{"id":83443,"date":"2020-05-31T13:42:09","date_gmt":"2020-05-31T11:42:09","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ustarevanie-kornevogo-sertifikata-addtrust-privelo-k-sboyam-v-sistemah-s-openssl-i-gnutls"},"modified":"2020-05-31T13:42:09","modified_gmt":"2020-05-31T11:42:09","slug":"ustarevanie-kornevogo-sertifikata-addtrust-privelo-k-sboyam-v-sistemah-s-openssl-i-gnutls","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pt\/blog\/news\/ustarevanie-kornevogo-sertifikata-addtrust-privelo-k-sboyam-v-sistemah-s-openssl-i-gnutls","title":{"rendered":"O desatualiza\u00e7\u00e3o do certificado raiz AddTrust levou a falhas em sistemas com OpenSSL e GnuTLS","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Em 30 de maio, expirou o prazo de 20 anos do certificado raiz AddTrust<\/a><\/noindex>, que era utilizado<\/a><\/noindex> para a cria\u00e7\u00e3o de assinatura cruzada (cross-signed) nos certificados de um dos maiores centros de certifica\u00e7\u00e3o, a Sectigo (Comodo). A assinatura cruzada permitia garantir a compatibilidade com dispositivos antigos, cujo reposit\u00f3rio de certificados raiz n\u00e3o tinha o novo certificado raiz USERTrust adicionado. <\/p>\n

\"O<\/a><\/noindex><\/center><\/p>\n

Teoricamente, a expira\u00e7\u00e3o do certificado raiz AddTrust deveria levar apenas a uma perda de compatibilidade com sistemas antigos (Android 2.3, Windows XP, Mac OS X 10.11, iOS 9, etc.), j\u00e1 que o segundo certificado raiz usado na assinatura cruzada permanece vigente e os navegadores modernos o consideram na verifica\u00e7\u00e3o da cadeia de confian\u00e7a. Na pr\u00e1tica foram<\/a><\/noindex> detectados problemas na verifica\u00e7\u00e3o da assinatura cruzada em clientes TLS que n\u00e3o usam navegadores, incluindo aqueles baseados em OpenSSL 1.0.x e GnuTLS. A conex\u00e3o segura deixou de ser estabelecida, resultando em um erro de expira\u00e7\u00e3o de certificado, se o servidor usa um certificado Sectigo vinculado \u00e0 cadeia de confian\u00e7a do certificado raiz AddTrust.<\/p>\n

Embora os usu\u00e1rios de navegadores modernos n\u00e3o tenham notado a expira\u00e7\u00e3o do certificado raiz AddTrust ao processar certificados assinados cruzadamente da Sectigo, come\u00e7aram a surgir problemas em v\u00e1rios aplicativos de terceiros e manipuladores de servidor, levando a a uma falha<\/a><\/noindex> falhas<\/a><\/noindex> de muitas infraestruturas que usam canais criptografados para intera\u00e7\u00e3o entre componentes. <\/p>\n

Por exemplo, houve problemas<\/a><\/noindex> com acesso a alguns reposit\u00f3rios de pacotes no Debian e Ubuntu (apt come\u00e7ou a apresentar erro de valida\u00e7\u00e3o de certificado), est\u00e3o falhando acessos a partir de scripts atrav\u00e9s das ferramentas 'curl' e 'wget', e est\u00e3o sendo observados erros ao usar o Git, causando<\/a><\/noindex> problemas na plataforma de streaming Roku, os manipuladores deixaram de ser chamados Stripe<\/a><\/noindex> e DataDog<\/a><\/noindex>, come\u00e7aram a ocorrer falhas<\/a><\/noindex> em aplica\u00e7\u00f5es Heroku, os clientes OpenLDAP deixaram de<\/a><\/noindex> conectar, problemas foram identificados no envio de e-mails para servidores SMTPS e SMTP com STARTTLS. Al\u00e9m disso, problemas foram observados em v\u00e1rios scripts em Ruby, PHP e Python que utilizam um m\u00f3dulo de cliente HTTP. Nos navegadores, o problema afeta<\/a><\/noindex> Epiphany, em que as listas de bloqueio de an\u00fancios deixaram de carregar.<\/p>\n

Programas escritos em Go n\u00e3o s\u00e3o afetados pelo problema, pois no Go \u00e9 oferecido implementa\u00e7\u00e3o pr\u00f3pria<\/a><\/noindex> TLS.<\/p>\n

Era esperado<\/a><\/noindex>, que o problema afeta vers\u00f5es antigas de distribui\u00e7\u00f5es (incluindo Debian 9, Ubuntu 16.04, RHEL 6\/7<\/a><\/noindex>) em que s\u00e3o utilizadas ramifica\u00e7\u00f5es problem\u00e1ticas do OpenSSL, mas o problema apareceu<\/a><\/noindex> tamb\u00e9m ao trabalhar com o gerenciador de pacotes APT nas vers\u00f5es atuais do Debian 10 e Ubuntu 18.04\/20.04, pois o APT utiliza a biblioteca GnuTLS. A ess\u00eancia do problema \u00e9 que muitas bibliotecas TLS\/SSL interpretam o certificado como uma cadeia linear, enquanto, de acordo com a RFC 4158, o certificado pode representar um gr\u00e1fico c\u00edclico orientado distribu\u00eddo com v\u00e1rios \u00e2ncoras de confian\u00e7a que precisam ser consideradas. Essa falha no OpenSSL e GnuTLS era<\/a><\/noindex> revelado<\/a><\/noindex> j\u00e1 existe h\u00e1 muitos anos<\/a><\/noindex>. No OpenSSL, o problema foi corrigido na ramifica\u00e7\u00e3o 1.1.1, mas em GnuTLS<\/a><\/noindex> permanece n\u00e3o corrigido<\/a><\/noindex>.<\/p>\n

Como uma solu\u00e7\u00e3o alternativa para contornar a falha, \u00e9 sugerido remover do armazenamento de certificados do sistema o certificado 'AddTrust External CA Root' (por exemplo, remover de \/etc\/ca-certificates.conf e \/etc\/ssl\/certs, e ent\u00e3o executar 'update-ca-certificates -f -v'), ap\u00f3s o que o OpenSSL come\u00e7ar\u00e1 a processar corretamente os certificados cruzados envolvidos. Ao usar o gerenciador de pacotes APT, por sua pr\u00f3pria conta e risco, \u00e9 poss\u00edvel desativar a verifica\u00e7\u00e3o de certificados para solicita\u00e7\u00f5es espec\u00edficas (por exemplo, 'apt-get update -o Acquire::https::download.jitsi.org::Verify-Peer=false'). <\/p>\n

Para bloquear o problema em Fedora<\/a><\/noindex> e RHEL<\/a><\/noindex> \u00e9 sugerido adicionar o certificado AddTrust \u00e0 lista negra:<\/p>\n

trust dump \u2014filter 'pkcs11:id=;type=cert' \\
\n > \/etc\/pki\/ca-trust\/source\/blacklist\/addtrust-external-root.p11-kit
\n update-ca-trust extract<\/p>\n

Mas essa abordagem n\u00e3o funciona<\/a><\/noindex> para GnuTLS (por exemplo, ainda continua a emitir um erro de verifica\u00e7\u00e3o do certificado ao executar a ferramenta wget).<\/p>\n

Do lado do servidor, pode-se alterar<\/a><\/noindex> a ordem<\/a><\/noindex> listagem de certificados na cadeia de confian\u00e7a, enviados pelo servidor ao cliente (se o certificado relacionado ao 'AddTrust External CA Root' for removido da lista, a valida\u00e7\u00e3o pelo cliente ser\u00e1 bem-sucedida). Para verificar e gerar uma nova cadeia de confian\u00e7a, pode-se utilizar o servi\u00e7o whatsmychaincert.com<\/a><\/noindex>. A empresa Sectigo tamb\u00e9m forneceu<\/a><\/noindex> certificado intermedi\u00e1rio cruzado alternativo 'AAA Certificate Services<\/a><\/noindex>', que ser\u00e1 v\u00e1lido at\u00e9 2028 e permitir\u00e1 manter a compatibilidade com vers\u00f5es antigas do sistema operacional.<\/p>\n

Nota: O problema tamb\u00e9m se manifesta<\/a><\/noindex> afeta o LibreSSL.<\/p>\n

<\/a><\/noindex><\/p>\n

Fonte: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

30 \u043c\u0430\u044f \u0438\u0441\u0442\u0451\u043a 20-\u043b\u0435\u0442\u043d\u0438\u0439 \u0441\u0440\u043e\u043a \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u043a\u043e\u0440\u043d\u0435\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 AddTrust, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u043b\u0441\u044f \u0434\u043b\u044f \u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u0435\u0440\u0435\u043a\u0440\u0451\u0441\u0442\u043d\u043e\u0439 \u043f\u043e\u0434\u043f\u0438\u0441\u0438 (cross-signed) \u0432 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430\u0445 \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u043a\u0440\u0443\u043f\u043d\u0435\u0439\u0448\u0438\u0445 \u0443\u0434\u043e\u0441\u0442\u043e\u0432\u0435\u0440\u044f\u044e\u0449\u0438\u0445 \u0446\u0435\u043d\u0442\u0440\u043e\u0432 Sectigo (Comodo). \u041f\u0435\u0440\u0435\u043a\u0440\u0451\u0441\u0442\u043d\u0430\u044f \u043f\u043e\u0434\u043f\u0438\u0441\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u043b\u0430 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0442\u044c \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u0438\u043c\u043e\u0441\u0442\u044c \u0441 \u0443\u0441\u0442\u0430\u0440\u0435\u0432\u0448\u0438\u043c\u0438 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u043c\u0438, \u0432 \u0445\u0440\u0430\u043d\u0438\u043b\u0438\u0449\u0435 \u043a\u043e\u0440\u043d\u0435\u0432\u044b\u0445 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043d\u0435 \u0431\u044b\u043b \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d \u043d\u043e\u0432\u044b\u0439 \u043a\u043e\u0440\u043d\u0435\u0432\u043e\u0439 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 USERTRust. \u0422\u0435\u043e\u0440\u0435\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u043f\u0440\u0435\u043a\u0440\u0430\u0449\u0435\u043d\u0438\u0435 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u043a\u043e\u0440\u043d\u0435\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 AddTrust \u0434\u043e\u043b\u0436\u043d\u043e \u0431\u044b\u043b\u043e \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043b\u0438\u0448\u044c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":83444,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-83443","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47A obsolesc\u00eancia do certificado raiz AddTrust causou falhas em sistemas com OpenSSL e GnuTLS | ProHoster","description":"Em 30 de maio, expirou o prazo de 20 anos do certificado raiz AddTrust, que","canonical_url":"https:\/\/prohoster.info\/pt\/blog\/news\/ustarevanie-kornevogo-sertifikata-addtrust-privelo-k-sboyam-v-sistemah-s-openssl-i-gnutls","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pt_PT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u0441\u0442\u0430\u0440\u0435\u0432\u0430\u043d\u0438\u0435 \u043a\u043e\u0440\u043d\u0435\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 AddTrust \u043f\u0440\u0438\u0432\u0435\u043b\u043e \u043a \u0441\u0431\u043e\u044f\u043c \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u0441 OpenSSL \u0438 GnuTLS | ProHoster","og:description":"30 \u043c\u0430\u044f \u0438\u0441\u0442\u0451\u043a 20-\u043b\u0435\u0442\u043d\u0438\u0439 \u0441\u0440\u043e\u043a \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u043a\u043e\u0440\u043d\u0435\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 AddTrust, \u043a\u043e\u0442\u043e\u0440\u044b\u0439","og:url":"https:\/\/prohoster.info\/pt\/blog\/news\/ustarevanie-kornevogo-sertifikata-addtrust-privelo-k-sboyam-v-sistemah-s-openssl-i-gnutls","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-05-31T11:42:09+00:00","article:modified_time":"2020-05-31T11:42:09+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"83443","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 15:17:29","updated":"2022-09-28 18:33:53","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/83443","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/comments?post=83443"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/83443\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media\/83444"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media?parent=83443"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/categories?post=83443"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/tags?post=83443"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}