30. septembril kell 17:01 Moskva aja j\u00e4rgi aegub IdenTrusti (DST Root CA X3) juuriksertifikaadi kehtivus, mida kasutati Let's Encrypti (ISRG Root X1) juuriksertifikaadi ristallkirjastamiseks. See, mida haldab kogukond ja mis pakub tasuta sertifikaate k\u00f5igile soovijatele. Ristallkiri tagas Let's Encrypti sertifikaatide usaldusv\u00e4\u00e4rsuse laiaulatuslikul seadmete, operatsioonis\u00fcsteemide ja brauserite spektril, kuni ettev\u00f5tte oma Let's Encrypti juuriksertifikaat integreeriti juuriksertifikaatide ladustamisse. <\/p>\n
Algselt plaaniti, et p\u00e4rast DST Root CA X3 aegumist l\u00e4heb Let's Encrypt \u00fcle ainult oma juuriksertifikaadi kasutamisele allkirjastamisel, kuid see samm tooks kaasa \u00fchilduvuse kadumise suure hulga vanade s\u00fcsteemidega, mis ei ole Let's Encrypti juuriksertifikaati oma ladustamisse lisanud. Eriti umbes 30% k\u00e4ibel olevatest Android-seadmetest ei sisalda Let's Encrypti juuriksertifikaadi andmeid, mille tugi ilmus alles Android 7.1.1 platvormiga, mis ilmus 2016. aasta l\u00f5pus. <\/p>\n
Let\u2019s Encrypt ei kavatsenud s\u00f5lmida uut ristallkirjastamise lepingut, kuna see toob kaasa t\u00e4iendava vastutuse lepingupoolte jaoks, v\u00e4hendab iseseisvust ja seob k\u00e4ed teiste sertifitseerimisasutuste k\u00f5igi protseduuride ja reeglite j\u00e4rgimisel. Kuid potentsiaalsete probleemide t\u00f5ttu suurtes Android-seadmetes vaadati plaan \u00fcle. Sertifitseerimisagentuuriga IdenTrust on s\u00f5lmitud uus leping, mille raames on loodud alternatiivne ristallkirjastatud vahesertifikaat Let\u2019s Encrypt. Ristallkiri kehtib kolm aastat ja v\u00f5imaldab s\u00e4ilitada toetust Android-seadmetele alates versioonist 2.3.6. <\/p>\n
Sellegipoolest ei kata uus vahesertifikaat paljusid teisi vananenud s\u00fcsteeme. N\u00e4iteks p\u00e4rast sertifikaadi DST Root CA X3 vananemist 30. septembril lakkavad Let\u2019s Encrypt sertifikaadid t\u00f6\u00f6tamast juba toetust mitteomavates tarkvarades ja operatsioonis\u00fcsteemides, kus Let\u2019s Encrypt sertifikaatide usaldusv\u00e4\u00e4rsuse tagamiseks on vaja k\u00e4sitsi lisada sertifikaat ISRG Root X1 juure sertifikaatide hoidlasse. Probleemid hakkavad ilmnema: <\/p>\n
OpenSSL 1.0.2 puhul tekib probleem veast, mis ei v\u00f5imalda korrektselt t\u00f6\u00f6delda ristallkirjastatud sertifikaate, kui \u00fcks kasulikest juureritsertifikaatidest, mida kasutatakse allkirjastamisel, on aegunud, isegi kui teised kehtivad usaldusketid j\u00e4\u00e4vad alles. Probleem ilmnes esmakordselt eelmisel aastal p\u00e4rast AddTrust sertifikaadi aegumist, millel rakendati ristallkirjastust Sectigo (Comodo) sertifikaatide puhul. Probleemi tuum on, et OpenSSL t\u00f6\u00f6tles sertifikaati kui lineaarset ketti, samas kui RFC 4158 kohaselt v\u00f5ib sertifikaat esindada suunatud jaotatud ts\u00fcklilist graafi, millel on mitu usalduspunkti, mida tuleb arvesse v\u00f5tta. <\/p>\n
Vanadele levitamisele, mis on seotud OpenSSL 1.0.2, pakutakse kolme m\u00f6\u00f6davariantide v\u00f5imalust probleemi lahendamiseks: <\/p>\n
Lisaks on v\u00f5imalik m\u00e4rkida, et Let’s Encrypt on \u00fcletanud kahe miljardi genereeritud sertifikaadi piiri. \u00dcks miljard saavutati eelmisel veebruaril. Igap\u00e4evaselt genereeritakse 2,2\u20132,4 miljonit uut sertifikaati. Aktiivsete sertifikaatide arv on 192 miljonit (sertifikaat kehtib kolm kuud) ja see katab umbes 260 miljonit. of domains<\/a> (aasta tagasi oli h\u00f5lmatud 195 miljonit domeeni, kaks aastat tagasi — 150 miljonit, kolm aastat tagasi — 60 miljonit). Statistika kohaselt on Firefox Telemetry teenuse kaudu globaalne HTTPS-i lehep\u00e4ringute osakaal 82% (aasta tagasi — 81%, kaks aastat tagasi — 77%, kolm aastat tagasi — 69%, neli aastat tagasi — 58%). 30 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f \u0432 17:01 \u043f\u043e \u043c\u043e\u0441\u043a\u043e\u0432\u0441\u043a\u043e\u043c\u0443 \u0432\u0440\u0435\u043c\u0435\u043d\u0438 \u0438\u0441\u0442\u0435\u043a\u0430\u0435\u0442 \u0432\u0440\u0435\u043c\u044f \u0436\u0438\u0437\u043d\u0438 \u043a\u043e\u0440\u043d\u0435\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 IdenTrust (DST Root CA X3), \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0441\u044f \u0434\u043b\u044f \u043a\u0440\u043e\u0441\u0441-\u043f\u043e\u0434\u043f\u0438\u0441\u0438 \u043a\u043e\u0440\u043d\u0435\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 \u0443\u0434\u043e\u0441\u0442\u043e\u0432\u0435\u0440\u044f\u044e\u0449\u0435\u0433\u043e \u0446\u0435\u043d\u0442\u0440\u0430 Let’s Encrypt (ISRG Root X1), \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u043e\u0433\u043e \u0441\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e\u043c \u0438 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0439 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u044b \u0431\u0435\u0437\u0432\u043e\u0437\u043c\u0435\u0437\u0434\u043d\u043e \u0432\u0441\u0435\u043c \u0436\u0435\u043b\u0430\u044e\u0449\u0438\u043c. \u041f\u0435\u0440\u0435\u043a\u0440\u0451\u0441\u0442\u043d\u0430\u044f \u043f\u043e\u0434\u043f\u0438\u0441\u044c \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u043b\u0430 \u0434\u043e\u0432\u0435\u0440\u0438\u0435 \u043a \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430\u043c Let’s Encrypt \u043d\u0430 \u0448\u0438\u0440\u043e\u043a\u043e\u043c \u0441\u043f\u0435\u043a\u0442\u0440\u0435 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432, \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u0438 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u043e\u0432 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-101436","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47IdenTrusti juuresertifikaadi aegumine toob kaasa Let's Encrypti usaldusv\u00e4\u00e4rsuse kadumise vanades seadmetes | ProHoster","description":"30. septembril kell 17:01 Moskva aja j\u00e4rgi aegub IdenTrusti (DST Root CA X3) juuresertifikaadi kehtivus, mida kasutati Let's Encrypti (ISRG Root X1) juuresertifikaadi ristallkirjastamiseks, mille haldab kogukond ja mis annab sertifikaate tasuta igal soovijal. Ristallkirjastamine tagas usaldusv\u00e4\u00e4rsuse Let's Encrypti sertifikaatide jaoks laias valikus seadmetes, operatsioonis\u00fcsteemides ja brauserites.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/ustarevanie-kornevogo-sertifikata-identrust-privedyot-k-potere-doveriya-k-lets-encrypt-na-staryh-ustrojstvah","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u0441\u0442\u0430\u0440\u0435\u0432\u0430\u043d\u0438\u0435 \u043a\u043e\u0440\u043d\u0435\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 IdenTrust \u043f\u0440\u0438\u0432\u0435\u0434\u0451\u0442 \u043a \u043f\u043e\u0442\u0435\u0440\u0435 \u0434\u043e\u0432\u0435\u0440\u0438\u044f \u043a Let's Encrypt \u043d\u0430 \u0441\u0442\u0430\u0440\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445 | ProHoster","og:description":"30 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f \u0432 17:01 \u043f\u043e \u043c\u043e\u0441\u043a\u043e\u0432\u0441\u043a\u043e\u043c\u0443 \u0432\u0440\u0435\u043c\u0435\u043d\u0438 \u0438\u0441\u0442\u0435\u043a\u0430\u0435\u0442 \u0432\u0440\u0435\u043c\u044f \u0436\u0438\u0437\u043d\u0438 \u043a\u043e\u0440\u043d\u0435\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 IdenTrust (DST Root CA X3), \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0441\u044f \u0434\u043b\u044f \u043a\u0440\u043e\u0441\u0441-\u043f\u043e\u0434\u043f\u0438\u0441\u0438 \u043a\u043e\u0440\u043d\u0435\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 \u0443\u0434\u043e\u0441\u0442\u043e\u0432\u0435\u0440\u044f\u044e\u0449\u0435\u0433\u043e \u0446\u0435\u043d\u0442\u0440\u0430 Let's Encrypt (ISRG Root X1), \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u043e\u0433\u043e \u0441\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e\u043c \u0438 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0439 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u044b \u0431\u0435\u0437\u0432\u043e\u0437\u043c\u0435\u0437\u0434\u043d\u043e \u0432\u0441\u0435\u043c \u0436\u0435\u043b\u0430\u044e\u0449\u0438\u043c. \u041f\u0435\u0440\u0435\u043a\u0440\u0451\u0441\u0442\u043d\u0430\u044f \u043f\u043e\u0434\u043f\u0438\u0441\u044c \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u043b\u0430 \u0434\u043e\u0432\u0435\u0440\u0438\u0435 \u043a \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430\u043c Let's Encrypt \u043d\u0430 \u0448\u0438\u0440\u043e\u043a\u043e\u043c \u0441\u043f\u0435\u043a\u0442\u0440\u0435 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432, \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u0438 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u043e\u0432","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/ustarevanie-kornevogo-sertifikata-identrust-privedyot-k-potere-doveriya-k-lets-encrypt-na-staryh-ustrojstvah","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-09-27T14:22:56+00:00","article:modified_time":"2021-09-27T14:22:56+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"101436","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-09-27 14:30:20","updated":"2026-02-11 11:12:05"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/101436","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=101436"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/101436\/revisions"}],"predecessor-version":[{"id":160560,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/101436\/revisions\/160560"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=101436"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=101436"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=101436"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"