{"id":55146,"date":"2020-01-13T00:00:00","date_gmt":"2020-01-12T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/mozilla-vnedryaet-crlite-dlya-proverki-problemnyh-tls-sertifikatov"},"modified":"2020-02-18T14:03:13","modified_gmt":"2020-02-18T11:03:13","slug":"mozilla-vnedryaet-crlite-dlya-proverki-problemnyh-tls-sertifikatov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/mozilla-vnedryaet-crlite-dlya-proverki-problemnyh-tls-sertifikatov","title":{"rendered":"Mozilla tutvustab CRLite'i probleemsete TLS-sertifikaatide kontrollimiseks","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Ettev\u00f5te Mozilla teatas<\/a><\/noindex> Firefoxi \u00f6\u00f6kaubanduse uue sertifikaadi t\u00fchistamise mehhanismi testimise algusest CRLite<\/a><\/noindex>. CRLite v\u00f5imaldab t\u00f5husat sertifikaatide t\u00fchistamise kontrolli kasutaja s\u00fcsteemis asuva andmebaasi p\u00f5hjal. Mozilla arendab CRLite rakendust avalikustatud<\/a><\/noindex> avatud MPL 2.0 litsentsi alusel. Andmebaasi genereerimise ja serveri komponentide kood on kirjutatud Python<\/a><\/noindex> ja Go keeles. Firefoxi lisatud kliendipoolsed osad andmete lugemiseks andmebaasist valmistatud<\/a><\/noindex> on kirjutatud Rust keeles.<\/p>\n

V\u00e4line teenuste p\u00f5hjal sertifikaatide kontrollimine, mis p\u00f5hineb protokollil OCSP<\/a><\/noindex> (Online Certificate Status Protocol), n\u00f5uab usaldusv\u00e4\u00e4rset v\u00f5rgus juurdep\u00e4\u00e4su, p\u00f5hjustab m\u00e4rgatavat viivitust p\u00e4ringu t\u00f6\u00f6tlemisel (keskmiselt 350ms) ja tekitab privaatsusprobleeme (OCSP p\u00e4ringutele vastavad serverid saavad teavet kindlate sertifikaatide kohta, mille alusel saab hinnata, milliseid veebisaite kasutaja avab). Samuti on olemas v\u00f5imalus kohalikuks kontrollimiseks loendite kaudu CRL<\/a><\/noindex> (Certificate Revocation List), kuid sellise meetodi miinuseks on allalaaditavate andmete v\u00e4ga suur maht - praegu on t\u00fchistatud sertifikaatide andmebaasi suurus umbes 300 MB ja see j\u00e4\u00e4b pidevalt kasvama.<\/p>\n

T\u00fchistatud ja kompromiteeritud sertifikaatide blokeerimiseks on Firefoxis alates 2015. aastast kasutusel keskne must nimekiri OneCRL<\/a><\/noindex> koos teenusega Google Safe Browsing<\/a><\/noindex> , et m\u00e4\u00e4rata v\u00f5imaliku pahatahtliku tegevuse olemus. OneCRL, nagu ka CRLSets<\/a><\/noindex> Chrome'is, toimib vahelingina, mis kogub sertifikaatide t\u00fchistamismeetmed ja pakub \u00fchtset keskset OCSP-teenust t\u00fchistatud sertifikaatide kontrollimiseks, v\u00f5imaldades mitte saata p\u00e4ringuid otse sertifitseerimiskeskustele. Vaatamata suurtele pingutustele sertifikaatide online-kontrollimise teenuse usaldusv\u00e4\u00e4rsuse t\u00f5stmiseks n\u00e4itavad telemeetriandmed, et \u00fcle 7% OCSP p\u00e4ringutest katkevad timeout'iga (m\u00f5ni aasta tagasi oli see n\u00e4itaja 15%). <\/p>\n

Vaikimisi juhul, kui OCSP kaudu kontrollimine ei \u00f5nnestu, peab brauser sertifikaati kehtivaks. Teenus v\u00f5ib olla kergesti k\u00e4ttesaamatu kas v\u00f5rguprobleemide t\u00f5ttu v\u00f5i v\u00e4liste r\u00fcnnakute t\u00f5ttu - OCSP kontrollimise m\u00f6\u00f6da hiilimiseks piisab teenuse kontrollimise ligip\u00e4\u00e4su blokeerimisest. Osaliselt taoliste r\u00fcnnakute v\u00e4ltimiseks on v\u00e4lja t\u00f6\u00f6tatud tehnika Must-Staple<\/a><\/noindex>, mis v\u00f5imaldab t\u00f5lgendada OCSP tagasiside vea v\u00f5i OCSP k\u00e4ttesaamatust sertifikaadi probleemina, kuid see v\u00f5imalus on vabatahtlik ja n\u00f5uab sertifikaadi erilist vormistamist. <\/p>\n

CRLite v\u00f5imaldab koguda t\u00e4ielikku teavet k\u00f5igi t\u00fchistatud sertifikaatide kohta \u00fchte kergesti uuendatavasse struktuuri, mille suurus on vaid 1 MB, mis annab v\u00f5imaluse salvestada t\u00e4ielik CRL andmebaas kliendi poole.
\nBrauser suudab igap\u00e4evaselt s\u00fcnkroniseerida oma koopia t\u00fchistatud sertifikaatide andmetest, ning see andmebaas on kergesti k\u00e4ttesaadav igasugustes tingimustes. <\/p>\n

CRLite integreerib teavet Certificate Transparency<\/a><\/noindex>, k\u00f5igi v\u00e4ljastatud ja t\u00fchistatud sertifikaatide avalikust logist ning sertifikaatide internetis skaneerimise tulemustest (kuid erinevad CRL nimekirjad v\u00e4ljastusasutustest kogutakse kokku ja agrageeritakse teave k\u00f5ikide tuntud sertifikaatide kohta). Andmed pakendatakse, kasutades kaskaadset Bloom-filtred<\/a><\/noindex>, t\u00f5en\u00e4osusstruktuuri, mis lubab vale m\u00e4\u00e4ratlemise puudumise korral, kuid v\u00e4listab olemasoleva elemendi mitteleitmise (st kindla t\u00f5en\u00e4osusega v\u00f5ib \u00f5igele sertifikaadile esineda valeaktiveerimine, kuid t\u00fchistatud sertifikaadid tuvastatakse garantiiga). <\/p>\n

False positives in CRLite are mitigated through additional corrective filtering levels. After the structure is generated, all original records are processed to identify any false positives. Based on this verification, an additional structure is created that is cascaded onto the first to correct any false positives. This operation is repeated until false positives are completely eliminated in the control check. Typically, creating 7-10 layers suffices for full data coverage. Since the state of the database lags slightly due to periodic synchronization from the current state of the CRL, checking new certificates issued after the last CRLite database update is done using the OCSP protocol, including using the technique OCSP Stapling<\/a><\/noindex> (the OCSP response, certified by the certificate authority, is provided by the server hosting the site during the TLS connection negotiation).<\/p>\n

\"Mozilla<\/a><\/noindex><\/center><\/p>\n

Using Bloom filters, the December snapshot of WebPKI data covering 100 million active certificates and 750,000 revoked certificates was packed into a structure of 1.3 MB. The process of generating this structure is quite resource-intensive, but it is performed on Mozilla's server, and the user receives a ready-made update. For example, in binary form, the source data used during generation requires about 16 GB of memory when stored in the Redis database, and in hexadecimal form, the dump of all certificate serial numbers occupies about 6.7 GB. The process of aggregating all revoked and active certificates takes about 40 minutes, while generating the packed structure based on Bloom filter requires an additional 20 minutes.<\/p>\n

Praegu on Mozilla taganud CRLite andmebaasi v\u00e4rskendamise neli korda p\u00e4evas (mitte k\u00f5ik v\u00e4rskendused ei j\u00f5ua klientideni). Delta-v\u00e4rskenduste genereerimine ei ole aga veel realiseeritud - bsdiff4, mida kasutatakse versioonide delta-v\u00e4rskenduste loomiseks, ei taga CRLite jaoks vajalikku efektiivsust ning v\u00e4rskendused osutuvad p\u00f5hjendamatult suurteks. Selle puuduse k\u00f5rvaldamiseks on plaanis \u00fcmber kujundada salvestusstruktuuri formaat, et v\u00e4listada liigset \u00fcmberstruktureerimist ja kihtide eemaldamist.<\/p>\n

CRLite t\u00f6\u00f6tab Firefoxis passiivre\u017eiimis ja seda kasutatakse koos OCSP-ga, et koguda statistikat t\u00f6\u00f6 korrektsuse kohta. CRLite v\u00f5ib minna p\u00f5hikontrolli re\u017eiimi, selleks tuleb about:config-is seada parameeter security.pki.crlite_mode = 2.<\/p>\n

\"Mozilla<\/a><\/noindex><\/center><\/p>\n

<\/a><\/noindex><\/p>\n

Allikas: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Mozilla \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u043d\u0430\u0447\u0430\u043b\u0435 \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0432 \u043d\u043e\u0447\u043d\u044b\u0445 \u0441\u0431\u043e\u0440\u043a\u0430\u0445 Firefox \u043d\u043e\u0432\u043e\u0433\u043e \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u043e\u0442\u043e\u0437\u0432\u0430\u043d\u043d\u044b\u0445 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 — CRLite. CRLite \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u044d\u0444\u0444\u0435\u043a\u0442\u0438\u0432\u043d\u0443\u044e \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0443 \u043e\u0442\u0437\u044b\u0432\u0430 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 \u043f\u043e \u0431\u0430\u0437\u0435 \u0434\u0430\u043d\u043d\u044b\u0445, \u0440\u0430\u0437\u043c\u0435\u0449\u0430\u0435\u043c\u043e\u0439 \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f. \u0420\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u0430\u044f \u0432 Mozilla \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f CRLite \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430 \u043f\u043e\u0434 \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0439 \u043b\u0438\u0446\u0435\u043d\u0437\u0438\u0435\u0439 MPL 2.0. \u041a\u043e\u0434 \u0434\u043b\u044f \u0433\u0435\u043d\u0435\u0440\u0430\u0446\u0438\u0438 \u0411\u0414 \u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u043d\u044b\u0435 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u044b \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u044b \u043d\u0430 Python \u0438 Go. \u0414\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-55146","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Mozilla rakendab CRLite probleemi tekitavate TLS-sertifikaatide kontrollimiseks | ProHoster","description":"Firma Mozilla teatas, et on alustanud testimist Firefoxi \u00f6\u00f6sel v\u00e4lja antud versioonides.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/mozilla-vnedryaet-crlite-dlya-proverki-problemnyh-tls-sertifikatov","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Mozilla \u0432\u043d\u0435\u0434\u0440\u044f\u0435\u0442 CRLite \u0434\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u043d\u044b\u0445 TLS-\u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Mozilla \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u043d\u0430\u0447\u0430\u043b\u0435 \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0432 \u043d\u043e\u0447\u043d\u044b\u0445 \u0441\u0431\u043e\u0440\u043a\u0430\u0445 Firefox.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/mozilla-vnedryaet-crlite-dlya-proverki-problemnyh-tls-sertifikatov","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-01-12T21:00:00+00:00","article:modified_time":"2020-02-18T11:03:13+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"55146","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 19:50:02","updated":"2022-10-10 06:24:37","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/55146","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=55146"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/55146\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=55146"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=55146"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=55146"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}