Certificatul de autoritate non-profit Let’s Encrypt, controlat de comunitate \u0219i care ofer\u0103 certificate gratuit oricui dore\u0219te, a decis s\u0103 \u00eenceteze suportul pentru protocolul OCSP (Online Certificate Status Protocol), folosit pentru verificarea revoc\u0103rii certificatelor. \u00cen locul protocolului OCSP, se recomand\u0103 utilizarea listelor de certificate revocate (CRL \u2014 Certificate Revocation List), publicate de serviciul Let’s Encrypt \u00eencep\u00e2nd cu anul 2022. Pe 7 mai 2025, Let’s Encrypt va dezactiva ad\u0103ugarea de linkuri c\u0103tre adresele OCSP \u00een certificatele emise \u0219i va \u00eenceta procesarea cererilor legate de utilizarea extensiei «OCSP Must Staple». Pe 6 august 2025, serverele vor dezactiva gestionarea cererilor OCSP. <\/p>\n
Ca motiv pentru oprirea suportului OCSP se men\u021bioneaz\u0103 grija fa\u021b\u0103 de confiden\u021bialitate. Utilizarea OCSP duce la faptul c\u0103, la fiecare instalare a unei conexiuni securizate pentru a verifica validitatea certificatului, sistemul client trimite o cerere c\u0103tre serverul OCSP al autorit\u0103\u021bii de certificare care a generat certificatul. \u00cen r\u0103spuns, serverul ofer\u0103 informa\u021bii despre dac\u0103 certificatului respectiv poate fi acordat\u0103 \u00eencredere. Problema este c\u0103 autoritatea de certificare ob\u021bine informa\u021bii despre c\u00e2nd \u0219i ce site-uri viziteaz\u0103 utilizatorul, \u00een leg\u0103tur\u0103 cu adresa IP<\/a>, ceea ce poate fi considerat o scurgere de date confiden\u021biale. \u00cen plus, utilizarea OCSP duce la \u00eent\u00e2rzieri \u00een procesarea cererii, necesit\u0103 acces garantat la re\u021bea \u0219i creeaz\u0103 o dependen\u021b\u0103 de func\u021bionarea continu\u0103 a serverelor OCSP. <\/p>\n Pentru a rezolva problemele de confiden\u021bialitate la verificarea revoc\u0103rii certificatelor, a fost dezvoltat\u0103 tehnologia OCSP Stapling, care const\u0103 \u00een faptul c\u0103 r\u0103spunsurile OCSP certificate de autoritatea de certificare pot fi transmise de serverele care g\u0103zduiesc site-urile \u00een timpul negocierii unei conexiuni TLS cu clientul (transmiterea informa\u021biilor OCSP este mutat\u0103 pe servere<\/a> servere, ceea ce elibereaz\u0103 sistemul client de a face apeluri directe la serverul OCSP al autorit\u0103\u021bii de certificare, corectitudinea r\u0103spunsurilor fiind asigurat\u0103 prin semn\u0103tura digital\u0103 a autorit\u0103\u021bii de certificare). <\/p>\n \u00cen plus fa\u021b\u0103 de OCSP Stapling, exist\u0103 o extensie ad\u0103ugat\u0103 \u00een certificate denumit\u0103 «OCSP Must Staple», care impune browserelor s\u0103 foloseasc\u0103 tehnica OCSP Stapling \u00een locul apel\u0103rii directe c\u0103tre serverele OCSP \u0219i cere considerarea certificatului ca fiind ne\u00eencredere dac\u0103 serverul care g\u0103zduie\u0219te site-ul nu a returnat un r\u0103spuns OCSP validat. Din p\u0103cate, extensia «Must Staple» nu a fost adoptat\u0103 pe scar\u0103 larg\u0103 de c\u0103tre browsere, iar tehnologia OCSP Stapling este legat\u0103 de necesitatea activ\u0103rii explicit a suportului pe partea serverului HTTP (\u00een nginx este suportat\u0103 din 2013). <\/p>\n \u00cen utilizarea CRL, verificarea revoc\u0103rii certificatelor se face pe sistemul local folosind listele generate de autoritatea de certificare. Dezavantajele acestui mod de abordare sunt dimensiunea foarte mare a datelor desc\u0103rcate \u0219i apari\u021bia unei brese temporale \u00een actualitatea informa\u021biilor (de exemplu, \u00een Firefox datele sunt actualizate la fiecare 6 ore). Problema dimensiunii a fost rezolvat\u0103 \u00een browsere prin proxying CRL pe serverele produc\u0103torilor de browsere \u2014 \u00een ambele browsere este inclus un CRL de baz\u0103, care \u00een timpul func\u021bion\u0103rii se sincronizeaz\u0103 periodic cu lista actualizat\u0103 (pe sistemul clientului sunt transmise doar datele care s-au modificat). Pentru a reduce dimensiunea bazei de date cu CRL, se folose\u0219te o structur\u0103 probabilistic\u0103 «filtrul Bloom», permi\u021b\u00e2nd stocarea \u00eentregii baze CRL pe partea clientului \u00eentr-o reprezentare foarte compact\u0103. \u00cen Firefox, o astfel de tehnic\u0103 este implementat\u0103 prin intermediul instrumentului CRLite, iar \u00een Chrome \u2014 CRLSets. \u041d\u0435\u043a\u043e\u043c\u043c\u0435\u0440\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0434\u043e\u0441\u0442\u043e\u0432\u0435\u0440\u044f\u044e\u0449\u0438\u0439 \u0446\u0435\u043d\u0442\u0440 Let’s Encrypt, \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u044b\u0439 \u0441\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e\u043c \u0438 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0439 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u044b \u0431\u0435\u0437\u0432\u043e\u0437\u043c\u0435\u0437\u0434\u043d\u043e \u0432\u0441\u0435\u043c \u0436\u0435\u043b\u0430\u044e\u0449\u0438\u043c, \u043f\u0440\u0438\u043d\u044f\u043b \u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u0435\u043a\u0440\u0430\u0442\u0438\u0442\u044c \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0443 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 OCSP (Online Certificate Status Protocol), \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u0433\u043e \u0434\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043e\u0442\u0437\u044b\u0432\u0430 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432. \u0412\u043c\u0435\u0441\u0442\u043e \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 OCSP \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u0435\u0442\u0441\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0441\u043f\u0438\u0441\u043a\u0438 \u043e\u0442\u043e\u0437\u0432\u0430\u043d\u043d\u044b\u0445 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 (CRL — Certificate Revocation List), \u043f\u0443\u0431\u043b\u0438\u043a\u0443\u0435\u043c\u044b\u0435 \u0441\u0435\u0440\u0432\u0438\u0441\u043e\u043c Let’s Encrypt \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 2022 \u0433\u043e\u0434\u0430. 7 \u043c\u0430\u044f 2025 \u0433\u043e\u0434\u0430 Let’s Encrypt […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-120904","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Let's Encrypt opre\u0219te suportul pentru protocolul OCSP pentru verificarea certificatelor revocate | ProHoster","description":"Autoritatea de certificare f\u0103r\u0103 scop lucrativ Let's Encrypt, controlat\u0103 de comunitate \u0219i care ofer\u0103 certificate gratuit oricui dore\u0219te, a decis s\u0103 opreasc\u0103 suportul pentru protocolul OCSP (Online Certificate Status).","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/lets-encrypt-prekrashhaet-podderzhku-protokola-ocsp-dlya-proverki-otozvannyh-sertifikatov","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Let's Encrypt \u043f\u0440\u0435\u043a\u0440\u0430\u0449\u0430\u0435\u0442 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0443 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 OCSP \u0434\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043e\u0442\u043e\u0437\u0432\u0430\u043d\u043d\u044b\u0445 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 | ProHoster","og:description":"\u041d\u0435\u043a\u043e\u043c\u043c\u0435\u0440\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0434\u043e\u0441\u0442\u043e\u0432\u0435\u0440\u044f\u044e\u0449\u0438\u0439 \u0446\u0435\u043d\u0442\u0440 Let's Encrypt, \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u044b\u0439 \u0441\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e\u043c \u0438 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0439 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u044b \u0431\u0435\u0437\u0432\u043e\u0437\u043c\u0435\u0437\u0434\u043d\u043e \u0432\u0441\u0435\u043c \u0436\u0435\u043b\u0430\u044e\u0449\u0438\u043c, \u043f\u0440\u0438\u043d\u044f\u043b \u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u0435\u043a\u0440\u0430\u0442\u0438\u0442\u044c \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0443 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 OCSP (Online Certificate Status.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/lets-encrypt-prekrashhaet-podderzhku-protokola-ocsp-dlya-proverki-otozvannyh-sertifikatov","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-12-09T13:46:00+00:00","article:modified_time":"2024-12-09T13:46:00+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"120904","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 17:38:18","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 08:45:20","updated":"2026-02-09 17:38:18","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/120904","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=120904"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/120904\/revisions"}],"predecessor-version":[{"id":159219,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/120904\/revisions\/159219"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=120904"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=120904"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=120904"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"