{"id":84766,"date":"2020-06-10T13:43:11","date_gmt":"2020-06-10T11:43:11","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/problema-ustarevshih-kornevyh-sertifikatov-na-ocheredi-lets-encrypt-i-umnye-televizory"},"modified":"2020-06-10T13:43:11","modified_gmt":"2020-06-10T11:43:11","slug":"problema-ustarevshih-kornevyh-sertifikatov-na-ocheredi-lets-encrypt-i-umnye-televizory","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/problema-ustarevshih-kornevyh-sertifikatov-na-ocheredi-lets-encrypt-i-umnye-televizory","title":{"rendered":"Vanade juurte sertifikaatide probleem. Ootel on Let\u2019s Encrypt ja nutitelerid.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Probleem
\n
\nEt brauser saaks autentida veebisaiti, peab see esitama kehtiva sertifikaadiketi. T\u00fc\u00fcpiline ahel on esitatud \u00fclal, v\u00f5ib sisaldada rohkem kui \u00fchte vahesertifikaati. Kehtiva ahela minimaalne sertifikaatide arv on kolm.<\/p>\n

Juursertifikaat on sertifitseerimiskeskuse s\u00fcda. See on s\u00f5na-s\u00f5nalt teie operatsioonis\u00fcsteemis v\u00f5i brauseris sisseehitatud, f\u00fc\u00fcsiliselt olemas teie seadmes. Seda ei saa serveripoolse sekkumisega muuta. Vaja on sunnitud v\u00e4rskendamist OS-i v\u00f5i seadme sisseehitatud tarkvarale.<\/p>\n

Turvaekspert Scott Helme writes<\/a><\/noindex>, \u0447\u0442\u043e \u043e\u0441\u043d\u043e\u0432\u043d\u044b\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0432\u043e\u0437\u043d\u0438\u043a\u043d\u0443\u0442 \u0443 \u0446\u0435\u043d\u0442\u0440\u0430 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 Let’s Encrypt, \u043f\u043e\u0442\u043e\u043c\u0443 \u0447\u0442\u043e \u0441\u0435\u0433\u043e\u0434\u043d\u044f \u044d\u0442\u043e \u0441\u0430\u043c\u044b\u0439 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0439 \u0426\u0421 \u0432 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0435, \u0430 \u0435\u0433\u043e \u043a\u043e\u0440\u043d\u0435\u0432\u043e\u0439 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 \u0441\u043a\u043e\u0440\u043e \u00ab\u043f\u0440\u043e\u0442\u0443\u0445\u043d\u0435\u0442\u00bb. \u0421\u043c\u0435\u043d\u0430 \u043a\u043e\u0440\u043d\u044f Let’s Encrypt on planeeritud 8. juuliks 2020.<\/a><\/noindex>.
\n<\/a><\/noindex>
\nL\u00f5plikud ja vahesertifikaadid edastatakse kliendile serverist, kuid juursertifikaat on kliendil juba olemas.<\/i>, seega saab selle sertifikaadikollektsiooni abil luua ahelat ja autentida veebisaiti. <\/p>\n

Probleem on see, et igal sertifikaadil on aegumiskuup\u00e4ev, p\u00e4rast mida tuleb see asendada. N\u00e4iteks kavatsetakse Safari brauseris alates 1. septembrist 2020 kehtestada serveri TLS-sertifikaatide aegumist\u00e4htaja piirang. kuni 398 p\u00e4eva<\/a><\/noindex>.<\/p>\n

See t\u00e4hendab, et meil k\u00f5igil tuleb serveri sertifikaate asendada v\u00e4hemalt iga 12 kuu j\u00e4rel. See piirang kehtib ainult serveri sertifikaatide kohta, ei<\/i> see kehtib ka CA juursertifikaatide kohta.<\/p>\n

CA sertifikaate reguleeritakse teiste reeglite kogumiga, seet\u00f5ttu on nende aegumistaotlused erinevad. Vahel esinevad vahe-sertifikaadid, mille kehtivusaeg on 5 aastat ja juursertifikaadid, mille kehtivusaeg ulatub isegi 25 aastani! <\/p>\n

Vahesertifikaatide kasutamisel probleeme tavaliselt ei esine, sest need saadetakse kliendile serverist, mis vahetab oma sertifikaate palju sagedamini. Seet\u00f5ttu asendab see ka vahesertifikaadi. Selle asendamine koos serveri sertifikaadiga on \u00fcsna lihtne, erinevalt juure CA-st.<\/p>\n

Nagu juba mainitud, on juure CA otse sisseehitatud kliendiseadmesse, operatsioonis\u00fcsteemi, brauserisse v\u00f5i muusse tarkvarasse. Juure CA muutmist ei saa veebisait kontrollida. Siin on vajalik uuendus kliendi seadmes, olgu selleks operatsioonis\u00fcsteemi v\u00f5i tarkvara uuendus.<\/p>\n

M\u00f5ned juure CA-d on eksisteerinud juba v\u00e4ga pikka aega, tegemist on 20\u201325 aastaga. Peagi j\u00f5uavad m\u00f5ned vanimad juure CA-d oma loomuliku elu l\u00f5pule, nende aeg on peaaegu otsa saanud. Enamiku jaoks ei tule see probleemina, kuna CA on loonud uusi juure sertifikaate, mida on juba aastaid levitatud \u00fcle kogu maailma operatsioonis\u00fcsteemide ja brauserite uuendustega. Kuid kui keegi ei ole v\u00e4ga pikka aega oma operatsioonis\u00fcsteemi v\u00f5i brauserit uuendanud, v\u00f5ib see olla probleem.<\/p>\n

Selline olukord tekkis 30. mai 2020. aastal kell 10:48:38 GMT. See on t\u00e4pne aeg, millal t\u00fchistus juurer\u00fchm sertifikaat AddTrust<\/a><\/noindex> sertifitseerimisest Comodo (Sectigo).<\/p>\n

Seda kasutati ristallkirjastamiseks, et tagada \u00fchilduvus aegunud seadmetega, mille sertifikaadihoidlas pole uut juurer\u00fchm sertifikaati USERTrust.<\/p>\n

Kahjuks esines probleeme mitte ainult vananenud brauserites, vaid ka brauseriv\u00e4listes klientides, mis p\u00f5hinevad OpenSSL 1.0.x, LibreSSL ja GnuTLS<\/a><\/noindex>. N\u00e4iteks LED-televisioonide emulatorites Roku<\/a><\/noindex>, teenuses Heroku<\/a><\/noindex>, rakendustes Fortinet, Chargify, .NET Core 2.0 platvormil Linuxil ja paljus mujal.<\/a><\/noindex>.<\/p>\n

Oletati, et probleem puudutab ainult vananenud s\u00fcsteeme (Android 2.3, Windows XP, Mac OS X 10.11, iOS 9 jne), kuna kaasaegsed brauserid saavad kasutada teist juurer\u00fchm sertifikaati USERTRust. Kuid tegelikult hakkasid mitmesugustes veebiteenustes, mis kasutasid tasuta OpenSSL 1.0.x ja GnuTLS raamatukogusid, ilmuma t\u00f5rkeid. Turvalist \u00fchendust ei suudetud luua, kuna sertifikaadi aegumine p\u00f5hjustas vea.<\/p>\n

\u0421\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0439 \u2014 Let’s Encrypt<\/h1>\n

\n\u0415\u0449\u0451 \u043e\u0434\u0438\u043d \u0445\u043e\u0440\u043e\u0448\u0438\u0439 \u043f\u0440\u0438\u043c\u0435\u0440 \u043f\u0440\u0435\u0434\u0441\u0442\u043e\u044f\u0449\u0435\u0439 \u0441\u043c\u0435\u043d\u044b \u043a\u043e\u0440\u043d\u0435\u0432\u043e\u0433\u043e CA \u2014 \u0446\u0435\u043d\u0442\u0440 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 Let’s Encrypt. \u0415\u0449\u0451 aprillis 2019<\/a><\/noindex> nadati, et nad \u00fcritavad liikuda Identrusti ahelalt oma ISRG Root ahelale, kuid seda ei juhtunud<\/a><\/noindex>.<\/p>\n

\"Probleem
\n
\n\u00ab\u0418\u0437-\u0437\u0430 \u043e\u043f\u0430\u0441\u0435\u043d\u0438\u0439 \u043f\u043e \u043f\u043e\u0432\u043e\u0434\u0443 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e\u0433\u043e \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0440\u043d\u044f ISRG \u043d\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445 Android \u043c\u044b \u0440\u0435\u0448\u0438\u043b\u0438 \u043f\u0435\u0440\u0435\u043d\u0435\u0441\u0442\u0438 \u0434\u0430\u0442\u0443 \u043f\u0435\u0440\u0435\u0445\u043e\u0434\u0430 \u043a \u0441\u043e\u0431\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u043c\u0443 \u043a\u043e\u0440\u043d\u044e \u0441 8 \u0438\u044e\u043b\u044f 2019 \u0433\u043e\u0434\u0430 \u043d\u0430 8 \u0438\u044e\u043b\u044f 2020 \u0433\u043e\u0434\u0430\u00bb, \u2014 \u0441\u043a\u0430\u0437\u0430\u043d\u043e \u0432 \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u043c \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0438 Let’s Encrypt.<\/p>\n

Kuup\u00e4eva tuli edasi l\u00fckata probleemide t\u00f5ttu, mida nimetatakse \u201ejuure levitamiseks\u201c (root propagation), t\u00e4psemalt juure levitamise puudumise t\u00f5ttu, kui juure CA ei ole k\u00f5ikjal klientides laialdaselt levinud. <\/p>\n

\u0421\u0435\u0439\u0447\u0430\u0441 Let’s Encrypt \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u043f\u0435\u0440\u0435\u043a\u0440\u0451\u0441\u0442\u043d\u043e \u043f\u043e\u0434\u043f\u0438\u0441\u0430\u043d\u043d\u044b\u0439 \u043f\u0440\u043e\u043c\u0435\u0436\u0443\u0442\u043e\u0447\u043d\u044b\u0439 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 \u0441 \u0446\u0435\u043f\u043e\u0447\u043a\u043e\u0439 \u0434\u043e \u043a\u043e\u0440\u043d\u044f IdenTrust DST Root CA X3. \u042d\u0442\u043e\u0442 \u043a\u043e\u0440\u043d\u0435\u0432\u043e\u0439 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 \u0431\u044b\u043b \u0432\u044b\u0434\u0430\u043d \u0435\u0449\u0451 \u0432 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u0435 2000 \u0433\u043e\u0434\u0430 \u0438 \u0438\u0441\u0442\u0435\u043a\u0430\u0435\u0442 30 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f 2021 \u0433\u043e\u0434\u0430. \u0414\u043e \u044d\u0442\u043e\u0433\u043e \u0432\u0440\u0435\u043c\u0435\u043d\u0438 Let’s Encrypt \u043f\u043b\u0430\u043d\u0438\u0440\u0443\u0435\u0442 \u043f\u0435\u0440\u0435\u0439\u0442\u0438 \u043d\u0430 \u0441\u043e\u0431\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0439 \u0441\u0430\u043c\u043e\u043f\u043e\u0434\u043f\u0438\u0441\u0430\u043d\u043d\u044b\u0439 \u043a\u043e\u0440\u0435\u043d\u044c ISRG Root X1.<\/p>\n

\"Probleem
\n
\nISRG juur anti v\u00e4lja 4. juunil 2015. P\u00e4rast seda algas selle kinnitamine sertifitseerimiskeskusena, mis l\u00f5petati 6. augustil 2018.<\/a><\/noindex>. Alates sellest hetkest oli juur-CA k\u00f5igile klientidele kergesti saadaval operatsioonis\u00fcsteemi v\u00f5i tarkvara uuenduse kaudu. K\u00f5ik, mida vaja oli, oli uuenduse installimine. <\/p>\n

Aga see on probleem.<\/p>\n

\u0415\u0441\u043b\u0438 \u0432\u0430\u0448 \u043c\u043e\u0431\u0438\u043b\u044c\u043d\u044b\u0439 \u0442\u0435\u043b\u0435\u0444\u043e\u043d, \u0442\u0435\u043b\u0435\u0432\u0438\u0437\u043e\u0440 \u0438\u043b\u0438 \u0434\u0440\u0443\u0433\u043e\u0435 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u043e \u043d\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u044f\u043b\u043e\u0441\u044c \u0434\u0432\u0430 \u0433\u043e\u0434\u0430 \u2014 \u043a\u0430\u043a \u043e\u043d\u043e \u0443\u0437\u043d\u0430\u0435\u0442 \u043e \u043d\u043e\u0432\u043e\u043c \u043a\u043e\u0440\u043d\u0435\u0432\u043e\u043c \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0435 ISRG Root X1? \u0410 \u0435\u0441\u043b\u0438 \u0435\u0433\u043e \u043d\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435, \u0442\u043e \u0432\u0441\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u043d\u044b\u0435 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u044b Let’s Encrypt \u0432\u0430\u0448\u0435 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u043e \u043f\u0440\u0438\u0437\u043d\u0430\u0435\u0442 \u043d\u0435\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u043c\u0438, \u043a\u0430\u043a \u0442\u043e\u043b\u044c\u043a\u043e Let’s Encrypt \u043f\u0435\u0440\u0435\u0439\u0434\u0451\u0442 \u043d\u0430 \u043d\u043e\u0432\u044b\u0439 \u043a\u043e\u0440\u0435\u043d\u044c. \u0410 \u0432 \u044d\u043a\u043e\u0441\u0438\u0441\u0442\u0435\u043c\u0435 Android \u043c\u043d\u043e\u0433\u043e \u0443\u0441\u0442\u0430\u0440\u0435\u0432\u0448\u0438\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0434\u0430\u0432\u043d\u043e \u043d\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u044f\u043b\u0438\u0441\u044c.<\/p>\n

\"Probleem
\nAndroidi \u00f6kos\u00fcsteem<\/i><\/p>\n

\u0412\u043e\u0442 \u043f\u043e\u0447\u0435\u043c\u0443 Let’s Encrypt \u043e\u0442\u043b\u043e\u0436\u0438\u043b \u043f\u0435\u0440\u0435\u0445\u043e\u0434 \u043a \u0441\u043e\u0431\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u043c\u0443 \u043a\u043e\u0440\u043d\u044e ISRG \u0438 \u0432\u0441\u0451 \u0435\u0449\u0451 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u043f\u0440\u043e\u043c\u0435\u0436\u0443\u0442\u043e\u0447\u043d\u043e\u0435 \u0437\u0432\u0435\u043d\u043e, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u0441\u043f\u0443\u0441\u043a\u0430\u0435\u0442\u0441\u044f \u043a \u043a\u043e\u0440\u043d\u044e IdenTrust. \u041d\u043e \u043f\u0435\u0440\u0435\u0445\u043e\u0434 \u0432 \u043b\u044e\u0431\u043e\u043c \u0441\u043b\u0443\u0447\u0430\u0435 \u043f\u0440\u0438\u0434\u0451\u0442\u0441\u044f \u0441\u0434\u0435\u043b\u0430\u0442\u044c. \u0418 \u0434\u0430\u0442\u043e\u0439 \u0441\u043c\u0435\u043d\u044b \u043a\u043e\u0440\u043d\u044f \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u043e 8. juuli 2020.<\/a><\/noindex>.<\/p>\n

Kinnitamiseks, et teie seadmes (televiisor, kast v\u00f5i muu klient) on installsitud ISRG X1 juur, avage testimisleht https:\/\/valid-isrgrootx1.letsencrypt.org\/<\/a><\/noindex>. Kui turvakaubanduse hoiatust ei ilmu, on k\u00f5ik tavaliselt korras. <\/p>\n

Let’s Encrypt \u043d\u0435 \u0435\u0434\u0438\u043d\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0439, \u043a\u043e\u043c\u0443 \u043f\u0440\u0435\u0434\u0441\u0442\u043e\u0438\u0442 \u0440\u0435\u0448\u0438\u0442\u044c \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443 \u0441 \u043f\u0435\u0440\u0435\u0445\u043e\u0434\u043e\u043c \u043d\u0430 \u043d\u043e\u0432\u044b\u0439 \u043a\u043e\u0440\u0435\u043d\u044c. \u041a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u044e \u0432 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0435 \u043d\u0430\u0447\u0430\u043b\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0447\u0443\u0442\u044c \u0431\u043e\u043b\u0435\u0435 20 \u043b\u0435\u0442 \u043d\u0430\u0437\u0430\u0434, \u0442\u0430\u043a \u0447\u0442\u043e \u043a\u0430\u043a \u0440\u0430\u0437 \u0441\u0435\u0439\u0447\u0430\u0441 \u043d\u0430\u0441\u0442\u0443\u043f\u0430\u0435\u0442 \u043c\u043e\u043c\u0435\u043d\u0442 \u043e\u043a\u043e\u043d\u0447\u0430\u043d\u0438\u044f \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u043c\u043d\u043e\u0433\u0438\u0445 \u043a\u043e\u0440\u043d\u0435\u0432\u044b\u0445 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432.<\/p>\n

Sellise probleemiga v\u00f5ivad kokku puutuda nutitelerite omanikud, kes ei ole Smart TV tarkvara aastate jooksul uuendanud. N\u00e4iteks uus GlobalSigni juur. R5 Root<\/a><\/noindex> v\u00e4ljastati 2012. aastal, ja seet\u00f5ttu ei suuda m\u00f5ned vanad nutitelerid selle juurde ahelat luua, kuna seda juure CA-d neil lihtsalt ei ole. Eelk\u00f5ige ei saanud need kliendid luua turvalist \u00fchendust aadressiga bbc.co.uk. Probleemi lahendamiseks pidid BBC administreerijad kasutama trikki: nad ehitasid nendele klientidele alternatiivse ahela<\/a><\/noindex> kasutades t\u00e4iendavaid vahesertifikaate, kaasates vanu juuri R3 Root<\/a><\/noindex> ja R1 Root<\/a><\/noindex>, mis ei ole veel aegunud.<\/p>\n

www.bbc.co.uk (Leaf)\nGlobalSign ECC OV SSL CA 2018 (Intermediate)\nGlobalSign Root CA - R5 (Intermediate)\nGlobalSign Root CA - R3 (Intermediate)<\/pre>\n
\nSee on ajutine lahendus. Probleem ei kao kuhugi, kui klienditarkvara ei uuendata. Nutiteler on p\u00f5him\u00f5tteliselt Linuxi operatsioonis\u00fcsteemiga piiratud funktsiooniga arvuti. Ilma uuendusteta muutuvad selle juurtunnistused paratamatult aegunuks.<\/p>\n
See puudutab k\u00f5iki seadmeid, mitte ainult telerite. Kui teil on \u00fcksk\u00f5ik milline seade, mis on \u00fchendatud internetiga ja mida on reklaamitud kui \u201enutiseade\u201d, siis probleem aegunud sertifikaatidega puudutab seda t\u00f5en\u00e4oliselt. Kui seadet ei uuendata, siis aegub juurte CA hoidla aja jooksul ja l\u00f5puks probleem ilmneb. Probleemi tekkimise kiirus s\u00f5ltub viimasest juurte hoidla uuendamisest. See v\u00f5ib olla mitu aastat enne seadme tegelikku v\u00e4ljalaskekuup\u00e4eva.<\/p>\n
\u041a\u0441\u0442\u0430\u0442\u0438, \u0432 \u044d\u0442\u043e\u043c \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430, \u043f\u043e\u0447\u0435\u043c\u0443 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043a\u0440\u0443\u043f\u043d\u044b\u0435 \u043c\u0435\u0434\u0438\u0430\u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u043d\u0435 \u043c\u043e\u0433\u0443\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0441\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0435 \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0446\u0435\u043d\u0442\u0440\u044b \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0442\u0438\u043f\u0430 Let’s Encrypt, \u043f\u0438\u0448\u0435\u0442 \u0421\u043a\u043e\u0442\u0442 \u0425\u0435\u043b\u044c\u043c\u0435. \u0414\u043b\u044f \u0443\u043c\u043d\u044b\u0445 \u0422\u0412 \u043e\u043d\u0438 \u043d\u0435 \u043f\u043e\u0434\u0445\u043e\u0434\u044f\u0442, \u0438 \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u043a\u043e\u0440\u043d\u0435\u0439 \u0441\u043b\u0438\u0448\u043a\u043e\u043c \u043c\u0430\u043b\u043e, \u0447\u0442\u043e\u0431\u044b \u0433\u0430\u0440\u0430\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0443 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 \u043d\u0430 \u0443\u0441\u0442\u0430\u0440\u0435\u0432\u0448\u0438\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445. \u0412 \u043f\u0440\u043e\u0442\u0438\u0432\u043d\u043e\u043c \u0441\u043b\u0443\u0447\u0430\u0435 \u0422\u0412 \u043f\u0440\u043e\u0441\u0442\u043e \u043d\u0435 \u0441\u043c\u043e\u0436\u0435\u0442 \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c \u0441\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0435 \u0441\u0442\u0440\u0438\u043c\u0438\u043d\u0433\u043e\u0432\u044b\u0435 \u0441\u0435\u0440\u0432\u0438\u0441\u044b.<\/p>\n
Viimane juhtum AddTrustiga n\u00e4itas, et isegi suured IT-ettev\u00f5tted ei pruugi olla valmis selleks, et juuresertifikaadi kehtivusaeg l\u00f5peb.<\/p>\n
Probleemi lahendamiseks on ainult \u00fcks v\u00f5imalus \u2014 uuendamine. Nutiseadmete arendajad peavad eelnevalt tagama tarkvara ja juuresertifikaatide uuendamise mehhanismi. Teiselt poolt ei ole tootjatel kasulik tagada oma seadmete t\u00f6\u00f6d garantiiaja l\u00f5ppemise j\u00e4rel.<\/p>\n
\n\"Probleem
\n<\/a><\/noindex>
\n
Allikas: habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u0427\u0442\u043e\u0431\u044b \u0431\u0440\u0430\u0443\u0437\u0435\u0440 \u043c\u043e\u0433 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0432\u0435\u0431-\u0441\u0430\u0439\u0442, \u0442\u043e\u0442 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u0435\u0431\u044f \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0439 \u0446\u0435\u043f\u043e\u0447\u043a\u043e\u0439 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432. \u0422\u0438\u043f\u0438\u0447\u043d\u0430\u044f \u0446\u0435\u043f\u043e\u0447\u043a\u0430 \u043f\u043e\u043a\u0430\u0437\u0430\u043d\u0430 \u0441\u0432\u0435\u0440\u0445\u0443, \u0432 \u043d\u0435\u0439 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0431\u043e\u043b\u044c\u0448\u0435 \u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u043c\u0435\u0436\u0443\u0442\u043e\u0447\u043d\u043e\u0433\u043e \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430. \u041c\u0438\u043d\u0438\u043c\u0430\u043b\u044c\u043d\u043e\u0435 \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 \u0432 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0439 \u0446\u0435\u043f\u043e\u0447\u043a\u0435 \u0440\u0430\u0432\u043d\u043e \u0442\u0440\u0451\u043c. \u041a\u043e\u0440\u043d\u0435\u0432\u043e\u0439 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 \u2014 \u0441\u0435\u0440\u0434\u0446\u0435 \u0446\u0435\u043d\u0442\u0440\u0430 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438. \u041e\u043d \u0431\u0443\u043a\u0432\u0430\u043b\u044c\u043d\u043e \u0432\u0441\u0442\u0440\u043e\u0435\u043d \u0432 \u0432\u0430\u0448\u0443 \u041e\u0421 \u0438\u043b\u0438 \u0431\u0440\u0430\u0443\u0437\u0435\u0440, \u043e\u043d \u0444\u0438\u0437\u0438\u0447\u0435\u0441\u043a\u0438 \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u043d\u0430 \u0432\u0430\u0448\u0435\u043c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0435. \u0415\u0433\u043e \u043d\u0435 \u043f\u043e\u043c\u0435\u043d\u044f\u0435\u0448\u044c \u0441\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":84767,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-84766","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Aegunud juurt\u00f5endite probleem. J\u00e4rgmine on Let\u2019s Encrypt ja nutitelerid | ProHoster","description":"Kuna brauser suudab veebilehte autentida, peab see esitama kehtiva sertifikaatide ahela. \u00dcks t\u00fc\u00fcpiline ahel on n\u00e4idatud \u00fclal, selles v\u00f5ib olla rohkem kui \u00fcks vahe-sertifikaat. Kehtiva ahela minimaalne sertifikaatide arv on kolm. Juurt\u00f5end on sertifitseerimiskeskuse s\u00fcdamik. See on s\u00f5na otseses m\u00f5ttes paigaldatud teie ops\u00fcsteemi v\u00f5i brauserisse, see on f\u00fc\u00fcsiliselt olemas teie seadmes. Seda ei saa vahetada","canonical_url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/problema-ustarevshih-kornevyh-sertifikatov-na-ocheredi-lets-encrypt-i-umnye-televizory","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0443\u0441\u0442\u0430\u0440\u0435\u0432\u0448\u0438\u0445 \u043a\u043e\u0440\u043d\u0435\u0432\u044b\u0445 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432. \u041d\u0430 \u043e\u0447\u0435\u0440\u0435\u0434\u0438 Let\u2019s Encrypt \u0438 \u0443\u043c\u043d\u044b\u0435 \u0442\u0435\u043b\u0435\u0432\u0438\u0437\u043e\u0440\u044b | ProHoster","og:description":"\u0427\u0442\u043e\u0431\u044b \u0431\u0440\u0430\u0443\u0437\u0435\u0440 \u043c\u043e\u0433 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0432\u0435\u0431-\u0441\u0430\u0439\u0442, \u0442\u043e\u0442 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u0435\u0431\u044f \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0439 \u0446\u0435\u043f\u043e\u0447\u043a\u043e\u0439 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432. \u0422\u0438\u043f\u0438\u0447\u043d\u0430\u044f \u0446\u0435\u043f\u043e\u0447\u043a\u0430 \u043f\u043e\u043a\u0430\u0437\u0430\u043d\u0430 \u0441\u0432\u0435\u0440\u0445\u0443, \u0432 \u043d\u0435\u0439 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0431\u043e\u043b\u044c\u0448\u0435 \u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u043c\u0435\u0436\u0443\u0442\u043e\u0447\u043d\u043e\u0433\u043e \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430. \u041c\u0438\u043d\u0438\u043c\u0430\u043b\u044c\u043d\u043e\u0435 \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 \u0432 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0439 \u0446\u0435\u043f\u043e\u0447\u043a\u0435 \u0440\u0430\u0432\u043d\u043e \u0442\u0440\u0451\u043c. \u041a\u043e\u0440\u043d\u0435\u0432\u043e\u0439 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 \u2014 \u0441\u0435\u0440\u0434\u0446\u0435 \u0446\u0435\u043d\u0442\u0440\u0430 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438. \u041e\u043d \u0431\u0443\u043a\u0432\u0430\u043b\u044c\u043d\u043e \u0432\u0441\u0442\u0440\u043e\u0435\u043d \u0432 \u0432\u0430\u0448\u0443 \u041e\u0421 \u0438\u043b\u0438 \u0431\u0440\u0430\u0443\u0437\u0435\u0440, \u043e\u043d \u0444\u0438\u0437\u0438\u0447\u0435\u0441\u043a\u0438 \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u043d\u0430 \u0432\u0430\u0448\u0435\u043c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0435. \u0415\u0433\u043e \u043d\u0435 \u043f\u043e\u043c\u0435\u043d\u044f\u0435\u0448\u044c \u0441\u043e","og:url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/problema-ustarevshih-kornevyh-sertifikatov-na-ocheredi-lets-encrypt-i-umnye-televizory","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-06-10T11:43:11+00:00","article:modified_time":"2020-06-10T11:43:11+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"84766","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 14:51:43","updated":"2022-09-29 06:39:22"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/84766","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=84766"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/84766\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/84767"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=84766"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=84766"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=84766"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}