{"id":83443,"date":"2020-05-31T13:42:09","date_gmt":"2020-05-31T11:42:09","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ustarevanie-kornevogo-sertifikata-addtrust-privelo-k-sboyam-v-sistemah-s-openssl-i-gnutls"},"modified":"2020-05-31T13:42:09","modified_gmt":"2020-05-31T11:42:09","slug":"ustarevanie-kornevogo-sertifikata-addtrust-privelo-k-sboyam-v-sistemah-s-openssl-i-gnutls","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/ustarevanie-kornevogo-sertifikata-addtrust-privelo-k-sboyam-v-sistemah-s-openssl-i-gnutls","title":{"rendered":"\u00cemb\u0103tr\u00e2nirea certificatului r\u0103d\u0103cin\u0103 AddTrust a dus la erori \u00een sistemele cu OpenSSL \u0219i GnuTLS","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

30 mai a expirat perioada de valabilitate de 20 de ani a certificatul r\u0103d\u0103cin\u0103 AddTrust<\/a><\/noindex>, care se utiliza<\/a><\/noindex> pentru a forma o semn\u0103tur\u0103 \u00eencruci\u0219at\u0103 (cross-signed) \u00een certificatul unuia dintre cei mai mari furnizori de servicii de certificare, Sectigo (Comodo). Semn\u0103tura \u00eencruci\u0219at\u0103 permitea asigurarea compatibilit\u0103\u021bii cu dispozitivele \u00eenvechite, \u00een depozitul certificatelor r\u0103d\u0103cin\u0103 ale c\u0103ror nu a fost ad\u0103ugat noul certificat r\u0103d\u0103cin\u0103 USERTrust. <\/p>\n

\"\u00cemb\u0103tr\u00e2nirea<\/a><\/noindex><\/center><\/p>\n

Teoretic, expirarea certificatului r\u0103d\u0103cin\u0103 AddTrust ar fi trebuit s\u0103 duc\u0103 doar la o \u00eenc\u0103lcare a compatibilit\u0103\u021bii cu sistemele vechi (Android 2.3, Windows XP, Mac OS X 10.11, iOS 9 \u0219.a.), deoarece cel de-al doilea certificat r\u0103d\u0103cin\u0103 folosit \u00een semn\u0103tura \u00eencruci\u0219at\u0103 r\u0103m\u00e2ne valabil \u0219i browserele moderne \u00eel iau \u00een considerare \u00een timpul verific\u0103rii lan\u021bului de \u00eencredere. \u00cen practic\u0103 s-au descoperit<\/a><\/noindex> probleme cu verificarea semn\u0103turii \u00eencruci\u0219ate \u00een clien\u021bii TLS care nu folosesc browsere, inclusiv cele bazate pe OpenSSL 1.0.x \u0219i GnuTLS. Conexiunea securizat\u0103 a \u00eencetat s\u0103 se stabileasc\u0103, cu un mesaj de eroare despre expirarea certificatului, atunci c\u00e2nd pe server este utilizat certificatul Sectigo, conectat prin lan\u021bul de \u00eencredere cu certificatul r\u0103d\u0103cin\u0103 AddTrust.<\/p>\n

Dac\u0103 utilizatorii browserelor moderne nu au observat expirarea certificatului r\u0103d\u0103cin\u0103 AddTrust \u00een timpul proces\u0103rii certificatelor semnate \u00eencruci\u0219at de Sectigo, atunci \u00een diverse aplica\u021bii ter\u021be \u0219i procesatoare de servere au \u00eenceput s\u0103 apar\u0103 probleme, ceea ce a condus la la o \u00eentrerupere<\/a><\/noindex> func\u021bionarea<\/a><\/noindex> multor infrastructuri care utilizeaz\u0103 canale de comunicare criptate pentru interac\u021biunea \u00eentre componente. <\/p>\n

De exemplu, au ap\u0103rut probleme<\/a><\/noindex> cu acces la unele module de pachete \u00een Debian \u0219i Ubuntu (apt a \u00eenceput s\u0103 emit\u0103 o eroare de verificare a certificatului), apelurile din scripturi folosind utilitarele \u201ecurl\u201d \u0219i \u201ewget\u201d au \u00eenceput s\u0103 e\u0219ueze, fiind observate erori \u00een utilizarea Git, s-a \u00eentrerupt<\/a><\/noindex> func\u021bionarea platformei de streaming Roku, au \u00eencetat apelurile c\u0103tre procesatori Stripe<\/a><\/noindex> \u0219i DataDog<\/a><\/noindex>, au \u00eenceput s\u0103 apar\u0103 erori<\/a><\/noindex> \u00een aplica\u021biile Heroku, au \u00eencetat<\/a><\/noindex> s\u0103 se conecteze clien\u021bii OpenLDAP, fiind raportate probleme cu trimiterea de emailuri c\u0103tre serverele SMTPS \u0219i SMTP cu STARTTLS. \u00cen plus, se observ\u0103 probleme \u00een diverse scripturi Ruby, PHP \u0219i Python, care folosesc un modul cu client http. Din browsere, problema implic\u0103<\/a><\/noindex> Epiphany, \u00een care listele de blocare a reclamelor nu mai pot fi \u00eenc\u0103rcate.<\/p>\n

Programele scrise \u00een Go nu sunt afectate de problem\u0103, deoarece \u00een Go se ofer\u0103 o implementare proprie<\/a><\/noindex> TLS.<\/p>\n

Se presupunea<\/a><\/noindex>, problema afecteaz\u0103 versiunile mai vechi ale distribu\u021biilor (inclusiv Debian 9, Ubuntu 16.04, RHEL 6\/7<\/a><\/noindex>) \u00een care sunt utilizate bran\u0219ele problematice OpenSSL, dar problema s-a manifestat<\/a><\/noindex> de asemenea \u00een gestionarea pachetelor APT \u00een versiunile curente Debian 10 \u0219i Ubuntu 18.04\/20.04, deoarece APT utilizeaz\u0103 biblioteca GnuTLS. Esen\u021ba problemei este c\u0103 multe biblioteci TLS\/SSL interpreteaz\u0103 certificatul ca un lan\u021b liniar, \u00een timp ce conform RFC 4158 certificatul poate reprezenta un graf distribuit orientat ciclic cu mai multe ancore de \u00eencredere care trebuie luate \u00een considerare. Aceast\u0103 deficien\u021b\u0103 \u00een OpenSSL \u0219i GnuTLS s\u0103 aib\u0103<\/a><\/noindex> se \u0219tie<\/a><\/noindex> exist\u0103 de mul\u021bi ani<\/a><\/noindex>. \u00cen OpenSSL problema a fost rezolvat\u0103 \u00een bran\u0219a 1.1.1, iar \u00een GnuTLS<\/a><\/noindex> r\u0103m\u00e2ne necorectat\u0103<\/a><\/noindex>.<\/p>\n

Ca solu\u021bie alternativ\u0103 la problema e\u0219ecului, se propune eliminarea din depozitul sistemic a certificatului \u201eAddTrust External CA Root\u201d (de exemplu, eliminarea din \/etc\/ca-certificates.conf \u0219i \/etc\/ssl\/certs, apoi rularea \u201eupdate-ca-certificates -f -v\u201d), dup\u0103 care OpenSSL \u00eencepe s\u0103 proceseze corect certificatele semnate \u00eencruci\u0219at \u00een care este implicat. Utiliz\u00e2nd managerul de pachete APT, pe riscul propriu, se poate dezactiva verificarea certificatelor pentru anumite solicit\u0103ri (de exemplu, \u201eapt-get update -o Acquire::https::download.jitsi.org::Verify-Peer=false\u201d). <\/p>\n

Pentru a bloca problema \u00een Fedora<\/a><\/noindex> \u0219i RHEL<\/a><\/noindex> se propune ad\u0103ugarea certificatului AddTrust \u00een lista neagr\u0103:<\/p>\n

dump de \u00eencredere \u2014 filtrare \u00abpkcs11:id=;type=cert\u00bb \\
\n > \/etc\/pki\/ca-trust\/source\/blacklist\/addtrust-external-root.p11-kit
\n update-ca-trust extract<\/p>\n

Dar aceast\u0103 metod\u0103 nu func\u021bioneaz\u0103<\/a><\/noindex> pentru GnuTLS (de exemplu, continu\u0103 s\u0103 emit\u0103 o eroare de verificare a certificatului la rularea utilitarului wget).<\/p>\n

Pe partea serverului, se poate schimba<\/a><\/noindex> ordonarea<\/a><\/noindex> enumerarea certificatelor din lan\u021bul de \u00eencredere, trimise de server c\u0103tre client (dac\u0103 certificatul asociat cu \u201eAddTrust External CA Root\u201d va fi eliminat din list\u0103, atunci verificarea de c\u0103tre client va reu\u0219i). Pentru verificarea \u0219i generarea unui nou lan\u021b de \u00eencredere poate fi utilizat serviciul whatsmychaincert.com<\/a><\/noindex>. Compania Sectigo a furnizat, de asemenea, un<\/a><\/noindex> certificatul intermediar semnat alternativ \u201eAAA Certificate Services<\/a><\/noindex>\u201e, care va fi valabil p\u00e2n\u0103 \u00een 2028 \u0219i va permite men\u021binerea compatibilit\u0103\u021bii cu versiunile mai vechi ale sistemului de operare.<\/p>\n

Ad\u0103ugare: Problema exist\u0103 \u0219i se manifest\u0103<\/a><\/noindex> \u00een LibreSSL.<\/p>\n

<\/a><\/noindex><\/p>\n

Sursa: opennet.ro<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

30 \u043c\u0430\u044f \u0438\u0441\u0442\u0451\u043a 20-\u043b\u0435\u0442\u043d\u0438\u0439 \u0441\u0440\u043e\u043a \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u043a\u043e\u0440\u043d\u0435\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 AddTrust, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u043b\u0441\u044f \u0434\u043b\u044f \u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u0435\u0440\u0435\u043a\u0440\u0451\u0441\u0442\u043d\u043e\u0439 \u043f\u043e\u0434\u043f\u0438\u0441\u0438 (cross-signed) \u0432 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430\u0445 \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u043a\u0440\u0443\u043f\u043d\u0435\u0439\u0448\u0438\u0445 \u0443\u0434\u043e\u0441\u0442\u043e\u0432\u0435\u0440\u044f\u044e\u0449\u0438\u0445 \u0446\u0435\u043d\u0442\u0440\u043e\u0432 Sectigo (Comodo). \u041f\u0435\u0440\u0435\u043a\u0440\u0451\u0441\u0442\u043d\u0430\u044f \u043f\u043e\u0434\u043f\u0438\u0441\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u043b\u0430 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0442\u044c \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u0438\u043c\u043e\u0441\u0442\u044c \u0441 \u0443\u0441\u0442\u0430\u0440\u0435\u0432\u0448\u0438\u043c\u0438 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u043c\u0438, \u0432 \u0445\u0440\u0430\u043d\u0438\u043b\u0438\u0449\u0435 \u043a\u043e\u0440\u043d\u0435\u0432\u044b\u0445 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043d\u0435 \u0431\u044b\u043b \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d \u043d\u043e\u0432\u044b\u0439 \u043a\u043e\u0440\u043d\u0435\u0432\u043e\u0439 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 USERTRust. \u0422\u0435\u043e\u0440\u0435\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u043f\u0440\u0435\u043a\u0440\u0430\u0449\u0435\u043d\u0438\u0435 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u043a\u043e\u0440\u043d\u0435\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 AddTrust \u0434\u043e\u043b\u0436\u043d\u043e \u0431\u044b\u043b\u043e \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043b\u0438\u0448\u044c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":83444,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-83443","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Dep\u0103\u0219irea certificatului de r\u0103d\u0103cin\u0103 AddTrust a dus la defec\u021biuni \u00een sistemele cu OpenSSL \u0219i GnuTLS | ProHoster","description":"30 mai a expirat o perioad\u0103 de 20 de ani pentru certificatul de r\u0103d\u0103cin\u0103 AddTrust, care","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/ustarevanie-kornevogo-sertifikata-addtrust-privelo-k-sboyam-v-sistemah-s-openssl-i-gnutls","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u0441\u0442\u0430\u0440\u0435\u0432\u0430\u043d\u0438\u0435 \u043a\u043e\u0440\u043d\u0435\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 AddTrust \u043f\u0440\u0438\u0432\u0435\u043b\u043e \u043a \u0441\u0431\u043e\u044f\u043c \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u0441 OpenSSL \u0438 GnuTLS | ProHoster","og:description":"30 \u043c\u0430\u044f \u0438\u0441\u0442\u0451\u043a 20-\u043b\u0435\u0442\u043d\u0438\u0439 \u0441\u0440\u043e\u043a \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u043a\u043e\u0440\u043d\u0435\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 AddTrust, \u043a\u043e\u0442\u043e\u0440\u044b\u0439","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/ustarevanie-kornevogo-sertifikata-addtrust-privelo-k-sboyam-v-sistemah-s-openssl-i-gnutls","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-05-31T11:42:09+00:00","article:modified_time":"2020-05-31T11:42:09+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"83443","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 15:17:29","updated":"2022-09-28 18:33:53","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/83443","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=83443"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/83443\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/83444"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=83443"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=83443"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=83443"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}