{"id":34921,"date":"2019-10-31T22:01:17","date_gmt":"2019-10-31T19:01:17","guid":{"rendered":"https:\/\/prohoster.info\/blog\/est-mnenie-tehnologiya-dane-dlya-brauzerov-provalilas\/"},"modified":"2019-10-31T22:01:17","modified_gmt":"2019-10-31T19:01:17","slug":"est-mnenie-tehnologiya-dane-dlya-brauzerov-provalilas","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/est-mnenie-tehnologiya-dane-dlya-brauzerov-provalilas","title":{"rendered":"On arvamus, et tehnoloogia DANE on brauserites eba\u00f5nnestunud","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

R\u00e4\u00e4gime, mis on DANE tehnoloogia domeeninimede autentimiseks DNS-i kaudu ja miks see ei ole brauserites laialdaselt levinud.<\/p>\n

\"On<\/a><\/noindex><\/a><\/noindex>
\n\/ Unsplash \/ Paulius Dragunas<\/a><\/noindex><\/i><\/p>\n

Mis on DANE<\/h2>\n

\nSertifitseerimiskeskused (CA) on organisatsioonid, kes tegelevad<\/a><\/noindex> kr\u00fcptograafiliste SSL-sertifikaate<\/a><\/noindex>. Need panevad neile oma digitaalse allkirja, kinnitades autentsuse. Siiski v\u00f5ivad m\u00f5nikord esineda olukordi, kus sertifikaate v\u00e4ljastatakse rikkumistega. N\u00e4iteks eelmisel aastal alustas Google \"usaldusv\u00e4\u00e4rsuse l\u00f5petamise protsessi\" Symantec'i sertifikaatide osas, kuna need olid kompromiteeritud (seda lugu kajastasime meie blogis \u2014 kord<\/a><\/noindex> ja kaks<\/a><\/noindex>).<\/p>\n

Et v\u00e4ltida selliseid olukordi, hakati paar aastat tagasi IETF-is arendama<\/a><\/noindex> DANE tehnoloogiat (aga see ei ole brauserites laialdaselt levinud \u2014 miks see nii on, r\u00e4\u00e4gime edaspidi).<\/p>\n

DANE (DNS-p\u00f5hine nimede autentimine) on spetsifikatsioonide kogum, mis v\u00f5imaldab kasutada DNSSEC (nimede s\u00fcsteemi turbe laiendused) SSL-sertifikaatide autentimise kontrollimiseks. DNSSEC on domeeninime s\u00fcsteemi laiendus, mis minimeerib aadresside valelemise r\u00fcnnakuid. Kasutades neid kahte tehnoloogiat, saavad veebimeistrid v\u00f5i kliendid p\u00f6\u00f6rduda \u00fche DNS-ala operaatori poole ja kinnitada kasutatava sertifikaadi kehtivust.<\/p>\n

Sisuliselt toimib DANE iseenesest allkirjastatud sertifikaadina (DNSSEC on selle usaldusv\u00e4\u00e4rsuse garant) ja t\u00e4iendab CA funktsioone.<\/p>\n

Kuidas see toimib<\/h2>\n

\nDANE spetsifikatsioon on kirjeldatud RFC6698<\/a><\/noindex>. Dokumendis on DNS-i ressursikirjed<\/a><\/noindex> t\u00e4iendatud uue t\u00fc\u00fcbi \u2014 TLSA. See sisaldab teavet edastatava sertifikaadi, edastatavate andmete m\u00f5\u00f5tmete ja t\u00fc\u00fcpide kohta, samuti edastatavaid andmeid. Veebimeister loob sertifikaadi digitaalse s\u00f5rmej\u00e4lje, allkirjastab selle DNSSEC-i abil ja paigutab selle TLSA-sse.<\/p>\n

Klient \u00fchendub veebisaidiga ja v\u00f5rdleb selle sertifikaati DNS-operaatorilt saadud \u201ekoopia\u201d kanssa. Kui need kokku langevad, loetakse ressurss usaldusv\u00e4\u00e4rseks.<\/p><\/blockquote>\n

\nWiki-lehel DANE on j\u00e4rgmine n\u00e4idis DNS-p\u00e4ringule serverile example.org TCP-porti 443 kaudu:<\/p>\n

IN TLSA _443._tcp.example.org<\/code><\/pre>\n
\nVastus sellele n\u00e4eb v\u00e4lja j\u00e4rgmine:<\/p>\n
 _443._tcp.example.com. IN TLSA (\n   3 0 0 30820307308201efa003020102020... )\n<\/code><\/pre>\n
\nDANE-l on mitu laiendust, mis t\u00f6\u00f6tavad koos teiste DNS-kirjetega peale TLSA. Esiteks on DNS-kirje SSHFP, mis kontrollib v\u00f5tmeid SSH-\u00fchenduste ajal. Selle kohta on kirjutatud RFC4255<\/a><\/noindex>,\u00a0RFC6594<\/a><\/noindex>\u00a0ja\u00a0RFC7479<\/a><\/noindex>. Teiseks on kirje OPENPGPKEY v\u00f5tmete vahetamiseks PGP kaudu (RFC7929<\/a><\/noindex>). L\u00f5puks on kolmandaks kirje SMIMEA (RFC standardit ei ole veel vormistatud, olemas on vaid kavand<\/a><\/noindex>) kr\u00fcptograafiliste v\u00f5tmete vahetamiseks S\/MIME kaudu.<\/p>\n
Mis on DANE probleem<\/h2>\n
\nMais toimus DNS-OARC konverents (see on mittetulundus\u00fching, mis tegeleb domeeninimede s\u00fcsteemi turvalisuse, stabiilsuse ja arendamise k\u00fcsimustega). \u00dche paneeli ajal j\u00f5udsid eksperdid j\u00e4reldusele<\/a><\/noindex>, et DANE tehnoloogia on brauserites eba\u00f5nnestunud (v\u00e4hemalt praeguses rakenduses). Konverentsil osalenud Geoff Huston, juhtiv teadust\u00f6\u00f6taja APNIC<\/a><\/noindex>, \u00fches viiest piirkondlikust interneti registrist, nimetas<\/a><\/noindex> DANE't \u201esurnud tehnoloogiaks.\u201d<\/p>\n
Populaarsed brauserid ei toeta DANE sertifikaatidega autentimist. Turul on olemas spetsiaalsed pluginate<\/a><\/noindex>, mis avavad TLSA-kirje funktsionaalsuse, kuid ka nende toetamist l\u00f5petatakse j\u00e4rk-j\u00e4rgult<\/a><\/noindex>.<\/p><\/blockquote>\n
\nDANE levikuga seotud probleemid brauserites on seotud DNSSEC-i valideerimise protsessi pikkusega. S\u00fcsteem peab tegema kr\u00fcptograafilisi arvutusi SSL-sertifikaadi ehtsuse kinnitamiseks ja l\u00e4bima k\u00f5ik DNS-serverite kettad (alates juurepiirkonnast kuni hosti domeenini) esmakordsel ressursile \u00fchendamisel.<\/p>\n
\"On
\n\/ Unsplash \/ Kaley Dykstra<\/a><\/noindex><\/i><\/p>\n
Seda puudust \u00fcritati Mozilla-s lahendada DNSSEC Chain Extension<\/a><\/noindex> TLS-i jaoks. See pidi v\u00e4hendama DNS-kirjete arvu, mida kliendil tuli autentimise ajal vaadata. Siiski tekkis arendajate grupis erimeelsusi, mida ei suudetud lahendada. Tulemusena parade projekt pooleli, kuigi see sai IETF-i heakskiidu m\u00e4rtsis 2018.<\/p>\n
Teine p\u00f5hjus DANE madala populaarsuse taga on DNSSEC-i n\u00f5rk levik maailmas \u2014 sellega t\u00f6\u00f6tab vaid 19% ressursse<\/a><\/noindex>. Eksperdid on arvutanud, et see ei ole piisav DANE aktiivseks edendamiseks.<\/p>\n
T\u00f5en\u00e4oliselt areneb t\u00f6\u00f6stus teises suunas. Selle asemel, et kasutada DNS-i SSL\/TLS-sertifikaatide autentimiseks, hakkavad turuosalised edendama protokolle DNS-over-TLS (DoT) ja DNS-over-HTTPS (DoH). Viimast mainisime \u00fche meie eelneva materjali<\/a><\/noindex> Habr'is. Need kr\u00fcpteerivad ja kontrollivad kasutajate p\u00e4ringute edastamist DNS-serverile, takistades kurjategijatel andmete valeesitamist. Aasta alguses rakendas Google DoT-d oma avaliku DNS-i jaoks. Mis puudutab DANE'i \u2014 kas tehnoloogia dokkide juurde tagasi naaseb ja muutub siiski peavooluks, j\u00e4\u00e4b tulevik n\u00e4ha. Sisse<\/a><\/noindex> Google's Public DNS. As for DANE \u2014 whether this technology can \"get back in the saddle\" and become mainstream again remains to be seen in the future.<\/p>\n
Mis meid veel ootab lisalugemiseks:<\/b><\/p>\n
\"On Kuidas automatiseerida IT-infrastruktuuri haldust \u2014 arutame kolme suundumust<\/a><\/noindex>
\n\"On JMAP \u2014 avatud protokoll asendab IMAP'i e-kirjade vahetamisel<\/a><\/noindex><\/p>\n
\"On Kuidas s\u00e4\u00e4sta rakendusliidese abil<\/a><\/noindex>
\n\"On DevOps'i rakendamine pilveteenuses n\u00e4itel 1cloud.ru<\/a><\/noindex>
\n\"On 1cloudi pilvearhitektuuri evolutsioon<\/a><\/noindex><\/p>\n
\"On Kuidas 1cloud'i tehniline tugi t\u00f6\u00f6tab<\/a><\/noindex>
\n\"On M\u00fc\u00fcdid pilvetehnoloogiate kohta<\/a><\/noindex><\/p><\/blockquote>\n
Allikas: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u0413\u043e\u0432\u043e\u0440\u0438\u043c \u043e \u0442\u043e\u043c, \u0447\u0442\u043e \u0441\u043e\u0431\u043e\u0439 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u044f DANE \u0434\u043b\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0434\u043e\u043c\u0435\u043d\u043d\u044b\u0445 \u0438\u043c\u0435\u043d \u043f\u043e DNS \u0438 \u043f\u043e\u0447\u0435\u043c\u0443 \u043e\u043d\u0430 \u043d\u0435 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u0448\u0438\u0440\u043e\u043a\u043e\u0433\u043e \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0432 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430\u0445. \/ Unsplash \/ Paulius Dragunas \u0427\u0442\u043e \u0442\u0430\u043a\u043e\u0435 DANE \u0421\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0435 \u0446\u0435\u043d\u0442\u0440\u044b (CA) \u2014 \u044d\u0442\u043e \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0437\u0430\u043d\u0438\u043c\u0430\u044e\u0442\u0441\u044f \u0443\u0434\u043e\u0441\u0442\u043e\u0432\u0435\u0440\u0435\u043d\u0438\u0435\u043c \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u0438\u0445 SSL-\u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432. \u041e\u043d\u0438 \u0441\u0442\u0430\u0432\u044f\u0442 \u043d\u0430 \u043d\u0438\u0445 \u0441\u0432\u043e\u044e \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u0443\u044e \u043f\u043e\u0434\u043f\u0438\u0441\u044c, \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u044f \u043f\u043e\u0434\u043b\u0438\u043d\u043d\u043e\u0441\u0442\u044c. \u041e\u0434\u043d\u0430\u043a\u043e \u043f\u043e\u0440\u043e\u0439 \u0432\u043e\u0437\u043d\u0438\u043a\u0430\u044e\u0442 \u0441\u0438\u0442\u0443\u0430\u0446\u0438\u0438, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":26289,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-34921","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47On arvamus: DANE tehnoloogia on brauserites eba\u00f5nnestunud | ProHoster","description":"R\u00e4\u00e4gime DANE tehnoloogiast, mis autentib domeeninimesid DNS kaudu ja miks see pole brauserites laialdaselt levinud. \/ Unsplash \/ Paulius Dragunas Mis on DANE Sertifitseerimisasutused (CA) on organisatsioonid, mis tegelevad kr\u00fcptograafiliste SSL-sertifikaatide t\u00f5endamisega. Need lisavad oma elektronallkiri, kinnitades autentsust. Kuid m\u00f5nikord tekivad olukorrad,","canonical_url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/est-mnenie-tehnologiya-dane-dlya-brauzerov-provalilas","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0415\u0441\u0442\u044c \u043c\u043d\u0435\u043d\u0438\u0435: \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u044f DANE \u0434\u043b\u044f \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u043e\u0432 \u043f\u0440\u043e\u0432\u0430\u043b\u0438\u043b\u0430\u0441\u044c | ProHoster","og:description":"\u0413\u043e\u0432\u043e\u0440\u0438\u043c \u043e \u0442\u043e\u043c, \u0447\u0442\u043e \u0441\u043e\u0431\u043e\u0439 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u044f DANE \u0434\u043b\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0434\u043e\u043c\u0435\u043d\u043d\u044b\u0445 \u0438\u043c\u0435\u043d \u043f\u043e DNS \u0438 \u043f\u043e\u0447\u0435\u043c\u0443 \u043e\u043d\u0430 \u043d\u0435 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u0448\u0438\u0440\u043e\u043a\u043e\u0433\u043e \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0432 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430\u0445. \/ Unsplash \/ Paulius Dragunas \u0427\u0442\u043e \u0442\u0430\u043a\u043e\u0435 DANE \u0421\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0435 \u0446\u0435\u043d\u0442\u0440\u044b (CA) \u2014 \u044d\u0442\u043e \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0437\u0430\u043d\u0438\u043c\u0430\u044e\u0442\u0441\u044f \u0443\u0434\u043e\u0441\u0442\u043e\u0432\u0435\u0440\u0435\u043d\u0438\u0435\u043c \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u0438\u0445 SSL-\u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432. \u041e\u043d\u0438 \u0441\u0442\u0430\u0432\u044f\u0442 \u043d\u0430 \u043d\u0438\u0445 \u0441\u0432\u043e\u044e \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u0443\u044e \u043f\u043e\u0434\u043f\u0438\u0441\u044c, \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u044f \u043f\u043e\u0434\u043b\u0438\u043d\u043d\u043e\u0441\u0442\u044c. \u041e\u0434\u043d\u0430\u043a\u043e \u043f\u043e\u0440\u043e\u0439 \u0432\u043e\u0437\u043d\u0438\u043a\u0430\u044e\u0442 \u0441\u0438\u0442\u0443\u0430\u0446\u0438\u0438,","og:url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/est-mnenie-tehnologiya-dane-dlya-brauzerov-provalilas","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:01:17+00:00","article:modified_time":"2019-10-31T19:01:17+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"34921","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 21:07:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 02:12:28","updated":"2026-01-21 21:07:19"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/34921","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=34921"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/34921\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/26289"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=34921"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=34921"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=34921"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}