{"id":72754,"date":"2020-03-04T02:42:36","date_gmt":"2020-03-03T23:42:36","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/massovyj-otzyv-sertifikatov-lets-encrypt"},"modified":"2020-03-04T02:42:36","modified_gmt":"2020-03-03T23:42:36","slug":"massovyj-otzyv-sertifikatov-lets-encrypt","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/massovyj-otzyv-sertifikatov-lets-encrypt","title":{"rendered":"Masov\u00e9 sta\u017een\u00ed certifik\u00e1t\u016f Let's Encrypt","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Nekomer\u010dn\u00ed certifika\u010dn\u00ed autorita Let's Encrypt, \u0159\u00edzen\u00e1 komunitou a poskytuj\u00edc\u00ed certifik\u00e1ty zdarma v\u0161em z\u00e1jemc\u016fm, varoval<\/a><\/noindex> o pl\u00e1novan\u00e9m zru\u0161en\u00ed mnoha d\u0159\u00edve vydan\u00fdch TLS\/SSL certifik\u00e1t\u016f. Z 116 milion\u016f aktu\u00e1ln\u011b platn\u00fdch certifik\u00e1t\u016f Let's Encrypt bude zru\u0161eno n\u011bco m\u00e1lo p\u0159es 3 miliony (2,6 %), z nich\u017e p\u0159ibli\u017en\u011b 1 milion jsou duplik\u00e1ty p\u0159ipojen\u00e9 k jedn\u00e9 dom\u00e9n\u011b (chyba se hlavn\u011b dotkla velmi \u010dasto aktualizovan\u00fdch certifik\u00e1t\u016f, proto je tolik duplik\u00e1t\u016f). Zru\u0161en\u00ed je napl\u00e1nov\u00e1no na 4. b\u0159ezna (p\u0159esn\u00fd \u010das zat\u00edm nebyl ur\u010den, ale zru\u0161en\u00ed prob\u011bhne nejd\u0159\u00edve ve 3 hodiny r\u00e1no MSK).<\/p>\n

Pot\u0159eba odvol\u00e1n\u00ed je zp\u016fsobena zji\u0161t\u011bn\u00edm 29. \u00fanora chyby<\/a><\/noindex>. Probl\u00e9m se projevuje od 25. \u010dervence 2019 a dot\u00fdk\u00e1 se syst\u00e9mu ov\u011b\u0159ov\u00e1n\u00ed CAA z\u00e1znam\u016f v DNS. Z\u00e1znam CAA (RFC-6844<\/a><\/noindex>, Certificate Authority Authorization) umo\u017e\u0148uje vlastn\u00edkovi dom\u00e9ny jasn\u011b ur\u010dit certifika\u010dn\u00ed autoritu, prost\u0159ednictv\u00edm kter\u00e9 lze generovat certifik\u00e1ty pro danou dom\u00e9nu. Pokud certifika\u010dn\u00ed autorita nen\u00ed uvedena v z\u00e1znamech CAA, je povinen zablokovat vyd\u00e1n\u00ed certifik\u00e1t\u016f pro tuto dom\u00e9nu a informovat majitele dom\u00e9ny o pokusech o kompromitaci. V\u011bt\u0161inou je certifik\u00e1t po\u017eadov\u00e1n hned po \u00fasp\u011b\u0161n\u00e9m ov\u011b\u0159en\u00ed CAA, ale v\u00fdsledek ov\u011b\u0159en\u00ed se pova\u017euje za platn\u00fd je\u0161t\u011b 30 dn\u00ed. Pravidla tak\u00e9 p\u0159ikazuj\u00ed prov\u00e1d\u011bt op\u011btovnou kontrolu nejd\u00e9le 8 hodin p\u0159ed vyd\u00e1n\u00edm nov\u00e9ho certifik\u00e1tu (tj. pokud od posledn\u00edho ov\u011b\u0159en\u00ed uplynulo 8 hodin, je pot\u0159ebn\u00e1 op\u011btovn\u00e1 kontrola).<\/p>\n

Chyba se projevuje, pokud \u017e\u00e1dost o certifik\u00e1t zahrnuje v\u00edce dom\u00e9nov\u00fdch jmen, pro ka\u017ed\u00e9 z nich\u017e je vy\u017eadov\u00e1no ov\u011b\u0159en\u00ed z\u00e1znamu CAA. Podstatou chyby je, \u017ee v okam\u017eiku op\u011btovn\u00e9ho ov\u011b\u0159en\u00ed nebyla validov\u00e1na v\u0161echna dom\u00e9ny, ale prob\u00edhalo pouze op\u011btovn\u00e9 ov\u011b\u0159en\u00ed pouze jedn\u00e9 dom\u00e9ny ze seznamu (pokud bylo v \u017e\u00e1dosti N dom\u00e9n, m\u00edsto N r\u016fzn\u00fdch ov\u011b\u0159en\u00ed, byla jedna dom\u00e9na ov\u011b\u0159ov\u00e1na Nkr\u00e1t). U ostatn\u00edch dom\u00e9n nebylo op\u011btovn\u00e9 ov\u011b\u0159en\u00ed provedeno a p\u0159i rozhodov\u00e1n\u00ed byly pou\u017eity \u00fadaje z prvn\u00edho ov\u011b\u0159en\u00ed (tj. byly pou\u017eity \u00fadaje star\u00e9 maxim\u00e1ln\u011b 30 dn\u00ed). V d\u016fsledku toho mohlo Let's Encrypt vydat certifik\u00e1t i b\u011bhem 30 dn\u00ed po prvn\u00edm ov\u011b\u0159en\u00ed, i kdy\u017e byla hodnota z\u00e1znamu CAA zm\u011bn\u011bna a Let's Encrypt byla odstran\u011bna ze seznamu povolen\u00fdch certifika\u010dn\u00edch autorit.<\/p>\n

U\u017eivatel\u00e9 dot\u010den\u00ed probl\u00e9mem obdr\u017eeli e-mailov\u00e9 upozorn\u011bn\u00ed, pokud byly p\u0159i z\u00edsk\u00e1n\u00ed certifik\u00e1tu vypln\u011bny kontaktn\u00ed \u00fadaje. Svoje certifik\u00e1ty m\u016f\u017eete zkontrolovat nahr\u00e1n\u00edm seznam<\/a><\/noindex> s\u00e9riov\u00fdch \u010d\u00edsel zru\u0161en\u00fdch certifik\u00e1t\u016f nebo vyu\u017eit\u00edm online slu\u017eby<\/a><\/noindex> (um\u00edst\u011bn\u00e9 na IP adrese, kter\u00e1 je blokov\u00e1na<\/a><\/noindex> v RF Roskomnadzorem). Z\u00edskat s\u00e9riov\u00e9 \u010d\u00edslo certifik\u00e1tu pro danou dom\u00e9nu m\u016f\u017eete pomoc\u00ed p\u0159\u00edkazu:<\/p>\n

openssl s_client -connect example.com:443 -showcerts \/dev\/null \\
\n | openssl x509 -text -noout | grep -A 1 Serial\\ Number | tr -d :<\/p>\n

<\/a><\/noindex><\/p>\n

Zdroj: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041d\u0435\u043a\u043e\u043c\u043c\u0435\u0440\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0434\u043e\u0441\u0442\u043e\u0432\u0435\u0440\u044f\u044e\u0449\u0438\u0439 \u0446\u0435\u043d\u0442\u0440 Let’s Encrypt, \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u044b\u0439 \u0441\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e\u043c \u0438 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0439 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u044b \u0431\u0435\u0437\u0432\u043e\u0437\u043c\u0435\u0437\u0434\u043d\u043e \u0432\u0441\u0435\u043c \u0436\u0435\u043b\u0430\u044e\u0449\u0438\u043c, \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b \u043e \u043f\u0440\u0435\u0434\u0441\u0442\u043e\u044f\u0449\u0435\u043c \u043e\u0442\u0437\u044b\u0432\u0435 \u043c\u043d\u043e\u0433\u0438\u0445 \u0440\u0430\u043d\u0435\u0435 \u0432\u044b\u0434\u0430\u043d\u043d\u044b\u0445 TLS\/SSL \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432. \u0418\u0437 116 \u043c\u043b\u043d \u043d\u044b\u043d\u0435 \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0445 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 Let’s Encrypt \u0431\u0443\u0434\u0435\u0442 \u043e\u0442\u043e\u0437\u0432\u0430\u043d\u043e \u0447\u0443\u0442\u044c \u0431\u043e\u043b\u044c\u0448\u0435 3 \u043c\u043b\u043d (2.6%), \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u0440\u0438\u043c\u0435\u0440\u043d\u043e 1 \u043c\u043b\u043d \u044f\u0432\u043b\u044f\u044e\u0442\u0441\u044f \u0434\u0443\u0431\u043b\u0438\u043a\u0430\u0442\u0430\u043c\u0438, \u043f\u0440\u0438\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u043c\u0438 \u043a \u043e\u0434\u043d\u043e\u043c\u0443 \u0434\u043e\u043c\u0435\u043d\u0443 (\u043e\u0448\u0438\u0431\u043a\u0430 \u0432 \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u043c \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u043b\u0430 \u043e\u0447\u0435\u043d\u044c \u0447\u0430\u0441\u0442\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u044f\u0435\u043c\u044b\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-72754","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Hromadn\u00e9 odvol\u00e1n\u00ed certifik\u00e1t\u016f Let's Encrypt | ProHoster","description":"neziskov\u00fd certifika\u010dn\u00ed \u00fa\u0159ad Let's Encrypt, \u0159\u00edzen\u00fd komunitou a poskytuj\u00edc\u00ed certifik\u00e1ty zdarma v\u0161em z\u00e1jemc\u016fm,","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/massovyj-otzyv-sertifikatov-lets-encrypt","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041c\u0430\u0441\u0441\u043e\u0432\u044b\u0439 \u043e\u0442\u0437\u044b\u0432 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 Let&apos;s Encrypt | ProHoster","og:description":"\u041d\u0435\u043a\u043e\u043c\u043c\u0435\u0440\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0434\u043e\u0441\u0442\u043e\u0432\u0435\u0440\u044f\u044e\u0449\u0438\u0439 \u0446\u0435\u043d\u0442\u0440 Let's Encrypt, \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u044b\u0439 \u0441\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e\u043c \u0438 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0439 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u044b \u0431\u0435\u0437\u0432\u043e\u0437\u043c\u0435\u0437\u0434\u043d\u043e \u0432\u0441\u0435\u043c \u0436\u0435\u043b\u0430\u044e\u0449\u0438\u043c,","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/massovyj-otzyv-sertifikatov-lets-encrypt","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-03-03T23:42:36+00:00","article:modified_time":"2020-03-03T23:42:36+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"72754","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 18:46:21","updated":"2022-09-28 12:43:03","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/72754","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=72754"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/72754\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=72754"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=72754"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=72754"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}