{"id":52168,"date":"2019-11-02T00:00:00","date_gmt":"2019-11-01T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/mozilla-cloudflare-i-facebook-predstavili-tls-rasshirenie-dlya-delegirovaniya-korotkozhivushhih-sertifikatov"},"modified":"2020-02-18T13:59:50","modified_gmt":"2020-02-18T10:59:50","slug":"mozilla-cloudflare-i-facebook-predstavili-tls-rasshirenie-dlya-delegirovaniya-korotkozhivushhih-sertifikatov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hr\/blog\/news\/mozilla-cloudflare-i-facebook-predstavili-tls-rasshirenie-dlya-delegirovaniya-korotkozhivushhih-sertifikatov","title":{"rendered":"Mozilla, Cloudflare i Facebook predstavili su TLS pro\u0161irenje za delegiranje kratkotrajnih certifikata","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Mozilla<\/a><\/noindex>, Cloudflare<\/a><\/noindex> i Facebook<\/a><\/noindex> zajedni\u010dki su najavili novo TLS pro\u0161irenje Delegated Credentials<\/a><\/noindex> (DC), koje rje\u0161ava problem s certifikatima prilikom organiziranja pristupa webu putem mre\u017ea za isporuku sadr\u017eaja. Sertifikati koje izdaju certifikacijski centri imaju dug vijek trajanja, \u0161to stvara pote\u0161ko\u0107e u organiziranju pristupa webu putem vanjske usluge, \u010dije ime treba uspostaviti sigurno povezivanje, jer prijenos certifikata weba vanjskoj usluzi stvara dodatne sigurnosne prijetnje. <\/p>\n

Novo pro\u0161irenje mo\u017ee biti korisno i za web stranice \u010dija je funkcionalnost osigurana velikom distribuiranom infrastrukturom s brojnim balansirnicima optere\u0107enja. Delegated Credentials \u0107e izbje\u0107i pohranu kopija privatnih klju\u010deva glavnih certifikata na svakom \u010dvoru koji isporu\u010duje sadr\u017eaj. U klasi\u010dnom pristupu, uspje\u0161an napad na bilo koji od poslu\u017eitelja uklju\u010denih u isporuku HTTPS prometa dovodi do kompromitacije cijelog certifikata. U slu\u010daju prijenosa privatnih klju\u010deva mre\u017eama za isporuku sadr\u017eaja, javljaju se prijetnje curenju podataka zbog diverzija osoblja, akcija obavje\u0161tajnih slu\u017ebi ili kompromitacije infrastrukture CDN-a. <\/p>\n

Ako curenje klju\u010deva ostane neprimije\u0107eno, oni koji su dobili pristup klju\u010devima mogli bi se dovoljno dugo neprimjetno infiltrirati u promet weba (MITM), budu\u0107i da rokovi va\u017eenja certifikata traju mjesecima i godinama. U Cloudflare-u, za za\u0161titu klju\u010deva certifikata mogu biti kori\u0161teni<\/a><\/noindex> biti posebni poslu\u017eitelji klju\u010deva koji rade s strane vlasnika weba, no rad u takvom re\u017eimu dovodi do opipljivih zastoja u isporuci prometa, smanjuje pouzdanost zbog dodatnog sloja i zahtijeva implementaciju slo\u017eene infrastrukture.<\/p>\n

Predlo\u017eeno TLS pro\u0161irenje Delegated Credentials uvodi dodatni privremeni privatni klju\u010d, \u010dije trajanje je ograni\u010deno na sate ili nekoliko dana (ne vi\u0161e od 7 dana). Ovaj klju\u010d generira se na temelju certifikata izdanog od strane certifikacijskog centra i omogu\u0107uje \u010duvanje privatnog klju\u010da izvorni certifikata u tajnosti od usluga isporuke sadr\u017eaja, pru\u017eaju\u0107i im samo privremeni certifikat s kratkim vremenom trajanja. <\/p>\n

\"Mozilla,<\/a><\/noindex><\/center><\/p>\n

Kako bi se izbjegli problemi s pristupom nakon isteka roka trajanja me\u0111usobnog klju\u010da, uvedena je tehnologija automatskog a\u017euriranja koja se izvr\u0161ava s strane izvornih TLS poslu\u017eitelja. Za generaciju nisu potrebne ru\u010dne operacije ili pokretanje skripti \u2014 autorizirani poslu\u017eitelj kojem je potreban privatni klju\u010d, prije isteka roka trajanja prethodnog klju\u010da, obra\u0107a se izvorom TLS poslu\u017eitelju web stranice koji generira me\u0111usobni klju\u010d za sljede\u0107i kratki vremenski period.<\/p>\n

\"Mozilla,<\/a><\/noindex><\/center><\/p>\n

Brave koje podr\u017eavaju TLS ekstenziju Delegated Credentials \u0107e takve izvedene certifikate smatrati pouzdanim. Na primjer, podr\u0161ka za ovu ekstenziju ve\u0107 je dodana u no\u0107ne izgradnje i beta verzije Firefoxa i mo\u017ee se aktivirati u about:config promjenom postavke \"security.tls.enable_delegated_credentials\". Sredinom studenog planira se provesti eksperiment me\u0111u odre\u0111enim postotkom korisnika testnih verzija Firefoxa.Eksperiment TLS Delegated Credentials<\/a><\/noindex>\"U okviru kojeg \u0107e se za provjeru kvalitete implementacije nove TLS ekstenzije poslati testni zahtjev na DC poslu\u017eitelj Cloudflare. Podr\u0161ka za Delegated Credentials tako\u0111er je ve\u0107 ugra\u0111ena u biblioteku. Fizz<\/a><\/noindex> s implementacijom TLS 1.3.<\/p>\n

Specifikacija Delegated Credentials predana je IETF (Internet Engineering Task Force) odboru, koji se bavi razvojem protokola i arhitekture interneta, i trenutno je u fazi nacrta<\/a><\/noindex>, koja pretendira na titulu internetskog standarda. Pro\u0161irenje Delegated Credentials mo\u017ee se koristiti samo s TLSv1.3.
\nZa generiranje privremenih klju\u010deva potrebno je dobiti TLS certifikat koji uklju\u010duje posebno pro\u0161irenje X.509, koje za sada podr\u017eava samo certifikacijski autoritet DigiCert. <\/p>\n

<\/a><\/noindex><\/p>\n

Izvor: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

Mozilla, Cloudflare \u0438 Facebook \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u043e \u0430\u043d\u043e\u043d\u0441\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u043d\u043e\u0432\u043e\u0435 TLS-\u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u0435 Delegated Credentials (DC), \u0440\u0435\u0448\u0430\u044e\u0449\u0435\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443 c \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430\u043c\u0438 \u043f\u0440\u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0441\u0430\u0439\u0442\u0443 \u0447\u0435\u0440\u0435\u0437 \u0441\u0435\u0442\u0438 \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u0430. \u0412\u044b\u0434\u0430\u0432\u0430\u0435\u043c\u044b\u0435 \u0443\u0434\u043e\u0441\u0442\u043e\u0432\u0435\u0440\u044f\u044e\u0449\u0438\u043c\u0438 \u0446\u0435\u043d\u0442\u0440\u0430\u043c\u0438 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u044b \u0438\u043c\u0435\u044e\u0442 \u0434\u043b\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0439 \u0441\u0440\u043e\u043a \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f, \u0447\u0442\u043e \u0441\u043e\u0437\u0434\u0430\u0451\u0442 \u0442\u0440\u0443\u0434\u043d\u043e\u0441\u0442\u0438 \u043f\u0440\u0438 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0441\u0430\u0439\u0442\u0443 \u0447\u0435\u0440\u0435\u0437 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0439 \u0441\u0435\u0440\u0432\u0438\u0441, \u043e\u0442 \u043b\u0438\u0446\u0430 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0434\u043e\u043b\u0436\u043d\u043e \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0442\u044c\u0441\u044f \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u043e\u0435 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0435, \u0442\u0430\u043a \u043a\u0430\u043a \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0430 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-52168","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Mozilla, Cloudflare i Facebook predstavili su TLS pro\u0161irenje za delegiranje kratkoro\u010dnih certifikata | ProHoster","description":"Mozilla,","canonical_url":"https:\/\/prohoster.info\/hr\/blog\/news\/mozilla-cloudflare-i-facebook-predstavili-tls-rasshirenie-dlya-delegirovaniya-korotkozhivushhih-sertifikatov","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hr_HR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Mozilla, Cloudflare \u0438 Facebook \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0438 TLS-\u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u0435 \u0434\u043b\u044f \u0434\u0435\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043a\u043e\u0440\u043e\u0442\u043a\u043e\u0436\u0438\u0432\u0443\u0449\u0438\u0445 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 | ProHoster","og:description":"Mozilla,","og:url":"https:\/\/prohoster.info\/hr\/blog\/news\/mozilla-cloudflare-i-facebook-predstavili-tls-rasshirenie-dlya-delegirovaniya-korotkozhivushhih-sertifikatov","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-11-01T21:00:00+00:00","article:modified_time":"2020-02-18T10:59:50+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"52168","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 02:44:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 13:40:57","updated":"2026-01-24 02:44:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/52168","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/comments?post=52168"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/52168\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media?parent=52168"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/categories?post=52168"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/tags?post=52168"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}