{"id":72754,"date":"2020-03-04T02:42:36","date_gmt":"2020-03-03T23:42:36","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/massovyj-otzyv-sertifikatov-lets-encrypt"},"modified":"2020-03-04T02:42:36","modified_gmt":"2020-03-03T23:42:36","slug":"massovyj-otzyv-sertifikatov-lets-encrypt","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/massovyj-otzyv-sertifikatov-lets-encrypt","title":{"rendered":"Massiline Let's Encrypt sertifikaatide tagasiv\u00f5tmine","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\u00dchiskonna poolt hallatav mittekaubanduslik sertifitseerimiskeskus Let’s Encrypt, mis pakub sertifikaate tasuta k\u00f5igile soovijatele, hoiatab<\/a><\/noindex> peatsest TLS\/SSL sertifikaatide tagasikutsumisest. 116 miljonist praegu kehtivast Let's Encrypt sertifikaadist kutsutakse tagasi veidi \u00fcle 3 miljoni (2,6%), millest umbes 1 miljon on duplikaadid, mis on seotud \u00fche domeeniga (viga m\u00f5jutas peamiselt v\u00e4ga sageli uuendatavaid sertifikaate, mist\u00f5ttu on duplikaate nii palju). Tagasikutsumine on planeeritud 4. m\u00e4rtsiks (t\u00e4pne aeg pole veel kindlaks m\u00e4\u00e4ratud, kuid tagasikutsumine toimub mitte varem kui kell 3 \u00f6\u00f6sel MSK).<\/p>\n

Tagasiv\u00f5tmise vajadus tuleneb 29. veebruaril tuvastatud veast<\/a><\/noindex>. Probleem on ilmnenud alates 25. juulist 2019 ja see m\u00f5jutab CAA-kirjete kontrollimise s\u00fcsteemi DNS-is. CAA-kiri (RFC-6844<\/a><\/noindex>, Certificate Authority Authorization) v\u00f5imaldab domeeni omanikul selgelt m\u00e4\u00e4ratleda, milline sertifitseerimisasutus tohib v\u00e4lja anda sertifikaate m\u00e4\u00e4ratud domeeni jaoks. Kui sertifitseerimisasutust ei ole CAA rekordites loetletud, on see kohustatud keelduma sertifikaatide v\u00e4ljastamisest selle domeeni jaoks ja teavitama domeeni omanikku katsetest selle kompromiteerimiseks. Enamasti taotletakse sertifikaati kohe p\u00e4rast CAA kontrolli l\u00e4bimist, kuid kontrolli tulemus kehtib veel 30 p\u00e4eva. Reeglid n\u00f5uavad ka korduvkontrolli tegemist mitte hiljem kui 8 tundi enne uue sertifikaadi v\u00e4ljastamist (st kui uue sertifikaadi taotlemise ja eelmise kontrolli vahel on m\u00f6\u00f6dunud 8 tundi, on vajalik korduvkontroll).<\/p>\n

Viga ilmneb, kui sertifikaadi taotlus katab mitu domeeninime, mille kohta on vaja CAA kirje kontrolli. Probleemi olemus seisneb selles, et korduvkontrolli hetkel kontrolliti valideerimise asemel k\u00f5iki domeene, vaid ainult \u00fchte domeeni nimekirjast (kui taotlus h\u00f5lmas N domeeni, kontrolliti N erineva kontrolli asemel \u00fchte domeeni N korda). \u00dclej\u00e4\u00e4nud domeene ei kontrollitud ja otsuse tegemisel kasutati esimese kontrolli andmeid (st kasutati kuni 30 p\u00e4eva vanuseid andmeid). Selle tulemusena v\u00f5is Let's Encrypt anda sertifikaadi isegi siis, kui CAA kirje v\u00e4\u00e4rtus oli muutunud ja Let's Encrypt eemaldati lubatud sertifitseerimiskeskuste loetelmast esimese kontrolli j\u00e4rgselt 30 p\u00e4eva jooksul.<\/p>\n

Probleemiga kasutajatele on saadetud e-kiri, kui sertifikaadi taotlemisel olid t\u00e4idetud kontaktandmed. Oma sertifikaate saab kontrollida, laadides \u00fcles nimekiri<\/a><\/noindex> tagasi kutsutud sertifikaatide seerianumbrid v\u00f5i kasutades veebi teenust<\/a><\/noindex> (asub IP-aadressil, blokeeritud<\/a><\/noindex> Venema hooldusteenusega Roskomnadzoriga Venemaal). Teha kindlaks huvitava domeeni sertifikaadi seerianumber saab j\u00e4rgmise k\u00e4su abil:<\/p>\n

openssl s_client -connect example.com:443 -showcerts \/dev\/null \\
\n | openssl x509 -text -noout | grep -A 1 Serial\\ Number | tr -d :<\/p>\n

<\/a><\/noindex><\/p>\n

Allikas: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041d\u0435\u043a\u043e\u043c\u043c\u0435\u0440\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0434\u043e\u0441\u0442\u043e\u0432\u0435\u0440\u044f\u044e\u0449\u0438\u0439 \u0446\u0435\u043d\u0442\u0440 Let’s Encrypt, \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u044b\u0439 \u0441\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e\u043c \u0438 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0439 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u044b \u0431\u0435\u0437\u0432\u043e\u0437\u043c\u0435\u0437\u0434\u043d\u043e \u0432\u0441\u0435\u043c \u0436\u0435\u043b\u0430\u044e\u0449\u0438\u043c, \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b \u043e \u043f\u0440\u0435\u0434\u0441\u0442\u043e\u044f\u0449\u0435\u043c \u043e\u0442\u0437\u044b\u0432\u0435 \u043c\u043d\u043e\u0433\u0438\u0445 \u0440\u0430\u043d\u0435\u0435 \u0432\u044b\u0434\u0430\u043d\u043d\u044b\u0445 TLS\/SSL \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432. \u0418\u0437 116 \u043c\u043b\u043d \u043d\u044b\u043d\u0435 \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0445 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 Let’s Encrypt \u0431\u0443\u0434\u0435\u0442 \u043e\u0442\u043e\u0437\u0432\u0430\u043d\u043e \u0447\u0443\u0442\u044c \u0431\u043e\u043b\u044c\u0448\u0435 3 \u043c\u043b\u043d (2.6%), \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u0440\u0438\u043c\u0435\u0440\u043d\u043e 1 \u043c\u043b\u043d \u044f\u0432\u043b\u044f\u044e\u0442\u0441\u044f \u0434\u0443\u0431\u043b\u0438\u043a\u0430\u0442\u0430\u043c\u0438, \u043f\u0440\u0438\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u043c\u0438 \u043a \u043e\u0434\u043d\u043e\u043c\u0443 \u0434\u043e\u043c\u0435\u043d\u0443 (\u043e\u0448\u0438\u0431\u043a\u0430 \u0432 \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u043c \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u043b\u0430 \u043e\u0447\u0435\u043d\u044c \u0447\u0430\u0441\u0442\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u044f\u0435\u043c\u044b\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-72754","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Massiline Let's Encrypti sertifikaatide tagasiv\u00f5tmine | ProHoster","description":"Kogukonna kontrollitud mittetulundus\u00fching Let's Encrypt, mis pakub tasuta sertifikaate k\u00f5igile soovijatele,","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/massovyj-otzyv-sertifikatov-lets-encrypt","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041c\u0430\u0441\u0441\u043e\u0432\u044b\u0439 \u043e\u0442\u0437\u044b\u0432 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 Let&apos;s Encrypt | ProHoster","og:description":"\u041d\u0435\u043a\u043e\u043c\u043c\u0435\u0440\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0434\u043e\u0441\u0442\u043e\u0432\u0435\u0440\u044f\u044e\u0449\u0438\u0439 \u0446\u0435\u043d\u0442\u0440 Let's Encrypt, \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u044b\u0439 \u0441\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e\u043c \u0438 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0439 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u044b \u0431\u0435\u0437\u0432\u043e\u0437\u043c\u0435\u0437\u0434\u043d\u043e \u0432\u0441\u0435\u043c \u0436\u0435\u043b\u0430\u044e\u0449\u0438\u043c,","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/massovyj-otzyv-sertifikatov-lets-encrypt","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-03-03T23:42:36+00:00","article:modified_time":"2020-03-03T23:42:36+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"72754","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 18:46:21","updated":"2022-09-28 12:43:03","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/72754","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=72754"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/72754\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=72754"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=72754"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=72754"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}