{"id":52168,"date":"2019-11-02T00:00:00","date_gmt":"2019-11-01T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/mozilla-cloudflare-i-facebook-predstavili-tls-rasshirenie-dlya-delegirovaniya-korotkozhivushhih-sertifikatov"},"modified":"2020-02-18T13:59:50","modified_gmt":"2020-02-18T10:59:50","slug":"mozilla-cloudflare-i-facebook-predstavili-tls-rasshirenie-dlya-delegirovaniya-korotkozhivushhih-sertifikatov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/mozilla-cloudflare-i-facebook-predstavili-tls-rasshirenie-dlya-delegirovaniya-korotkozhivushhih-sertifikatov","title":{"rendered":"Mozilla, Cloudflare \u0219i Facebook au prezentat o extensie TLS pentru delegarea certificatelor pe termen scurt.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Mozilla<\/a><\/noindex>, Cloudflare<\/a><\/noindex> \u0219i Facebook<\/a><\/noindex> au anun\u021bat \u00eempreun\u0103 o nou\u0103 extensie TLS Credite delegate<\/a><\/noindex> (DC), care rezolv\u0103 problema certificatelor atunci c\u00e2nd se organizeaz\u0103 accesul la un site prin re\u021bele de livrare a con\u021binutului. Certificatele emise de autorit\u0103\u021bile de certificare au o durat\u0103 lung\u0103 de valabilitate, ceea ce creeaz\u0103 dificult\u0103\u021bi \u00een organizarea accesului la site printr-un serviciu ter\u021b, care trebuie s\u0103 stabileasc\u0103 o conexiune securizat\u0103, deoarece transmiterea certificatului site-ului unui serviciu extern creeaz\u0103 amenin\u021b\u0103ri suplimentare la adresa securit\u0103\u021bii. <\/p>\n

Noua extensie poate fi, de asemenea, util\u0103 pentru site-urile care func\u021bioneaz\u0103 cu o infrastructur\u0103 distribuit\u0103 mare, cu un num\u0103r mare de echilibratoare de sarcin\u0103. Creditele delegate vor permite evitarea stoc\u0103rii copiilor cheilor private ale certificatelor principale pe fiecare nod de livrare a con\u021binutului. \u00cen abordarea clasic\u0103, o atac\u0103 de succes asupra oric\u0103ruia dintre serverele implicate \u00een livrarea traficului HTTPS va compromite \u00eentregul certificat. \u00cen cazul transferului cheilor private c\u0103tre re\u021belele de livrare a con\u021binutului, exist\u0103 amenin\u021b\u0103ri de scurgere a datelor ca urmare a actelor de sabaj de c\u0103tre personal, ac\u021biunilor serviciilor secrete sau compromiterii infrastructurii CDN. <\/p>\n

Dac\u0103 scurgerea cheilor r\u0103m\u00e2ne neobservat\u0103, cei care au acces la chei pot interfera \u00een mod discret cu traficul site-ului timp de destul de mult timp (MITM), deoarece durata de valabilitate a certificatelor este m\u0103surat\u0103 \u00een luni \u0219i ani. \u00cen Cloudflare, pentru protec\u021bia cheilor certificatelor pot exista fi utilizat<\/a><\/noindex> servere de chei speciale, care func\u021bioneaz\u0103 pe partea proprietarului site-ului, dar func\u021bionarea \u00een acest mod duce la \u00eent\u00e2rzieri semnificative \u00een livrarea traficului, scade fiabilitatea din cauza apari\u021biei unui link suplimentar \u0219i necesit\u0103 implementarea unei infrastructuri complicate.<\/p>\n

Extensia TLS propus\u0103, Credite delegate, introduce \u00een utilizare o cheie privat\u0103 suplimentar\u0103, a c\u0103rei valabilitate este limitat\u0103 la c\u00e2teva ore sau zile (nu mai mult de 7 zile). Aceast\u0103 cheie este generat\u0103 pe baza certificatului emis de autoritatea de certificare \u0219i permite p\u0103strarea cheii private a certificatului ini\u021bial \u00een secret de c\u0103tre serviciile de livrare a con\u021binutului, oferindu-le doar un certificat temporar cu o durat\u0103 scurt\u0103 de via\u021b\u0103. <\/p>\n

\"Mozilla,<\/a><\/noindex><\/center><\/p>\n

Pentru a evita problemele de acces dup\u0103 expirarea duratei de via\u021b\u0103 a cheii intermediare, este prev\u0103zut\u0103 o tehnologie de actualizare automat\u0103, efectuat\u0103 pe partea serverului TLS surs\u0103. Generarea nu necesit\u0103 execu\u021bia de opera\u021biuni manuale sau lansarea de scripturi \u2014 serverul autorizat, care necesit\u0103 cheia privat\u0103, se adreseaz\u0103 serverului TLS surs\u0103 al site-ului \u00eenainte de expirarea duratei de via\u021b\u0103 a cheii anterioare \u0219i acesta genereaz\u0103 o cheie intermediar\u0103 pentru o nou\u0103 perioad\u0103 scurt\u0103 de timp.<\/p>\n

\"Mozilla,<\/a><\/noindex><\/center><\/p>\n

Browserele care suport\u0103 extensia TLS Delegated Credentials vor percepe aceste certificate derivate ca fiind de \u00eencredere. De exemplu, suportul pentru extensia men\u021bionat\u0103 a fost deja ad\u0103ugat \u00een versiunile nightly \u0219i beta ale Firefox \u0219i poate fi activat \u00een about:config prin modificarea set\u0103rii \u201esecurity.tls.enable_delegated_credentials\u201d. La mijlocul lunii noiembrie, se preconizeaz\u0103 c\u0103 va avea loc un experiment \u00een r\u00e2ndul unui anumit procent de utilizatori ai versiunilor de test ale Firefox \u201eExperimentul TLS Delegated Credentials<\/a><\/noindex>\u201e, \u00een cadrul c\u0103ruia va fi trimis\u0103 o cerere de testare c\u0103tre serverul DC Cloudflare pentru a verifica calitatea implement\u0103rii noii extensii TLS. Suportul pentru Delegated Credentials este deja integrat \u00een bibliotec\u0103 Fizz<\/a><\/noindex> cu implementarea TLS 1.3.<\/p>\n

Specifica\u021bia Delegated Credentials a fost transmis\u0103 comitetului IETF (Internet Engineering Task Force), care se ocup\u0103 cu dezvoltarea protocoalelor \u0219i arhitecturii Internetului, \u0219i se afl\u0103 \u00een faza brouillon<\/a><\/noindex>de candidatur\u0103 pentru statutul de standard internet. Extensia Delegated Credentials poate fi utilizat\u0103 doar cu TLSv1.3.
\nPentru a genera chei intermediare, se necesit\u0103 ob\u021binerea unui certificat TLS care include o extensie special\u0103 X.509, care este suportat\u0103 \u00een prezent doar de c\u0103tre autoritatea de certificare DigiCert. <\/p>\n

<\/a><\/noindex><\/p>\n

Sursa: opennet.ro<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

Mozilla, Cloudflare \u0438 Facebook \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u043e \u0430\u043d\u043e\u043d\u0441\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u043d\u043e\u0432\u043e\u0435 TLS-\u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u0435 Delegated Credentials (DC), \u0440\u0435\u0448\u0430\u044e\u0449\u0435\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443 c \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430\u043c\u0438 \u043f\u0440\u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0441\u0430\u0439\u0442\u0443 \u0447\u0435\u0440\u0435\u0437 \u0441\u0435\u0442\u0438 \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u0430. \u0412\u044b\u0434\u0430\u0432\u0430\u0435\u043c\u044b\u0435 \u0443\u0434\u043e\u0441\u0442\u043e\u0432\u0435\u0440\u044f\u044e\u0449\u0438\u043c\u0438 \u0446\u0435\u043d\u0442\u0440\u0430\u043c\u0438 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u044b \u0438\u043c\u0435\u044e\u0442 \u0434\u043b\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0439 \u0441\u0440\u043e\u043a \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f, \u0447\u0442\u043e \u0441\u043e\u0437\u0434\u0430\u0451\u0442 \u0442\u0440\u0443\u0434\u043d\u043e\u0441\u0442\u0438 \u043f\u0440\u0438 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0441\u0430\u0439\u0442\u0443 \u0447\u0435\u0440\u0435\u0437 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0439 \u0441\u0435\u0440\u0432\u0438\u0441, \u043e\u0442 \u043b\u0438\u0446\u0430 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0434\u043e\u043b\u0436\u043d\u043e \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0442\u044c\u0441\u044f \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u043e\u0435 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0435, \u0442\u0430\u043a \u043a\u0430\u043a \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0430 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-52168","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Mozilla, Cloudflare \u0219i Facebook au prezentat extensia TLS pentru delegarea certificatelor cu durat\u0103 scurt\u0103 de via\u021b\u0103 | ProHoster","description":"Mozilla,","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/mozilla-cloudflare-i-facebook-predstavili-tls-rasshirenie-dlya-delegirovaniya-korotkozhivushhih-sertifikatov","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Mozilla, Cloudflare \u0438 Facebook \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0438 TLS-\u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u0435 \u0434\u043b\u044f \u0434\u0435\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043a\u043e\u0440\u043e\u0442\u043a\u043e\u0436\u0438\u0432\u0443\u0449\u0438\u0445 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 | ProHoster","og:description":"Mozilla,","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/mozilla-cloudflare-i-facebook-predstavili-tls-rasshirenie-dlya-delegirovaniya-korotkozhivushhih-sertifikatov","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-11-01T21:00:00+00:00","article:modified_time":"2020-02-18T10:59:50+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"52168","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 02:44:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 13:40:57","updated":"2026-01-24 02:44:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/52168","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=52168"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/52168\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=52168"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=52168"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=52168"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}