{"id":84766,"date":"2020-06-10T13:43:11","date_gmt":"2020-06-10T11:43:11","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/problema-ustarevshih-kornevyh-sertifikatov-na-ocheredi-lets-encrypt-i-umnye-televizory"},"modified":"2020-06-10T13:43:11","modified_gmt":"2020-06-10T11:43:11","slug":"problema-ustarevshih-kornevyh-sertifikatov-na-ocheredi-lets-encrypt-i-umnye-televizory","status":"publish","type":"post","link":"https:\/\/prohoster.info\/it\/blog\/administrirovanie\/problema-ustarevshih-kornevyh-sertifikatov-na-ocheredi-lets-encrypt-i-umnye-televizory","title":{"rendered":"Problema dei certificati radice obsoleti. In arrivo Let's Encrypt e smart TV","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Il
\n
\nAffinch\u00e9 il browser possa autenticare un sito web, deve presentare una catena di certificati valida. Una catena tipica \u00e8 mostrata sopra, ed essa pu\u00f2 contenere pi\u00f9 di un certificato intermedio. Il numero minimo di certificati in una catena valida \u00e8 tre.<\/p>\n

Il certificato radice \u00e8 il cuore dell'autorit\u00e0 di certificazione. \u00c8 letteralmente incorporato nel tuo sistema operativo o browser, e fisicamente presente sul tuo dispositivo. Non pu\u00f2 essere cambiato dal server. \u00c8 necessario un aggiornamento forzato del sistema operativo o del firmware sul dispositivo.<\/p>\n

L'esperto di sicurezza Scott Helme scrive<\/a><\/noindex>, \u0447\u0442\u043e \u043e\u0441\u043d\u043e\u0432\u043d\u044b\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0432\u043e\u0437\u043d\u0438\u043a\u043d\u0443\u0442 \u0443 \u0446\u0435\u043d\u0442\u0440\u0430 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 Let’s Encrypt, \u043f\u043e\u0442\u043e\u043c\u0443 \u0447\u0442\u043e \u0441\u0435\u0433\u043e\u0434\u043d\u044f \u044d\u0442\u043e \u0441\u0430\u043c\u044b\u0439 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0439 \u0426\u0421 \u0432 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0435, \u0430 \u0435\u0433\u043e \u043a\u043e\u0440\u043d\u0435\u0432\u043e\u0439 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 \u0441\u043a\u043e\u0440\u043e \u00ab\u043f\u0440\u043e\u0442\u0443\u0445\u043d\u0435\u0442\u00bb. \u0421\u043c\u0435\u043d\u0430 \u043a\u043e\u0440\u043d\u044f Let’s Encrypt \u00e8 prevista per l'8 luglio 2020<\/a><\/noindex>.
\n<\/a><\/noindex>
\nI certificati finali e intermedi dell'autorit\u00e0 di certificazione (CA) vengono forniti al cliente dal server, mentre il certificato radice \u00e8 gi\u00e0 presente sul cliente \u00e8 gi\u00e0 presente<\/i>, quindi con questa collezione di certificati \u00e8 possibile costruire una catena e autenticare il sito web. <\/p>\n

Il problema \u00e8 che ogni certificato ha una data di scadenza, dopo la quale deve essere sostituito. Ad esempio, dal 1 settembre 2020, nel browser Safari si prevede di introdurre un limite alla durata dei certificati TLS del server. massimo 398 giorni<\/a><\/noindex>.<\/p>\n

Questo significa che tutti noi dovremo sostituire i certificati del server almeno ogni 12 mesi. Questa limitazione si applica solo ai certificati del server, non<\/i> si applica ai certificati radice CA.<\/p>\n

I certificati CA sono regolati da un altro insieme di regole, quindi hanno diverse limitazioni sulla durata. Molto spesso si possono trovare certificati intermedi con una durata di 5 anni e certificati radice con una durata di addirittura 25 anni! <\/p>\n

Con i certificati intermedi, di solito non ci sono problemi, perch\u00e9 vengono forniti al cliente dal server, che cambia il proprio certificato molto pi\u00f9 frequentemente, sostituendo anche quello intermedio nel processo. \u00c8 piuttosto facile cambiarlo insieme al certificato del server, a differenza del certificato radice CA.<\/p>\n

Come abbiamo gi\u00e0 accennato, il CA radice \u00e8 integrato direttamente nel dispositivo client, nel sistema operativo, nel browser o in un altro software. Il sito web non pu\u00f2 controllare la modifica del CA radice. Qui \u00e8 richiesta un aggiornamento sul client, che si tratti di un aggiornamento del sistema operativo o del software.<\/p>\n

Alcuni CA radice esistono da molto tempo, parliamo di 20-25 anni. Presto alcuni dei CA radice pi\u00f9 antichi si avvicineranno alla fine della loro vita naturale; il loro tempo \u00e8 quasi scaduto. Per la maggior parte di noi non sar\u00e0 affatto un problema, perch\u00e9 i CA hanno creato nuovi certificati radice e questi sono gi\u00e0 stati distribuiti in tutto il mondo tramite gli aggiornamenti del sistema operativo e dei browser per molti anni. Ma se qualcuno non ha aggiornato il sistema operativo o il browser da molto tempo, questo rappresenta una sorta di problema.<\/p>\n

Questa situazione si \u00e8 verificata il 30 maggio 2020 alle 10:48:38 GMT. \u00c8 l'orario esatto in cui \u00e8 scaduto il certificato radice AddTrust<\/a><\/noindex> del certificatore Comodo (Sectigo).<\/p>\n

\u00c8 stato utilizzato per la firma incrociata, per garantire la compatibilit\u00e0 con i dispositivi obsoleti, nei cui archivi manca il nuovo certificato radice USERTrust.<\/p>\n

Sfortunatamente, i problemi si sono presentati non solo nei browser obsoleti, ma anche nei client non browser basati su OpenSSL 1.0.x, LibreSSL e GnuTLS<\/a><\/noindex>. Ad esempio, nelle scatole televisive Roku<\/a><\/noindex>, servizio Heroku<\/a><\/noindex>, nelle applicazioni Fortinet, Chargify, sulla piattaforma .NET Core 2.0 su Linux e in molti altri<\/a><\/noindex>.<\/p>\n

Si pensava che il problema riguardasse solo i sistemi obsoleti (Android 2.3, Windows XP, Mac OS X 10.11, iOS 9, ecc.), poich\u00e9 i browser moderni possono utilizzare il secondo certificato radice USERTrust. Ma in realt\u00e0 si sono verificati guasti in centinaia di servizi web che utilizzavano le librerie gratuite OpenSSL 1.0.x e GnuTLS. La connessione sicura non si \u00e8 pi\u00f9 stabilita, con un errore di certificato scaduto.<\/p>\n

\u0421\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0439 \u2014 Let’s Encrypt<\/h1>\n

\n\u0415\u0449\u0451 \u043e\u0434\u0438\u043d \u0445\u043e\u0440\u043e\u0448\u0438\u0439 \u043f\u0440\u0438\u043c\u0435\u0440 \u043f\u0440\u0435\u0434\u0441\u0442\u043e\u044f\u0449\u0435\u0439 \u0441\u043c\u0435\u043d\u044b \u043a\u043e\u0440\u043d\u0435\u0432\u043e\u0433\u043e CA \u2014 \u0446\u0435\u043d\u0442\u0440 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 Let’s Encrypt. \u0415\u0449\u0451 nell'aprile 2019<\/a><\/noindex> avevano pianificato di passare dalla catena Identrust alla propria catena ISRG Root, ma ci\u00f2 non \u00e8 accaduto<\/a><\/noindex>.<\/p>\n

\"Il
\n
\n\u00ab\u0418\u0437-\u0437\u0430 \u043e\u043f\u0430\u0441\u0435\u043d\u0438\u0439 \u043f\u043e \u043f\u043e\u0432\u043e\u0434\u0443 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e\u0433\u043e \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0440\u043d\u044f ISRG \u043d\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445 Android \u043c\u044b \u0440\u0435\u0448\u0438\u043b\u0438 \u043f\u0435\u0440\u0435\u043d\u0435\u0441\u0442\u0438 \u0434\u0430\u0442\u0443 \u043f\u0435\u0440\u0435\u0445\u043e\u0434\u0430 \u043a \u0441\u043e\u0431\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u043c\u0443 \u043a\u043e\u0440\u043d\u044e \u0441 8 \u0438\u044e\u043b\u044f 2019 \u0433\u043e\u0434\u0430 \u043d\u0430 8 \u0438\u044e\u043b\u044f 2020 \u0433\u043e\u0434\u0430\u00bb, \u2014 \u0441\u043a\u0430\u0437\u0430\u043d\u043e \u0432 \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u043c \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0438 Let’s Encrypt.<\/p>\n

La data \u00e8 stata posticipata a causa di un problema noto come \u00abpropagazione del root\u00bb, o meglio, all'assenza di diffusione del root, quando il CA radice non \u00e8 ampiamente distribuito su tutti i client. <\/p>\n

\u0421\u0435\u0439\u0447\u0430\u0441 Let’s Encrypt \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u043f\u0435\u0440\u0435\u043a\u0440\u0451\u0441\u0442\u043d\u043e \u043f\u043e\u0434\u043f\u0438\u0441\u0430\u043d\u043d\u044b\u0439 \u043f\u0440\u043e\u043c\u0435\u0436\u0443\u0442\u043e\u0447\u043d\u044b\u0439 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 \u0441 \u0446\u0435\u043f\u043e\u0447\u043a\u043e\u0439 \u0434\u043e \u043a\u043e\u0440\u043d\u044f IdenTrust DST Root CA X3. \u042d\u0442\u043e\u0442 \u043a\u043e\u0440\u043d\u0435\u0432\u043e\u0439 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 \u0431\u044b\u043b \u0432\u044b\u0434\u0430\u043d \u0435\u0449\u0451 \u0432 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u0435 2000 \u0433\u043e\u0434\u0430 \u0438 \u0438\u0441\u0442\u0435\u043a\u0430\u0435\u0442 30 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f 2021 \u0433\u043e\u0434\u0430. \u0414\u043e \u044d\u0442\u043e\u0433\u043e \u0432\u0440\u0435\u043c\u0435\u043d\u0438 Let’s Encrypt \u043f\u043b\u0430\u043d\u0438\u0440\u0443\u0435\u0442 \u043f\u0435\u0440\u0435\u0439\u0442\u0438 \u043d\u0430 \u0441\u043e\u0431\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0439 \u0441\u0430\u043c\u043e\u043f\u043e\u0434\u043f\u0438\u0441\u0430\u043d\u043d\u044b\u0439 \u043a\u043e\u0440\u0435\u043d\u044c ISRG Root X1.<\/p>\n

\"Il
\n
\nIl root ISRG \u00e8 stato emesso il 4 giugno 2015. Successivamente, \u00e8 iniziato il processo per la sua approvazione come autorit\u00e0 di certificazione, che si \u00e8 concluso il 6 agosto 2018<\/a><\/noindex>. Da questo momento, il CA radice era accessibile a tutti i clienti tramite un aggiornamento del sistema operativo o del software. Tutto ci\u00f2 che dovevi fare era installare l'aggiornamento. <\/p>\n

Ma questo \u00e8 proprio il problema.<\/p>\n

\u0415\u0441\u043b\u0438 \u0432\u0430\u0448 \u043c\u043e\u0431\u0438\u043b\u044c\u043d\u044b\u0439 \u0442\u0435\u043b\u0435\u0444\u043e\u043d, \u0442\u0435\u043b\u0435\u0432\u0438\u0437\u043e\u0440 \u0438\u043b\u0438 \u0434\u0440\u0443\u0433\u043e\u0435 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u043e \u043d\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u044f\u043b\u043e\u0441\u044c \u0434\u0432\u0430 \u0433\u043e\u0434\u0430 \u2014 \u043a\u0430\u043a \u043e\u043d\u043e \u0443\u0437\u043d\u0430\u0435\u0442 \u043e \u043d\u043e\u0432\u043e\u043c \u043a\u043e\u0440\u043d\u0435\u0432\u043e\u043c \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0435 ISRG Root X1? \u0410 \u0435\u0441\u043b\u0438 \u0435\u0433\u043e \u043d\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435, \u0442\u043e \u0432\u0441\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u043d\u044b\u0435 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u044b Let’s Encrypt \u0432\u0430\u0448\u0435 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u043e \u043f\u0440\u0438\u0437\u043d\u0430\u0435\u0442 \u043d\u0435\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u043c\u0438, \u043a\u0430\u043a \u0442\u043e\u043b\u044c\u043a\u043e Let’s Encrypt \u043f\u0435\u0440\u0435\u0439\u0434\u0451\u0442 \u043d\u0430 \u043d\u043e\u0432\u044b\u0439 \u043a\u043e\u0440\u0435\u043d\u044c. \u0410 \u0432 \u044d\u043a\u043e\u0441\u0438\u0441\u0442\u0435\u043c\u0435 Android \u043c\u043d\u043e\u0433\u043e \u0443\u0441\u0442\u0430\u0440\u0435\u0432\u0448\u0438\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0434\u0430\u0432\u043d\u043e \u043d\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u044f\u043b\u0438\u0441\u044c.<\/p>\n

\"Il
\nEcosistema Android<\/i><\/p>\n

\u0412\u043e\u0442 \u043f\u043e\u0447\u0435\u043c\u0443 Let’s Encrypt \u043e\u0442\u043b\u043e\u0436\u0438\u043b \u043f\u0435\u0440\u0435\u0445\u043e\u0434 \u043a \u0441\u043e\u0431\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u043c\u0443 \u043a\u043e\u0440\u043d\u044e ISRG \u0438 \u0432\u0441\u0451 \u0435\u0449\u0451 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u043f\u0440\u043e\u043c\u0435\u0436\u0443\u0442\u043e\u0447\u043d\u043e\u0435 \u0437\u0432\u0435\u043d\u043e, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u0441\u043f\u0443\u0441\u043a\u0430\u0435\u0442\u0441\u044f \u043a \u043a\u043e\u0440\u043d\u044e IdenTrust. \u041d\u043e \u043f\u0435\u0440\u0435\u0445\u043e\u0434 \u0432 \u043b\u044e\u0431\u043e\u043c \u0441\u043b\u0443\u0447\u0430\u0435 \u043f\u0440\u0438\u0434\u0451\u0442\u0441\u044f \u0441\u0434\u0435\u043b\u0430\u0442\u044c. \u0418 \u0434\u0430\u0442\u043e\u0439 \u0441\u043c\u0435\u043d\u044b \u043a\u043e\u0440\u043d\u044f \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u043e 8 luglio 2020<\/a><\/noindex>.<\/p>\n

Per verificare se il tuo dispositivo (televisore, decoder o altro client) ha installato il root ISRG X1, apri il sito di test https:\/\/valid-isrgrootx1.letsencrypt.org\/<\/a><\/noindex>. Se non appare un avviso di sicurezza, di solito va tutto bene. <\/p>\n

Let’s Encrypt \u043d\u0435 \u0435\u0434\u0438\u043d\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0439, \u043a\u043e\u043c\u0443 \u043f\u0440\u0435\u0434\u0441\u0442\u043e\u0438\u0442 \u0440\u0435\u0448\u0438\u0442\u044c \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443 \u0441 \u043f\u0435\u0440\u0435\u0445\u043e\u0434\u043e\u043c \u043d\u0430 \u043d\u043e\u0432\u044b\u0439 \u043a\u043e\u0440\u0435\u043d\u044c. \u041a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u044e \u0432 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0435 \u043d\u0430\u0447\u0430\u043b\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0447\u0443\u0442\u044c \u0431\u043e\u043b\u0435\u0435 20 \u043b\u0435\u0442 \u043d\u0430\u0437\u0430\u0434, \u0442\u0430\u043a \u0447\u0442\u043e \u043a\u0430\u043a \u0440\u0430\u0437 \u0441\u0435\u0439\u0447\u0430\u0441 \u043d\u0430\u0441\u0442\u0443\u043f\u0430\u0435\u0442 \u043c\u043e\u043c\u0435\u043d\u0442 \u043e\u043a\u043e\u043d\u0447\u0430\u043d\u0438\u044f \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u043c\u043d\u043e\u0433\u0438\u0445 \u043a\u043e\u0440\u043d\u0435\u0432\u044b\u0445 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432.<\/p>\n

I proprietari di smart TV che non aggiornano da anni il software di Smart TV potrebbero affrontare questo problema. Ad esempio, il nuovo root GlobalSign R5 Root<\/a><\/noindex> \u00e8 stato emesso nel 2012 e, dopo, alcuni vecchi smart TV non riescono a costruire una catena verso di esso, poich\u00e9 questo CA root \u00e8 semplicemente mancante. In particolare, questi clienti non potevano stabilire una connessione sicura con il sito bbc.co.uk. Per risolvere il problema, gli amministratori della BBC hanno dovuto adottare una soluzione: hanno costruito una catena alternativa per questi clienti<\/a><\/noindex> attraverso certificati intermedi addizionali, coinvolgendo vecchi root R3 Root<\/a><\/noindex> e R1 Root<\/a><\/noindex>, che non erano ancora scaduti.<\/p>\n

www.bbc.co.uk (Leaf)\nGlobalSign ECC OV SSL CA 2018 (Intermedio)\nGlobalSign Root CA - R5 (Intermedio)\nGlobalSign Root CA - R3 (Intermedio)<\/pre>\n
\nQuesta \u00e8 una soluzione temporanea. Il problema non scomparir\u00e0 se non si aggiorna il software client. Una smart TV \u00e8 fondamentalmente un computer con Linux limitato nelle funzionalit\u00e0. Senza aggiornamenti, i suoi certificati radice inevitabilmente scadono.<\/p>\n
Questo vale per tutti i dispositivi, non solo per le TV. Se hai qualsiasi dispositivo che si connette a Internet e che \u00e8 stato pubblicizzato come un dispositivo \u00absmart\u00bb, il problema dei certificati scaduti riguarda quasi sicuramente anche lui. Se il dispositivo non viene aggiornato, l'archivio dei certificati radice CA diventer\u00e0 obsoleto nel tempo e alla fine il problema emerger\u00e0. Quanto presto si verificher\u00e0 il problema dipende dall'ultima volta che l'archivio radice \u00e8 stato aggiornato. Questo pu\u00f2 avvenire diversi anni prima della data di effettivo rilascio del dispositivo.<\/p>\n
\u041a\u0441\u0442\u0430\u0442\u0438, \u0432 \u044d\u0442\u043e\u043c \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430, \u043f\u043e\u0447\u0435\u043c\u0443 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043a\u0440\u0443\u043f\u043d\u044b\u0435 \u043c\u0435\u0434\u0438\u0430\u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u043d\u0435 \u043c\u043e\u0433\u0443\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0441\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0435 \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0446\u0435\u043d\u0442\u0440\u044b \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0442\u0438\u043f\u0430 Let’s Encrypt, \u043f\u0438\u0448\u0435\u0442 \u0421\u043a\u043e\u0442\u0442 \u0425\u0435\u043b\u044c\u043c\u0435. \u0414\u043b\u044f \u0443\u043c\u043d\u044b\u0445 \u0422\u0412 \u043e\u043d\u0438 \u043d\u0435 \u043f\u043e\u0434\u0445\u043e\u0434\u044f\u0442, \u0438 \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u043a\u043e\u0440\u043d\u0435\u0439 \u0441\u043b\u0438\u0448\u043a\u043e\u043c \u043c\u0430\u043b\u043e, \u0447\u0442\u043e\u0431\u044b \u0433\u0430\u0440\u0430\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0443 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 \u043d\u0430 \u0443\u0441\u0442\u0430\u0440\u0435\u0432\u0448\u0438\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445. \u0412 \u043f\u0440\u043e\u0442\u0438\u0432\u043d\u043e\u043c \u0441\u043b\u0443\u0447\u0430\u0435 \u0422\u0412 \u043f\u0440\u043e\u0441\u0442\u043e \u043d\u0435 \u0441\u043c\u043e\u0436\u0435\u0442 \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c \u0441\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0435 \u0441\u0442\u0440\u0438\u043c\u0438\u043d\u0433\u043e\u0432\u044b\u0435 \u0441\u0435\u0440\u0432\u0438\u0441\u044b.<\/p>\n
L'ultimo incidente con AddTrust ha dimostrato che anche le grandi aziende IT possono non essere pronte a un'origine scadenza dei certificati radice.<\/p>\n
L'unica soluzione al problema \u00e8 l'aggiornamento. Gli sviluppatori di dispositivi intelligenti devono garantire in anticipo un meccanismo di aggiornamento per il software e i certificati radice. D'altra parte, ai produttori non conviene garantire il funzionamento dei loro dispositivi dopo la scadenza della garanzia.<\/p>\n
\n\"Il
\n<\/a><\/noindex>
\n
Fonte: habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u0427\u0442\u043e\u0431\u044b \u0431\u0440\u0430\u0443\u0437\u0435\u0440 \u043c\u043e\u0433 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0432\u0435\u0431-\u0441\u0430\u0439\u0442, \u0442\u043e\u0442 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u0435\u0431\u044f \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0439 \u0446\u0435\u043f\u043e\u0447\u043a\u043e\u0439 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432. \u0422\u0438\u043f\u0438\u0447\u043d\u0430\u044f \u0446\u0435\u043f\u043e\u0447\u043a\u0430 \u043f\u043e\u043a\u0430\u0437\u0430\u043d\u0430 \u0441\u0432\u0435\u0440\u0445\u0443, \u0432 \u043d\u0435\u0439 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0431\u043e\u043b\u044c\u0448\u0435 \u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u043c\u0435\u0436\u0443\u0442\u043e\u0447\u043d\u043e\u0433\u043e \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430. \u041c\u0438\u043d\u0438\u043c\u0430\u043b\u044c\u043d\u043e\u0435 \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 \u0432 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0439 \u0446\u0435\u043f\u043e\u0447\u043a\u0435 \u0440\u0430\u0432\u043d\u043e \u0442\u0440\u0451\u043c. \u041a\u043e\u0440\u043d\u0435\u0432\u043e\u0439 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 \u2014 \u0441\u0435\u0440\u0434\u0446\u0435 \u0446\u0435\u043d\u0442\u0440\u0430 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438. \u041e\u043d \u0431\u0443\u043a\u0432\u0430\u043b\u044c\u043d\u043e \u0432\u0441\u0442\u0440\u043e\u0435\u043d \u0432 \u0432\u0430\u0448\u0443 \u041e\u0421 \u0438\u043b\u0438 \u0431\u0440\u0430\u0443\u0437\u0435\u0440, \u043e\u043d \u0444\u0438\u0437\u0438\u0447\u0435\u0441\u043a\u0438 \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u043d\u0430 \u0432\u0430\u0448\u0435\u043c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0435. \u0415\u0433\u043e \u043d\u0435 \u043f\u043e\u043c\u0435\u043d\u044f\u0435\u0448\u044c \u0441\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":84767,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-84766","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Il problema dei certificati radice obsoleti. In attesa di Let\u2019s Encrypt e TV intelligenti | ProHoster","description":"Per consentire al browser di autenticare un sito web, quest'ultimo deve presentarsi con una catena di certificati valida. Una catena tipica \u00e8 mostrata sopra e pu\u00f2 contenere pi\u00f9 di un certificato intermedio. Il numero minimo di certificati in una catena valida \u00e8 tre. Il certificato radice \u00e8 il cuore dell'autorit\u00e0 di certificazione. \u00c8 letteralmente integrato nel tuo sistema operativo o browser e \u00e8 fisicamente presente sul tuo dispositivo. Non pu\u00f2 essere sostituito con","canonical_url":"https:\/\/prohoster.info\/it\/blog\/administrirovanie\/problema-ustarevshih-kornevyh-sertifikatov-na-ocheredi-lets-encrypt-i-umnye-televizory","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"it_IT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0443\u0441\u0442\u0430\u0440\u0435\u0432\u0448\u0438\u0445 \u043a\u043e\u0440\u043d\u0435\u0432\u044b\u0445 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432. \u041d\u0430 \u043e\u0447\u0435\u0440\u0435\u0434\u0438 Let\u2019s Encrypt \u0438 \u0443\u043c\u043d\u044b\u0435 \u0442\u0435\u043b\u0435\u0432\u0438\u0437\u043e\u0440\u044b | ProHoster","og:description":"\u0427\u0442\u043e\u0431\u044b \u0431\u0440\u0430\u0443\u0437\u0435\u0440 \u043c\u043e\u0433 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0432\u0435\u0431-\u0441\u0430\u0439\u0442, \u0442\u043e\u0442 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u0435\u0431\u044f \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0439 \u0446\u0435\u043f\u043e\u0447\u043a\u043e\u0439 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432. \u0422\u0438\u043f\u0438\u0447\u043d\u0430\u044f \u0446\u0435\u043f\u043e\u0447\u043a\u0430 \u043f\u043e\u043a\u0430\u0437\u0430\u043d\u0430 \u0441\u0432\u0435\u0440\u0445\u0443, \u0432 \u043d\u0435\u0439 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0431\u043e\u043b\u044c\u0448\u0435 \u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u043c\u0435\u0436\u0443\u0442\u043e\u0447\u043d\u043e\u0433\u043e \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430. \u041c\u0438\u043d\u0438\u043c\u0430\u043b\u044c\u043d\u043e\u0435 \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 \u0432 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0439 \u0446\u0435\u043f\u043e\u0447\u043a\u0435 \u0440\u0430\u0432\u043d\u043e \u0442\u0440\u0451\u043c. \u041a\u043e\u0440\u043d\u0435\u0432\u043e\u0439 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 \u2014 \u0441\u0435\u0440\u0434\u0446\u0435 \u0446\u0435\u043d\u0442\u0440\u0430 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438. \u041e\u043d \u0431\u0443\u043a\u0432\u0430\u043b\u044c\u043d\u043e \u0432\u0441\u0442\u0440\u043e\u0435\u043d \u0432 \u0432\u0430\u0448\u0443 \u041e\u0421 \u0438\u043b\u0438 \u0431\u0440\u0430\u0443\u0437\u0435\u0440, \u043e\u043d \u0444\u0438\u0437\u0438\u0447\u0435\u0441\u043a\u0438 \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u043d\u0430 \u0432\u0430\u0448\u0435\u043c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0435. \u0415\u0433\u043e \u043d\u0435 \u043f\u043e\u043c\u0435\u043d\u044f\u0435\u0448\u044c \u0441\u043e","og:url":"https:\/\/prohoster.info\/it\/blog\/administrirovanie\/problema-ustarevshih-kornevyh-sertifikatov-na-ocheredi-lets-encrypt-i-umnye-televizory","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-06-10T11:43:11+00:00","article:modified_time":"2020-06-10T11:43:11+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"84766","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 14:51:43","updated":"2022-09-29 06:39:22"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/84766","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/comments?post=84766"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/84766\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/media\/84767"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/media?parent=84766"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/categories?post=84766"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/tags?post=84766"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}