{"id":38175,"date":"2019-10-31T22:22:05","date_gmt":"2019-10-31T19:22:05","guid":{"rendered":"https:\/\/prohoster.info\/blog\/forum-ca-b-progolosoval-protiv-sokrashheniya-sroka-dejstviya-ssl-sertifikatov-do-397-dnej\/"},"modified":"2019-10-31T22:22:05","modified_gmt":"2019-10-31T19:22:05","slug":"forum-ca-b-progolosoval-protiv-sokrashheniya-sroka-dejstviya-ssl-sertifikatov-do-397-dnej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/forum-ca-b-progolosoval-protiv-sokrashheniya-sroka-dejstviya-ssl-sertifikatov-do-397-dnej","title":{"rendered":"Foorum CA\/B h\u00e4\u00e4letas SSL-sertifikaatide kehtivusaja l\u00fchendamise vastu 397 p\u00e4evani.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

26. juuli 2019. aastal teatas Google ettepanek<\/a><\/noindex> v\u00e4hemalt v\u00e4hendada SSL\/TLS serveri sertifikaatide maksimaalset kehtivusaega praegustelt 825 p\u00e4evalt 397 p\u00e4evani (umbes 13 kuud), mist\u00f5ttu on see peaaegu poole v\u00e4hem. Google arvab, et ainult t\u00e4ielik sertifikaatide automatiseerimine suudab k\u00f5rvaldada praegused turvaprobleemid, mida tihti seletatakse inimfaktoriga. Seet\u00f5ttu on ideaalne p\u00fc\u00fcelda automatiseeritud l\u00fchikese kehtivusajaga sertifikaatide v\u00e4ljastamise poole.<\/p>\n

K\u00fcsimus viidi h\u00e4\u00e4letusele CA\/Browse Forum'is (CABF), mis seab n\u00f5udeid SSL\/TLS sertifikaatidele, sealhulgas maksimaalsele kehtivusajale.<\/p>\n

Ja 10. septembril kuulutati tulemused<\/a><\/noindex>: konsortsiumi liikmed h\u00e4\u00e4letasid vastu<\/b> ettepaneku poolt.
\n<\/a><\/noindex><\/p>\n

Tulemused<\/h1>\n

<\/p>\n

Sertifikaatide v\u00e4ljaandjate h\u00e4\u00e4letus<\/h4>\n

Jah (11 h\u00e4\u00e4lt)<\/b>: Amazon, Buypass, Certigna (DHIMYOTIS), certSIGN, Sectigo (endine Comodo CA), eMudhra, Kamu SM, Let’s Encrypt, Logius, PKIoverheid, SHECA, SSL.com<\/p>\n

Vastu (20)<\/b>: Camerfirma, Certum (Asseco), CFCA, Chunghwa Telecom, Comsign, D-TRUST, DarkMatter, Entrust Datacard, Firmaprofesional, GDCA, GlobalSign, GoDaddy, Izenpe, Network Solutions, OATI, SECOM, SwissSign, TWCA, TrustCor, SecureTrust (endine Trustwave)<\/p>\n

V\u00e4\u00e4ratas (2)<\/b>: HARICA, TurkTrust<\/p><\/blockquote>\n

<\/p>\n

Tarbijate sertifikaatide h\u00e4\u00e4letus<\/h4>\n

Jah (7)<\/b>: Apple, Cisco, Google, Microsoft, Mozilla, Opera, 360<\/p>\n

Vastu<\/b>: 0<\/p>\n

Olen vaikimisi<\/b>: 0<\/p><\/blockquote>\n

\nCA \/ Browser Foorumi reeglite kohaselt peab positiivse otsuse vastuv\u00f5tmiseks h\u00e4\u00e4letama kaks kolmandikku sertifikaatide v\u00e4ljaandjatest ja 50% pluss \u00fcks h\u00e4\u00e4l tarbijate seast.<\/p>\n

Digicerti esindajad vabandavad<\/a><\/noindex> h\u00e4\u00e4letamise vahelej\u00e4tmise p\u00e4rast, kus nad oleksid oma h\u00e4\u00e4le andnud sertifikaatide kehtivusaja l\u00fchendamise poolt. Nad m\u00e4rkivad, et m\u00f5nedel klientidel v\u00f5ib kehtivusaja l\u00fchendamine esindada probleemide tekitamist, kuid pikaajalises plaanis toob see turvalisuse eeliseid.<\/p>\n

Nii v\u00f5i teisiti, aga t\u00f6\u00f6stus ei ole veel valmis sertifikaatide kehtivusaja l\u00fchendamiseks ja t\u00e4ielikuks automatiseeritud lahenduste kasutuselev\u00f5tuks. Sertifikaatide v\u00e4ljaandvad keskused v\u00f5ivad selliseid teenuseid pakkuda, kuid paljud kliendid pole veel automatiseerimist rakendanud. Seet\u00f5ttu l\u00fckatakse kehtivuse v\u00e4hendamine 397 p\u00e4evani edasi. Kuid k\u00fcsimus j\u00e4\u00e4b avatuks.<\/p>\n

N\u00fc\u00fcd v\u00f5ib Google proovida standardit 'sundida' nagu see oli protokolli puhul Certificate Transparency<\/a><\/noindex>. Eriti kuna seda toetavad ka teised arendajad: Apple, Microsoft, Mozilla ja Opera.<\/p>\n

Tulet meelde, et t\u00e4ielik automatiseerimine on \u00fcks p\u00f5him\u00f5tteid, millele p\u00f5hineb mittetulundus\u00fchingu Let’s Encrypt t\u00f6\u00f6. See v\u00e4ljastab tasuta sertifikaate k\u00f5igile soovijatele, kuid sertifikaadi maksimaalne kehtivusaeg on piiratud 90 p\u00e4evaga. L\u00fchikesed sertifikaatide kehtivusajad omavad kaht peamist eelised<\/a><\/noindex>:<\/p>\n

    \n
  1. kahjude piiramine compromiteeritud v\u00f5tmetest ja valesti v\u00e4ljastatud sertifikaatidest, kuna neid kasutatakse l\u00fchemat aega;\n<\/li>\n
  2. l\u00fchiajalised sertifikaadid toetavad ja soodustavad automatiseerimist, mis on t\u00e4iesti vajalik HTTPS-i kasutamise lihtsuse tagamiseks. Kui me kavatseme kogu maailmas veebi \u00fcle viia HTTPS-ile, ei saa kindlasti oodata, et iga olemasoleva saidi administraator v\u00e4rskendab sertifikaate k\u00e4sitsi. Kui sertifikaatide v\u00e4ljastamine ja uuendamine saab t\u00e4ielikult automatiseeritud, muutuvad l\u00fchemad kehtivusajad vastupidi veelgi mugavamaks ja praktilisemaks. <\/li>\n<\/ol>\n

    \nGlobalSign'i uuring Habr's<\/a><\/noindex> n\u00e4itas, et 73,7% vastajatest \u201epigem toetavad\u201d sertifikaatide kehtivusaja l\u00fchendamist.<\/p>\n

    Mis EV-sertifikaatide ikooni peitmine aadressiribal puudutab, siis selle k\u00fcsimuse \u00fcle ei h\u00e4\u00e4letanud konsortsiumi liikmed, kuna brauserite UI-de k\u00fcsimus on t\u00e4ielikult arendajate p\u00e4devuses. Uued versioonid Chrome 77 ja Firefox 70 tulevad v\u00e4lja septembris-oktoobris, mis eemaldavad EV-sertifikaatidelt aadressiribal erilise koha. Nii n\u00e4eb muutus v\u00e4lja Firefox 70 t\u00f6\u00f6lauaversiooni n\u00e4itel:<\/p>\n

    Oli:<\/p>\n

    \"Foorum
    \n
    \nSaab olema:<\/p>\n

    \"Foorum
    \n
    \nTurvaekspert Troy Hanti arvates eemaldamine EV-infost brauserite aadressiribal     sisuliselt matab selle t\u00fc\u00fcbi sertifikaadid<\/a><\/noindex>.
    \n
    Allikas:     habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

    26 \u0438\u044e\u043b\u044f 2019 \u0433\u043e\u0434\u0430 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Google \u0432\u044b\u0441\u0442\u0443\u043f\u0438\u043b\u0430 \u0441 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u0438\u0435\u043c \u0443\u043c\u0435\u043d\u044c\u0448\u0438\u0442\u044c \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u044b\u0439 \u0441\u0440\u043e\u043a \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u0441\u0435\u0440\u0432\u0435\u0440\u043d\u044b\u0445 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 SSL\/TLS \u0441 \u043d\u044b\u043d\u0435\u0448\u043d\u0438\u0445 825 \u0434\u043d\u0435\u0439 \u0434\u043e 397 \u0434\u043d\u0435\u0439 (\u043e\u043a\u043e\u043b\u043e 13 \u043c\u0435\u0441\u044f\u0446\u0435\u0432), \u0442\u043e \u0435\u0441\u0442\u044c \u043f\u0440\u0438\u043c\u0435\u0440\u043d\u043e \u0432\u0434\u0432\u043e\u0435. Google \u0441\u0447\u0438\u0442\u0430\u0435\u0442, \u0447\u0442\u043e \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u043e\u043b\u043d\u0430\u044f \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0437\u0430\u0446\u0438\u044f \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0439 \u0441 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430\u043c\u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442 \u0438\u0437\u0431\u0430\u0432\u0438\u0442\u044c\u0441\u044f \u043e\u0442 \u043d\u044b\u043d\u0435\u0448\u043d\u0438\u0445 \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0441 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\u044e, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0447\u0430\u0441\u0442\u043e \u043e\u0431\u044a\u044f\u0441\u043d\u044f\u044e\u0442\u0441\u044f \u0447\u0435\u043b\u043e\u0432\u0435\u0447\u0435\u0441\u043a\u0438\u043c \u0444\u0430\u043a\u0442\u043e\u0440\u043e\u043c. \u041f\u043e\u044d\u0442\u043e\u043c\u0443 \u0432 \u0438\u0434\u0435\u0430\u043b\u0435 \u043d\u0443\u0436\u043d\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":28658,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-38175","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Foorum CA\/B h\u00e4\u00e4letas SSL-sertifikaatide kehtivusaja v\u00e4hendamise vastu 397 p\u00e4evani | ProHoster","description":"26. juulil 2019 esitas Google ettepaneku v\u00e4hendada SSL\/TLS serveri sertifikaatide maksimaalset kehtivusaega seniselt 825 p\u00e4evalt 397 p\u00e4evale (umbes 13 kuud), mis t\u00e4hendab ligikaudu kahekordset v\u00e4hendamist. Google usub, et ainult t\u00e4ielik sertifikaatide automatiseerimine suudab vabastada praegustest turvaprobleemidest, mida sageli selgitab inimfaktor. Seet\u00f5ttu on ideaalne, et","canonical_url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/forum-ca-b-progolosoval-protiv-sokrashheniya-sroka-dejstviya-ssl-sertifikatov-do-397-dnej","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0424\u043e\u0440\u0443\u043c CA\/B \u043f\u0440\u043e\u0433\u043e\u043b\u043e\u0441\u043e\u0432\u0430\u043b \u043f\u0440\u043e\u0442\u0438\u0432 \u0441\u043e\u043a\u0440\u0430\u0449\u0435\u043d\u0438\u044f \u0441\u0440\u043e\u043a\u0430 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f SSL-\u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 \u0434\u043e 397 \u0434\u043d\u0435\u0439 | ProHoster","og:description":"26 \u0438\u044e\u043b\u044f 2019 \u0433\u043e\u0434\u0430 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Google \u0432\u044b\u0441\u0442\u0443\u043f\u0438\u043b\u0430 \u0441 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u0438\u0435\u043c \u0443\u043c\u0435\u043d\u044c\u0448\u0438\u0442\u044c \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u044b\u0439 \u0441\u0440\u043e\u043a \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u0441\u0435\u0440\u0432\u0435\u0440\u043d\u044b\u0445 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 SSL\/TLS \u0441 \u043d\u044b\u043d\u0435\u0448\u043d\u0438\u0445 825 \u0434\u043d\u0435\u0439 \u0434\u043e 397 \u0434\u043d\u0435\u0439 (\u043e\u043a\u043e\u043b\u043e 13 \u043c\u0435\u0441\u044f\u0446\u0435\u0432), \u0442\u043e \u0435\u0441\u0442\u044c \u043f\u0440\u0438\u043c\u0435\u0440\u043d\u043e \u0432\u0434\u0432\u043e\u0435. Google \u0441\u0447\u0438\u0442\u0430\u0435\u0442, \u0447\u0442\u043e \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u043e\u043b\u043d\u0430\u044f \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0437\u0430\u0446\u0438\u044f \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0439 \u0441 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430\u043c\u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442 \u0438\u0437\u0431\u0430\u0432\u0438\u0442\u044c\u0441\u044f \u043e\u0442 \u043d\u044b\u043d\u0435\u0448\u043d\u0438\u0445 \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0441 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\u044e, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0447\u0430\u0441\u0442\u043e \u043e\u0431\u044a\u044f\u0441\u043d\u044f\u044e\u0442\u0441\u044f \u0447\u0435\u043b\u043e\u0432\u0435\u0447\u0435\u0441\u043a\u0438\u043c \u0444\u0430\u043a\u0442\u043e\u0440\u043e\u043c. \u041f\u043e\u044d\u0442\u043e\u043c\u0443 \u0432 \u0438\u0434\u0435\u0430\u043b\u0435 \u043d\u0443\u0436\u043d\u043e","og:url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/forum-ca-b-progolosoval-protiv-sokrashheniya-sroka-dejstviya-ssl-sertifikatov-do-397-dnej","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:22:05+00:00","article:modified_time":"2019-10-31T19:22:05+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"38175","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 20:47:03","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 18:29:57","updated":"2026-01-23 20:47:03","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/38175","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=38175"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/38175\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/28658"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=38175"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=38175"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=38175"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}