{"id":38175,"date":"2019-10-31T22:22:05","date_gmt":"2019-10-31T19:22:05","guid":{"rendered":"https:\/\/prohoster.info\/blog\/forum-ca-b-progolosoval-protiv-sokrashheniya-sroka-dejstviya-ssl-sertifikatov-do-397-dnej\/"},"modified":"2019-10-31T22:22:05","modified_gmt":"2019-10-31T19:22:05","slug":"forum-ca-b-progolosoval-protiv-sokrashheniya-sroka-dejstviya-ssl-sertifikatov-do-397-dnej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/forum-ca-b-progolosoval-protiv-sokrashheniya-sroka-dejstviya-ssl-sertifikatov-do-397-dnej","title":{"rendered":"F\u00f3rum CA\/B hlasoval proti zkr\u00e1cen\u00ed platnosti SSL certifik\u00e1t\u016f na 397 dn\u016f","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

26. \u010dervence 2019 spole\u010dnost Google navrhla<\/a><\/noindex> sn\u00ed\u017eit maxim\u00e1ln\u00ed dobu platnosti serverov\u00fdch SSL\/TLS certifik\u00e1t\u016f z aktu\u00e1ln\u00edch 825 dn\u00ed na 397 dn\u00ed (asi 13 m\u011bs\u00edc\u016f), tedy p\u0159ibli\u017en\u011b na polovinu. Google se domn\u00edv\u00e1, \u017ee pouze pln\u00e1 automatizace spr\u00e1vy certifik\u00e1t\u016f m\u016f\u017ee odstranit sou\u010dasn\u00e9 bezpe\u010dnostn\u00ed probl\u00e9my, kter\u00e9 jsou \u010dasto vysv\u011btlov\u00e1ny lidsk\u00fdm faktorem. Proto bychom se ide\u00e1ln\u011b m\u011bli sna\u017eit o automatizovan\u00e9 vyd\u00e1v\u00e1n\u00ed certifik\u00e1t\u016f s kr\u00e1tkou platnost\u00ed.<\/p>\n

Ot\u00e1zka byla p\u0159edlo\u017eena k hlasov\u00e1n\u00ed v organizaci CA\/Browser Forum (CABF), kter\u00e1 stanovuje po\u017eadavky na SSL\/TLS certifik\u00e1ty, v\u010detn\u011b maxim\u00e1ln\u00ed doby platnosti.<\/p>\n

A tak 10. z\u00e1\u0159\u00ed byly ozn\u00e1meny v\u00fdsledky<\/a><\/noindex>: \u010dlenov\u00e9 konsorcia hlasovali proti<\/b> o n\u00e1vrhu.
\n<\/a><\/noindex><\/p>\n

V\u00fdsledky<\/h1>\n

<\/p>\n

Hlasov\u00e1n\u00ed vydavatel\u016f certifik\u00e1t\u016f<\/h4>\n

Pro (11 hlas\u016f)<\/b>: Amazon, Buypass, Certigna (DHIMYOTIS), certSIGN, Sectigo (b\u00fdval\u00fd Comodo CA), eMudhra, Kamu SM, Let’s Encrypt, Logius, PKIoverheid, SHECA, SSL.com<\/p>\n

Proti (20)<\/b>: Camerfirma, Certum (Asseco), CFCA, Chunghwa Telecom, Comsign, D-TRUST, DarkMatter, Entrust Datacard, Firmaprofesional, GDCA, GlobalSign, GoDaddy, Izenpe, Network Solutions, OATI, SECOM, SwissSign, TWCA, TrustCor, SecureTrust (d\u0159\u00edve Trustwave)<\/p>\n

Zdr\u017eeli se (2)<\/b>: HARICA, TurkTrust<\/p><\/blockquote>\n

<\/p>\n

Hlasov\u00e1n\u00ed spot\u0159ebitel\u016f certifik\u00e1t\u016f<\/h4>\n

Pro (7)<\/b>: Apple, Cisco, Google, Microsoft, Mozilla, Opera, 360<\/p>\n

Proti<\/b>: 0<\/p>\n

Zdr\u017eelo se<\/b>: 0<\/p><\/blockquote>\n

\nPodle pravidel CA\/Browser Forum mus\u00ed pro p\u0159ijet\u00ed kladn\u00e9ho rozhodnut\u00ed hlasovat dv\u011b t\u0159etiny vydavatel\u016f certifik\u00e1t\u016f a 50 % plus jeden hlas mezi spot\u0159ebiteli.<\/p>\n

Z\u00e1stupci spole\u010dnosti Digicert se omluvili<\/a><\/noindex> za vynech\u00e1n\u00ed hlasov\u00e1n\u00ed, kde by dali sv\u016fj hlas k podpo\u0159e zkr\u00e1cen\u00ed doby platnosti certifik\u00e1t\u016f. Upozornili, \u017ee pro n\u011bkter\u00e9 klienty m\u016f\u017ee zkr\u00e1cen\u00ed doby platnosti p\u0159edstavovat probl\u00e9m, ale v dlouhodob\u00e9m horizontu to p\u0159in\u00e1\u0161\u00ed v\u00fdhody pro bezpe\u010dnost.<\/p>\n

A\u0165 u\u017e to je jakkoli, pr\u016fmysl zat\u00edm nen\u00ed p\u0159ipraven na zkr\u00e1cen\u00ed doby platnosti certifik\u00e1t\u016f a na \u00fapln\u00fd p\u0159echod na automatizovan\u00e1 \u0159e\u0161en\u00ed. Samotn\u00e9 certifika\u010dn\u00ed autority takov\u00e9 slu\u017eby mohou nab\u00eddnout, ale mnoz\u00ed klienti zat\u00edm automatizaci neimplementovali. Proto je zkr\u00e1cen\u00ed poji\u0161t\u011bn\u00ed na 397 dn\u00ed zat\u00edm odlo\u017eeno. Ale ot\u00e1zka z\u016fst\u00e1v\u00e1 otev\u0159en\u00e1.<\/p>\n

Nyn\u00ed m\u016f\u017ee Google zkusit zav\u00e9st standard \u201en\u00e1siln\u011b\u201c, jak tomu bylo u protokolu Certificate Transparency<\/a><\/noindex>. O to v\u00edce, \u017ee jejich podporuj\u00ed i jin\u00ed v\u00fdvoj\u00e1\u0159i: Apple, Microsoft, Mozilla a Opera.<\/p>\n

P\u0159ipom\u00edn\u00e1me, \u017ee pln\u00e1 automatizace je jedn\u00edm z princip\u016f, na kter\u00fdch je zalo\u017eena \u010dinnost neziskov\u00e9ho certifika\u010dn\u00edho centra Let's Encrypt. To vyd\u00e1v\u00e1 zdarma certifik\u00e1ty v\u0161em z\u00e1jemc\u016fm, av\u0161ak maxim\u00e1ln\u00ed doba platnosti certifik\u00e1tu je omezena na 90 dn\u00ed. Kr\u00e1tk\u00e1 doba platnosti certifik\u00e1t\u016f m\u00e1 dv\u011b hlavn\u00ed v\u00fdhody<\/a><\/noindex>:<\/p>\n

    \n
  1. omezen\u00ed \u0161kod zp\u016fsoben\u00fdch kompromitovan\u00fdmi kl\u00ed\u010di a chybn\u011b vydan\u00fdmi certifik\u00e1ty, proto\u017ee jsou pou\u017e\u00edv\u00e1ny po krat\u0161\u00ed \u010dasov\u00e9 obdob\u00ed.\n<\/li>\n
  2. Kr\u00e1tkodob\u00e9 certifik\u00e1ty podporuj\u00ed a podporuj\u00ed automatizaci, kter\u00e1 je naprosto nezbytn\u00e1 pro snadn\u00e9 pou\u017e\u00edv\u00e1n\u00ed HTTPS. Pokud se chyst\u00e1me migrovat cel\u00fd internet na HTTPS, nelze o\u010dek\u00e1vat ru\u010dn\u00ed aktualizaci certifik\u00e1t\u016f od spr\u00e1vce ka\u017ed\u00e9ho existuj\u00edc\u00edho webu. Jakmile se vyd\u00e1v\u00e1n\u00ed a aktualizace certifik\u00e1t\u016f stane pln\u011b automatizovan\u00fdm, krat\u0161\u00ed doby platnosti certifik\u00e1t\u016f se naopak stanou pohodln\u011bj\u0161\u00edmi a prakti\u010dt\u011bj\u0161\u00edmi. <\/li>\n<\/ol>\n

    \nPr\u016fzkum GlobalSign na Habr.ru<\/a><\/noindex> uk\u00e1zal, \u017ee 73,7 % respondent\u016f \u201esp\u00ed\u0161e podporuje\u201c zkr\u00e1cen\u00ed doby platnosti certifik\u00e1t\u016f.<\/p>\n

    Pokud jde o skryt\u00ed loga EV pro SSL certifik\u00e1ty v adresn\u00edm \u0159\u00e1dku, konsorcium o t\u00e9to ot\u00e1zce nehlasovalo, proto\u017ee ot\u00e1zka UI prohl\u00ed\u017ee\u010d\u016f je zcela v kompetenci v\u00fdvoj\u00e1\u0159\u016f. V z\u00e1\u0159\u00ed-\u0159\u00edjnu vyjdou nov\u00e9 verze Chrome 77 a Firefox 70, kter\u00e9 zbav\u00ed EV certifik\u00e1ty zvl\u00e1\u0161tn\u00edho m\u00edsta v adresn\u00edm \u0159\u00e1dku prohl\u00ed\u017ee\u010de. Takto vypad\u00e1 zm\u011bna na p\u0159\u00edkladu desktopov\u00e9 verze Firefox 70:<\/p>\n

    Bylo:<\/p>\n

    \"F\u00f3rum
    \n
    \nBude:<\/p>\n

    \"F\u00f3rum
    \n
    \nPodle bezpe\u010dnostn\u00edho experta Trot Hanta odstran\u011bn\u00ed informac\u00ed EV z adresn\u00edho \u0159\u00e1dku prohl\u00ed\u017ee\u010d\u016f     v podstat\u011b poh\u0159b\u00edv\u00e1 tento typ certifik\u00e1t\u016f.<\/a><\/noindex>.
    \n
    Zdroj:     habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

    26 \u0438\u044e\u043b\u044f 2019 \u0433\u043e\u0434\u0430 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Google \u0432\u044b\u0441\u0442\u0443\u043f\u0438\u043b\u0430 \u0441 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u0438\u0435\u043c \u0443\u043c\u0435\u043d\u044c\u0448\u0438\u0442\u044c \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u044b\u0439 \u0441\u0440\u043e\u043a \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u0441\u0435\u0440\u0432\u0435\u0440\u043d\u044b\u0445 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 SSL\/TLS \u0441 \u043d\u044b\u043d\u0435\u0448\u043d\u0438\u0445 825 \u0434\u043d\u0435\u0439 \u0434\u043e 397 \u0434\u043d\u0435\u0439 (\u043e\u043a\u043e\u043b\u043e 13 \u043c\u0435\u0441\u044f\u0446\u0435\u0432), \u0442\u043e \u0435\u0441\u0442\u044c \u043f\u0440\u0438\u043c\u0435\u0440\u043d\u043e \u0432\u0434\u0432\u043e\u0435. Google \u0441\u0447\u0438\u0442\u0430\u0435\u0442, \u0447\u0442\u043e \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u043e\u043b\u043d\u0430\u044f \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0437\u0430\u0446\u0438\u044f \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0439 \u0441 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430\u043c\u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442 \u0438\u0437\u0431\u0430\u0432\u0438\u0442\u044c\u0441\u044f \u043e\u0442 \u043d\u044b\u043d\u0435\u0448\u043d\u0438\u0445 \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0441 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\u044e, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0447\u0430\u0441\u0442\u043e \u043e\u0431\u044a\u044f\u0441\u043d\u044f\u044e\u0442\u0441\u044f \u0447\u0435\u043b\u043e\u0432\u0435\u0447\u0435\u0441\u043a\u0438\u043c \u0444\u0430\u043a\u0442\u043e\u0440\u043e\u043c. \u041f\u043e\u044d\u0442\u043e\u043c\u0443 \u0432 \u0438\u0434\u0435\u0430\u043b\u0435 \u043d\u0443\u0436\u043d\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":28658,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-38175","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47F\u00f3rum CA\/B hlasovalo proti zkr\u00e1cen\u00ed doby platnosti SSL certifik\u00e1t\u016f na 397 dn\u00ed | ProHoster","description":"Dne 26. \u010dervence 2019 spole\u010dnost Google navrhla sn\u00ed\u017eit maxim\u00e1ln\u00ed dobu platnosti serverov\u00fdch.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/forum-ca-b-progolosoval-protiv-sokrashheniya-sroka-dejstviya-ssl-sertifikatov-do-397-dnej","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0424\u043e\u0440\u0443\u043c CA\/B \u043f\u0440\u043e\u0433\u043e\u043b\u043e\u0441\u043e\u0432\u0430\u043b \u043f\u0440\u043e\u0442\u0438\u0432 \u0441\u043e\u043a\u0440\u0430\u0449\u0435\u043d\u0438\u044f \u0441\u0440\u043e\u043a\u0430 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f SSL-\u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 \u0434\u043e 397 \u0434\u043d\u0435\u0439 | ProHoster","og:description":"26 \u0438\u044e\u043b\u044f 2019 \u0433\u043e\u0434\u0430 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Google \u0432\u044b\u0441\u0442\u0443\u043f\u0438\u043b\u0430 \u0441 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u0438\u0435\u043c \u0443\u043c\u0435\u043d\u044c\u0448\u0438\u0442\u044c \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u044b\u0439 \u0441\u0440\u043e\u043a \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u0441\u0435\u0440\u0432\u0435\u0440\u043d\u044b\u0445.","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/forum-ca-b-progolosoval-protiv-sokrashheniya-sroka-dejstviya-ssl-sertifikatov-do-397-dnej","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:22:05+00:00","article:modified_time":"2019-10-31T19:22:05+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"38175","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 20:47:03","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 18:29:57","updated":"2026-01-23 20:47:03","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/38175","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=38175"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/38175\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/28658"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=38175"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=38175"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=38175"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}