{"id":72754,"date":"2020-03-04T02:42:36","date_gmt":"2020-03-03T23:42:36","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/massovyj-otzyv-sertifikatov-lets-encrypt"},"modified":"2020-03-04T02:42:36","modified_gmt":"2020-03-03T23:42:36","slug":"massovyj-otzyv-sertifikatov-lets-encrypt","status":"publish","type":"post","link":"https:\/\/prohoster.info\/fr\/blog\/news\/massovyj-otzyv-sertifikatov-lets-encrypt","title":{"rendered":"Retrait massif des certificats Let&apos;s Encrypt","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>L'autorit\u00e9 de certification \u00e0 but non lucratif Let's Encrypt, contr\u00f4l\u00e9e par la communaut\u00e9 et fournissant des certificats gratuitement \u00e0 tous ceux qui le souhaitent, <noindex><a rel=\"nofollow\" href=\"https:\/\/community.letsencrypt.org\/t\/revoking-certain-certificates-on-march-4\/114864\">a averti<\/a><\/noindex> a annonc\u00e9 le retrait imminent de nombreux certificats TLS\/SSL pr\u00e9c\u00e9demment d\u00e9livr\u00e9s. Parmi les 116 millions de certificats en cours, un peu plus de 3 millions (2,6 %) seront r\u00e9voqu\u00e9s, dont environ 1 million sont des doublons li\u00e9s \u00e0 un seul domaine (l'erreur a principalement touch\u00e9 les certificats souvent mis \u00e0 jour, ce qui explique le grand nombre de doublons). La r\u00e9vocation est pr\u00e9vue pour le 4 mars (l'heure exacte n'est pas encore d\u00e9termin\u00e9e, mais la r\u00e9vocation aura lieu apr\u00e8s 3 heures du matin, heure de Moscou).<\/p>\n<p>La n\u00e9cessit\u00e9 de la r\u00e9vocation est due \u00e0 une <noindex><a rel=\"nofollow\" href=\"https:\/\/community.letsencrypt.org\/t\/2020-02-29-caa-rechecking-bug\/114591\">erreur<\/a><\/noindex>. Le probl\u00e8me appara\u00eet depuis le 25 juillet 2019 et affecte le syst\u00e8me de v\u00e9rification des enregistrements CAA dans le DNS. Un enregistrement CAA (<noindex><a rel=\"nofollow\" href=\"https:\/\/tools.ietf.org\/html\/rfc6844\">RFC-6844<\/a><\/noindex>, Certificate Authority Authorization) permet au propri\u00e9taire d'un domaine de d\u00e9finir explicitement l'autorit\u00e9 de certification par laquelle des certificats peuvent \u00eatre g\u00e9n\u00e9r\u00e9s pour le domaine sp\u00e9cifi\u00e9. Si l'autorit\u00e9 de certification n'est pas r\u00e9pertori\u00e9e dans les enregistrements CAA, elle doit bloquer l'\u00e9mission de certificats pour ce domaine et informer le propri\u00e9taire du domaine de toute tentative de compromission. Dans la plupart des cas, le certificat est demand\u00e9 imm\u00e9diatement apr\u00e8s la v\u00e9rification CAA, mais le r\u00e9sultat de la v\u00e9rification est consid\u00e9r\u00e9 comme valide encore pendant 30 jours. Les r\u00e8gles pr\u00e9voient \u00e9galement une nouvelle v\u00e9rification au plus tard 8 heures avant l'\u00e9mission d'un nouveau certificat (c'est-\u00e0-dire que si 8 heures se sont \u00e9coul\u00e9es depuis la derni\u00e8re v\u00e9rification lors de la demande d'un nouveau certificat, une nouvelle v\u00e9rification est requise).<\/p>\n<p>L'erreur se manifeste si la demande de certificat couvre plusieurs noms de domaine, pour chacun desquels une v\u00e9rification de l'enregistrement CAA est requise. La nature de l'erreur est qu'au moment de la v\u00e9rification r\u00e9p\u00e9t\u00e9e, plut\u00f4t que de valider tous les domaines, seule une v\u00e9rification d'un domaine de la liste \u00e9tait effectu\u00e9e (si la demande contenait N domaines, au lieu de N v\u00e9rifications diff\u00e9rentes, un domaine \u00e9tait v\u00e9rifi\u00e9 N fois). Pour les autres domaines, la v\u00e9rification r\u00e9p\u00e9t\u00e9e n'\u00e9tait pas effectu\u00e9e et lors de la prise de d\u00e9cision, les donn\u00e9es de la premi\u00e8re v\u00e9rification \u00e9taient utilis\u00e9es (c'est-\u00e0-dire que des donn\u00e9es vieilles de 30 jours \u00e9taient prises en compte). En cons\u00e9quence, au cours des 30 jours suivant la premi\u00e8re v\u00e9rification, Let's Encrypt pouvait d\u00e9livrer un certificat, m\u00eame si la valeur de l'enregistrement CAA avait \u00e9t\u00e9 modifi\u00e9e et que Let's Encrypt avait \u00e9t\u00e9 retir\u00e9 de la liste des autorit\u00e9s de certification autoris\u00e9es.<\/p>\n<p>Les utilisateurs concern\u00e9s par le probl\u00e8me ont re\u00e7u une notification par e-mail si les coordonn\u00e9es avaient \u00e9t\u00e9 remplies lors de la demande de certificat. Vous pouvez v\u00e9rifier vos certificats en t\u00e9l\u00e9chargeant <noindex><a rel=\"nofollow\" href=\"https:\/\/d4twhgtvn0ff5.cloudfront.net\/caa-rechecking-incident-affected-serials.txt.gz\">des<\/a><\/noindex> les num\u00e9ros de s\u00e9rie des certificats r\u00e9voqu\u00e9s ou en utilisant <noindex><a rel=\"nofollow\" href=\"https:\/\/unboundtest.com\/caaproblem.html\">un service en ligne<\/a><\/noindex> (h\u00f4te \u00e0 l'adresse IP, <noindex><a rel=\"nofollow\" href=\"https:\/\/isitblockedinrussia.com\/?host=unboundtest.com\">bloqu\u00e9<\/a><\/noindex> par le Roskomnadzor en Russie). Vous pouvez conna\u00eetre le num\u00e9ro de s\u00e9rie du certificat pour le domaine concern\u00e9 en utilisant la commande :<\/p>\n<p>   openssl s_client -connect example.com:443 -showcerts \/dev\/null \\<br \/>\n     | openssl x509 -text -noout | grep -A 1 Serial\\ Number | tr -d :<\/p>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>Source : <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=52472\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041d\u0435\u043a\u043e\u043c\u043c\u0435\u0440\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0434\u043e\u0441\u0442\u043e\u0432\u0435\u0440\u044f\u044e\u0449\u0438\u0439 \u0446\u0435\u043d\u0442\u0440 Let&#8217;s Encrypt, \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u044b\u0439 \u0441\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e\u043c \u0438 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0439 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u044b \u0431\u0435\u0437\u0432\u043e\u0437\u043c\u0435\u0437\u0434\u043d\u043e \u0432\u0441\u0435\u043c \u0436\u0435\u043b\u0430\u044e\u0449\u0438\u043c, \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b \u043e \u043f\u0440\u0435\u0434\u0441\u0442\u043e\u044f\u0449\u0435\u043c \u043e\u0442\u0437\u044b\u0432\u0435 \u043c\u043d\u043e\u0433\u0438\u0445 \u0440\u0430\u043d\u0435\u0435 \u0432\u044b\u0434\u0430\u043d\u043d\u044b\u0445 TLS\/SSL \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432. \u0418\u0437 116 \u043c\u043b\u043d \u043d\u044b\u043d\u0435 \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0445 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 Let&#8217;s Encrypt \u0431\u0443\u0434\u0435\u0442 \u043e\u0442\u043e\u0437\u0432\u0430\u043d\u043e \u0447\u0443\u0442\u044c \u0431\u043e\u043b\u044c\u0448\u0435 3 \u043c\u043b\u043d (2.6%), \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u0440\u0438\u043c\u0435\u0440\u043d\u043e 1 \u043c\u043b\u043d \u044f\u0432\u043b\u044f\u044e\u0442\u0441\u044f \u0434\u0443\u0431\u043b\u0438\u043a\u0430\u0442\u0430\u043c\u0438, \u043f\u0440\u0438\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u043c\u0438 \u043a \u043e\u0434\u043d\u043e\u043c\u0443 \u0434\u043e\u043c\u0435\u043d\u0443 (\u043e\u0448\u0438\u0431\u043a\u0430 \u0432 \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u043c \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u043b\u0430 \u043e\u0447\u0435\u043d\u044c \u0447\u0430\u0441\u0442\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u044f\u0435\u043c\u044b\u0435 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-72754","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041d\u0435\u043a\u043e\u043c\u043c\u0435\u0440\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0434\u043e\u0441\u0442\u043e\u0432\u0435\u0440\u044f\u044e\u0449\u0438\u0439 \u0446\u0435\u043d\u0442\u0440 Let&#039;s Encrypt, \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u044b\u0439 \u0441\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e\u043c \u0438 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0439 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u044b \u0431\u0435\u0437\u0432\u043e\u0437\u043c\u0435\u0437\u0434\u043d\u043e \u0432\u0441\u0435\u043c \u0436\u0435\u043b\u0430\u044e\u0449\u0438\u043c,\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/fr\/blog\/news\/massovyj-otzyv-sertifikatov-lets-encrypt\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2\" \/>\n\t\t<meta property=\"og:locale\" content=\"fr_FR\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041c\u0430\u0441\u0441\u043e\u0432\u044b\u0439 \u043e\u0442\u0437\u044b\u0432 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 Let&amp;apos;s Encrypt | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041d\u0435\u043a\u043e\u043c\u043c\u0435\u0440\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0434\u043e\u0441\u0442\u043e\u0432\u0435\u0440\u044f\u044e\u0449\u0438\u0439 \u0446\u0435\u043d\u0442\u0440 Let&#039;s Encrypt, \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u044b\u0439 \u0441\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e\u043c \u0438 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0439 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u044b \u0431\u0435\u0437\u0432\u043e\u0437\u043c\u0435\u0437\u0434\u043d\u043e \u0432\u0441\u0435\u043c \u0436\u0435\u043b\u0430\u044e\u0449\u0438\u043c,\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/fr\/blog\/news\/massovyj-otzyv-sertifikatov-lets-encrypt\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-03-03T23:42:36+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-03-03T23:42:36+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47R\u00e9vocation massive des certificats Let's Encrypt | ProHoster","description":"L'autorit\u00e9 de certification \u00e0 but non lucratif Let's Encrypt, contr\u00f4l\u00e9e par la communaut\u00e9 et fournissant des certificats gratuitement \u00e0 tous les demandeurs,","canonical_url":"https:\/\/prohoster.info\/fr\/blog\/news\/massovyj-otzyv-sertifikatov-lets-encrypt","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"fr_FR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041c\u0430\u0441\u0441\u043e\u0432\u044b\u0439 \u043e\u0442\u0437\u044b\u0432 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 Let&amp;apos;s Encrypt | ProHoster","og:description":"\u041d\u0435\u043a\u043e\u043c\u043c\u0435\u0440\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0434\u043e\u0441\u0442\u043e\u0432\u0435\u0440\u044f\u044e\u0449\u0438\u0439 \u0446\u0435\u043d\u0442\u0440 Let's Encrypt, \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u044b\u0439 \u0441\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e\u043c \u0438 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0439 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u044b \u0431\u0435\u0437\u0432\u043e\u0437\u043c\u0435\u0437\u0434\u043d\u043e \u0432\u0441\u0435\u043c \u0436\u0435\u043b\u0430\u044e\u0449\u0438\u043c,","og:url":"https:\/\/prohoster.info\/fr\/blog\/news\/massovyj-otzyv-sertifikatov-lets-encrypt","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-03-03T23:42:36+00:00","article:modified_time":"2020-03-03T23:42:36+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"72754","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 18:46:21","updated":"2022-09-28 12:43:03","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/72754","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/comments?post=72754"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/72754\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/media?parent=72754"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/categories?post=72754"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/tags?post=72754"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}