{"id":38175,"date":"2019-10-31T22:22:05","date_gmt":"2019-10-31T19:22:05","guid":{"rendered":"https:\/\/prohoster.info\/blog\/forum-ca-b-progolosoval-protiv-sokrashheniya-sroka-dejstviya-ssl-sertifikatov-do-397-dnej\/"},"modified":"2019-10-31T22:22:05","modified_gmt":"2019-10-31T19:22:05","slug":"forum-ca-b-progolosoval-protiv-sokrashheniya-sroka-dejstviya-ssl-sertifikatov-do-397-dnej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/forum-ca-b-progolosoval-protiv-sokrashheniya-sroka-dejstviya-ssl-sertifikatov-do-397-dnej","title":{"rendered":"CA\/B foorum h\u00e4\u00e4letas SSL-sertifikaatide kehtivusaja l\u00fchendamise vastu 397 p\u00e4evani","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

26. juulil 2019 teatas Google ettepanekust<\/a><\/noindex> l\u00fchendada SSL\/TLS serverisertifikaatide maksimaalset kehtivusaega praegustelt 825 p\u00e4evalt 397 p\u00e4evani (umbes 13 kuud), mis on ligikaudu poole v\u00e4hem. Google usub, et ainult t\u00e4ielik automatiseerimine sertifikaatidega seotud toimingutes v\u00f5imaldab vabaneda olemasolevatest turvaprobleemidest, mida sageli seletatakse inimfaktoritega. Seet\u00f5ttu on ideaalne p\u00fc\u00fcdleda automatiseeritud l\u00fchikese kehtivusajaga sertifikaatide v\u00e4ljastamise poole.<\/p>\n

K\u00fcsimus pandi h\u00e4\u00e4letusele CA\/Browser Forum organisatsioonis (CABF), mis kehtestab n\u00f5uded SSL\/TLS-sertifikaatidele, sealhulgas ka maksimaalsele kehtivusele.<\/p>\n

Ja 10. septembril teatati tulemustest<\/a><\/noindex>: konsortsiumi liikmed h\u00e4\u00e4letasid vastu<\/b> ettepanekule.
\n<\/a><\/noindex><\/p>\n

tulemused n\u00e4itasid ainult nelja ebaolulise koodibloki kattuvust, mis olid tingitud POSIX ja ANSI C n\u00f5uetest.<\/h1>\n

<\/p>\n

Sertifikaatide v\u00e4ljaandjate h\u00e4\u00e4letus<\/h4>\n

Jah (11 h\u00e4\u00e4lt)<\/b>: Amazon, Buypass, Certigna (DHIMYOTIS), certSIGN, Sectigo (endine Comodo CA), eMudhra, Kamu SM, Let’s Encrypt, Logius, PKIoverheid, SHECA, SSL.com<\/p>\n

Vastu (20)<\/b>: Camerfirma, Certum (Asseco), CFCA, Chunghwa Telecom, Comsign, D-TRUST, DarkMatter, Entrust Datacard, Firmaprofesional, GDCA, GlobalSign, GoDaddy, Izenpe, Network Solutions, OATI, SECOM, SwissSign, TWCA, TrustCor, SecureTrust (endine Trustwave)<\/p>\n

V\u00e4ltinud (2)<\/b>: HARICA, TurkTrust<\/p><\/blockquote>\n

<\/p>\n

Sertifikaatide tarbijate h\u00e4\u00e4letus<\/h4>\n

Jah (7)<\/b>: Apple, Cisco, Google, Microsoft, Mozilla, Opera, 360<\/p>\n

Vastu<\/b>: 0<\/p>\n

V\u00e4ltinud<\/b>: 0<\/p><\/blockquote>\n

\nCA\/Browser Forum reeglite kohaselt peab positiivse otsuse tegemiseks h\u00e4\u00e4letama kaks kolmandikku sertifikaatide v\u00e4ljaandjatest ja 50% plus \u00fcks h\u00e4\u00e4l tarbijate seas.<\/p>\n

Digicerti esindajad avaldasid kahetsust<\/a><\/noindex> h\u00e4\u00e4letuse vahelej\u00e4\u00e4mise p\u00e4rast, kus nad oleksid h\u00e4\u00e4letanud sertifikaatide kehtivusaja l\u00fchendamise poolt. Nad m\u00e4rgivad, et m\u00f5ne kliendi jaoks v\u00f5ib kehtivusaja l\u00fchendamine olla probleemiks, kuid pikaajalises perspektiivis toob see turvalisuse eeliseid.<\/p>\n

Nii v\u00f5i naa, ent t\u00f6\u00f6stus ei ole veel valmis sertifikaatide kehtivusaega l\u00fchendama ja t\u00e4ielikult automatiseeritud lahendustele \u00fcle minema. Sertifitseerimiskeskused v\u00f5ivad selliseid teenuseid pakkuda, kuid paljud kliendid ei ole veel automatiseerimist rakendanud. Seet\u00f5ttu l\u00fckatakse ajavahemiku l\u00fchendamine 397 p\u00e4evani edasi. Kuid k\u00fcsimus j\u00e4\u00e4b avatuks.<\/p>\n

N\u00fc\u00fcd v\u00f5ib Google proovida standardit \"sundida\" rakendama, nagu see toimus protokolliga Certificate Transparency<\/a><\/noindex>. Eriti, kuna seda toetavad ka teised arendajad: Apple, Microsoft, Mozilla ja Opera.<\/p>\n

Tuletame meelde, et t\u00e4ielik automatiseerimine on \u00fcks p\u00f5him\u00f5tteid, millele on rajatud mittetulundus\u00fchingu Let's Encrypt sertifitseerimiskeskuse t\u00f6\u00f6. See v\u00e4ljastab tasuta sertifikaate k\u00f5igile soovijatele, kuid sertifikaadi maksimaalne kehtivusaeg on piiratud 90 p\u00e4evaga. Sertifikaatide l\u00fchike kehtivusaeg on kaks peamist eelist<\/a><\/noindex>:<\/p>\n

    \n
  1. kahjustuste piiramise kompromiteeritud v\u00f5tmete ja valesti v\u00e4ljastatud sertifikaatide osas, kuna neid kasutatakse l\u00fchema ajavahemiku jooksul;\n<\/li>\n
  2. l\u00fchikese kehtivusajaga sertifikaadid toetavad ja soodustavad automatiseerimist, mis on absoluutne vajadus HTTPS-i kasutamise lihtsustamiseks. Kui me kavatseme \u00fcle viia kogu World Wide Web'i HTTPS-ile, ei saa oodata, et igas olemasolevas saidis on administraator, kes k\u00e4sitsi sertifikaate uuendab. Niipea kui sertifikaatide v\u00e4ljastamine ja uuendamine muutub t\u00e4ielikult automatiseerituks, muutuvad l\u00fchemad kehtivusajad vastupidiselt mugavamaks ja praktilisemaks. <\/li>\n<\/ol>\n

    \nGlobalSign'i k\u00fcsitlus Habras<\/a><\/noindex> n\u00e4itas, et 73,7% vastanuist \u00abtoetaks pigem\u00bb sertifikaatide kehtivusaja l\u00fchendamist.<\/p>\n

    Mis puudutab EV-sertifikaatide ikooni peitmist aadressireal, siis selle k\u00fcsimuse osas konsorsium ei h\u00e4\u00e4letanud, kuna brauserite kasutajaliidese k\u00fcsimus j\u00e4\u00e4b t\u00e4ielikult arendajate p\u00e4devusse. Septembris ja oktoobris ilmuvad uued versioonid Chrome 77 ja Firefox 70, mis eemaldavad EV-sertifikaatidelt erilise koha brauseri aadressirealt. Nii n\u00e4eb v\u00e4lja muudatus n\u00e4iteks Firefox 70 lauaversioonis:<\/p>\n

    Oli:<\/p>\n

    \"CA\/B
    \n
    \nSaab olema:<\/p>\n

    \"CA\/B
    \n
    \nTurbeekspert Troy Hanti arvates t\u00e4hendab EV-info eemaldamine brauserite aadressirivist     see sisuliselt EV-sertifikaatide mahamatmist<\/a><\/noindex>.
    \n
    Allikas:     habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

    26 \u0438\u044e\u043b\u044f 2019 \u0433\u043e\u0434\u0430 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Google \u0432\u044b\u0441\u0442\u0443\u043f\u0438\u043b\u0430 \u0441 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u0438\u0435\u043c \u0443\u043c\u0435\u043d\u044c\u0448\u0438\u0442\u044c \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u044b\u0439 \u0441\u0440\u043e\u043a \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u0441\u0435\u0440\u0432\u0435\u0440\u043d\u044b\u0445 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 SSL\/TLS \u0441 \u043d\u044b\u043d\u0435\u0448\u043d\u0438\u0445 825 \u0434\u043d\u0435\u0439 \u0434\u043e 397 \u0434\u043d\u0435\u0439 (\u043e\u043a\u043e\u043b\u043e 13 \u043c\u0435\u0441\u044f\u0446\u0435\u0432), \u0442\u043e \u0435\u0441\u0442\u044c \u043f\u0440\u0438\u043c\u0435\u0440\u043d\u043e \u0432\u0434\u0432\u043e\u0435. Google \u0441\u0447\u0438\u0442\u0430\u0435\u0442, \u0447\u0442\u043e \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u043e\u043b\u043d\u0430\u044f \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0437\u0430\u0446\u0438\u044f \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0439 \u0441 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430\u043c\u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442 \u0438\u0437\u0431\u0430\u0432\u0438\u0442\u044c\u0441\u044f \u043e\u0442 \u043d\u044b\u043d\u0435\u0448\u043d\u0438\u0445 \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0441 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\u044e, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0447\u0430\u0441\u0442\u043e \u043e\u0431\u044a\u044f\u0441\u043d\u044f\u044e\u0442\u0441\u044f \u0447\u0435\u043b\u043e\u0432\u0435\u0447\u0435\u0441\u043a\u0438\u043c \u0444\u0430\u043a\u0442\u043e\u0440\u043e\u043c. \u041f\u043e\u044d\u0442\u043e\u043c\u0443 \u0432 \u0438\u0434\u0435\u0430\u043b\u0435 \u043d\u0443\u0436\u043d\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":28658,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-38175","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 CA\/B foorum h\u00e4\u00e4letas SSL-sertifikaatide kehtivusaja l\u00fchendamise vastu kuni 397 p\u00e4evani | ProHoster","description":"26. juulil 2019 tegi Google ettepaneku v\u00e4hendada serverite maksimaalset kehtivusaega.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/forum-ca-b-progolosoval-protiv-sokrashheniya-sroka-dejstviya-ssl-sertifikatov-do-397-dnej","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0424\u043e\u0440\u0443\u043c CA\/B \u043f\u0440\u043e\u0433\u043e\u043b\u043e\u0441\u043e\u0432\u0430\u043b \u043f\u0440\u043e\u0442\u0438\u0432 \u0441\u043e\u043a\u0440\u0430\u0449\u0435\u043d\u0438\u044f \u0441\u0440\u043e\u043a\u0430 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f SSL-\u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 \u0434\u043e 397 \u0434\u043d\u0435\u0439 | ProHoster","og:description":"26 \u0438\u044e\u043b\u044f 2019 \u0433\u043e\u0434\u0430 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Google \u0432\u044b\u0441\u0442\u0443\u043f\u0438\u043b\u0430 \u0441 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u0438\u0435\u043c \u0443\u043c\u0435\u043d\u044c\u0448\u0438\u0442\u044c \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u044b\u0439 \u0441\u0440\u043e\u043a \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u0441\u0435\u0440\u0432\u0435\u0440\u043d\u044b\u0445.","og:url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/forum-ca-b-progolosoval-protiv-sokrashheniya-sroka-dejstviya-ssl-sertifikatov-do-397-dnej","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:22:05+00:00","article:modified_time":"2019-10-31T19:22:05+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"38175","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 20:47:03","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 18:29:57","updated":"2026-01-23 20:47:03","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/38175","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=38175"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/38175\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/28658"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=38175"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=38175"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=38175"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}