{"id":30214,"date":"2019-10-31T21:34:16","date_gmt":"2019-10-31T18:34:16","guid":{"rendered":"https:\/\/prohoster.info\/blog\/ietf-odobrili-acme-eto-standart-dlya-raboty-s-ssl-sertifikatami\/"},"modified":"2019-10-31T21:34:16","modified_gmt":"2019-10-31T18:34:16","slug":"ietf-odobrili-acme-eto-standart-dlya-raboty-s-ssl-sertifikatami","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/ietf-odobrili-acme-eto-standart-dlya-raboty-s-ssl-sertifikatami","title":{"rendered":"IETF har godkendt ACME - det er standarden for arbejde med SSL-certifikater","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

IETF godkendte standard<\/a><\/noindex> Automatisk Certifikatstyringsmilj\u00f8 (ACME), som vil hj\u00e6lpe med at automatisere modtagelsen af SSL-certifikater. Vi vil forklare, hvordan det fungerer.<\/p>\n

\"IETF<\/a><\/noindex><\/a><\/noindex>
\n\/ Flickr \/ Cliff Johnson<\/a><\/noindex> \/ CC BY-SA<\/a><\/noindex><\/i><\/p>\n

Hvorfor standarden var n\u00f8dvendig<\/h2>\n

\nI gennemsnit kan en administrator bruge fra en til tre timer p\u00e5 at konfigurere SSL-certifikatet<\/a><\/noindex> et dom\u00e6ne. Hvis der opst\u00e5r en fejl, m\u00e5 man vente p\u00e5, at anmodningen bliver afvist, og f\u00f8rst derefter kan man indsende den igen. Alt dette besv\u00e6rligg\u00f8r udrulningen af storskalasystemer.<\/p>\n

Valideringsproceduren for dom\u00e6net kan variere mellem certifikationscentre. Manglende standardisering f\u00f8rer nogle gange til sikkerhedsproblemer. Et kendt tilf\u00e6lde<\/a><\/noindex>, hvor en CA p\u00e5 grund af en fejl i systemet bekr\u00e6ftede alle anmeldte dom\u00e6ner. I s\u00e5danne situationer kan SSL-certifikater blive udstedt til svindlende ressourcer.<\/p>\n

Den godkendte IETF-protokol ACME (specifikation RFC8555<\/a><\/noindex>) skal automatisere og standardisere processen for at f\u00e5 certifikatet. Udelukkelse af den menneskelige faktor vil hj\u00e6lpe med at \u00f8ge p\u00e5lideligheden og sikkerheden ved validering af dom\u00e6nenavnet.<\/p>\n

Standarden er \u00e5ben, og alle interesserede kan bidrage til dens udvikling. I repository p\u00e5 GitHub<\/a><\/noindex> er der publiceret relevante instruktioner.<\/p>\n

Hvordan fungerer det<\/h2>\n

\nUdvekslingen af anmodninger i ACME sker via HTTPS ved hj\u00e6lp af JSON-beskeder. For at arbejde med protokollen er det n\u00f8dvendigt at installere en ACME-klient p\u00e5 m\u00e5lmaskinen, som genererer et unikt n\u00f8glepar ved f\u00f8rste kontakt med CA. Derefter vil de blive brugt til at underskrive alle klient- og serverbeskeder.<\/p>\n

Den f\u00f8rste besked indeholder kontaktoplysninger for dom\u00e6neejeren. Den underskrives med den private n\u00f8gle og sendes sammen med den offentlige n\u00f8gle til serveren. Serveren kontrollerer \u00e6gtheden af underskriften, og hvis alt er i orden, starter proceduren for udstedelse af SSL-certifikatet.<\/p>\n

For at f\u00e5 certifikatet skal klienten bevise over for serveren, at de ejer dom\u00e6net. For dette udf\u00f8rer de bestemte handlinger, som kun ejeren har adgang til. For eksempel kan certifikationscentret generere en unik token og bede klienten om at placere den p\u00e5 hjemmesiden. Derefter danner CA en web- eller DNS-anmodning for at hente n\u00f8glen fra denne token.<\/p>\n

For example, in the case of HTTP, the key from the token must be placed in a file that will be served by the web server. During DNS verification, the certificate authority will look for a unique key in the text document of the DNS record. If everything is in order, the server confirms that the client has been validated, and the CA issues the certificate.<\/p>\n

\"IETF
\n\/ Flickr \/ Blondinrikard Fr\u00f6berg<\/a><\/noindex> \/ CC BY<\/a><\/noindex><\/i><\/p>\n

Meninger<\/h2>\n

\nIf\u00f8lge if\u00f8lge<\/a><\/noindex> IETF, ACME will be useful for administrators who have to work with multiple domain names. The standard helps link each of them with the required SSL.<\/p>\n

Among the advantages of the standard, experts also note several security mechanisms<\/a><\/noindex>. They must ensure that SSL certificates are issued only to the legitimate owners of the domains. Specifically, a set of extensions is used to protect against DNS attacks, DNSSEC<\/a><\/noindex>and to protect against DoS, the standard limits the execution speed of individual requests \u2014 for example, HTTP for the method POST<\/a><\/noindex>. The ACME developers themselves anbefales det<\/a><\/noindex> add entropy to DNS queries and perform them from multiple points in the network to enhance security.<\/p>\n

Det f\u00f8rste selskab til virtualisering af grafiske processorer<\/h2>\n

\nProtocols are also used to obtain certificates, SCEP<\/a><\/noindex> og EST<\/a><\/noindex>.<\/p>\n

The former was developed at Cisco Systems. Its goal was to simplify the procedure for issuing X.509 digital certificates and make it as scalable as possible. Before the advent of SCEP, this process required active involvement from system administrators and did not scale well. Today, this protocol is one of the most widely used.<\/p>\n

As for EST, it allows PKI clients to obtain certificates over secure channels. It uses TLS for message transmission and SSL issuance, as well as to bind the CSR to the sender. Additionally, EST supports methods of elliptic cryptography, adding an extra level of protection.<\/p>\n

If\u00f8lge according to experts,<\/a><\/noindex>solutions like ACME will need to gain wider adoption. They provide a simplified and secure model for configuring SSL and also speed up the process.<\/p>\n

Additional posts from our corporate blog:<\/h5>\n

<\/p>\n