{"id":33503,"date":"2019-10-31T21:52:58","date_gmt":"2019-10-31T18:52:58","guid":{"rendered":"https:\/\/prohoster.info\/blog\/kak-dnscrypt-reshil-problemu-prosrochennyh-sertifikatov-vvedya-srok-dejstviya-24-chasa\/"},"modified":"2019-10-31T21:52:58","modified_gmt":"2019-10-31T18:52:58","slug":"kak-dnscrypt-reshil-problemu-prosrochennyh-sertifikatov-vvedya-srok-dejstviya-24-chasa","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/kak-dnscrypt-reshil-problemu-prosrochennyh-sertifikatov-vvedya-srok-dejstviya-24-chasa","title":{"rendered":"Cum a rezolvat DNSCrypt problema certificatelor expirate, introduc\u00e2nd o perioad\u0103 de valabilitate de 24 de ore","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Cum
\n
\nAnterior, certificatul expira adesea din cauza necesit\u0103\u021bii de a fi actualizat manual. Oamenii pur \u0219i simplu uitau s\u0103 fac\u0103 acest lucru. Odat\u0103 cu apari\u021bia Let\u2019s Encrypt \u0219i a procedurii automate de actualizare, problema p\u0103rea s\u0103 fie rezolvat\u0103. \u00cens\u0103 o recent\u0103 istorie cu Firefox<\/a><\/noindex> arat\u0103 c\u0103, de fapt, aceasta este \u00eenc\u0103 relevant\u0103. Din p\u0103cate, certificatele continu\u0103 s\u0103 expire.<\/p>\n

Dac\u0103 cineva a ratat aceast\u0103 poveste, la miezul nop\u021bii pe 4 mai 2019, aproape toate extensiile Firefox au \u00eencetat brusc s\u0103 func\u021bioneze.
\n<\/a><\/noindex>
\nA\u0219a cum s-a descoperit, o defec\u021biune masiv\u0103 a avut loc din cauza faptului c\u0103 Mozilla a expirat certificatul<\/a><\/noindex>, care era folosit pentru semnarea extensiilor. Prin urmare, acestea erau marcate ca \u201enevalide\u201d \u0219i nu treceau verificarea (detalii tehnice<\/a><\/noindex>). Pe forumuri, ca o solu\u021bie temporar\u0103, a fost recomandat s\u0103 se dezactiveze verificarea semn\u0103turilor extensiilor \u00een about:config<\/i> sau prin modificarea orelor de sistem.<\/p>\n

Mozilla a lansat rapid un patch pentru Firefox 66.0.4, care rezolv\u0103 problema cu certificatul nevalid, iar toate extensiile revin la normal. Dezvoltatorii recomand\u0103 s\u0103 fie instalat \u0219i s\u0103 nu se foloseasc\u0103<\/a><\/noindex> nicio solu\u021bie temporar\u0103 pentru a ocoli verificarea semn\u0103turilor, deoarece acestea pot conflictua cu patch-ul.<\/p>\n

Cu toate acestea, aceast\u0103 poveste arat\u0103 din nou c\u0103 expirarea certificatelor r\u0103m\u00e2ne o problem\u0103 relevant\u0103 \u0219i ast\u0103zi.<\/p>\n

\u00cen acest context, este interesant s\u0103 ne uit\u0103m la un mod destul de original prin care dezvoltatorii protocolului DNSCrypt<\/a><\/noindex>. Solu\u021bia lor poate fi \u00eemp\u0103r\u021bit\u0103 \u00een dou\u0103 p\u0103r\u021bi. \u00cen primul r\u00e2nd, certificate pe termen scurt. \u00cen al doilea r\u00e2nd, notificarea utilizatorilor cu privire la expirarea celor pe termen lung.<\/p>\n

DNSCrypt<\/h1>\n

\n\"CumDNSCrypt este un protocol de criptare a traficului DNS. Acesta protejeaz\u0103 comunica\u021biile DNS de intercept\u0103ri \u0219i atacuri MiTM, precum \u0219i permite ocolirea blocajelor la nivelul cererilor DNS.<\/p>\n

Protocolul \u00eenv\u00e2rte traficul DNS \u00eentre client \u0219i server \u00eentr-o structur\u0103 criptografic\u0103, func\u021bion\u00e2nd pe protocoalele de transport UDP \u0219i TCP. Pentru a-l utiliza, at\u00e2t clientul, c\u00e2t \u0219i rezolutorul DNS trebuie s\u0103 suporte DNSCrypt. De exemplu, \u00een martie 2016, acesta a fost activat pe serverele DNS \u0219i \u00een browserul \u201eYandex\u201d. De asemenea, c\u00e2\u021biva al\u021bi furnizori, inclusiv Google \u0219i Cloudflare, au anun\u021bat suportul. Din p\u0103cate, nu sunt foarte mul\u021bi (pe site-ul oficial sunt listate 152 de servere DNS publice). Dar programul dnscrypt-proxy<\/a><\/noindex> poate fi instalat manual pe clien\u021bi sub Linux, Windows \u0219i MacOS. Exist\u0103 \u0219i implemet\u0103ri server<\/a><\/noindex>.<\/p>\n

\"Cum
\n
\nCum func\u021bioneaz\u0103 DNSCrypt? \u00centr-un rezumat, clientul ia cheia public\u0103 a furnizorului ales \u0219i o folose\u0219te pentru a verifica certificatele acestuia. Acolo sunt disponibile cheile publice pe termen scurt pentru sesiune \u0219i identificatorul setului de algoritmi de criptare. Se recomand\u0103 clien\u021bilor s\u0103 genereze o cheie nou\u0103 pentru fiecare cerere, iar serverelor s\u0103 schimbe cheile la fiecare 24 de ore<\/b>. \u00cen schimbul cheilor se folose\u0219te algoritmul X25519, pentru semn\u0103tur\u0103 \u2014 EdDSA, iar pentru criptarea blocurilor \u2014 XSalsa20-Poly1305 sau XChaCha20-Poly1305.<\/p>\n

Unul dintre dezvoltatorii protocolului, Frank Denis scrie<\/a><\/noindex>, a afirmat c\u0103 schimbarea automat\u0103 la fiecare 24 de ore a rezolvat problema certificatelor expirate. \u00cen principiu, clientul de referin\u021b\u0103 dnscrypt-proxy accept\u0103 certificate cu orice termen de valabilitate, dar emite un avertisment \u201ePerioada cheilor dnscrypt-proxy pentru acest server este prea mare\u201d, dac\u0103 este valid\u0103 mai mult de 24 de ore. De asemenea, a fost lansat\u0103 o imagine Docker, \u00een care a fost implementat\u0103 schimbarea rapid\u0103 a cheilor (\u0219i a certificatelor).<\/p>\n

\u00cen primul r\u00e2nd, este extrem de util pentru securitate: dac\u0103 serverul este compromis sau cheia a fost expus\u0103, traficul de ieri nu poate fi decriptat. Cheia a fost deja schimbat\u0103. Probabil, aceasta va constitui o problem\u0103 pentru aplicarea \u201elegii Iarovaya\u201d, care oblig\u0103 furnizorii s\u0103 p\u0103streze tot traficul, inclusiv cel criptat. Se sub\u00een\u021belege c\u0103 mai t\u00e2rziu poate fi decriptat la nevoie, solicit\u00e2nd cheia de la site. Dar \u00een acest caz, site-ul pur \u0219i simplu nu va putea s\u0103 o ofere, deoarece folose\u0219te chei de scurt\u0103 durat\u0103, \u0219terg\u00e2ndu-le pe cele vechi.<\/p>\n

Dar cel mai important, spune Denis, cheile pe termen scurt \u00eei oblig\u0103 pe servere s\u0103 configureze automatizarea din prima zi. Dac\u0103 serverul se conecteaz\u0103 la re\u021bea, iar scripturile de schimbare a cheilor nu sunt configurate sau nu func\u021bioneaz\u0103, acest lucru va fi imediat detectat.<\/p>\n

C\u00e2nd automatizarea schimb\u0103 cheile la c\u00e2\u021biva ani, nu po\u021bi conta pe ea, iar oamenii pot uita de expirarea certificatului. La schimbarea zilnic\u0103 a cheilor, acest lucru va fi descoperit imediat.<\/p>\n

\u00cen acela\u0219i timp, dac\u0103 automatizarea este configurat\u0103 corect, nu conteaz\u0103 c\u00e2t de des se schimb\u0103 cheile: anual, trimestrial sau de trei ori pe zi. Dac\u0103 totul func\u021bioneaz\u0103 mai mult de 24 de ore, va func\u021biona \u00eentotdeauna, scrie Frank Denis. Potrivit acestuia, recomandarea de schimbare zilnic\u0103 a cheilor \u00een a doua versiune a protocolului \u00eempreun\u0103 cu o imagine Docker care o implementeaz\u0103 a redus eficient num\u0103rul serverelor cu certificate expirate, \u00eembun\u0103t\u0103\u021bind \u00een acela\u0219i timp securitatea.<\/p>\n

Cu toate acestea, unii furnizori au decis din diverse motive tehnice s\u0103 stabileasc\u0103 un termen mai mare pentru expirarea certificatului de peste 24 de ore. Aceast\u0103 problem\u0103 a fost \u00een mare parte rezolvat\u0103 prin c\u00e2teva linii de cod \u00een dnscrypt-proxy: utilizatorii primesc un avertisment informativ cu 30 de zile \u00eenainte de expirarea certificatului, un alt mesaj de o severitate mai mare cu 7 zile \u00eenainte de expirare \u0219i un mesaj critic, dac\u0103 certificatul mai are sub 24 de ore. Aceasta se aplic\u0103 numai certificatelor care au avut ini\u021bial un termen lung de valabilitate.<\/p>\n

Aceste mesaje ofer\u0103 utilizatorilor ocazia de a informa operatorii DNS cu privire la expirarea iminent\u0103 a certificatului, \u00eenainte s\u0103 fie prea t\u00e2rziu. <\/p>\n

Poate c\u0103, dac\u0103 to\u021bi utilizatorii Firefox ar fi primit un astfel de mesaj, atunci cu siguran\u021b\u0103 cineva ar fi informat dezvoltatorii \u0219i ace\u0219tia nu ar fi permis expirarea certificatului. \u201eNu \u00eemi amintesc de niciun server DNSCrypt din lista serverelor DNS publice care s\u0103 fi avut certificatul expirat \u00een ultimii doi sau trei ani\u201d, scrie Frank Denis. \u00cen orice caz, probabil mai bine s\u0103 avertiz\u0103m utilizatorii \u00een primul r\u00e2nd, dec\u00e2t s\u0103 dezactiv\u0103m extensiile f\u0103r\u0103 avertisment.<\/p>\n

\n\"Cum
\n<\/a><\/noindex>
\n
Sursa: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u043d\u044c\u0448\u0435 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u044b \u0447\u0430\u0441\u0442\u043e \u0438\u0441\u0442\u0435\u043a\u0430\u043b\u0438 \u0438\u0437-\u0437\u0430 \u0442\u043e\u0433\u043e, \u0447\u0442\u043e \u0438\u0445 \u043d\u0443\u0436\u043d\u043e \u0431\u044b\u043b\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u044f\u0442\u044c \u0432\u0440\u0443\u0447\u043d\u0443\u044e. \u041b\u044e\u0434\u0438 \u043f\u0440\u043e\u0441\u0442\u043e \u0437\u0430\u0431\u044b\u0432\u0430\u043b\u0438 \u044d\u0442\u043e \u0441\u0434\u0435\u043b\u0430\u0442\u044c. \u0421 \u043f\u043e\u044f\u0432\u043b\u0435\u043d\u0438\u0435\u043c Let\u2019s Encrypt \u0438 \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043f\u0440\u043e\u0446\u0435\u0434\u0443\u0440\u044b \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0432\u0440\u043e\u0434\u0435 \u0431\u044b \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0434\u043e\u043b\u0436\u043d\u0430 \u0431\u044b\u0442\u044c \u0440\u0435\u0448\u0435\u043d\u0430. \u041d\u043e \u043d\u0435\u0434\u0430\u0432\u043d\u044f\u044f \u0438\u0441\u0442\u043e\u0440\u0438\u044f \u0441 Firefox \u043f\u043e\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442, \u0447\u0442\u043e \u043d\u0430 \u0441\u0430\u043c\u043e\u043c \u0434\u0435\u043b\u0435 \u043e\u043d\u0430 \u043f\u043e-\u043f\u0440\u0435\u0436\u043d\u0435\u043c\u0443 \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u0430. \u041a \u0441\u043e\u0436\u0430\u043b\u0435\u043d\u0438\u044e, \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u044b \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044e\u0442 \u0438\u0441\u0442\u0435\u043a\u0430\u0442\u044c. \u0415\u0441\u043b\u0438 \u043a\u0442\u043e-\u0442\u043e \u043f\u0440\u043e\u043f\u0443\u0441\u0442\u0438\u043b \u044d\u0442\u0443 \u0438\u0441\u0442\u043e\u0440\u0438\u044e, \u0432 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":25203,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-33503","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Cum a rezolvat DNSCrypt problema certificatelor expirate, introduc\u00e2nd un termen de 24 de ore | ProHoster","description":"C\u00e2ndva.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/kak-dnscrypt-reshil-problemu-prosrochennyh-sertifikatov-vvedya-srok-dejstviya-24-chasa","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0430\u043a DNSCrypt \u0440\u0435\u0448\u0438\u043b \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443 \u043f\u0440\u043e\u0441\u0440\u043e\u0447\u0435\u043d\u043d\u044b\u0445 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432, \u0432\u0432\u0435\u0434\u044f \u0441\u0440\u043e\u043a \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f 24 \u0447\u0430\u0441\u0430 | ProHoster","og:description":"\u0420\u0430\u043d\u044c\u0448\u0435.","og:url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/kak-dnscrypt-reshil-problemu-prosrochennyh-sertifikatov-vvedya-srok-dejstviya-24-chasa","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:52:58+00:00","article:modified_time":"2019-10-31T18:52:58+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"33503","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 15:31:39","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 02:39:23","updated":"2026-01-21 15:31:39","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/33503","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=33503"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/33503\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/25203"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=33503"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=33503"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=33503"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}