{"id":72877,"date":"2020-03-05T08:42:10","date_gmt":"2020-03-05T05:42:10","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/letsencrypt-planiruet-otozvat-svoi-sertifikaty-iz-za-programmnoj-oshibki"},"modified":"2020-03-05T08:42:10","modified_gmt":"2020-03-05T05:42:10","slug":"letsencrypt-planiruet-otozvat-svoi-sertifikaty-iz-za-programmnoj-oshibki","status":"publish","type":"post","link":"https:\/\/prohoster.info\/it\/blog\/administrirovanie\/letsencrypt-planiruet-otozvat-svoi-sertifikaty-iz-za-programmnoj-oshibki","title":{"rendered":"LetsEncrypt prevede di revocare i suoi certificati a causa di un errore software","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"LetsEncrypt prevede di revocare i suoi certificati a causa di un errore software\" src=\"\/wp-content\/uploads\/2020\/03\/b954f1ddd1b367591a9548984f21cfbb.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\nL'azienda LetsEncrypt, che offre certificati ssl gratuiti per la crittografia, \u00e8 costretta ad annullare alcuni certificati.<\/p>\n<p><noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<p>Il problema \u00e8 legato a <noindex><a rel=\"nofollow\" href=\"https:\/\/community.letsencrypt.org\/t\/2020-02-29-caa-rechecking-bug\/114591\">un errore software<\/a><\/noindex> nel software di gestione Boulder, utilizzato per costruire la CA. Di solito, il controllo del record DNS CAA avviene contemporaneamente alla verifica della propriet\u00e0 del dominio, e la maggior parte degli abbonati riceve il certificato subito dopo la verifica, ma gli sviluppatori del software hanno fatto in modo che il risultato della verifica fosse considerato superato anche nei successivi 30 giorni. In alcuni casi, \u00e8 possibile controllare i record una seconda volta, proprio prima del rilascio del certificato, in particolare \u00e8 necessaria una nuova verifica CAA nelle 8 ore precedenti al rilascio; pertanto, qualsiasi dominio verificato prima di questo termine deve essere nuovamente controllato.<\/p>\n<p><\/p>\n<p>Qual \u00e8 l'errore? Se la richiesta del certificato contiene N domini che necessitano di ri-verifica CAA, Boulder ne sceglie uno e lo controlla N volte. Di conseguenza, c'era la possibilit\u00e0 di emissione di un certificato, anche se successivamente (entro X+30 giorni) veniva impostato un record CAA che vietava l'emissione del certificato LetsEncrypt.<\/p>\n<p><\/p>\n<p>Per verificare i certificati, l'azienda ha preparato <noindex><a rel=\"nofollow\" href=\"https:\/\/unboundtest.com\/caaproblem.html\">uno strumento online<\/a><\/noindex>, che mostrer\u00e0 un rapporto dettagliato.<\/p>\n<p><\/p>\n<p>Gli utenti avanzati possono fare tutto da soli utilizzando i seguenti comandi:<\/p>\n<p><\/p>\n<pre><code class=\"plaintext\"># \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 https\nopenssl s_client -connect example.com:443 -showcerts &lt;\/dev\/null 2&gt;\/dev\/null | openssl x509 -text -noout | grep -A 1 Serial Number | tr -d :\n# \u0432\u0430\u0440\u0438\u0430\u043d\u0442 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043e\u0442 @simpleadmin \necho | openssl s_client -connect example.com:443 |&amp; openssl x509 -noout -serial\n# \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0430, \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b SMTP\nopenssl s_client -connect example.com:25 -starttls smtp -showcerts &lt;\/dev\/null 2&gt;\/dev\/null | openssl x509 -text -noout | grep -A 1 Serial Number | tr -d :\n# \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0430, \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b SMTP\nopenssl s_client -connect example.com:587 -starttls smtp -showcerts &lt;\/dev\/null 2&gt;\/dev\/null | openssl x509 -text -noout | grep -A 1 Serial Number | tr -d :\n# \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0430, \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b IMAP\nopenssl s_client -connect example.com:143 -starttls imap -showcerts &lt;\/dev\/null 2&gt;\/dev\/null | openssl x509 -text -noout | grep -A 1 Serial Number | tr -d :\n# \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0430, \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b IMAP\nopenssl s_client -connect example.com:993 -showcerts &lt;\/dev\/null 2&gt;\/dev\/null | openssl x509 -text -noout | grep -A 1 Serial Number | tr -d :\n# \u0432 \u043f\u0440\u0438\u043d\u0446\u0438\u043f\u0435 \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u043e \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u044e\u0442\u0441\u044f \u0438 \u0434\u0440\u0443\u0433\u0438\u0435 \u0441\u0435\u0440\u0432\u0438\u0441\u044b<\/code><\/pre>\n<p><\/p>\n<p>Successivamente, \u00e8 necessario controllare <noindex><a rel=\"nofollow\" href=\"https:\/\/letsencrypt.org\/caaproblem\/\">qui<\/a><\/noindex> il proprio numero di serie, e se \u00e8 nell'elenco, si consiglia di aggiornare il certificato(i).<\/p>\n<p><\/p>\n<p>Per aggiornare i certificati, si pu\u00f2 utilizzare certbot:<\/p>\n<p><\/p>\n<pre><code class=\"plaintext\">certbot renew --force-renewal<\/code><\/pre>\n<p><\/p>\n<p>Il problema \u00e8 stato riscontrato il 29 febbraio 2020, per risolvere il problema l'emissione di certificati \u00e8 stata sospesa dalle 3:10 UTC alle 5:22 UTC. Secondo un'indagine interna, l'errore \u00e8 stato introdotto il 25 luglio 2019, un rapporto pi\u00f9 dettagliato sar\u00e0 fornito dall'azienda in seguito.<\/p>\n<p><\/p>\n<p>UPD: il servizio di verifica dei certificati online potrebbe non funzionare con indirizzi IP russi.<\/p>\n<p>Fonte: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/southbridge\/blog\/490862\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f LetsEncrypt, \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u044e\u0449\u0430\u044f \u043a \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044e \u0431\u0435\u0441\u043f\u043b\u0430\u0442\u043d\u044b\u0435 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u044b ssl \u0434\u043b\u044f \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f, \u0432\u044b\u043d\u0443\u0436\u0434\u0435\u043d\u0430 \u0430\u043d\u043d\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u044b. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0439 \u043e\u0448\u0438\u0431\u043a\u043e\u0439 \u0432 \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u043c \u041f\u041e Boulder, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u043c \u0434\u043b\u044f \u043f\u043e\u0441\u0442\u0440\u043e\u0435\u043d\u0438\u044f CA. \u041e\u0431\u044b\u0447\u043d\u043e \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 DNS \u0437\u0430\u043f\u0438\u0441\u0438 CAA \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u0438\u0442 \u043e\u0434\u043d\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e \u0441 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0438\u0435\u043c \u0432\u043b\u0430\u0434\u0435\u043d\u0438\u044f \u0434\u043e\u043c\u0435\u043d\u043e\u043c, \u0430 \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e \u043f\u043e\u0434\u043f\u0438\u0441\u0447\u0438\u043a\u043e\u0432 \u043f\u043e\u043b\u0443\u0447\u0430\u044e\u0442 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 \u0441\u0440\u0430\u0437\u0443 \u0436\u0435 \u043f\u043e\u0441\u043b\u0435 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438, \u043d\u043e \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u041f\u041e \u0441\u0434\u0435\u043b\u0430\u043b\u0438 \u0442\u0430\u043a, \u0447\u0442\u043e \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":72878,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-72877","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.0.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/it\/blog\/administrirovanie\/letsencrypt-planiruet-otozvat-svoi-sertifikaty-iz-za-programmnoj-oshibki\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.0.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"it_IT\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47LetsEncrypt \u043f\u043b\u0430\u043d\u0438\u0440\u0443\u0435\u0442 \u043e\u0442\u043e\u0437\u0432\u0430\u0442\u044c \u0441\u0432\u043e\u0438 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u044b \u0438\u0437-\u0437\u0430 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0439 \u043e\u0448\u0438\u0431\u043a\u0438 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/it\/blog\/administrirovanie\/letsencrypt-planiruet-otozvat-svoi-sertifikaty-iz-za-programmnoj-oshibki\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-03-05T05:42:10+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-03-05T05:42:10+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47LetsEncrypt prevede di revocare i suoi certificati a causa di un errore software | ProHoster","description":"Azienda.","canonical_url":"https:\/\/prohoster.info\/it\/blog\/administrirovanie\/letsencrypt-planiruet-otozvat-svoi-sertifikaty-iz-za-programmnoj-oshibki","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"it_IT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47LetsEncrypt \u043f\u043b\u0430\u043d\u0438\u0440\u0443\u0435\u0442 \u043e\u0442\u043e\u0437\u0432\u0430\u0442\u044c \u0441\u0432\u043e\u0438 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u044b \u0438\u0437-\u0437\u0430 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0439 \u043e\u0448\u0438\u0431\u043a\u0438 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f.","og:url":"https:\/\/prohoster.info\/it\/blog\/administrirovanie\/letsencrypt-planiruet-otozvat-svoi-sertifikaty-iz-za-programmnoj-oshibki","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-03-05T05:42:10+00:00","article:modified_time":"2020-03-05T05:42:10+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"72877","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 18:43:29","updated":"2022-09-30 17:43:34","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/72877","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/comments?post=72877"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/72877\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/media\/72878"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/media?parent=72877"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/categories?post=72877"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/tags?post=72877"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}