{"id":183672,"date":"2026-10-07T22:54:13","date_gmt":"2026-10-07T20:54:13","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/komprometacziya-registratorov-3-domennyh-zon-pozvolila-poluchit-tls-sertifikaty-k-servisam-google"},"modified":"2026-10-07T22:54:20","modified_gmt":"2026-10-07T20:54:20","slug":"compromise-of-registrars-for-three-domain-zones-enabled-tls-certificate-issuance-for-google-services","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/compromise-of-registrars-for-three-domain-zones-enabled-tls-certificate-issuance-for-google-services","title":{"rendered":"Komprimit\u00e1cia registr\u00e1torov 3 dom\u00e9nov\u00fdch z\u00f3n umo\u017enila z\u00edska\u0165 TLS-certifik\u00e1ty pre slu\u017eby Google","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Spolo\u010dnos\u0165 Google ozn\u00e1mila incident, pri ktorom sa \u00fato\u010dn\u00edkom podarilo z\u00edska\u0165 TLS certifik\u00e1ty pre jednotliv\u00e9 dom\u00e9ny Google (napr\u00edklad google.as), online slu\u017eby a ve\u013ek\u00e9 spolo\u010dnosti v z\u00f3nach «.gh», «.sl» a «.as». \u00datok bol vykonan\u00fd prostredn\u00edctvom kompromit\u00e1cie registr\u00e1torov n\u00e1rodn\u00fdch dom\u00e9n najvy\u0161\u0161ej \u00farovne — «.gh» (Ghana), «.sl» (Sierrale\u00f3n) a «.as» (Americk\u00e1 Samoa), \u010do umo\u017enilo zmeni\u0165 DNS servery pre dom\u00e9ny v t\u00fdchto zon\u00e1ch a presmerova\u0165 po\u017eiadavky na servery \u00fato\u010dn\u00edkov. Presmerovan\u00edm prev\u00e1dzky \u00fato\u010dn\u00edci potvrdili vlastn\u00edctvo dom\u00e9n a z\u00edskali TLS certifik\u00e1ty, preto\u017ee po zmene \u00fadajov v DNS boli overovacie po\u017eiadavky od certifika\u010dn\u00fdch autor\u00edt odoslan\u00e9 nie na re\u00e1lne, ale na podvrhnut\u00e9 hostite\u013esk\u00e9 servery a na nich spracovan\u00e9. <\/p>\n

Neopr\u00e1vnen\u00e9 z\u00edskanie certifik\u00e1tov bolo zisten\u00e9 na z\u00e1klade anal\u00fdzy z\u00e1znamov Certificate Transparency, v ktor\u00fdch certifika\u010dn\u00e9 autority odr\u00e1\u017eaj\u00fa v\u0161etky vydan\u00e9 a odvolan\u00e9 certifik\u00e1ty. Spolo\u010dnos\u0165 Google zablokovala z\u00edskan\u00e9 certifik\u00e1ty z \u00fatoku ako nelegit\u00edmne pomocou mechanizmu CRLSets v prehliada\u010di Chrome a tie\u017e dosiahla ich odvolanie t\u00fdmi certifika\u010dn\u00fdmi autoritami. Zatia\u013e nie je zverejnen\u00e9, pre ktor\u00e9 konkr\u00e9tne dom\u00e9n<\/a> boli vydan\u00e9 falo\u0161n\u00e9 certifik\u00e1ty a ktor\u00e9 spolo\u010dnosti boli zasiahnut\u00e9 \u00fatokom. <\/p>\n

Aby sa minimalizovali rizik\u00e1 pri opakovan\u00ed podobn\u00fdch incidentov, majite\u013eom dom\u00e9n sa odpor\u00fa\u010da organizova\u0165 trval\u00fd monitoring verejn\u00fdch logov CT (Certificate Transparency) na zistenie neopr\u00e1vnen\u00e9ho vyd\u00e1vania certifik\u00e1tov. V DNS sa odpor\u00fa\u010da prida\u0165 z\u00e1znamy CAA (Certification Authority Authorization), ktor\u00e9 ur\u010duj\u00fa zoznam certifika\u010dn\u00fdch autor\u00edt, ktor\u00fdm je povolen\u00e9 vyd\u00e1va\u0165 certifik\u00e1ty pre uveden\u00fa dom\u00e9nu. Nastavenie DNS z\u00e1znamu CAA neochr\u00e1ni pred po\u017eiadavkou na certifik\u00e1t po pozmenen\u00ed DNS, ale po obnoven\u00ed kontroly nad DNS zabr\u00e1ni op\u00e4tovn\u00e9mu vydaniu certifik\u00e1tov \u00fato\u010dn\u00edkmi, ktor\u00ed vyu\u017e\u00edvaj\u00fa ulo\u017een\u00e9 \u00fadaje o vlastn\u00edctve dom\u00e9ny.
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Google \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0430 \u043e\u0431 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0435, \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u043c \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c TLS-\u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u044b \u0434\u043b\u044f \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0445 \u0434\u043e\u043c\u0435\u043d\u043e\u0432 Google (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, google.as), \u043e\u043d\u043b\u0430\u0439\u043d-\u0441\u0435\u0440\u0432\u0438\u0441\u043e\u0432 \u0438 \u043a\u0440\u0443\u043f\u043d\u044b\u0445 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 \u0432 \u0437\u043e\u043d\u0430\u0445 «.gh», «.sl» \u0438 «.as». \u0410\u0442\u0430\u043a\u0430 \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0430 \u0447\u0435\u0440\u0435\u0437 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044e \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u043e\u0432 \u043d\u0430\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u044b\u0445 \u0434\u043e\u043c\u0435\u043d\u043d\u044b\u0445 \u0437\u043e\u043d \u0432\u0435\u0440\u0445\u043d\u0435\u0433\u043e \u0443\u0440\u043e\u0432\u043d\u044f — «.gh» (\u0413\u0430\u043d\u0430), «.sl» (\u0421\u044c\u0435\u0440\u0440\u0430-\u041b\u0435\u043e\u043d\u0435) \u0438 «.as» (\u0410\u043c\u0435\u0440\u0438\u043a\u0430\u043d\u0441\u043a\u043e\u0435 \u0421\u0430\u043c\u043e\u0430), \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u043b\u043e \u0437\u0430\u043c\u0435\u043d\u0438\u0442\u044c DNS-\u0441\u0435\u0440\u0432\u0435\u0440\u044b \u0434\u043b\u044f \u0434\u043e\u043c\u0435\u043d\u043e\u0432 \u0432 \u044d\u0442\u0438\u0445 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":10,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-183672","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Kompromit\u00e1cia registr\u00e1torov 3 dom\u00e9nov\u00fdch z\u00f3n umo\u017enila z\u00edska\u0165 TLS certifik\u00e1ty k slu\u017eb\u00e1m Google | ProHoster","description":"Spolo\u010dnos\u0165 Google ozn\u00e1mila incident, pri ktorom sa \u00fato\u010dn\u00edkom podarilo z\u00edska\u0165 TLS certifik\u00e1ty pre jednotliv\u00e9 dom\u00e9ny Google (napr\u00edklad google.as), online slu\u017eby a v\u00fdznamn\u00e9 spolo\u010dnosti v z\u00f3nach \".gh\", \".sl\" a.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/compromise-of-registrars-for-three-domain-zones-enabled-tls-certificate-issuance-for-google-services","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044f \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u043e\u0432 3 \u0434\u043e\u043c\u0435\u043d\u043d\u044b\u0445 \u0437\u043e\u043d \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u043b\u0430 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c TLS-\u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u044b \u043a \u0441\u0435\u0440\u0432\u0438\u0441\u0430\u043c Google | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Google \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0430 \u043e\u0431 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0435, \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u043c \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c TLS-\u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u044b \u0434\u043b\u044f \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0445 \u0434\u043e\u043c\u0435\u043d\u043e\u0432 Google (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, google.as), \u043e\u043d\u043b\u0430\u0439\u043d-\u0441\u0435\u0440\u0432\u0438\u0441\u043e\u0432 \u0438 \u043a\u0440\u0443\u043f\u043d\u044b\u0445 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 \u0432 \u0437\u043e\u043d\u0430\u0445 ".gh", ".sl" \u0438.","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/compromise-of-registrars-for-three-domain-zones-enabled-tls-certificate-issuance-for-google-services","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-10-07T20:54:13+00:00","article:modified_time":"2026-10-07T20:54:20+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/183672","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=183672"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/183672\/revisions"}],"predecessor-version":[{"id":183975,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/183672\/revisions\/183975"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=183672"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=183672"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=183672"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}