{"id":71037,"date":"2020-02-23T14:45:41","date_gmt":"2020-02-23T11:45:41","guid":{"rendered":"https:\/\/prohoster.info\/blog\/lets-encrypt-pereshyol-k-proverke-s-ispolzovaniem-raznyh-podsetej"},"modified":"2020-03-03T16:10:57","modified_gmt":"2020-03-03T13:10:57","slug":"lets-encrypt-pereshyol-k-proverke-s-ispolzovaniem-raznyh-podsetej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pl\/blog\/news\/lets-encrypt-pereshyol-k-proverke-s-ispolzovaniem-raznyh-podsetej","title":{"rendered":"Let&apos;s Encrypt przeszed\u0142 do weryfikacji z wykorzystaniem r\u00f3\u017cnych podsieci","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Niekomercyjny certyfikuj\u0105cy urz\u0105d <noindex><a rel=\"nofollow\" href=\"https:\/\/letsencrypt.org\">Let\u2019s Encrypt<\/a><\/noindex>, kontrolowany przez spo\u0142eczno\u015b\u0107 i oferuj\u0105cy certyfikaty bezp\u0142atnie wszystkim ch\u0119tnym, <noindex><a rel=\"nofollow\" href=\"https:\/\/community.letsencrypt.org\/t\/acme-v1-v2-validating-challenges-from-multiple-network-vantage-points\/112253\">og\u0142osi\u0142<\/a><\/noindex> Wprowadzenie nowego schematu potwierdzania uprawnie\u0144 do uzyskania certyfikatu dla domeny. Od teraz zwracanie si\u0119 do serwera, na kt\u00f3rym znajduje si\u0119 u\u017cywany w weryfikacji katalog &#171;\/.well-known\/acme-challenge\/&#187;, b\u0119dzie odbywa\u0107 si\u0119 z wykorzystaniem kilku \u017c\u0105da\u0144 HTTP, wysy\u0142anych z 4 r\u00f3\u017cnych adres\u00f3w IP, umieszczonych w r\u00f3\u017cnych centrach danych i nale\u017c\u0105cych do r\u00f3\u017cnych autonomicznych system\u00f3w. Weryfikacja uznawana jest za skuteczn\u0105 tylko wtedy, gdy co najmniej 3 z 4 \u017c\u0105da\u0144 z r\u00f3\u017cnych IP zako\u0144czy\u0142y si\u0119 sukcesem. <\/p>\n<p>Weryfikacja z kilku podsieci pozwoli zminimalizowa\u0107 ryzyko uzyskania certyfikat\u00f3w na cudze domeny poprzez przeprowadzanie celowych atak\u00f3w, kt\u00f3re przekierowuj\u0105 ruch za pomoc\u0105 podstawienia fikcyjnych tras przy pomocy BGP. Przy u\u017cyciu wielopozycyjnego systemu weryfikacji, atakuj\u0105cy b\u0119dzie musia\u0142 jednocze\u015bnie osi\u0105gn\u0105\u0107 przekierowanie tras dla kilku autonomicznych system\u00f3w dostawc\u00f3w z r\u00f3\u017cnymi \u0142\u0105czami, co jest znacznie bardziej skomplikowane ni\u017c przekierowanie jednej trasy. Wysy\u0142anie \u017c\u0105da\u0144 z r\u00f3\u017cnych IP dodatkowo zwi\u0119ksza niezawodno\u015b\u0107 weryfikacji w przypadku ujawnienia pojedynczych host\u00f3w Let\u2019s Encrypt na listach blokad (na przyk\u0142ad w Rosji niekt\u00f3re IP letsencrypt.org by\u0142y blokowane przez Roskomnadzor). <\/p>\n<p>Do 1 czerwca b\u0119dzie obowi\u0105zywa\u0142 okres przej\u015bciowy, kt\u00f3ry pozwala na generowanie certyfikat\u00f3w po pomy\u015blnym przej\u015bciu weryfikacji z podstawowego centrum danych, w przypadku niedost\u0119pno\u015bci hosta z pozosta\u0142ych podsieci (na przyk\u0142ad mo\u017ce si\u0119 to zdarzy\u0107, je\u017celi administrator hosta na zaporze sieciowej zezwoli\u0142 na \u017c\u0105dania tylko z g\u0142\u00f3wnego centrum danych Let\u2019s Encrypt lub z powodu naruszenia synchronizacji stref w DNS). Na podstawie log\u00f3w zostanie przygotowana bia\u0142a lista dla domen, kt\u00f3re maj\u0105 problemy z weryfikacj\u0105 z 3 dodatkowych centr\u00f3w danych. Do bia\u0142ej listy trafi\u0105 tylko domeny z wype\u0142nionymi danymi kontaktowymi. W przypadku, gdy domena nie zostanie automatycznie dodana do bia\u0142ej listy, wniosek o jej dodanie mo\u017cna r\u00f3wnie\u017c przes\u0142a\u0107 poprzez <noindex><a rel=\"nofollow\" href=\"https:\/\/docs.google.com\/forms\/d\/e\/1FAIpQLSfaW8KUOulxuf14bb5qsy0p30N83diZNYIpPD7OMFgT084hQg\/viewform\">specjalny formularz<\/a><\/noindex>.<\/p>\n<p>Obecnie projekt Let\u2019s Encrypt wyda\u0142 113 mln certyfikat\u00f3w, obejmuj\u0105cych oko\u0142o 190 mln domen (rok temu obejmowa\u0142y 150 mln domen, a dwa lata temu \u2014 61 mln). Wed\u0142ug statystyk serwisu Firefox Telemetry globalny udzia\u0142 zapyta\u0144 stron przez HTTPS wynosi 81% (rok temu 77%, a dwa lata temu 69%), w USA \u2014 91%.<\/p>\n<p>Dodatkowo mo\u017cna zauwa\u017cy\u0107, <noindex><a rel=\"nofollow\" href=\"https:\/\/www.digicert.com\/position-on-1-year-certificates\/\">zamiar<\/a><\/noindex> firmy Apple<br \/>\nzaprzestanie w przegl\u0105darce Safari uznawania certyfikat\u00f3w, kt\u00f3rych czas \u017cycia przekracza 398 dni (13 miesi\u0119cy). Ograniczenie to ma obowi\u0105zywa\u0107 tylko dla certyfikat\u00f3w wydanych od 1 wrze\u015bnia 2020 roku. Certyfikaty uzyskane przed 1 wrze\u015bnia b\u0119d\u0105 mia\u0142y zachowane zaufanie, ale ograniczone do 825 dni (2,2 roku).  <\/p>\n<p>Zmiana ta mo\u017ce negatywnie wp\u0142yn\u0105\u0107 na dzia\u0142alno\u015b\u0107 centr\u00f3w certyfikacji, sprzedaj\u0105cych tanie certyfikaty o d\u0142ugim okresie wa\u017cno\u015bci, si\u0119gaj\u0105cym nawet 5 lat. W opinii firmy Apple generowanie takich certyfikat\u00f3w stwarza dodatkowe zagro\u017cenia dla bezpiecze\u0144stwa, utrudnia szybkie wprowadzanie nowych standard\u00f3w kryptograficznych i pozwala cyberprzest\u0119pcom na d\u0142u\u017csze kontrolowanie ruchu ofiary lub u\u017cywanie go do phishingu w przypadku niezauwa\u017conego wycieku certyfikatu w wyniku ataku.<\/p>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>\u0179r\u00f3d\u0142o: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=52419\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041d\u0435\u043a\u043e\u043c\u043c\u0435\u0440\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0434\u043e\u0441\u0442\u043e\u0432\u0435\u0440\u044f\u044e\u0449\u0438\u0439 \u0446\u0435\u043d\u0442\u0440 Let&#8217;s Encrypt, \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u044b\u0439 \u0441\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e\u043c \u0438 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0439 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u044b \u0431\u0435\u0437\u0432\u043e\u0437\u043c\u0435\u0437\u0434\u043d\u043e \u0432\u0441\u0435\u043c \u0436\u0435\u043b\u0430\u044e\u0449\u0438\u043c, \u043e\u0431\u044a\u044f\u0432\u0438\u043b \u043e \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u0438 \u043d\u043e\u0432\u043e\u0439 \u0441\u0445\u0435\u043c\u044b \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0438\u0435 \u043f\u043e\u043b\u043d\u043e\u043c\u043e\u0447\u0438\u0439 \u043d\u0430 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u0435 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 \u0434\u043b\u044f \u0434\u043e\u043c\u0435\u043d\u0430. \u041e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u0435 \u043a \u0441\u0435\u0440\u0432\u0435\u0440\u0443, \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0440\u0430\u0437\u043c\u0435\u0449\u0451\u043d \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0439 \u0432 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043a\u0430\u0442\u0430\u043b\u043e\u0433 &#171;\/.well-known\/acme-challenge\/&#187;, \u0442\u0435\u043f\u0435\u0440\u044c \u0431\u0443\u0434\u0435\u0442 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0442\u044c\u0441\u044f \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u0445 HTTP-\u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432, \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u043c\u044b\u0445 \u0441 4 \u0440\u0430\u0437\u043d\u044b\u0445 IP-\u0430\u0434\u0440\u0435\u0441\u043e\u0432, \u0440\u0430\u0437\u043c\u0435\u0449\u0451\u043d\u043d\u044b\u0445 \u0432 \u0440\u0430\u0437\u043d\u044b\u0445 \u0434\u0430\u0442\u0430\u0446\u0435\u043d\u0442\u0440\u0430\u0445 \u0438 \u043f\u0440\u0438\u043d\u0430\u0434\u043b\u0435\u0436\u0430\u0449\u0438\u0445 \u043a [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-71037","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041d\u0435\u043a\u043e\u043c\u043c\u0435\u0440\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0434\u043e\u0441\u0442\u043e\u0432\u0435\u0440\u044f\u044e\u0449\u0438\u0439 \u0446\u0435\u043d\u0442\u0440 Let\u2019s Encrypt, \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u044b\u0439 \u0441\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e\u043c \u0438 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0439 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u044b \u0431\u0435\u0437\u0432\u043e\u0437\u043c\u0435\u0437\u0434\u043d\u043e \u0432\u0441\u0435\u043c \u0436\u0435\u043b\u0430\u044e\u0449\u0438\u043c.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/pl\/blog\/news\/lets-encrypt-pereshyol-k-proverke-s-ispolzovaniem-raznyh-podsetej\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2\" \/>\n\t\t<meta property=\"og:locale\" content=\"pl_PL\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47Let&amp;apos;s Encrypt \u043f\u0435\u0440\u0435\u0448\u0451\u043b \u043a \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0435 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0440\u0430\u0437\u043d\u044b\u0445 \u043f\u043e\u0434\u0441\u0435\u0442\u0435\u0439 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041d\u0435\u043a\u043e\u043c\u043c\u0435\u0440\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0434\u043e\u0441\u0442\u043e\u0432\u0435\u0440\u044f\u044e\u0449\u0438\u0439 \u0446\u0435\u043d\u0442\u0440 Let\u2019s Encrypt, \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u044b\u0439 \u0441\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e\u043c \u0438 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0439 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u044b \u0431\u0435\u0437\u0432\u043e\u0437\u043c\u0435\u0437\u0434\u043d\u043e \u0432\u0441\u0435\u043c \u0436\u0435\u043b\u0430\u044e\u0449\u0438\u043c.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/pl\/blog\/news\/lets-encrypt-pereshyol-k-proverke-s-ispolzovaniem-raznyh-podsetej\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-02-23T11:45:41+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-03-03T13:10:57+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Let's Encrypt przeszed\u0142 do weryfikacji z wykorzystaniem r\u00f3\u017cnych podsieci | ProHoster","description":"Niekorporacyjny organ certyfikacyjny Let\u2019s Encrypt, kontrolowany przez spo\u0142eczno\u015b\u0107 i oferuj\u0105cy certyfikaty bezp\u0142atnie wszystkim ch\u0119tnym.","canonical_url":"https:\/\/prohoster.info\/pl\/blog\/news\/lets-encrypt-pereshyol-k-proverke-s-ispolzovaniem-raznyh-podsetej","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pl_PL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Let&amp;apos;s Encrypt \u043f\u0435\u0440\u0435\u0448\u0451\u043b \u043a \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0435 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0440\u0430\u0437\u043d\u044b\u0445 \u043f\u043e\u0434\u0441\u0435\u0442\u0435\u0439 | ProHoster","og:description":"\u041d\u0435\u043a\u043e\u043c\u043c\u0435\u0440\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0434\u043e\u0441\u0442\u043e\u0432\u0435\u0440\u044f\u044e\u0449\u0438\u0439 \u0446\u0435\u043d\u0442\u0440 Let\u2019s Encrypt, \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u044b\u0439 \u0441\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e\u043c \u0438 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0439 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u044b \u0431\u0435\u0437\u0432\u043e\u0437\u043c\u0435\u0437\u0434\u043d\u043e \u0432\u0441\u0435\u043c \u0436\u0435\u043b\u0430\u044e\u0449\u0438\u043c.","og:url":"https:\/\/prohoster.info\/pl\/blog\/news\/lets-encrypt-pereshyol-k-proverke-s-ispolzovaniem-raznyh-podsetej","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-02-23T11:45:41+00:00","article:modified_time":"2020-03-03T13:10:57+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"71037","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 19:09:24","updated":"2022-10-04 11:44:43","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/71037","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/comments?post=71037"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/71037\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/media?parent=71037"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/categories?post=71037"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/tags?post=71037"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}