{"id":72877,"date":"2020-03-05T08:42:10","date_gmt":"2020-03-05T05:42:10","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/letsencrypt-planiruet-otozvat-svoi-sertifikaty-iz-za-programmnoj-oshibki"},"modified":"2020-03-05T08:42:10","modified_gmt":"2020-03-05T05:42:10","slug":"letsencrypt-planiruet-otozvat-svoi-sertifikaty-iz-za-programmnoj-oshibki","status":"publish","type":"post","link":"https:\/\/prohoster.info\/it\/blog\/administrirovanie\/letsencrypt-planiruet-otozvat-svoi-sertifikaty-iz-za-programmnoj-oshibki","title":{"rendered":"LetsEncrypt prevede di revocare i propri certificati a causa di un errore software","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"LetsEncrypt
\nL'azienda LetsEncrypt, che offre certificati ssl gratuiti per la crittografia, \u00e8 costretta ad annullare alcuni certificati.<\/p>\n

<\/a><\/noindex><\/p>\n

Il problema \u00e8 legato a un errore software<\/a><\/noindex> nel software di gestione Boulder, utilizzato per costruire CA. Di solito, il controllo del record DNS CAA avviene contemporaneamente alla verifica della propriet\u00e0 del dominio, e la maggior parte dei sottoscrittori riceve il certificato immediatamente dopo la verifica, ma gli sviluppatori del software hanno progettato il sistema in modo che il risultato della verifica venga considerato superato per i successivi 30 giorni. In alcuni casi, \u00e8 possibile eseguire una verifica dei record una seconda volta, direttamente prima dell'emissione del certificato; in particolare, \u00e8 necessaria una nuova verifica CAA entro 8 ore dall'emissione, quindi qualsiasi dominio verificato prima di questo periodo deve essere ricontrollato.<\/p>\n

<\/p>\n

Qual \u00e8 l'errore? Se la richiesta per un certificato contiene N domini che richiedono una nuova verifica CAA, Boulder ne selezionava uno e lo verificava N volte. Di conseguenza, c'era la possibilit\u00e0 di emettere un certificato, anche se successivamente (fino a X+30 giorni) veniva impostato un record CAA che vietava l'emissione del certificato LetsEncrypt.<\/p>\n

<\/p>\n

Per controllare i certificati, l'azienda ha preparato uno strumento online<\/a><\/noindex>, che mostrer\u00e0 un rapporto dettagliato.<\/p>\n

<\/p>\n

Gli utenti avanzati possono fare tutto autonomamente utilizzando i seguenti comandi:<\/p>\n

<\/p>\n

# \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 https\nopenssl s_client -connect example.com:443 -showcerts <\/dev\/null 2>\/dev\/null | openssl x509 -text -noout | grep -A 1 Serial Number | tr -d :\n# \u0432\u0430\u0440\u0438\u0430\u043d\u0442 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043e\u0442 @simpleadmin \necho | openssl s_client -connect example.com:443 |& openssl x509 -noout -serial\n# \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0430, \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b SMTP\nopenssl s_client -connect example.com:25 -starttls smtp -showcerts <\/dev\/null 2>\/dev\/null | openssl x509 -text -noout | grep -A 1 Serial Number | tr -d :\n# \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0430, \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b SMTP\nopenssl s_client -connect example.com:587 -starttls smtp -showcerts <\/dev\/null 2>\/dev\/null | openssl x509 -text -noout | grep -A 1 Serial Number | tr -d :\n# \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0430, \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b IMAP\nopenssl s_client -connect example.com:143 -starttls imap -showcerts <\/dev\/null 2>\/dev\/null | openssl x509 -text -noout | grep -A 1 Serial Number | tr -d :\n# \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0430, \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b IMAP\nopenssl s_client -connect example.com:993 -showcerts <\/dev\/null 2>\/dev\/null | openssl x509 -text -noout | grep -A 1 Serial Number | tr -d :\n# \u0432 \u043f\u0440\u0438\u043d\u0446\u0438\u043f\u0435 \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u043e \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u044e\u0442\u0441\u044f \u0438 \u0434\u0440\u0443\u0433\u0438\u0435 \u0441\u0435\u0440\u0432\u0438\u0441\u044b<\/code><\/pre>\n
<\/p>\n
Successivamente, \u00e8 necessario controllare qui<\/a><\/noindex> il proprio numero di serie, e se \u00e8 nell'elenco, si consiglia di aggiornare il\/i certificato\/i.<\/p>\n
<\/p>\n
Per aggiornare i certificati, \u00e8 possibile utilizzare certbot:<\/p>\n
<\/p>\n
certbot renew --force-renewal<\/code><\/pre>\n
<\/p>\n
Il problema \u00e8 stato trovato il 29 febbraio 2020, per risolvere il problema \u00e8 stata sospesa l'emissione di certificati dalle 3:10 UTC alle 5:22 UTC. Secondo un'inchiesta interna, l'errore \u00e8 stato introdotto il 25 luglio 2019; l'azienda fornir\u00e0 un report pi\u00f9 dettagliato in seguito.<\/p>\n
<\/p>\n
UPD: il servizio online di verifica dei certificati potrebbe non funzionare con indirizzi IP russi.<\/p>\n
Fonte: habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f LetsEncrypt, \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u044e\u0449\u0430\u044f \u043a \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044e \u0431\u0435\u0441\u043f\u043b\u0430\u0442\u043d\u044b\u0435 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u044b ssl \u0434\u043b\u044f \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f, \u0432\u044b\u043d\u0443\u0436\u0434\u0435\u043d\u0430 \u0430\u043d\u043d\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u044b. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0439 \u043e\u0448\u0438\u0431\u043a\u043e\u0439 \u0432 \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u043c \u041f\u041e Boulder, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u043c \u0434\u043b\u044f \u043f\u043e\u0441\u0442\u0440\u043e\u0435\u043d\u0438\u044f CA. \u041e\u0431\u044b\u0447\u043d\u043e \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 DNS \u0437\u0430\u043f\u0438\u0441\u0438 CAA \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u0438\u0442 \u043e\u0434\u043d\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e \u0441 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0438\u0435\u043c \u0432\u043b\u0430\u0434\u0435\u043d\u0438\u044f \u0434\u043e\u043c\u0435\u043d\u043e\u043c, \u0430 \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e \u043f\u043e\u0434\u043f\u0438\u0441\u0447\u0438\u043a\u043e\u0432 \u043f\u043e\u043b\u0443\u0447\u0430\u044e\u0442 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 \u0441\u0440\u0430\u0437\u0443 \u0436\u0435 \u043f\u043e\u0441\u043b\u0435 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438, \u043d\u043e \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u041f\u041e \u0441\u0434\u0435\u043b\u0430\u043b\u0438 \u0442\u0430\u043a, \u0447\u0442\u043e \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":72878,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-72877","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47LetsEncrypt prevede di revocare i propri certificati a causa di un errore software | ProHoster","description":"L'azienda.","canonical_url":"https:\/\/prohoster.info\/it\/blog\/administrirovanie\/letsencrypt-planiruet-otozvat-svoi-sertifikaty-iz-za-programmnoj-oshibki","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"it_IT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47LetsEncrypt \u043f\u043b\u0430\u043d\u0438\u0440\u0443\u0435\u0442 \u043e\u0442\u043e\u0437\u0432\u0430\u0442\u044c \u0441\u0432\u043e\u0438 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u044b \u0438\u0437-\u0437\u0430 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0439 \u043e\u0448\u0438\u0431\u043a\u0438 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f.","og:url":"https:\/\/prohoster.info\/it\/blog\/administrirovanie\/letsencrypt-planiruet-otozvat-svoi-sertifikaty-iz-za-programmnoj-oshibki","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-03-05T05:42:10+00:00","article:modified_time":"2020-03-05T05:42:10+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"72877","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 18:43:29","updated":"2022-09-30 17:43:34","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/72877","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/comments?post=72877"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/72877\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/media\/72878"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/media?parent=72877"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/categories?post=72877"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/tags?post=72877"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}