Det non-profit certifikatcenter Let’s Encrypt, som er styret af f\u00e6llesskabet og tilbyder certifikater uden omkostninger til alle interesserede, har besluttet at stoppe med at st\u00f8tte OCSP (Online Certificate Status Protocol), der anvendes til at kontrollere tilbagekaldelse af certifikater. I stedet for OCSP-protokollen anbefales det at bruge certifikattilbagekaldelseslister (CRL — Certificate Revocation List), som offentligg\u00f8res af Let’s Encrypt fra 2022. Den 7. maj 2025 vil Let’s Encrypt deaktivere tilf\u00f8jelsen af ocsp-links i de udstedte certifikater og oph\u00f8re med at behandle anmodninger relateret til udvidelsen «OCSP Must Staple». Den 6. august 2025 vil OCSP-anmodningsbehandlere blive deaktiveret p\u00e5 serverne. <\/p>\n
Som \u00e5rsagen til at stoppe med at st\u00f8tte OCSP n\u00e6vnes bekymringer om fortrolighed. Brugen af OCSP medf\u00f8rer, at hver gang der oprettes en sikker forbindelse for at kontrollere certifikatets gyldighed, sender kundens system en foresp\u00f8rgsel til OCSP-serveren fra certifikationsorganet, der har udstedt certifikatet. Som svar giver serveren oplysninger om, hvorvidt det angivne certifikat kan stoles p\u00e5. Problemet er, at certifikationsorganet f\u00e5r information om, hvorn\u00e5r og hvilke hjemmesider brugeren bes\u00f8ger i relation til hans IP-adressen<\/a>, hvilket kan betragtes som en l\u00e6kage af fortrolige oplysninger. Desuden p\u00e5f\u00f8rer brugen af OCSP en forsinkelse i behandlingen af foresp\u00f8rgslen, kr\u00e6ver, at brugeren har garanteret netv\u00e6rksadgang, og skaber en afh\u00e6ngighed af uafbrudt drift af OCSP-serverne. <\/p>\n For at l\u00f8se fortrolighedsproblemerne ved kontrol af tilbagekaldelse af certifikater er teknologien OCSP Stapling blevet udviklet, hvis essens er, at de certificerede OCSP-svar fra certifikationsorganet kan overf\u00f8res af servere, der betjener hjemmesider, under forhandlingen af TLS-forbindelsen med klienten (overf\u00f8rslen af OCSP-oplysninger er flyttet til servere<\/a> serverne, hvilket fjerner kundens system fra direkte kontakt med OCSP-serveren fra certifikationsorganet, og korrektheden af svarene sikres af certifikationsorganets digitale signatur). <\/p>\n Udover OCSP Stapling findes der en udvidelse kaldet «OCSP Must Staple», som foreskriver, at browsere skal bruge OCSP Stapling-teknikken i stedet for direkte at kontakte OCSP-servere og kr\u00e6ver, at certificatet betragtes som uimodtageligt, hvis den betjenede server ikke har returneret et valideret OCSP-svar. Desv\u00e6rre har udvidelsen «Must Staple» ikke f\u00e5et bred anvendelse i browsere, mens OCSP Stapling-teknologien kr\u00e6ver, at st\u00f8tte aktiveres eksplicit p\u00e5 HTTP-servere (det er underst\u00f8ttet i nginx siden 2013). <\/p>\n Ved brug af CRL udf\u00f8res kontrol af tilbagekaldelse af certifikater lokalt baseret p\u00e5 lister, der er dannet af certifikatcentret. Ulemperne ved denne tilgang er den meget store st\u00f8rrelse af de data, der downloades, og der opst\u00e5r en midlertidig kl\u00f8ft i informationens aktualitet (for eksempel opdateres data i Firefox hver 6. time). Problemet med st\u00f8rrelsen er blevet l\u00f8st i browsere ved at proxy CRL til serverne fra browserproducenterne — der inkluderes en grundl\u00e6ggende CRL i browserne, som i l\u00f8bet af drift periodisk synkroniseres med den aktuelle liste (kun \u00e6ndrede data sendes til klientens system). For at reducere st\u00f8rrelsen p\u00e5 databasen med CRL anvendes en probabilistisk struktur kaldet «Bloom-filter», der muligg\u00f8r opbevaring af hele CRL-databasen p\u00e5 klientsiden i en meget kompakt repr\u00e6sentation. I Firefox er en tilsvarende teknik implementeret ved hj\u00e6lp af CRLite-v\u00e6rkt\u00f8jet, mens det i Chrome er implementeret med CRLSets. \u041d\u0435\u043a\u043e\u043c\u043c\u0435\u0440\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0434\u043e\u0441\u0442\u043e\u0432\u0435\u0440\u044f\u044e\u0449\u0438\u0439 \u0446\u0435\u043d\u0442\u0440 Let’s Encrypt, \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u044b\u0439 \u0441\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e\u043c \u0438 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0439 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u044b \u0431\u0435\u0437\u0432\u043e\u0437\u043c\u0435\u0437\u0434\u043d\u043e \u0432\u0441\u0435\u043c \u0436\u0435\u043b\u0430\u044e\u0449\u0438\u043c, \u043f\u0440\u0438\u043d\u044f\u043b \u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u0435\u043a\u0440\u0430\u0442\u0438\u0442\u044c \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0443 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 OCSP (Online Certificate Status Protocol), \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u0433\u043e \u0434\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043e\u0442\u0437\u044b\u0432\u0430 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432. \u0412\u043c\u0435\u0441\u0442\u043e \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 OCSP \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u0435\u0442\u0441\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0441\u043f\u0438\u0441\u043a\u0438 \u043e\u0442\u043e\u0437\u0432\u0430\u043d\u043d\u044b\u0445 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 (CRL — Certificate Revocation List), \u043f\u0443\u0431\u043b\u0438\u043a\u0443\u0435\u043c\u044b\u0435 \u0441\u0435\u0440\u0432\u0438\u0441\u043e\u043c Let’s Encrypt \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 2022 \u0433\u043e\u0434\u0430. 7 \u043c\u0430\u044f 2025 \u0433\u043e\u0434\u0430 Let’s Encrypt […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-120904","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Let's Encrypt stopper supporten af OCSP-protokollen til kontrol af tilbagekaldte certifikater | ProHoster","description":"Den non-profit certifikatmyndighed Let's Encrypt, der kontrolleres af f\u00e6llesskabet og tilbyder certifikater gratis til alle, der \u00f8nsker det, har besluttet at stoppe med at st\u00f8tte OCSP-protokollen (Online Certificate Status).","canonical_url":"https:\/\/prohoster.info\/da\/blog\/news\/lets-encrypt-prekrashhaet-podderzhku-protokola-ocsp-dlya-proverki-otozvannyh-sertifikatov","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Let's Encrypt \u043f\u0440\u0435\u043a\u0440\u0430\u0449\u0430\u0435\u0442 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0443 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 OCSP \u0434\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043e\u0442\u043e\u0437\u0432\u0430\u043d\u043d\u044b\u0445 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 | ProHoster","og:description":"\u041d\u0435\u043a\u043e\u043c\u043c\u0435\u0440\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0434\u043e\u0441\u0442\u043e\u0432\u0435\u0440\u044f\u044e\u0449\u0438\u0439 \u0446\u0435\u043d\u0442\u0440 Let's Encrypt, \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u044b\u0439 \u0441\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e\u043c \u0438 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0439 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u044b \u0431\u0435\u0437\u0432\u043e\u0437\u043c\u0435\u0437\u0434\u043d\u043e \u0432\u0441\u0435\u043c \u0436\u0435\u043b\u0430\u044e\u0449\u0438\u043c, \u043f\u0440\u0438\u043d\u044f\u043b \u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u0435\u043a\u0440\u0430\u0442\u0438\u0442\u044c \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0443 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 OCSP (Online Certificate Status.","og:url":"https:\/\/prohoster.info\/da\/blog\/news\/lets-encrypt-prekrashhaet-podderzhku-protokola-ocsp-dlya-proverki-otozvannyh-sertifikatov","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-12-09T13:46:00+00:00","article:modified_time":"2024-12-09T13:46:00+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"120904","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 17:38:18","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 08:45:20","updated":"2026-02-09 17:38:18","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/120904","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=120904"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/120904\/revisions"}],"predecessor-version":[{"id":159219,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/120904\/revisions\/159219"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=120904"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=120904"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=120904"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Kilde: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"