{"id":52168,"date":"2019-11-02T00:00:00","date_gmt":"2019-11-01T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/mozilla-cloudflare-i-facebook-predstavili-tls-rasshirenie-dlya-delegirovaniya-korotkozhivushhih-sertifikatov"},"modified":"2020-02-18T13:59:50","modified_gmt":"2020-02-18T10:59:50","slug":"mozilla-cloudflare-i-facebook-predstavili-tls-rasshirenie-dlya-delegirovaniya-korotkozhivushhih-sertifikatov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pt\/blog\/news\/mozilla-cloudflare-i-facebook-predstavili-tls-rasshirenie-dlya-delegirovaniya-korotkozhivushhih-sertifikatov","title":{"rendered":"Mozilla, Cloudflare e Facebook apresentaram uma extens\u00e3o TLS para delega\u00e7\u00e3o de certificados de curta dura\u00e7\u00e3o","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Mozilla<\/a><\/noindex>, Cloudflare<\/a><\/noindex> e Facebook<\/a><\/noindex> anunciaram em conjunto uma nova extens\u00e3o TLS Credenciais Delegadas<\/a><\/noindex> (DC), que resolve o problema com certificados ao organizar o acesso ao site atrav\u00e9s de redes de entrega de conte\u00fado. Os certificados emitidos pelas autoridades certificadoras t\u00eam um longo per\u00edodo de validade, o que dificulta a organiza\u00e7\u00e3o do acesso ao site atrav\u00e9s de um servi\u00e7o externo, que deve estabelecer uma conex\u00e3o segura em nome do site, uma vez que a transmiss\u00e3o do certificado do site para o servi\u00e7o externo cria amea\u00e7as adicionais \u00e0 seguran\u00e7a. <\/p>\n

A nova extens\u00e3o tamb\u00e9m pode ser \u00fatil para sites cuja opera\u00e7\u00e3o \u00e9 garantida por uma grande infraestrutura distribu\u00edda com muitos balanceadores de carga. As Credenciais Delegadas permitir\u00e3o evitar o armazenamento de c\u00f3pias das chaves privadas dos certificados principais em cada n\u00f3 de entrega de conte\u00fado. No m\u00e9todo cl\u00e1ssico, um ataque bem-sucedido a qualquer um dos servidores envolvidos na entrega do tr\u00e1fego HTTPS comprometer\u00e1 todo o certificado. Na transfer\u00eancia de chaves privadas para redes de entrega de conte\u00fado, surgem amea\u00e7as de vazamento de dados devido a a\u00e7\u00f5es de pessoal, atividades de servi\u00e7os secretos ou comprometimento da infraestrutura de CDN. <\/p>\n

Se o vazamento de chaves passar despercebido, aqueles que tiveram acesso \u00e0s chaves poder\u00e3o se infiltrar invisivelmente no tr\u00e1fego do site (MITM) por um per\u00edodo consider\u00e1vel, uma vez que os prazos de validade dos certificados s\u00e3o contados em meses e anos. Na Cloudflare, para proteger as chaves dos certificados podem ser usados<\/a><\/noindex> ser servidores especiais de chaves, operando do lado do propriet\u00e1rio do site, mas operar nesse modo resulta em atrasos significativos na entrega do tr\u00e1fego, reduz a confiabilidade devido \u00e0 adi\u00e7\u00e3o de um elo extra e requer a implementa\u00e7\u00e3o de uma infraestrutura complexa.<\/p>\n

A extens\u00e3o TLS proposta, Credenciais Delegadas, introduz uma chave privada intermedi\u00e1ria adicional, cujo tempo de atividade \u00e9 limitado a horas ou dias (n\u00e3o mais que 7 dias). Esta chave \u00e9 gerada com base no certificado emitido pela autoridade certificadora e permite manter a chave privada do certificado original em segredo dos servi\u00e7os de entrega de conte\u00fado, fornecendo apenas um certificado tempor\u00e1rio com um curto tempo de vida. <\/p>\n

\"Mozilla,<\/a><\/noindex><\/center><\/p>\n

Para evitar problemas de acesso ap\u00f3s o vencimento da vida \u00fatil da chave intermedi\u00e1ria, existe a tecnologia de atualiza\u00e7\u00e3o autom\u00e1tica, realizada no servidor TLS de origem. Para a gera\u00e7\u00e3o, n\u00e3o \u00e9 necess\u00e1rio realizar opera\u00e7\u00f5es manuais ou executar scripts \u2014 o servidor autorizado, que necessita da chave privada, antes que a vida \u00fatil da chave anterior expire, se comunica com o servidor TLS do site e gera uma chave intermedi\u00e1ria por um novo curto per\u00edodo de tempo.<\/p>\n

\"Mozilla,<\/a><\/noindex><\/center><\/p>\n

Os navegadores que suportam a extens\u00e3o TLS Delegated Credentials reconhecer\u00e3o esses certificados derivados como confi\u00e1veis. Por exemplo, o suporte a essa extens\u00e3o j\u00e1 foi adicionado nas vers\u00f5es noturnas e beta do Firefox e pode ser ativado no about:config atrav\u00e9s da altera\u00e7\u00e3o da configura\u00e7\u00e3o \"security.tls.enable_delegated_credentials\". Em meados de novembro, um experimento tamb\u00e9m est\u00e1 planejado para um determinado percentual de usu\u00e1rios das vers\u00f5es de teste do Firefox.Experimento de Delegated Credentials TLS<\/a><\/noindex>No \u00e2mbito do qual ser\u00e1 enviada uma solicita\u00e7\u00e3o de teste para verificar a qualidade da implementa\u00e7\u00e3o da nova extens\u00e3o TLS ao servidor DC da Cloudflare. O suporte para Delegated Credentials j\u00e1 est\u00e1 incorporado na biblioteca. Fizz<\/a><\/noindex> com implementa\u00e7\u00e3o do TLS 1.3.<\/p>\n

A especifica\u00e7\u00e3o de Delegated Credentials foi entregue ao comit\u00ea IETF (Internet Engineering Task Force), que \u00e9 respons\u00e1vel pelo desenvolvimento de protocolos e arquitetura da Internet, e est\u00e1 em fase rascunho<\/a><\/noindex>de reivindica\u00e7\u00e3o como padr\u00e3o da internet. A extens\u00e3o de Delegated Credentials pode ser aplicada apenas com TLSv1.3.
\nPara gerar chaves intermedi\u00e1rias, \u00e9 necess\u00e1rio obter um certificado TLS que inclua uma extens\u00e3o especial X.509, que atualmente \u00e9 suportada apenas pela autoridade certificadora DigiCert. <\/p>\n

<\/a><\/noindex><\/p>\n

Fonte: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

Mozilla, Cloudflare \u0438 Facebook \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u043e \u0430\u043d\u043e\u043d\u0441\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u043d\u043e\u0432\u043e\u0435 TLS-\u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u0435 Delegated Credentials (DC), \u0440\u0435\u0448\u0430\u044e\u0449\u0435\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443 c \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430\u043c\u0438 \u043f\u0440\u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0441\u0430\u0439\u0442\u0443 \u0447\u0435\u0440\u0435\u0437 \u0441\u0435\u0442\u0438 \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u0430. \u0412\u044b\u0434\u0430\u0432\u0430\u0435\u043c\u044b\u0435 \u0443\u0434\u043e\u0441\u0442\u043e\u0432\u0435\u0440\u044f\u044e\u0449\u0438\u043c\u0438 \u0446\u0435\u043d\u0442\u0440\u0430\u043c\u0438 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u044b \u0438\u043c\u0435\u044e\u0442 \u0434\u043b\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0439 \u0441\u0440\u043e\u043a \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f, \u0447\u0442\u043e \u0441\u043e\u0437\u0434\u0430\u0451\u0442 \u0442\u0440\u0443\u0434\u043d\u043e\u0441\u0442\u0438 \u043f\u0440\u0438 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0441\u0430\u0439\u0442\u0443 \u0447\u0435\u0440\u0435\u0437 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0439 \u0441\u0435\u0440\u0432\u0438\u0441, \u043e\u0442 \u043b\u0438\u0446\u0430 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0434\u043e\u043b\u0436\u043d\u043e \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0442\u044c\u0441\u044f \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u043e\u0435 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0435, \u0442\u0430\u043a \u043a\u0430\u043a \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0430 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-52168","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Mozilla, Cloudflare e Facebook apresentaram a extens\u00e3o TLS para delega\u00e7\u00e3o de certificados de curta dura\u00e7\u00e3o | ProHoster","description":"Mozilla,","canonical_url":"https:\/\/prohoster.info\/pt\/blog\/news\/mozilla-cloudflare-i-facebook-predstavili-tls-rasshirenie-dlya-delegirovaniya-korotkozhivushhih-sertifikatov","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pt_PT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Mozilla, Cloudflare \u0438 Facebook \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0438 TLS-\u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u0435 \u0434\u043b\u044f \u0434\u0435\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043a\u043e\u0440\u043e\u0442\u043a\u043e\u0436\u0438\u0432\u0443\u0449\u0438\u0445 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 | ProHoster","og:description":"Mozilla,","og:url":"https:\/\/prohoster.info\/pt\/blog\/news\/mozilla-cloudflare-i-facebook-predstavili-tls-rasshirenie-dlya-delegirovaniya-korotkozhivushhih-sertifikatov","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-11-01T21:00:00+00:00","article:modified_time":"2020-02-18T10:59:50+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"52168","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 02:44:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 13:40:57","updated":"2026-01-24 02:44:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/52168","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/comments?post=52168"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/52168\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media?parent=52168"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/categories?post=52168"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/tags?post=52168"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}