Non-profit certifying authority , community-controlled and providing certificates free of charge to all who wish, on the implementation of a new scheme for confirming authorization to obtain a certificate for a domain. Accessing the server hosting the directory used in the verification " / .well-known / acme-challenge / ", will now be conducted using several HTTP requests sent from 4 different IP addresses located in different data centers and belonging to different autonomous systems. The verification is considered successful only if at least 3 out of 4 requests from different IPs were successful.
Verification from multiple subnets will minimize the risks of obtaining certificates for foreign domains through targeted attacks that redirect traffic by substituting fake routes using BGP. When using a multi-position verification system, an attacker will need to simultaneously redirect routes for several providers’ autonomous systems with different uplinks, which is significantly more complex than redirecting a single route. Furthermore, sending requests from different IPs will enhance the reliability of verification in case any single Let’s Encrypt hosts are placed on block lists (for example, in Russia, some IPs of letsencrypt.org have been subject to Roskomnadzor's blocking).
Until June 1, a transition period will be in effect, allowing the generation of certificates upon successful verification from the primary data center when the host from other subnets is unavailable (for instance, this may happen if the host administrator has permitted requests only from the primary Let’s Encrypt data center, or due to DNS zone synchronization issues). A whitelist will be prepared based on the logs for domains experiencing verification problems from 3 additional data centers. Only domains with filled-in contact information will be included on the whitelist. If a domain is not automatically added to the whitelist, a request for inclusion can also be submitted through .
I øjeblikket har Let’s Encrypt-projektet udstedt 113 millioner certifikater, der dækker omkring 190 millioner domæner (for et år siden var det dækket 150 millioner domæner, og for to år siden — 61 millioner). Ifølge statistikken fra Firefox Telemetry udgør den samlede andel af sideanmodninger over HTTPS 81% (for et år siden 77%, for to år siden 69%), og i USA — 91%.
Derudover kan det nævnes, Apple-virksomheden
ophøre med at stole på certifikater i Safari-browseren, hvis levetid overstiger 398 dage (13 måneder). Begrænsningen forventes at blive indført kun for certifikater udstedt fra 1. september 2020. For certifikater udstedt før 1. september, der har en lang levetid, vil tilliden blive bevaret, men begrænset til 825 dage (2,2 år).
Ændringen kan have en negativ indvirkning på forretningen for certifikatudstedere, der sælger billige certifikater med lange udløb, op til 5 år. Ifølge Apple skaber genereringen af sådanne certifikater yderligere sikkerhedstrusler, forhindrer hurtig implementering af nye kryptostandarder og giver ondsindede aktører mulighed for i længere tid at kontrollere offerets trafik eller bruge den til phishing, hvis certifikatet lækkes ubemærket efter et hack.
Kilde: opennet.ru
