze dan\u00e9mu certifik\u00e1tu d\u016fv\u011b\u0159ovat. Probl\u00e9mem je, \u017ee certifika\u010dn\u00ed autorita z\u00edsk\u00e1v\u00e1 informace o tom, kdy a jak\u00e9 str\u00e1nky u\u017eivatel nav\u0161t\u011bvuje, v\u00e1zan\u00e9 na jeho IP adresu<\/a>, co\u017e m\u016f\u017ee b\u00fdt pova\u017eov\u00e1no za \u00fanik soukrom\u00fdch \u00fadaj\u016f. Nav\u00edc pou\u017eit\u00ed OCSP vede k v\u00fdskytu zpo\u017ed\u011bn\u00ed p\u0159i zpracov\u00e1n\u00ed \u017e\u00e1dosti, vy\u017eaduje zaru\u010den\u00fd p\u0159\u00edstup k s\u00edti a vytv\u00e1\u0159\u00ed z\u00e1vislost na bezprobl\u00e9mov\u00e9m fungov\u00e1n\u00ed OCSP server\u016f. <\/p>\n Pro vy\u0159e\u0161en\u00ed probl\u00e9m\u016f se soukrom\u00edm p\u0159i ov\u011b\u0159ov\u00e1n\u00ed zru\u0161en\u00ed certifik\u00e1t\u016f byla vyvinuta technologie OCSP Stapling, jej\u00ed\u017e podstatou je, \u017ee certifikovan\u00e9 odpov\u011bdi OCSP od certifika\u010dn\u00ed autority mohou b\u00fdt p\u0159ed\u00e1ny servery obsluhuj\u00edc\u00edmi str\u00e1nky b\u011bhem navazov\u00e1n\u00ed TLS p\u0159ipojen\u00ed s klientem (p\u0159ed\u00e1n\u00ed \u00fadaj\u016f OCSP se p\u0159esune na servery<\/a> servery, co\u017e zbavuje klientsk\u00fd syst\u00e9m p\u0159\u00edm\u00e9ho kontaktu s OCSP serverem certifika\u010dn\u00ed autority, p\u0159i\u010dem\u017e spr\u00e1vnost odpov\u011bd\u00ed zaji\u0161\u0165uje digit\u00e1ln\u00ed podpis certifika\u010dn\u00ed autority). <\/p>\n Krom\u011b OCSP Stapling existuje v certifik\u00e1tech p\u0159idan\u00e9 roz\u0161\u00ed\u0159en\u00ed \u201eOCSP Must Staple\u201c, kter\u00e9 ukl\u00e1d\u00e1 prohl\u00ed\u017ee\u010d\u016fm pou\u017e\u00edvat techniku OCSP Stapling m\u00edsto p\u0159\u00edm\u00e9ho kontaktu se servery OCSP a vy\u017eaduje pova\u017eovat certifik\u00e1t za ned\u016fv\u011bryhodn\u00fd, pokud obsluhuj\u00edc\u00ed server nevr\u00e1til ov\u011b\u0159enou odpov\u011b\u010f OCSP. Bohu\u017eel roz\u0161\u00ed\u0159en\u00ed \u201eMust Staple\u201c se v prohl\u00ed\u017ee\u010d\u00edch \u0161iroce neujalo, a technologie OCSP Stapling z\u00e1vis\u00ed na nutnosti explicitn\u00edho povolen\u00ed podpory na stran\u011b HTTP serveru (v nginx je podpora od roku 2013). <\/p>\n P\u0159i pou\u017eit\u00ed CRL se kontrola odvol\u00e1n\u00ed certifik\u00e1t\u016f prov\u00e1d\u00ed na lok\u00e1ln\u00edm syst\u00e9mu podle seznam\u016f, kter\u00e9 vytv\u00e1\u0159\u00ed certifika\u010dn\u00ed autorita. Nev\u00fdhodou tohoto p\u0159\u00edstupu je velmi velik\u00fd objem stahovan\u00fdch dat a vznik do\u010dasn\u00e9 nesrovnalosti v aktu\u00e1lnosti informac\u00ed (nap\u0159\u00edklad v prohl\u00ed\u017ee\u010di Firefox se data aktualizuj\u00ed jednou za 6 hodin). Probl\u00e9m s velikost\u00ed byl vy\u0159e\u0161en v prohl\u00ed\u017ee\u010d\u00edch pomoc\u00ed proxy CRL na serverech v\u00fdrobc\u016f prohl\u00ed\u017ee\u010d\u016f \u2014 do prohl\u00ed\u017ee\u010d\u016f je za\u010dlen\u011bn z\u00e1kladn\u00ed CRL, kter\u00fd se b\u011bhem pou\u017e\u00edv\u00e1n\u00ed pravideln\u011b synchronizuje s aktu\u00e1ln\u00edm seznamem (klientsk\u00e9mu syst\u00e9mu se p\u0159ed\u00e1vaj\u00ed pouze zm\u011bn\u011bn\u00e1 data). Pro sn\u00ed\u017een\u00ed velikosti datab\u00e1ze s CRL se pou\u017e\u00edv\u00e1 pravd\u011bpodobnostn\u00ed struktura \u201eBloom\u016fv filtr\u201c, kter\u00e1 umo\u017e\u0148uje ukl\u00e1dat celou datab\u00e1zi CRL na stran\u011b klienta v velmi kompaktn\u00ed podob\u011b. V prohl\u00ed\u017ee\u010di Firefox je podobn\u00e1 technika implementov\u00e1na pomoc\u00ed n\u00e1stroje CRLite, a v Chrome \u2013 CRLSets. \u041d\u0435\u043a\u043e\u043c\u043c\u0435\u0440\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0434\u043e\u0441\u0442\u043e\u0432\u0435\u0440\u044f\u044e\u0449\u0438\u0439 \u0446\u0435\u043d\u0442\u0440 Let’s Encrypt, \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u044b\u0439 \u0441\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e\u043c \u0438 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0439 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u044b \u0431\u0435\u0437\u0432\u043e\u0437\u043c\u0435\u0437\u0434\u043d\u043e \u0432\u0441\u0435\u043c \u0436\u0435\u043b\u0430\u044e\u0449\u0438\u043c, \u043f\u0440\u0438\u043d\u044f\u043b \u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u0435\u043a\u0440\u0430\u0442\u0438\u0442\u044c \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0443 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 OCSP (Online Certificate Status Protocol), \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u0433\u043e \u0434\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043e\u0442\u0437\u044b\u0432\u0430 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432. \u0412\u043c\u0435\u0441\u0442\u043e \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 OCSP \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u0435\u0442\u0441\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0441\u043f\u0438\u0441\u043a\u0438 \u043e\u0442\u043e\u0437\u0432\u0430\u043d\u043d\u044b\u0445 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 (CRL — Certificate Revocation List), \u043f\u0443\u0431\u043b\u0438\u043a\u0443\u0435\u043c\u044b\u0435 \u0441\u0435\u0440\u0432\u0438\u0441\u043e\u043c Let’s Encrypt \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 2022 \u0433\u043e\u0434\u0430. 7 \u043c\u0430\u044f 2025 \u0433\u043e\u0434\u0430 Let’s Encrypt […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-120904","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Let's Encrypt ukon\u010duje podporu protokolu OCSP pro ov\u011b\u0159ov\u00e1n\u00ed odvolan\u00fdch certifik\u00e1t\u016f | ProHoster","description":"Nekomer\u010dn\u00ed certifika\u010dn\u00ed autorita Let's Encrypt, \u0159\u00edzen\u00e1 komunitou a poskytuj\u00edc\u00ed certifik\u00e1ty zdarma v\u0161em z\u00e1jemc\u016fm, se rozhodla ukon\u010dit podporu protokolu OCSP (Online Certificate Status).","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/lets-encrypt-prekrashhaet-podderzhku-protokola-ocsp-dlya-proverki-otozvannyh-sertifikatov","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Let's Encrypt \u043f\u0440\u0435\u043a\u0440\u0430\u0449\u0430\u0435\u0442 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0443 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 OCSP \u0434\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043e\u0442\u043e\u0437\u0432\u0430\u043d\u043d\u044b\u0445 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 | ProHoster","og:description":"\u041d\u0435\u043a\u043e\u043c\u043c\u0435\u0440\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0434\u043e\u0441\u0442\u043e\u0432\u0435\u0440\u044f\u044e\u0449\u0438\u0439 \u0446\u0435\u043d\u0442\u0440 Let's Encrypt, \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u044b\u0439 \u0441\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e\u043c \u0438 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0439 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u044b \u0431\u0435\u0437\u0432\u043e\u0437\u043c\u0435\u0437\u0434\u043d\u043e \u0432\u0441\u0435\u043c \u0436\u0435\u043b\u0430\u044e\u0449\u0438\u043c, \u043f\u0440\u0438\u043d\u044f\u043b \u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u0435\u043a\u0440\u0430\u0442\u0438\u0442\u044c \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0443 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 OCSP (Online Certificate Status.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/lets-encrypt-prekrashhaet-podderzhku-protokola-ocsp-dlya-proverki-otozvannyh-sertifikatov","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-12-09T13:46:00+00:00","article:modified_time":"2024-12-09T13:46:00+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"120904","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 17:38:18","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 08:45:20","updated":"2026-02-09 17:38:18","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/120904","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=120904"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/120904\/revisions"}],"predecessor-version":[{"id":159219,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/120904\/revisions\/159219"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=120904"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=120904"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=120904"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"