{"id":86929,"date":"2020-07-01T19:42:02","date_gmt":"2020-07-01T17:42:02","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/chrome-tozhe-ogranichivaet-vremya-zhizni-tls-sertifikatov-13-mesyaczami"},"modified":"2020-07-01T19:42:02","modified_gmt":"2020-07-01T17:42:02","slug":"chrome-tozhe-ogranichivaet-vremya-zhizni-tls-sertifikatov-13-mesyaczami","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/chrome-tozhe-ogranichivaet-vremya-zhizni-tls-sertifikatov-13-mesyaczami","title":{"rendered":"Chrome also limits the lifespan of TLS certificates to 13 months","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"ChromeChromium projekti arendajad tehti muudatus<\/a><\/noindex>, mis m\u00e4\u00e4rab TLS-sertifikaatide maksimaalse kehtivusaja 398 p\u00e4evale (13 kuud).<\/p>\n

See tingimus kehtib k\u00f5ikide avalike serveri sertifikaatide kohta, mis on v\u00e4lja antud p\u00e4rast 1. septembrit 2020. Kui sertifikaat ei vasta sellele reeglile, siis brauser l\u00fckkab selle tagasi kui kehtetu ning annab konkreetse veateate ERR_CERT_VALIDITY_TOO_LONG<\/code>.<\/p>\n

1. septembrist 2020. aastast varem v\u00e4lja antud sertifikaatide puhul j\u00e4\u00e4b usaldus alles ning on piiratud 825 p\u00e4evaga<\/a><\/noindex> (2,2 aastat), nagu praegu.
\n<\/a><\/noindex>
\nVarasemaid piiranguid sertifikaatide maksimaalsele kehtivusajale on kehtestanud brauserid Firefox ja Safari. Muudatus kehtib samuti 1. septembrist<\/a><\/noindex>.<\/p>\n

See t\u00e4hendab, et veebilehed, mis kasutavad pikema kehtivusajaga SSL\/TLS sertifikaate, mis on v\u00e4lja antud l\u00f5ppkuup\u00e4eva j\u00e4rel, hakkavad brauserites andma konfidentsiaalsusvigu.<\/p>\n

\"Chrome
\n
\nUue poliitika kuulutas esimesena v\u00e4lja Apple CA\/Brauseri foorumi kohtumisel 2020. aasta veebruaris<\/a><\/noindex>. Uue reegli rakendamisel lubas Apple seda rakendada k\u00f5ikidel iOS ja macOS seadmetel. See avaldab survet veebilehtede haldajatele ja arendajatele, et nende sertifikaadid vastaksid n\u00f5uetele.<\/p>\n

Sertifikaatide kehtivusaja l\u00fchendamine on olnud arutelul Apple'i, Google'i ja teiste CA\/Brauseri osaliste seas juba mitu kuud. Sellel poliitikal on omad plusse ja miinuseid.<\/p>\n

Selle sammu eesm\u00e4rk on suurendada veebilehtede turvalisust, veendudes, et arendajad kasutavad uusimaid kr\u00fcptograafilisi standardeid, ja v\u00e4hendada vana, unustatud sertifikaatide hulka, mis v\u00f5ivad potentsiaalselt olla varastatud ja uuesti kasutatud kalastamise ja pahavara r\u00fcndamiseks. Kui kurjategijad suudavad murda SSL\/TLS kr\u00fcptograafiat, siis l\u00fchiajalised sertifikaadid v\u00f5imaldavad \u00fcleminekut turvalisematele sertifikaatidele umbes aasta jooksul.<\/p>\n

Sertifikaatide kehtivusaja l\u00fchendamisel on m\u00f5ned miinused. On m\u00e4rkmeid, et suurendades sertifikaatide vahetamise sagedust, muudavad Apple ja teised ettev\u00f5tted ka veidi keerulisemaks saitide omanikke ja ettev\u00f5tteid, kellel tuleb hallata sertifikaate ja j\u00e4rgida n\u00f5udeid.<\/p>\n

Teiselt poolt soodustavad Let’s Encrypt ja teised sertifitseerimiskeskused veebimeistreid rakendama automatiseeritud protseduure sertifikaatide uuendamiseks. See v\u00e4hendab inimlike kulude ja vigade riski, kui sertifikaatide asendamise sagedus suureneb.<\/p>\n

Nagu teada, v\u00e4ljastab Let’s Encrypt tasuta HTTPS-sertifikaate, mille kehtivusaeg l\u00f5peb 90 p\u00e4eva p\u00e4rast, ning pakub t\u00f6\u00f6riistu automatiseerimiseks. Nii sobivad need sertifikaadid veelgi paremini \u00fcldisesse infrastruktuuri \u2014 kuna brauserid seadistavad piirangu maksimaalsele kehtivusajale.<\/p>\n

See muudatus viidi CA\/Browser Foorumi liikmete h\u00e4\u00e4letusele, kuid otsus ei saanud kinnitust, kuna sertifitseerimiskeskuste seas oli erimeelsusi.<\/a><\/noindex>.<\/p>\n

tulemused n\u00e4itasid ainult nelja ebaolulise koodibloki kattuvust, mis olid tingitud POSIX ja ANSI C n\u00f5uetest.<\/h1>\n

<\/p>\n

Sertifikaatide v\u00e4ljaandjate h\u00e4\u00e4letus<\/h4>\n

Jah (11 h\u00e4\u00e4lt)<\/b>: Amazon, Buypass, Certigna (DHIMYOTIS), certSIGN, Sectigo (endine Comodo CA), eMudhra, Kamu SM, Let’s Encrypt, Logius, PKIoverheid, SHECA, SSL.com<\/p>\n

Vastu (20)<\/b>: Camerfirma, Certum (Asseco), CFCA, Chunghwa Telecom, Comsign, D-TRUST, DarkMatter, Entrust Datacard, Firmaprofesional, GDCA, GlobalSign, GoDaddy, Izenpe, Network Solutions, OATI, SECOM, SwissSign, TWCA, TrustCor, SecureTrust (endine Trustwave)<\/p>\n

V\u00e4ltinud (2)<\/b>: HARICA, TurkTrust<\/p><\/blockquote>\n

<\/p>\n

Sertifikaatide tarbijate h\u00e4\u00e4letus<\/h4>\n

Jah (7)<\/b>: Apple, Cisco, Google, Microsoft, Mozilla, Opera, 360<\/p>\n

Vastu<\/b>: 0<\/p>\n

V\u00e4ltinud<\/b>: 0<\/p><\/blockquote>\n

\nN\u00fc\u00fcd rakendavad brauserid seda poliitikat ilma sertifitseerimiskeskuste n\u00f5usolekuta.
\n
Allikas: habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 Chromium \u0432\u043d\u0435\u0441\u043b\u0438 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0435, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u0442 \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u044b\u0439 \u0441\u0440\u043e\u043a \u0436\u0438\u0437\u043d\u0438 TLS-\u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 \u0432 398 \u0434\u043d\u0435\u0439 (13 \u043c\u0435\u0441\u044f\u0446\u0435\u0432). \u0423\u0441\u043b\u043e\u0432\u0438\u0435 \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u0435\u0442 \u0434\u043b\u044f \u0432\u0441\u0435\u0445 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u043d\u044b\u0445 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432, \u0432\u044b\u0434\u0430\u043d\u043d\u044b\u0445 \u043f\u043e\u0441\u043b\u0435 1 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f 2020 \u0433\u043e\u0434\u0430. \u0415\u0441\u043b\u0438 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 \u043d\u0435 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u044d\u0442\u043e\u043c\u0443 \u043f\u0440\u0430\u0432\u0438\u043b\u0443, \u0431\u0440\u0430\u0443\u0437\u0435\u0440 \u0431\u0443\u0434\u0435\u0442 \u043e\u0442\u0432\u0435\u0440\u0433\u0430\u0442\u044c \u0435\u0433\u043e \u043a\u0430\u043a \u043d\u0435\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0439, \u0430 \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e \u043e\u0442\u0432\u0435\u0447\u0430\u0442\u044c \u043e\u0448\u0438\u0431\u043a\u043e\u0439 ERR_CERT_VALIDITY_TOO_LONG. \u0414\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u043d\u044b\u0445 \u0434\u043e 1 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f 2020 \u0433\u043e\u0434\u0430 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 \u0434\u043e\u0432\u0435\u0440\u0438\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":86930,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-86929","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Chrome piirab samuti TLS-sertifikaatide kehtivusaega 13 kuuga | ProHoster","description":"Chromium projekti arendajad.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/chrome-tozhe-ogranichivaet-vremya-zhizni-tls-sertifikatov-13-mesyaczami","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Chrome \u0442\u043e\u0436\u0435 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0432\u0430\u0435\u0442 \u0432\u0440\u0435\u043c\u044f \u0436\u0438\u0437\u043d\u0438 TLS-\u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 13 \u043c\u0435\u0441\u044f\u0446\u0430\u043c\u0438 | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 Chromium.","og:url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/chrome-tozhe-ogranichivaet-vremya-zhizni-tls-sertifikatov-13-mesyaczami","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-07-01T17:42:02+00:00","article:modified_time":"2020-07-01T17:42:02+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"86929","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 14:02:56","updated":"2022-10-03 00:14:10","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/86929","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=86929"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/86929\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/86930"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=86929"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=86929"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=86929"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}