{"id":33503,"date":"2019-10-31T21:52:58","date_gmt":"2019-10-31T18:52:58","guid":{"rendered":"https:\/\/prohoster.info\/blog\/kak-dnscrypt-reshil-problemu-prosrochennyh-sertifikatov-vvedya-srok-dejstviya-24-chasa\/"},"modified":"2019-10-31T21:52:58","modified_gmt":"2019-10-31T18:52:58","slug":"kak-dnscrypt-reshil-problemu-prosrochennyh-sertifikatov-vvedya-srok-dejstviya-24-chasa","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/kak-dnscrypt-reshil-problemu-prosrochennyh-sertifikatov-vvedya-srok-dejstviya-24-chasa","title":{"rendered":"Kuidas DNSCrypt lahendas aegunud sertifikaatide probleemi, kehtestades 24 tunni pikkuse kehtivusaja","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Kuidas
\n
\nVarem aegusid sertifikaadid sageli, kuna neid tuli k\u00e4sitsi uuendada. Inimesed lihtsalt unustasid selle teha. Let\u2019s Encrypt'i ja automaatsete uuendamisprotseduuride saabumisega paistab probleem olevat lahendatud. Kuid hiljutine lugu Firefoxist<\/a><\/noindex> n\u00e4itab, et tegelikult on see ikka veel aktuaalne. Kahjuks aeguvad sertifikaadid j\u00e4tkuvalt.<\/p>\n

Kui keegi on selle loo vahele j\u00e4tnud, siis 4. mai 2019. aasta s\u00fcda\u00f6\u00f6sel lakkasid t\u00f6\u00f6tamast peaaegu k\u00f5ik Firefoxi laiendused.
\n<\/a><\/noindex>
\nKuidas selgus, oli massiline rike p\u00f5hjustatud sellest, et Mozillal aegus sertifikaadi<\/a><\/noindex>, mida kasutati laienduste allkirjastamiseks. Seet\u00f5ttu m\u00e4rgiti need \"kehtetuks\" ja ei l\u00e4binud kontrolli (tehnilised \u00fcksikasjad<\/a><\/noindex>). Foorumites soovitati lahenduseks keelata laienduste allkirjade kontrollimine about:config<\/i> v\u00f5i muuta s\u00fcsteemi kellaaega.<\/p>\n

Mozilla avaldas kiiresti plaastri Firefox 66.0.4, mis lahendab kehtetu sertifikaadi probleemi ning k\u00f5ik laiendused naasevad normaalsesse olekusse. Arendajad soovitavad selle paigaldada ja mitte kasutada<\/a><\/noindex> ei ole olemas \u00fchtegi lahendust, mis v\u00f5imaldaks allkirjade kontrollimise v\u00e4ltimist, kuna need v\u00f5ivad konfliktida plaastriga.<\/p>\n

Kuid see lugu n\u00e4itab j\u00e4lle, et sertifikaatide aegumine on endiselt aktuaalne probleem ka t\u00e4nap\u00e4eval.<\/p>\n

Seega on huvitav, kuidas protokolli arendajad selle \u00fclesandega \u00fcsna originaalsel viisil hakkama said. DNSCrypt<\/a><\/noindex>. Nende lahendus on jagatud kaheks osaks. Esiteks, l\u00fchiajalised sertifikaadid. Teiseks, kasutajate teavitamine pikaajaliste sertifikaatide aegumisest.<\/p>\n

DNSCrypt<\/h1>\n

\n\"KuidasDNSCrypt on DNS-i liikluse kr\u00fcpteerimise protokoll. See kaitseb DNS-i kommunikatsiooni pealtkuulamise ja MiTM-i eest ning v\u00f5imaldab \u00fcletada DNS-p\u00e4ringute taseme blokeeringuid.<\/p>\n

Protokoll \u00fcmbritseb DNS-i liiklust kliendi ja serveri vahel kr\u00fcptograafilise konstruktsiooniga, t\u00f6\u00f6tades transports\u00fcsteemide UDP ja TCP kaudu. Selle kasutamiseks peavad nii klient kui DNS-i lahendaja toetama DNSCrypt'i. N\u00e4iteks on sellest alates m\u00e4rtsist 2016 seda oma DNS-serverites ja brauseris 'Yandex' kasutanud. Toetuse on kuulutanud v\u00e4lja ka m\u00f5ned muud teenusepakkujad, sealhulgas Google ja Cloudflare. Kahjuks ei ole neid palju (ametlikul veebisaidil on loetletud 152 avalikku DNS-serverit). Kuid programmi dnscrypt-proxy<\/a><\/noindex> on v\u00f5imalik k\u00e4sitsi installida klientidesse Linuxi, Windowsi ja MacOS-i jaoks. Samuti on olemas serveri rakendused<\/a><\/noindex>.<\/p>\n

\"Kuidas
\n
\nKuidas DNSCrypt t\u00f6\u00f6tab? L\u00fchidalt, klient v\u00f5tab valitud teenusepakkuja avaliku v\u00f5tme ja kontrollib selle abil sertifikaate. Seal leiduvad l\u00fchiajalised avalikud v\u00f5tmed sessiooni jaoks ja kr\u00fcptov\u00f5tme komplekti identifikaator. Klientidele soovitatakse genereerida iga p\u00e4ringu jaoks uus v\u00f5ti, serveritele aga - vahetada v\u00f5tmeid iga 24 tunni j\u00e4rel<\/b>. V\u00f5tmete vahetamisel kasutatakse algoritmi X25519, allkirjastamiseks - EdDSA, plokk\u0161ifreerimiseks - XSalsa20-Poly1305 v\u00f5i XChaCha20-Poly1305.<\/p>\n

Protokolli \u00fcks arendajatest on Frank Denis writes<\/a><\/noindex>, et automaatne vahetus iga 24 tunni j\u00e4rel lahendab aegunud sertifikaatide probleemi. \u00dcldiselt aktsepteerib dnscrypt-proxy viidatud klient sertifikaate, millel on mis tahes aegumist\u00e4htaeg, kuid annab hoiatuse \"dnscrypt-proxy v\u00f5tmete periood selle serveri jaoks on liiga pikk\", kui see on kehtiv \u00fcle 24 tunni. Samal ajal v\u00e4ljastati Docker'i pilt, kus rakendatakse v\u00f5tmete (ja sertifikaatide) kiiret vahetust.<\/p>\n

Esiteks on see \u00e4\u00e4rmiselt kasulik turvalisuse seisukohalt: kui server on kompromiteeritud v\u00f5i v\u00f5ti on lekitatud, ei saa eilset liiklust dekodeerida. V\u00f5ti on juba muutunud. See v\u00f5ib t\u00f5en\u00e4oliselt tekitada probleeme \"Jarovaya seaduse\" t\u00e4itmisega, mis sunnib teenusepakkujaid s\u00e4ilitama kogu liikluse, sealhulgas kr\u00fcpteeritud. Eeldatakse, et hiljem saab seda vajadusel dekodeerida, k\u00fcsides v\u00f5tme saidilt. Kuid antud juhul ei saa sait lihtsalt seda esitada, kuna kasutatakse l\u00fchikese kehtivusega v\u00f5tmeid, kustutades vanad.<\/p>\n

Kuid peamine, kirjutab Denis, on see, et l\u00fchiajalised v\u00f5tmed panevad serverid automaatika seadistama kohe esimesest p\u00e4evast. Kui server \u00fchendub v\u00f5rku ja v\u00f5tmevahetuse skriptid ei ole seadistatud v\u00f5i ei t\u00f6\u00f6ta, avastatakse see kohe.<\/p>\n

Kui automaatika vahetab v\u00f5tit iga paari aasta tagant, ei saa sellele loota ja inimesed v\u00f5ivad unustada sertifikaadi kehtivuse l\u00f5ppemise. Igap\u00e4evase v\u00f5tmevahetuse korral avastatakse see kohe.<\/p>\n

Samas, kui automaatika on korralikult seadistatud, ei oma vahetuse sagedus t\u00e4htsust: olgu see siis kord aastas, kord kvartalis v\u00f5i kolm korda p\u00e4evas. Kui see t\u00f6\u00f6tab \u00fcle 24 tunni, t\u00f6\u00f6tab see igavesti, kirjutab Frank Denis. Tema s\u00f5nul v\u00e4hendas soovitus vahetada v\u00f5tmeid igap\u00e4evaselt, koos valmis Docker-pildiga, mis seda realiseerib, efektiivselt serverite arvu, mille sertifikaadid olid aegunud, samas parandades turvalisust.<\/p>\n

Kuid m\u00f5ned teenusepakkujad on siiski otsustanud tehnilistel p\u00f5hjustel seada v\u00e4ljalaske sertifikaadi kehtivusaeg pikemaks kui 24 tundi. Selle probleemi on peamiselt lahendatud dnscrypt-proxy-s m\u00f5ne koodireaga: kasutajad saavad teavitusteate 30 p\u00e4eva enne sertifikaadi aegumist, t\u00f5sisema s\u00f5numi 7 p\u00e4eva enne aegumist ja kriitilise teate, kui sertifikaadist on j\u00e4\u00e4nud v\u00e4hem kui 24 tundi. See kehtib ainult sertifikaatide kohta, mille algne kehtivusaeg on pikk.<\/p>\n

Sellised teated annavad kasutajatele v\u00f5imaluse teavitada DNS-i operaatorit sertifikaadi peatsest aegumisest, enne kui on liiga hilja. <\/p>\n

V\u00f5ib-olla, kui k\u00f5ik Firefoxi kasutajad sellist teadet saaksid, oleks keegi kindlasti arendajatele teada andnud ja nemad ei oleks lubanud sertifikaadi kehtivuse l\u00f5ppemise juhtuda. \"Ma ei m\u00e4leta \u00fchtegi DNSCrypt-serverit avalike DNS-serverite loendist, mille sertifikaadid oleksid viimase kahe v\u00f5i kolme aasta jooksul aegunud,\" kirjutab Frank Denis. Igatahes on ilmselt parem k\u00f5igepealt kasutajaid hoiatada, kui sulgeda laiendusi ilma ette teatamata.<\/p>\n

\n\"Kuidas
\n<\/a><\/noindex>
\n
Allikas: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u043d\u044c\u0448\u0435 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u044b \u0447\u0430\u0441\u0442\u043e \u0438\u0441\u0442\u0435\u043a\u0430\u043b\u0438 \u0438\u0437-\u0437\u0430 \u0442\u043e\u0433\u043e, \u0447\u0442\u043e \u0438\u0445 \u043d\u0443\u0436\u043d\u043e \u0431\u044b\u043b\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u044f\u0442\u044c \u0432\u0440\u0443\u0447\u043d\u0443\u044e. \u041b\u044e\u0434\u0438 \u043f\u0440\u043e\u0441\u0442\u043e \u0437\u0430\u0431\u044b\u0432\u0430\u043b\u0438 \u044d\u0442\u043e \u0441\u0434\u0435\u043b\u0430\u0442\u044c. \u0421 \u043f\u043e\u044f\u0432\u043b\u0435\u043d\u0438\u0435\u043c Let\u2019s Encrypt \u0438 \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043f\u0440\u043e\u0446\u0435\u0434\u0443\u0440\u044b \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0432\u0440\u043e\u0434\u0435 \u0431\u044b \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0434\u043e\u043b\u0436\u043d\u0430 \u0431\u044b\u0442\u044c \u0440\u0435\u0448\u0435\u043d\u0430. \u041d\u043e \u043d\u0435\u0434\u0430\u0432\u043d\u044f\u044f \u0438\u0441\u0442\u043e\u0440\u0438\u044f \u0441 Firefox \u043f\u043e\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442, \u0447\u0442\u043e \u043d\u0430 \u0441\u0430\u043c\u043e\u043c \u0434\u0435\u043b\u0435 \u043e\u043d\u0430 \u043f\u043e-\u043f\u0440\u0435\u0436\u043d\u0435\u043c\u0443 \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u0430. \u041a \u0441\u043e\u0436\u0430\u043b\u0435\u043d\u0438\u044e, \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u044b \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044e\u0442 \u0438\u0441\u0442\u0435\u043a\u0430\u0442\u044c. \u0415\u0441\u043b\u0438 \u043a\u0442\u043e-\u0442\u043e \u043f\u0440\u043e\u043f\u0443\u0441\u0442\u0438\u043b \u044d\u0442\u0443 \u0438\u0441\u0442\u043e\u0440\u0438\u044e, \u0432 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":25203,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-33503","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Kuidas DNSCrypt lahendas aegunud sertifikaatide probleemi, kehtestades 24-tunnise kehtivusaja | ProHoster","description":"Varem aegusid sertifikaadid sageli selle t\u00f5ttu, et neid tuli k\u00e4sitsi uuendada. Inimesed lihtsalt unustasid selle teha. Let\u2019s Encrypt'i ja automaatse uuendamisprotseduuriga peaks probleem olema lahendatud. Kuid hiljutine lugu Firefoxist n\u00e4itab, et see on tegelikult endiselt aktuaalne. Kahjuks sertifikaadid j\u00e4tkuvalt aeguvad. Kui keegi seda lugu vahele j\u00e4i, siis","canonical_url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/kak-dnscrypt-reshil-problemu-prosrochennyh-sertifikatov-vvedya-srok-dejstviya-24-chasa","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0430\u043a DNSCrypt \u0440\u0435\u0448\u0438\u043b \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443 \u043f\u0440\u043e\u0441\u0440\u043e\u0447\u0435\u043d\u043d\u044b\u0445 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432, \u0432\u0432\u0435\u0434\u044f \u0441\u0440\u043e\u043a \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f 24 \u0447\u0430\u0441\u0430 | ProHoster","og:description":"\u0420\u0430\u043d\u044c\u0448\u0435 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u044b \u0447\u0430\u0441\u0442\u043e \u0438\u0441\u0442\u0435\u043a\u0430\u043b\u0438 \u0438\u0437-\u0437\u0430 \u0442\u043e\u0433\u043e, \u0447\u0442\u043e \u0438\u0445 \u043d\u0443\u0436\u043d\u043e \u0431\u044b\u043b\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u044f\u0442\u044c \u0432\u0440\u0443\u0447\u043d\u0443\u044e. \u041b\u044e\u0434\u0438 \u043f\u0440\u043e\u0441\u0442\u043e \u0437\u0430\u0431\u044b\u0432\u0430\u043b\u0438 \u044d\u0442\u043e \u0441\u0434\u0435\u043b\u0430\u0442\u044c. \u0421 \u043f\u043e\u044f\u0432\u043b\u0435\u043d\u0438\u0435\u043c Let\u2019s Encrypt \u0438 \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043f\u0440\u043e\u0446\u0435\u0434\u0443\u0440\u044b \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0432\u0440\u043e\u0434\u0435 \u0431\u044b \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0434\u043e\u043b\u0436\u043d\u0430 \u0431\u044b\u0442\u044c \u0440\u0435\u0448\u0435\u043d\u0430. \u041d\u043e \u043d\u0435\u0434\u0430\u0432\u043d\u044f\u044f \u0438\u0441\u0442\u043e\u0440\u0438\u044f \u0441 Firefox \u043f\u043e\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442, \u0447\u0442\u043e \u043d\u0430 \u0441\u0430\u043c\u043e\u043c \u0434\u0435\u043b\u0435 \u043e\u043d\u0430 \u043f\u043e-\u043f\u0440\u0435\u0436\u043d\u0435\u043c\u0443 \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u0430. \u041a \u0441\u043e\u0436\u0430\u043b\u0435\u043d\u0438\u044e, \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u044b \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044e\u0442 \u0438\u0441\u0442\u0435\u043a\u0430\u0442\u044c. \u0415\u0441\u043b\u0438 \u043a\u0442\u043e-\u0442\u043e \u043f\u0440\u043e\u043f\u0443\u0441\u0442\u0438\u043b \u044d\u0442\u0443 \u0438\u0441\u0442\u043e\u0440\u0438\u044e, \u0432","og:url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/kak-dnscrypt-reshil-problemu-prosrochennyh-sertifikatov-vvedya-srok-dejstviya-24-chasa","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:52:58+00:00","article:modified_time":"2019-10-31T18:52:58+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"33503","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 15:31:39","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 02:39:23","updated":"2026-01-21 15:31:39"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/33503","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=33503"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/33503\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/25203"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=33503"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=33503"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=33503"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}