{"id":52168,"date":"2019-11-02T00:00:00","date_gmt":"2019-11-01T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/mozilla-cloudflare-i-facebook-predstavili-tls-rasshirenie-dlya-delegirovaniya-korotkozhivushhih-sertifikatov"},"modified":"2020-02-18T13:59:50","modified_gmt":"2020-02-18T10:59:50","slug":"mozilla-cloudflare-i-facebook-predstavili-tls-rasshirenie-dlya-delegirovaniya-korotkozhivushhih-sertifikatov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/news\/mozilla-cloudflare-i-facebook-predstavili-tls-rasshirenie-dlya-delegirovaniya-korotkozhivushhih-sertifikatov","title":{"rendered":"Mozilla, Cloudflare og Facebook har pr\u00e6senteret en TLS-udvidelse til delegation af kortvarige certifikater","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Mozilla<\/a><\/noindex>, Cloudflare<\/a><\/noindex> og Facebook<\/a><\/noindex> samarbejdede om at annoncere en ny TLS-udvidelse Delegated Credentials<\/a><\/noindex> (DC), der l\u00f8ser problemet med certifikater ved adgang til websitet gennem indholdsleveringsnetv\u00e6rk. De certifikater, der udstedes af certifikationsmyndigheder, har lang holdbarhed, hvilket skaber vanskeligheder ved behovet for adgang til websitet gennem en tredjepartstjeneste, som skal etablere en sikker forbindelse, da overf\u00f8rsel af webstedets certifikat til den eksterne tjeneste skaber yderligere sikkerhedstrusler. <\/p>\n

Den nye udvidelse kan ogs\u00e5 vise sig at v\u00e6re nyttig for websteder, hvis drift underst\u00f8ttes af en stor distribueret infrastruktur med et stort antal belastningsbalancerere. Delegated Credentials vil muligg\u00f8re undg\u00e5else af opbevaring af kopier af de private n\u00f8gler for hovedcertifikaterne p\u00e5 hver node, der leverer indhold. Ved den klassiske tilgang vil en vellykket angreb p\u00e5 en hvilken som helst af serverne, der deltager i levering af HTTPS-trafik, f\u00f8re til kompromittering af hele certifikatet. I tilf\u00e6lde af overf\u00f8rsel af private n\u00f8gler til indholdsleveringsnetv\u00e6rk opst\u00e5r der trusler om datal\u00e6kage som f\u00f8lge af sabotage fra personale, agenter eller kompromittering af CDN-infrastrukturen. <\/p>\n

Hvis l\u00e6kagen af n\u00f8gler forbliver uopdaget, kan dem, der har f\u00e5et adgang til n\u00f8glerne, i en l\u00e6ngere periode ubem\u00e6rket inds\u00e6tte sig i webtrafikken (MITM), da certifikatets gyldighedsperioder varierer fra m\u00e5neder til \u00e5r. I Cloudflare er der specialiserede n\u00f8gletjenerservere, der arbejder p\u00e5 ejerens side af websitet for at beskytte certifikatn\u00f8glerne, men drift i dette mode f\u00f8rer til m\u00e6rkbare forsinkelser i trafiklevering, reducerer p\u00e5lideligheden p\u00e5 grund af det ekstra led og kr\u00e6ver implementering af en kompliceret infrastruktur. til at udf\u00f8re MITM, men blokeres ved brug af Firefox' certifikatlager);<\/a><\/noindex> Det foresl\u00e5ede TLS-udvidelse Delegated Credentials introducerer en ekstra mellemliggende privat n\u00f8gle, hvis gyldighedsperiode er begr\u00e6nset til timer eller nogle dage (maksimalt 7 dage). Denne n\u00f8gle genereres p\u00e5 basis af det certifikat, der er udstedt af certifikationsmyndigheden, og muligg\u00f8r, at den private n\u00f8gle for det oprindelige certifikat forbliver skjult for indholdsleveringstjenesterne, ved kun at give dem et midlertidigt certifikat med kort levetid.<\/p>\n

Denne metode sikrer, at den private n\u00f8gle forbliver hemmelig, hvilket reducerer risikoen for datal\u00e6kage og forbedrer sikkerheden ved brug af indholdsleveringsnetv\u00e6rk. <\/p>\n

\"Mozilla,<\/a><\/noindex><\/center><\/p>\n

For at undg\u00e5 adgangsproblemer, n\u00e5r livstiden for den midlertidige n\u00f8gle udl\u00f8ber, er der implementeret en teknologi til automatisk opdatering, der udf\u00f8res p\u00e5 siden af den oprindelige TLS-server. Genereringen kr\u00e6ver ikke udf\u00f8relse af manuelle operationer eller k\u00f8rsel af scripts \u2014 den autoriserede server, som har brug for den private n\u00f8gle, kontakter den oprindelige TLS-server p\u00e5 hjemmesiden f\u00f8r udl\u00f8b af den tidligere n\u00f8gle, og den genererer en midlertidig n\u00f8gle for en ny kort periode.<\/p>\n

\"Mozilla,<\/a><\/noindex><\/center><\/p>\n

Browsere, der underst\u00f8tter TLS-udvidelsen Delegated Credentials, vil opfatte s\u00e5danne afledte certifikater som p\u00e5lidelige. For eksempel er underst\u00f8ttelsen af den n\u00e6vnte udvidelse allerede blevet tilf\u00f8jet i natlige builds og beta-versioner af Firefox og kan aktiveres i about:config ved at \u00e6ndre indstillingen \u00absecurity.tls.enable_delegated_credentials\u00bb. I midten af november planl\u00e6gges der ogs\u00e5 at gennemf\u00f8re et eksperiment blandt en bestemt procentdel af brugerne af testversioner af Firefox \u00abTLS Delegated Credentials Experiment<\/a><\/noindex>\u00ab, hvor et testanmodning vil blive sendt til DC-serveren hos Cloudflare for at vurdere kvaliteten af implementeringen af den nye TLS-udvidelse. Underst\u00f8ttelsen af Delegated Credentials er ogs\u00e5 allerede indbygget i biblioteket Fizz<\/a><\/noindex> med implementering af TLS 1.3.<\/p>\n

Specifikationen for Delegated Credentials er blevet sendt til IETF (Internet Engineering Task Force), der arbejder med udvikling af internetprotokoller og -arkitektur, og er i draft<\/a><\/noindex>, som sigter mod at blive en internet-standard. Udvidelsen Delegated Credentials kan kun anvendes med TLSv1.3.
\nFor at generere midlertidige n\u00f8gler kr\u00e6ves der et TLS-certifikat, der inkluderer en s\u00e6rlig X.509-udvidelse, som i \u00f8jeblikket kun underst\u00f8ttes af certifikatudstederen DigiCert. <\/p>\n

<\/a><\/noindex><\/p>\n

Kilde: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

Mozilla, Cloudflare \u0438 Facebook \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u043e \u0430\u043d\u043e\u043d\u0441\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u043d\u043e\u0432\u043e\u0435 TLS-\u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u0435 Delegated Credentials (DC), \u0440\u0435\u0448\u0430\u044e\u0449\u0435\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443 c \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430\u043c\u0438 \u043f\u0440\u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0441\u0430\u0439\u0442\u0443 \u0447\u0435\u0440\u0435\u0437 \u0441\u0435\u0442\u0438 \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u0430. \u0412\u044b\u0434\u0430\u0432\u0430\u0435\u043c\u044b\u0435 \u0443\u0434\u043e\u0441\u0442\u043e\u0432\u0435\u0440\u044f\u044e\u0449\u0438\u043c\u0438 \u0446\u0435\u043d\u0442\u0440\u0430\u043c\u0438 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u044b \u0438\u043c\u0435\u044e\u0442 \u0434\u043b\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0439 \u0441\u0440\u043e\u043a \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f, \u0447\u0442\u043e \u0441\u043e\u0437\u0434\u0430\u0451\u0442 \u0442\u0440\u0443\u0434\u043d\u043e\u0441\u0442\u0438 \u043f\u0440\u0438 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0441\u0430\u0439\u0442\u0443 \u0447\u0435\u0440\u0435\u0437 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0439 \u0441\u0435\u0440\u0432\u0438\u0441, \u043e\u0442 \u043b\u0438\u0446\u0430 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0434\u043e\u043b\u0436\u043d\u043e \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0442\u044c\u0441\u044f \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u043e\u0435 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0435, \u0442\u0430\u043a \u043a\u0430\u043a \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0430 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-52168","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Mozilla, Cloudflare og Facebook pr\u00e6senterede TLS-udvidelsen til delegation af kortlivede certifikater | ProHoster","description":"Mozilla,","canonical_url":"https:\/\/prohoster.info\/da\/blog\/news\/mozilla-cloudflare-i-facebook-predstavili-tls-rasshirenie-dlya-delegirovaniya-korotkozhivushhih-sertifikatov","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Mozilla, Cloudflare \u0438 Facebook \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0438 TLS-\u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u0435 \u0434\u043b\u044f \u0434\u0435\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043a\u043e\u0440\u043e\u0442\u043a\u043e\u0436\u0438\u0432\u0443\u0449\u0438\u0445 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 | ProHoster","og:description":"Mozilla,","og:url":"https:\/\/prohoster.info\/da\/blog\/news\/mozilla-cloudflare-i-facebook-predstavili-tls-rasshirenie-dlya-delegirovaniya-korotkozhivushhih-sertifikatov","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-11-01T21:00:00+00:00","article:modified_time":"2020-02-18T10:59:50+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"52168","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 02:44:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 13:40:57","updated":"2026-01-24 02:44:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/52168","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=52168"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/52168\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=52168"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=52168"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=52168"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}