{"id":52168,"date":"2019-11-02T00:00:00","date_gmt":"2019-11-01T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/mozilla-cloudflare-i-facebook-predstavili-tls-rasshirenie-dlya-delegirovaniya-korotkozhivushhih-sertifikatov"},"modified":"2020-02-18T13:59:50","modified_gmt":"2020-02-18T10:59:50","slug":"mozilla-cloudflare-i-facebook-predstavili-tls-rasshirenie-dlya-delegirovaniya-korotkozhivushhih-sertifikatov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/mozilla-cloudflare-i-facebook-predstavili-tls-rasshirenie-dlya-delegirovaniya-korotkozhivushhih-sertifikatov","title":{"rendered":"Mozilla, Cloudflare a Facebook p\u0159edstavily roz\u0161\u00ed\u0159en\u00ed TLS pro delegaci kr\u00e1tkodob\u00fdch certifik\u00e1t\u016f","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Mozilla<\/a><\/noindex>, Cloudflare<\/a><\/noindex> a Facebook<\/a><\/noindex> spole\u010dn\u011b ozn\u00e1mili nov\u00e9 TLS roz\u0161\u00ed\u0159en\u00ed Delegated Credentials<\/a><\/noindex> (DC), kter\u00fd \u0159e\u0161\u00ed probl\u00e9m s certifik\u00e1ty p\u0159i organizaci p\u0159\u00edstupu na web prost\u0159ednictv\u00edm s\u00edt\u00ed dod\u00e1n\u00ed obsahu. Certifik\u00e1ty vyd\u00e1van\u00e9 certifika\u010dn\u00edmi autoritami maj\u00ed dlouhou dobu platnosti, co\u017e vytv\u00e1\u0159\u00ed obt\u00ed\u017ee p\u0159i nutnosti organizace p\u0159\u00edstupu na web prost\u0159ednictv\u00edm t\u0159et\u00ed slu\u017eby, za kterou by se m\u011blo navazovat zabezpe\u010den\u00e9 spojen\u00ed, proto\u017ee p\u0159ed\u00e1n\u00ed certifik\u00e1tu webu extern\u00ed slu\u017eb\u011b vytv\u00e1\u0159\u00ed dal\u0161\u00ed bezpe\u010dnostn\u00ed hrozby. <\/p>\n

Nov\u00e9 roz\u0161\u00ed\u0159en\u00ed m\u016f\u017ee tak\u00e9 b\u00fdt u\u017eite\u010dn\u00e9 pro weby, jejich\u017e provoz zaji\u0161\u0165uje velk\u00e1 distribuovan\u00e1 infrastruktura s mnoha vyva\u017eova\u010di z\u00e1t\u011b\u017ee. Delegated Credentials umo\u017en\u00ed vyhnout se ukl\u00e1d\u00e1n\u00ed kopi\u00ed soukrom\u00fdch kl\u00ed\u010d\u016f hlavn\u00edch certifik\u00e1t\u016f na ka\u017ed\u00e9m uzlu dod\u00e1n\u00ed obsahu. P\u0159i klasick\u00e9m p\u0159\u00edstupu \u00fasp\u011b\u0161n\u00fd \u00fatok na jak\u00fdkoli ze server\u016f, kter\u00e9 se pod\u00edlej\u00ed na dod\u00e1n\u00ed HTTPS provozu, povede k zkompromitov\u00e1n\u00ed cel\u00e9ho certifik\u00e1tu. V p\u0159\u00edpad\u011b p\u0159ed\u00e1n\u00ed soukrom\u00fdch kl\u00ed\u010d\u016f s\u00edt\u00edm dod\u00e1n\u00ed obsahu vznikaj\u00ed hrozby \u00faniku dat v d\u016fsledku diverze ze strany person\u00e1lu, akc\u00ed tajn\u00fdch slu\u017eeb nebo zkompromitov\u00e1n\u00ed infrastruktury CDN. <\/p>\n

Pokud \u00fanik kl\u00ed\u010d\u016f z\u016fstane nezpozorov\u00e1n, ti, kte\u0159\u00ed z\u00edskali p\u0159\u00edstup k kl\u00ed\u010d\u016fm, mohou po dostate\u010dn\u011b dlouhou dobu nen\u00e1padn\u011b zasahovat do provozu webu (MITM), proto\u017ee doby platnosti certifik\u00e1t\u016f se po\u010d\u00edtaj\u00ed m\u011bs\u00edci a lety. V Cloudflare pro ochranu kl\u00ed\u010d\u016f certifik\u00e1t\u016f mohou b\u00fdt aplikov\u00e1ny<\/a><\/noindex> speci\u00e1ln\u00ed kl\u00ed\u010dov\u00e9 servery pracuj\u00edc\u00ed na stran\u011b vlastn\u00edka webu, ale pr\u00e1ce v takov\u00e9m re\u017eimu vede k v\u00fdrazn\u00e9mu zpo\u017ed\u011bn\u00ed p\u0159i dod\u00e1n\u00ed provozu, sni\u017euje spolehlivost kv\u016fli vytvo\u0159en\u00ed dal\u0161\u00edho \u010dl\u00e1nku a vy\u017eaduje nasazen\u00ed slo\u017eit\u00e9 infrastruktury.<\/p>\n

Navrhovan\u00e9 TLS roz\u0161\u00ed\u0159en\u00ed Delegated Credentials zav\u00e1d\u00ed do u\u017e\u00edv\u00e1n\u00ed dal\u0161\u00ed mezilehl\u00fd soukrom\u00fd kl\u00ed\u010d, jeho\u017e doba platnosti je omezena na hodiny nebo n\u011bkolik dn\u016f (maxim\u00e1ln\u011b 7 dn\u00ed). Tento kl\u00ed\u010d je generov\u00e1n na z\u00e1klad\u011b certifik\u00e1tu vydan\u00e9ho certifika\u010dn\u00ed autoritou a umo\u017e\u0148uje udr\u017eet soukrom\u00fd kl\u00ed\u010d p\u016fvodn\u00edho certifik\u00e1tu v tajnosti p\u0159ed slu\u017ebami dod\u00e1n\u00ed obsahu t\u00edm, \u017ee jim poskytne pouze do\u010dasn\u00fd certifik\u00e1t s kr\u00e1tkou dobou platnosti. <\/p>\n

\"Mozilla,<\/a><\/noindex><\/center><\/p>\n

Aby se p\u0159ede\u0161lo probl\u00e9m\u016fm s p\u0159\u00edstupem po vypr\u0161en\u00ed platnosti prost\u0159edn\u00edho kl\u00ed\u010de, byla navr\u017eena technologie automatick\u00e9 aktualizace, kter\u00e1 se prov\u00e1d\u00ed na stran\u011b zdrojov\u00e9ho TLS serveru. K vygenerov\u00e1n\u00ed nen\u00ed t\u0159eba prov\u00e1d\u011bt manu\u00e1ln\u00ed operace nebo spou\u0161t\u011bt skripty \u2014 autorizovan\u00fd server, kter\u00fd pot\u0159ebuje soukrom\u00fd kl\u00ed\u010d, se p\u0159ed vypr\u0161en\u00edm platnosti p\u0159edchoz\u00edho kl\u00ed\u010de obr\u00e1t\u00ed na zdrojov\u00fd TLS server webu a ten vygeneruje prost\u0159edn\u00ed kl\u00ed\u010d na dal\u0161\u00ed kr\u00e1tk\u00e9 obdob\u00ed.<\/p>\n

\"Mozilla,<\/a><\/noindex><\/center><\/p>\n

Prohl\u00ed\u017ee\u010de podporuj\u00edc\u00ed TLS roz\u0161\u00ed\u0159en\u00ed Delegated Credentials budou takov\u00e9 odvozen\u00e9 certifik\u00e1ty pova\u017eovat za d\u016fv\u011bryhodn\u00e9. Nap\u0159\u00edklad podpora uveden\u00e9ho roz\u0161\u00ed\u0159en\u00ed ji\u017e byla p\u0159id\u00e1na do no\u010dn\u00edch sestaven\u00ed a beta verz\u00ed Firefoxu a m\u016f\u017ee b\u00fdt aktivov\u00e1na v about:config zm\u011bnou nastaven\u00ed \u00absecurity.tls.enable_delegated_credentials\u00bb. V polovin\u011b listopadu se pl\u00e1nuje mezi ur\u010dit\u00fdm procentem u\u017eivatel\u016f testovac\u00edch verz\u00ed Firefoxu prov\u00e9st experiment \u00abExperiment s Delegated Credentials TLS<\/a><\/noindex>\u00ab, v r\u00e1mci kter\u00e9ho bude pro ov\u011b\u0159en\u00ed kvality implementace nov\u00e9ho TLS roz\u0161\u00ed\u0159en\u00ed odesl\u00e1n testovac\u00ed po\u017eadavek na DC server Cloudflare. Podpora Delegated Credentials byla tak\u00e9 ji\u017e integrov\u00e1na do knihovny Fizz<\/a><\/noindex> s implementac\u00ed TLS 1.3.<\/p>\n

Specifikace Delegated Credentials byla p\u0159ed\u00e1na do v\u00fdboru IETF (Internet Engineering Task Force), kter\u00fd se zab\u00fdv\u00e1 rozvojem protokol\u016f a architektury internetu, a nach\u00e1z\u00ed se ve st\u00e1diu n\u00e1vrhu<\/a><\/noindex>, kter\u00fd usiluje o status internetov\u00e9ho standardu. Roz\u0161\u00ed\u0159en\u00ed Delegated Credentials lze pou\u017e\u00edvat pouze s TLSv1.3.
\nPro generaci mezilehl\u00fdch kl\u00ed\u010d\u016f je t\u0159eba z\u00edskat TLS certifik\u00e1t, kter\u00fd obsahuje speci\u00e1ln\u00ed roz\u0161\u00ed\u0159en\u00ed X.509, je\u017e v sou\u010dasnosti podporuje pouze certifika\u010dn\u00ed autorita DigiCert. <\/p>\n

<\/a><\/noindex><\/p>\n

Zdroj: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

Mozilla, Cloudflare \u0438 Facebook \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u043e \u0430\u043d\u043e\u043d\u0441\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u043d\u043e\u0432\u043e\u0435 TLS-\u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u0435 Delegated Credentials (DC), \u0440\u0435\u0448\u0430\u044e\u0449\u0435\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443 c \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430\u043c\u0438 \u043f\u0440\u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0441\u0430\u0439\u0442\u0443 \u0447\u0435\u0440\u0435\u0437 \u0441\u0435\u0442\u0438 \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u0430. \u0412\u044b\u0434\u0430\u0432\u0430\u0435\u043c\u044b\u0435 \u0443\u0434\u043e\u0441\u0442\u043e\u0432\u0435\u0440\u044f\u044e\u0449\u0438\u043c\u0438 \u0446\u0435\u043d\u0442\u0440\u0430\u043c\u0438 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u044b \u0438\u043c\u0435\u044e\u0442 \u0434\u043b\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0439 \u0441\u0440\u043e\u043a \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f, \u0447\u0442\u043e \u0441\u043e\u0437\u0434\u0430\u0451\u0442 \u0442\u0440\u0443\u0434\u043d\u043e\u0441\u0442\u0438 \u043f\u0440\u0438 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0441\u0430\u0439\u0442\u0443 \u0447\u0435\u0440\u0435\u0437 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0439 \u0441\u0435\u0440\u0432\u0438\u0441, \u043e\u0442 \u043b\u0438\u0446\u0430 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0434\u043e\u043b\u0436\u043d\u043e \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0442\u044c\u0441\u044f \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u043e\u0435 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0435, \u0442\u0430\u043a \u043a\u0430\u043a \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0430 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-52168","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Mozilla, Cloudflare a Facebook p\u0159edstavily TLS roz\u0161\u00ed\u0159en\u00ed pro delegov\u00e1n\u00ed kr\u00e1tkodob\u00fdch certifik\u00e1t\u016f | ProHoster","description":"Mozilla,","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/mozilla-cloudflare-i-facebook-predstavili-tls-rasshirenie-dlya-delegirovaniya-korotkozhivushhih-sertifikatov","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Mozilla, Cloudflare \u0438 Facebook \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0438 TLS-\u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u0435 \u0434\u043b\u044f \u0434\u0435\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043a\u043e\u0440\u043e\u0442\u043a\u043e\u0436\u0438\u0432\u0443\u0449\u0438\u0445 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 | ProHoster","og:description":"Mozilla,","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/mozilla-cloudflare-i-facebook-predstavili-tls-rasshirenie-dlya-delegirovaniya-korotkozhivushhih-sertifikatov","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-11-01T21:00:00+00:00","article:modified_time":"2020-02-18T10:59:50+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"52168","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 02:44:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 13:40:57","updated":"2026-01-24 02:44:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/52168","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=52168"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/52168\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=52168"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=52168"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=52168"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}