{"id":72877,"date":"2020-03-05T08:42:10","date_gmt":"2020-03-05T05:42:10","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/letsencrypt-planiruet-otozvat-svoi-sertifikaty-iz-za-programmnoj-oshibki"},"modified":"2020-03-05T08:42:10","modified_gmt":"2020-03-05T05:42:10","slug":"letsencrypt-planiruet-otozvat-svoi-sertifikaty-iz-za-programmnoj-oshibki","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/letsencrypt-planiruet-otozvat-svoi-sertifikaty-iz-za-programmnoj-oshibki","title":{"rendered":"LetsEncrypt plaanib oma sertifikaadid tagasiv\u00f5tta tarkvaravea t\u00f5ttu","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"LetsEncrypt
\nLetsEncrypt, mis pakub tasuta SSL-sertifikaate kr\u00fcpteerimiseks, peab t\u00fchistama m\u00f5ned sertifikaadid.<\/p>\n

<\/a><\/noindex><\/p>\n

Probleem on seotud tarkvara veaga<\/a><\/noindex> haldusprogrammis Boulder, mida kasutatakse CA loomisel. Tavaliselt toimub DNS CAA kirje kontrollimine samal ajal domeeni omandi kinnitamisega, ja enamik tellijaid saavad sertifikaadi kohe p\u00e4rast kontrollimist. Kuid tarkvara arendajad tegid nii, et kontrollimise tulemus loetakse kehtivaks veel j\u00e4rgmise 30 p\u00e4eva jooksul. M\u00f5nes juhus peab kontrollima kirjeid teist korda, just enne sertifikaadi v\u00e4ljastamist, eriti on vajalik CAA korduv kontroll 8 tundi enne v\u00e4ljastamist, seega k\u00f5ik domeenid, mis on kontrollitud enne seda aega, tuleb kontrollida uuesti.<\/p>\n

<\/p>\n

Mis on vea sisu? Kui sertifikaadi taotlus sisaldab N domeeni, mis vajavad CAA korduvat kontrollimist \u2014 Boulder valis \u00fche neist ja kontrollis seda N korda. Selle tulemusena oli v\u00f5imalik sertifikaadi v\u00e4ljastamine, isegi kui hiljem (enne X+30 p\u00e4eva) seadistatakse CAA kirje, mis keelab LetsEncrypt\u2019i sertifikaadi v\u00e4ljastamise.<\/p>\n

<\/p>\n

Sertifikaatide kontrollimiseks valmistab ettev\u00f5te ette veebit\u00f6\u00f6riist<\/a><\/noindex>, mis n\u00e4itab \u00fcksikasjalikku aruannet.<\/p>\n

<\/p>\n

Kogenud kasutajad saavad k\u00f5ik ise teha, kasutades j\u00e4rgmisi k\u00e4ske:<\/p>\n

<\/p>\n

# \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 https\nopenssl s_client -connect example.com:443 -showcerts <\/dev\/null 2>\/dev\/null | openssl x509 -text -noout | grep -A 1 Serial Number | tr -d :\n# \u0432\u0430\u0440\u0438\u0430\u043d\u0442 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043e\u0442 @simpleadmin \necho | openssl s_client -connect example.com:443 |& openssl x509 -noout -serial\n# \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0430, \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b SMTP\nopenssl s_client -connect example.com:25 -starttls smtp -showcerts <\/dev\/null 2>\/dev\/null | openssl x509 -text -noout | grep -A 1 Serial Number | tr -d :\n# \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0430, \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b SMTP\nopenssl s_client -connect example.com:587 -starttls smtp -showcerts <\/dev\/null 2>\/dev\/null | openssl x509 -text -noout | grep -A 1 Serial Number | tr -d :\n# \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0430, \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b IMAP\nopenssl s_client -connect example.com:143 -starttls imap -showcerts <\/dev\/null 2>\/dev\/null | openssl x509 -text -noout | grep -A 1 Serial Number | tr -d :\n# \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0430, \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b IMAP\nopenssl s_client -connect example.com:993 -showcerts <\/dev\/null 2>\/dev\/null | openssl x509 -text -noout | grep -A 1 Serial Number | tr -d :\n# \u0432 \u043f\u0440\u0438\u043d\u0446\u0438\u043f\u0435 \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u043e \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u044e\u0442\u0441\u044f \u0438 \u0434\u0440\u0443\u0433\u0438\u0435 \u0441\u0435\u0440\u0432\u0438\u0441\u044b<\/code><\/pre>\n
<\/p>\n
Seej\u00e4rel tuleb vaadata siit<\/a><\/noindex> oma seerianumbrit, ja kui see on nimekirjas \u2014 on soovitatav uuendada sertifikaati(d).<\/p>\n
<\/p>\n
Sertifikaatide uuendamiseks v\u00f5ib kasutada certbot'i:<\/p>\n
<\/p>\n
certbot renew --force-renewal<\/code><\/pre>\n
<\/p>\n
Probleem leiti juba 29. veebruaril 2020, probleemi lahendamiseks peeti sertifikaatide v\u00e4ljastamine kinni ajavahemikus 3:10 UTC kuni 5:22 UTC. Sisemises uurimises selgus, et viga tekkis 25. juulil 2019, \u00fcksikasjaliku aruande esitab ettev\u00f5te hiljem.<\/p>\n
<\/p>\n
UPD: sertifikaatide kontrollimise veebiteenus ei pruugi t\u00f6\u00f6tada Venemaa IP-aadressidelt.<\/p>\n
Allikas: habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f LetsEncrypt, \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u044e\u0449\u0430\u044f \u043a \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044e \u0431\u0435\u0441\u043f\u043b\u0430\u0442\u043d\u044b\u0435 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u044b ssl \u0434\u043b\u044f \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f, \u0432\u044b\u043d\u0443\u0436\u0434\u0435\u043d\u0430 \u0430\u043d\u043d\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u044b. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0439 \u043e\u0448\u0438\u0431\u043a\u043e\u0439 \u0432 \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u043c \u041f\u041e Boulder, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u043c \u0434\u043b\u044f \u043f\u043e\u0441\u0442\u0440\u043e\u0435\u043d\u0438\u044f CA. \u041e\u0431\u044b\u0447\u043d\u043e \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 DNS \u0437\u0430\u043f\u0438\u0441\u0438 CAA \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u0438\u0442 \u043e\u0434\u043d\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e \u0441 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0438\u0435\u043c \u0432\u043b\u0430\u0434\u0435\u043d\u0438\u044f \u0434\u043e\u043c\u0435\u043d\u043e\u043c, \u0430 \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e \u043f\u043e\u0434\u043f\u0438\u0441\u0447\u0438\u043a\u043e\u0432 \u043f\u043e\u043b\u0443\u0447\u0430\u044e\u0442 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 \u0441\u0440\u0430\u0437\u0443 \u0436\u0435 \u043f\u043e\u0441\u043b\u0435 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438, \u043d\u043e \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u041f\u041e \u0441\u0434\u0435\u043b\u0430\u043b\u0438 \u0442\u0430\u043a, \u0447\u0442\u043e \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":72878,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-72877","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47LetsEncrypt plaanib oma sertifikaate tagasi kutsuda programmist tuleneva vea t\u00f5ttu | ProHoster","description":"Ettev\u00f5te.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/letsencrypt-planiruet-otozvat-svoi-sertifikaty-iz-za-programmnoj-oshibki","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47LetsEncrypt \u043f\u043b\u0430\u043d\u0438\u0440\u0443\u0435\u0442 \u043e\u0442\u043e\u0437\u0432\u0430\u0442\u044c \u0441\u0432\u043e\u0438 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u044b \u0438\u0437-\u0437\u0430 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0439 \u043e\u0448\u0438\u0431\u043a\u0438 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f.","og:url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/letsencrypt-planiruet-otozvat-svoi-sertifikaty-iz-za-programmnoj-oshibki","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-03-05T05:42:10+00:00","article:modified_time":"2020-03-05T05:42:10+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"72877","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 18:43:29","updated":"2022-09-30 17:43:34","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/72877","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=72877"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/72877\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/72878"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=72877"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=72877"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=72877"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}