{"id":120904,"date":"2024-12-09T15:46:00","date_gmt":"2024-12-09T13:46:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/lets-encrypt-prekrashhaet-podderzhku-protokola-ocsp-dlya-proverki-otozvannyh-sertifikatov"},"modified":"2024-12-09T15:46:00","modified_gmt":"2024-12-09T13:46:00","slug":"lets-encrypt-prekrashhaet-podderzhku-protokola-ocsp-dlya-proverki-otozvannyh-sertifikatov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/lets-encrypt-prekrashhaet-podderzhku-protokola-ocsp-dlya-proverki-otozvannyh-sertifikatov","title":{"rendered":"Let's Encrypt l\u00f5petab OCSP protokolli toe t\u00fchistatud sertifikaatide kontrollimiseks.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\u00dchendusvaba sertifitseerimiskeskus Let’s Encrypt, mida juhib kogukond ja mis pakub sertifikaate tasuta k\u00f5igile soovijatele, on otsustanud l\u00f5petada OCSP (Online Certificate Status Protocol) protokolli toe, mida kasutatakse sertifikaatide t\u00fchistamise kontrollimiseks. OCSP protokolli asemel soovitatakse kasutada t\u00fchistamisteatiste loendeid (CRL — Certificate Revocation List), mida Let’s Encrypt avaldab alates 2022. aastast. 7. mail 2025 l\u00fclitab Let’s Encrypt v\u00e4lja viidatud OCSP aadresside lisamise v\u00e4ljastatud sertifikaatidesse ja l\u00f5petab OCSP Must Staple laiendusega seotud p\u00e4ringute t\u00f6\u00f6tlemise. 6. augustil 2025 peatatakse OCSP p\u00e4ringute t\u00f6\u00f6tlemine serverites. <\/p>\n

OCSP toe l\u00f5petamise p\u00f5hjuseks on toodud mure privaatsuse p\u00e4rast. OCSP kasutamine t\u00e4hendab, et iga kord, kui luuakse turvaline \u00fchendus sertifikaadi kehtivuse kontrollimiseks, saadab kliendi s\u00fcsteem n\u00f5ude OCSP sertifitseerimiskeskuse serverisse, mis sertifikaadi genereeris. Vastuseks annab server teavet selle kohta, kas antud sertifikaati saab usaldada. Probleem on selles, et sertifitseerimiskeskus saab teada, millal ja milliseid saite kasutaja k\u00fclastab, seostades selle tema. IP-aadressiga<\/a>, mis v\u00f5ib olla t\u00f5lgendatav kui privaatsusandmete lekke oht. Lisaks p\u00f5hjustab OCSP kasutamine p\u00e4ringu t\u00f6\u00f6tlemisel viivitusi, n\u00f5uab kasutajalt stabiilsete interneti\u00fchenduste olemasolu ning loob s\u00f5ltuvuse OCSP serverite katkematust t\u00f6\u00f6st. <\/p>\n

Sertifikaatide t\u00fchistamise kontrollimise privaatsusprobleemide lahendamiseks on v\u00e4lja t\u00f6\u00f6tatud OCSP Stapling tehnoloogia, mille olemus seisneb selles, et sertifitseerimiskeskuse kinnitatud OCSP vastuseid saab edastada veebisaitide serverite kaudu klientidega TLS-\u00fchenduse loomise ajal (OCSP teabe edastus kolmandate osapoolte) serverid<\/a> , mis vabastab kliendi s\u00fcsteemi otse\u00fchenduse loomise vajadusest OCSP sertifitseerimiskeskuse serveriga, samas kui vastuste \u00f5igsust tagab sertifitseerimiskeskuse digiallkiri). <\/p>\n

OCSP Stapling'ule lisaks on sertifikaatidesse lisatud laiend «OCSP Must Staple», mis n\u00f5uab brauseritelt OCSP Stapling'i kasutamist otse OCSP serverite poole p\u00f6\u00f6rdumise asemel ja kohustab sertifikaati pidama usaldusv\u00e4\u00e4rseks, kui teenindav server ei tagastanud kinnitatud OCSP vastust. Kahjuks ei ole laiend «Must Staple» brauserites laialdast levikut leidnud ning OCSP Stapling tehnoloogia p\u00f5hineb HTTP-serveri poolelt toe selges\u00f5nalisel lubamisel (nginxis on toimetatud alates 2013. aastast). <\/p>\n

CRL-i kasutamisel kontrollitakse sertifikaatide t\u00fchistamist lokaalses s\u00fcsteemis sertifitseerimiskeskuse koostatud loendite alusel. Selle l\u00e4henemise miinusteks on v\u00e4ga suur allalaaditavate andmete maht ja ajutine teabe kehtivuse katkestus (n\u00e4iteks Firefoxis v\u00e4rskendatakse andmeid iga 6 tunni j\u00e4rel). Suuruse probleem on lahendatud brauserites CRL-i tootjate serverites edastamise kaudu — brauserite ulatusse on kaasatud p\u00f5hiline CRL, mis t\u00f6\u00f6protsessi k\u00e4igus perioodiliselt s\u00fcnkroniseeritakse kehtiva loendiga (klientidele edastatakse ainult muudetud andmed). CRL andmebaasi suuruse v\u00e4hendamiseks kasutatakse t\u00f5en\u00e4osuslikku struktuuri «Bloom filter», mis v\u00f5imaldab hoida kogu CRL-i baas klientide poolel v\u00e4ga kompaktse esitena. Firefoxis on sarnane tehnika rakendatud CRLite t\u00f6\u00f6riistade abil ning Chrome'is — CRLSets.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041d\u0435\u043a\u043e\u043c\u043c\u0435\u0440\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0434\u043e\u0441\u0442\u043e\u0432\u0435\u0440\u044f\u044e\u0449\u0438\u0439 \u0446\u0435\u043d\u0442\u0440 Let’s Encrypt, \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u044b\u0439 \u0441\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e\u043c \u0438 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0439 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u044b \u0431\u0435\u0437\u0432\u043e\u0437\u043c\u0435\u0437\u0434\u043d\u043e \u0432\u0441\u0435\u043c \u0436\u0435\u043b\u0430\u044e\u0449\u0438\u043c, \u043f\u0440\u0438\u043d\u044f\u043b \u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u0435\u043a\u0440\u0430\u0442\u0438\u0442\u044c \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0443 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 OCSP (Online Certificate Status Protocol), \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u0433\u043e \u0434\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043e\u0442\u0437\u044b\u0432\u0430 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432. \u0412\u043c\u0435\u0441\u0442\u043e \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 OCSP \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u0435\u0442\u0441\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0441\u043f\u0438\u0441\u043a\u0438 \u043e\u0442\u043e\u0437\u0432\u0430\u043d\u043d\u044b\u0445 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 (CRL — Certificate Revocation List), \u043f\u0443\u0431\u043b\u0438\u043a\u0443\u0435\u043c\u044b\u0435 \u0441\u0435\u0440\u0432\u0438\u0441\u043e\u043c Let’s Encrypt \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 2022 \u0433\u043e\u0434\u0430. 7 \u043c\u0430\u044f 2025 \u0433\u043e\u0434\u0430 Let’s Encrypt […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-120904","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Let's Encrypt l\u00f5petab OCSP protokolli toe tagasiv\u00f5etud sertifikaatide kontrollimiseks | ProHoster","description":"Mittekasumlik tunnustuskeskus Let's Encrypt, mida juhib kogukond ja mis pakub sertifikaate tasuta soovijatele, on otsustanud l\u00f5petada OCSP (Online Certificate Status) protokolli toe.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/lets-encrypt-prekrashhaet-podderzhku-protokola-ocsp-dlya-proverki-otozvannyh-sertifikatov","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Let&apos;s Encrypt \u043f\u0440\u0435\u043a\u0440\u0430\u0449\u0430\u0435\u0442 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0443 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 OCSP \u0434\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043e\u0442\u043e\u0437\u0432\u0430\u043d\u043d\u044b\u0445 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 | ProHoster","og:description":"\u041d\u0435\u043a\u043e\u043c\u043c\u0435\u0440\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0434\u043e\u0441\u0442\u043e\u0432\u0435\u0440\u044f\u044e\u0449\u0438\u0439 \u0446\u0435\u043d\u0442\u0440 Let's Encrypt, \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u044b\u0439 \u0441\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e\u043c \u0438 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0439 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u044b \u0431\u0435\u0437\u0432\u043e\u0437\u043c\u0435\u0437\u0434\u043d\u043e \u0432\u0441\u0435\u043c \u0436\u0435\u043b\u0430\u044e\u0449\u0438\u043c, \u043f\u0440\u0438\u043d\u044f\u043b \u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u0435\u043a\u0440\u0430\u0442\u0438\u0442\u044c \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0443 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 OCSP (Online Certificate Status.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/lets-encrypt-prekrashhaet-podderzhku-protokola-ocsp-dlya-proverki-otozvannyh-sertifikatov","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-12-09T13:46:00+00:00","article:modified_time":"2024-12-09T13:46:00+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"120904","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 17:38:18","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 08:45:20","updated":"2026-02-09 17:38:18","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/120904","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=120904"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/120904\/revisions"}],"predecessor-version":[{"id":159219,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/120904\/revisions\/159219"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=120904"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=120904"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=120904"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}