{"id":120904,"date":"2024-12-09T15:46:00","date_gmt":"2024-12-09T13:46:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/lets-encrypt-prekrashhaet-podderzhku-protokola-ocsp-dlya-proverki-otozvannyh-sertifikatov"},"modified":"2024-12-09T15:46:00","modified_gmt":"2024-12-09T13:46:00","slug":"lets-encrypt-prekrashhaet-podderzhku-protokola-ocsp-dlya-proverki-otozvannyh-sertifikatov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/lets-encrypt-prekrashhaet-podderzhku-protokola-ocsp-dlya-proverki-otozvannyh-sertifikatov","title":{"rendered":"Let's Encrypt l\u00f5petab OCSP protokolli toe kehtetuks tunnistatavate sertifikaatide kontrollimiseks","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Kogukondlik mittetulunduslik sertifitseerimiskeskus Let's Encrypt, mis pakub sertifikaate tasuta k\u00f5igile soovijatele, on otsustanud l\u00f5petada OCSP (Online Certificate Status Protocol) protokolli toe, mida kasutatakse sertifikaatide kehtetuks tunnistamise kontrollimiseks. OCSP protokolli asemel soovitatakse alates 2022. aastast kasutada kehtetuks tunnistatud sertifikaatide loetelusid (CRL - Certificate Revocation List), mida Let's Encrypt avaldab. 7. mail 2025 katkestab Let's Encrypt OCSP linkide lisamise v\u00e4ljastatud sertifikaatidesse ja l\u00f5petab OCSP Must Staple laiendiga seotud p\u00e4ringute t\u00f6\u00f6tlemise. 6. augustil 2025 katkestatakse OCSP-p\u00e4ringute t\u00f6\u00f6tlemine serverites. <\/p>\n

OCSP toe l\u00f5petamise p\u00f5hjuseks tuuakse \u00fclesandeks privaatsus. OCSP kasutamine t\u00e4hendab, et iga kord, kui luuakse kaitstud \u00fchendus, saadab kliendis\u00fcsteem k\u00fcsimuse sertifikaadi v\u00e4ljastanud sertifitseerimiskeskuse OCSP-serverile. Vastuseks annab server teavet, kas antud sertifikaadi usaldusv\u00e4\u00e4rsust saab kinnitada. Probleem seisneb selles, et sertifitseerimiskeskus saab teavet selle kohta, milliseid saite kasutaja k\u00fclastab, sidudes need tema IP-aadressi<\/a>, mis v\u00f5ib pidada privaatsusandmete lekkeks. Lisaks p\u00f5hjustab OCSP kasutamine p\u00e4ringu t\u00f6\u00f6tlemise viivituse, n\u00f5uab, et kasutajal oleks tagatud interneti\u00fchendus, ning loob s\u00f5ltuvuse OCSP-serverite katkematust t\u00f6\u00f6st. <\/p>\n

Sertifikaatide kehtetuks tunnistamise kontrollimise privaatsusprobleemide lahendamiseks on v\u00e4lja t\u00f6\u00f6tatud OCSP Stapling tehnoloogia, mille p\u00f5him\u00f5te seisneb selles, et sertifitseerimiskeskuse kinnitatud OCSP-vastused saadetakse veebiserverite kaudu kliendi TLS-\u00fchenduse loomise ajal (OCSP teabe edastamine toimub serverid<\/a> veebisaitide serveritest, vabastades kliendis\u00fcsteemi otse OCSP-sertifitseerimiskeskuse serveriga suhtlemise vajadusest, samas kui vastuste \u00f5igsus tagatakse sertifitseerimiskeskuse digitaalse allkirjaga). <\/p>\n

OCSP Stapling'ule lisaks on olemas sertifikaatidesse lisatav 'OCSP Must Staple' laiendus, mis sunnib brausiereid kasutama OCSP Stapling tehnoloogiat, mitte otse OCSP-serverite poole p\u00f6\u00f6rduma, ja n\u00f5uab, et sertifikaat ei oleks usaldusv\u00e4\u00e4rne, kui teenindav veebiserver ei ole tagastanud kinnitatud OCSP-vastust. Kahjuks ei ole 'Must Staple' laiendus laialdaselt kasutusele v\u00f5etud brauserites, ja OCSP Stapling tehnoloogia s\u00f5ltub HTTP-serveri poolel toe selges\u00f5nalisest aktiveerimisest (nginx toetab alates 2013. aastast). <\/p>\n

CRL-i kasutamisel toimub sertifikaatide kehtetuks tunnistamise kontrollimine kohaliku s\u00fcsteemi kaudu sertifitseerimiskeskuse koostatud loendite p\u00f5hjal. Selle l\u00e4henemise miinusteks on v\u00e4ga suur allalaaditav andmemahu suurus ja ajutiste teabepuuduste ilmnemine (n\u00e4iteks Firefoxis uuendatakse andmeid iga 6 tunni tagant). Suuruse probleem on lahendatud brauserites CRL-i serverite kaudu proksimise teel - brauserite koostises sisaldub baasi CRL, mida s\u00fcnkroonitakse regulaarselt ajakohase loendiga (kliendi s\u00fcsteemile edastatakse ainult muutunud andmed). CRL andmebaasi suuruse v\u00e4hendamiseks kasutatakse t\u00f5en\u00e4osuslikku struktuuri 'Bloom filter', mis v\u00f5imaldab hoida kogu CRL andmebaasi kliendi poolel v\u00e4ga kompaktse esindusena. Firefoxis on seda tehnikat rakendatud CRLite t\u00f6\u00f6riistade abil ning Chrome'is - CRLSets.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041d\u0435\u043a\u043e\u043c\u043c\u0435\u0440\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0434\u043e\u0441\u0442\u043e\u0432\u0435\u0440\u044f\u044e\u0449\u0438\u0439 \u0446\u0435\u043d\u0442\u0440 Let’s Encrypt, \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u044b\u0439 \u0441\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e\u043c \u0438 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0439 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u044b \u0431\u0435\u0437\u0432\u043e\u0437\u043c\u0435\u0437\u0434\u043d\u043e \u0432\u0441\u0435\u043c \u0436\u0435\u043b\u0430\u044e\u0449\u0438\u043c, \u043f\u0440\u0438\u043d\u044f\u043b \u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u0435\u043a\u0440\u0430\u0442\u0438\u0442\u044c \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0443 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 OCSP (Online Certificate Status Protocol), \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u0433\u043e \u0434\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043e\u0442\u0437\u044b\u0432\u0430 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432. \u0412\u043c\u0435\u0441\u0442\u043e \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 OCSP \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u0435\u0442\u0441\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0441\u043f\u0438\u0441\u043a\u0438 \u043e\u0442\u043e\u0437\u0432\u0430\u043d\u043d\u044b\u0445 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 (CRL — Certificate Revocation List), \u043f\u0443\u0431\u043b\u0438\u043a\u0443\u0435\u043c\u044b\u0435 \u0441\u0435\u0440\u0432\u0438\u0441\u043e\u043c Let’s Encrypt \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 2022 \u0433\u043e\u0434\u0430. 7 \u043c\u0430\u044f 2025 \u0433\u043e\u0434\u0430 Let’s Encrypt […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-120904","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Let's Encrypt l\u00f5petab OCSP protokolli toetamise tagasiv\u00f5etud sertifikaatide kontrollimiseks | ProHoster","description":"\u00dchingutest s\u00f5ltumatu Let's Encrypt, mis pakub tasuta sertifikaate k\u00f5igile soovijatele, on otsustanud l\u00f5petada OCSP (Online Certificate Status Protocol) protokolli toe, mida kasutatakse sertifikaatide t\u00fchistamise kontrollimiseks. OCSP protokolli asemel soovitatakse kasutada t\u00fchistatud sertifikaatide loetelusid (CRL - Certificate Revocation List), mida Let's Encrypt avaldab alates 2022. aastast. 7. mai 2025. aastal l\u00f5petab Let's Encrypt","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/lets-encrypt-prekrashhaet-podderzhku-protokola-ocsp-dlya-proverki-otozvannyh-sertifikatov","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Let&apos;s Encrypt \u043f\u0440\u0435\u043a\u0440\u0430\u0449\u0430\u0435\u0442 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0443 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 OCSP \u0434\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043e\u0442\u043e\u0437\u0432\u0430\u043d\u043d\u044b\u0445 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 | ProHoster","og:description":"\u041d\u0435\u043a\u043e\u043c\u043c\u0435\u0440\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0434\u043e\u0441\u0442\u043e\u0432\u0435\u0440\u044f\u044e\u0449\u0438\u0439 \u0446\u0435\u043d\u0442\u0440 Let's Encrypt, \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u044b\u0439 \u0441\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e\u043c \u0438 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0439 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u044b \u0431\u0435\u0437\u0432\u043e\u0437\u043c\u0435\u0437\u0434\u043d\u043e \u0432\u0441\u0435\u043c \u0436\u0435\u043b\u0430\u044e\u0449\u0438\u043c, \u043f\u0440\u0438\u043d\u044f\u043b \u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u0435\u043a\u0440\u0430\u0442\u0438\u0442\u044c \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0443 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 OCSP (Online Certificate Status Protocol), \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u0433\u043e \u0434\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043e\u0442\u0437\u044b\u0432\u0430 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432. \u0412\u043c\u0435\u0441\u0442\u043e \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 OCSP \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u0435\u0442\u0441\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0441\u043f\u0438\u0441\u043a\u0438 \u043e\u0442\u043e\u0437\u0432\u0430\u043d\u043d\u044b\u0445 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 (CRL - Certificate Revocation List), \u043f\u0443\u0431\u043b\u0438\u043a\u0443\u0435\u043c\u044b\u0435 \u0441\u0435\u0440\u0432\u0438\u0441\u043e\u043c Let's Encrypt \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 2022 \u0433\u043e\u0434\u0430. 7 \u043c\u0430\u044f 2025 \u0433\u043e\u0434\u0430 Let's Encrypt","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/lets-encrypt-prekrashhaet-podderzhku-protokola-ocsp-dlya-proverki-otozvannyh-sertifikatov","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-12-09T13:46:00+00:00","article:modified_time":"2024-12-09T13:46:00+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"120904","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 17:38:18","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 08:45:20","updated":"2026-02-09 17:38:18"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/120904","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=120904"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/120904\/revisions"}],"predecessor-version":[{"id":159219,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/120904\/revisions\/159219"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=120904"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=120904"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=120904"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}