{"id":72754,"date":"2020-03-04T02:42:36","date_gmt":"2020-03-03T23:42:36","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/massovyj-otzyv-sertifikatov-lets-encrypt"},"modified":"2020-03-04T02:42:36","modified_gmt":"2020-03-03T23:42:36","slug":"massovyj-otzyv-sertifikatov-lets-encrypt","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/massovyj-otzyv-sertifikatov-lets-encrypt","title":{"rendered":"Hromadn\u00e9 stiahnutie certifik\u00e1tov Let's Encrypt","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Nekomern\u00fd certifika\u010dn\u00fd \u00farad Let's Encrypt, riaden\u00fd komunitou a poskytuj\u00faci certifik\u00e1ty bezplatne v\u0161etk\u00fdm z\u00e1ujemcom, varoval<\/a><\/noindex> o nadch\u00e1dzaj\u00facom odvolan\u00ed mnoh\u00fdch predt\u00fdm vydan\u00fdch TLS\/SSL certifik\u00e1tov. Z 116 mili\u00f3nov aktu\u00e1lne platn\u00fdch certifik\u00e1tov Let's Encrypt bude odvolan\u00fdch trochu viac ako 3 mili\u00f3ny (2,6 %), z ktor\u00fdch pribli\u017ene 1 mili\u00f3n s\u00fa duplik\u00e1ty viazan\u00e9 na jednu dom\u00e9nu (chyba hlavne zasiahla ve\u013emi \u010dasto aktualizovan\u00e9 certifik\u00e1ty, preto je to\u013eko duplik\u00e1tov). Odvolanie je napl\u00e1novan\u00e9 na 4. marca (presn\u00fd \u010das zatia\u013e nie je ur\u010den\u00fd, ale odvolanie sa uskuto\u010dn\u00ed najsk\u00f4r o 3. hodine miestneho \u010dasu MSK).<\/p>\n

Potreba od\u0148atia je sp\u00f4soben\u00e1 zistenou d\u0148a 29. febru\u00e1ra chybou<\/a><\/noindex>. Probl\u00e9m sa prejavuje od 25. j\u00fala 2019 a t\u00fdka sa syst\u00e9mu kontroly z\u00e1znamov CAA v DNS. Z\u00e1znam CAA (RFC-6844<\/a><\/noindex>, Certificate Authority Authorization) umo\u017e\u0148uje majite\u013eovi dom\u00e9ny jasne ur\u010di\u0165 certifika\u010dn\u00fd org\u00e1n, cez ktor\u00fd m\u00f4\u017eu by\u0165 generovan\u00e9 certifik\u00e1ty pre uveden\u00fa dom\u00e9nu. Ak certifika\u010dn\u00fd org\u00e1n nie je uveden\u00fd v z\u00e1znamoch CAA, m\u00e1 povinnos\u0165 zablokova\u0165 vydanie certifik\u00e1tov pre t\u00fato dom\u00e9nu a informova\u0165 majite\u013ea dom\u00e9ny o pokusoch o kompromit\u00e1ciu. V drvivej v\u00e4\u010d\u0161ine pr\u00edpadov je certifik\u00e1t \u017eiadan\u00fd hne\u010f po \u00faspe\u0161nej kontrole CAA, ale v\u00fdsledok kontroly sa pova\u017euje za platn\u00fd e\u0161te 30 dn\u00ed. Pravidl\u00e1 tie\u017e predpisuj\u00fa, \u017ee op\u00e4tovn\u00e1 kontrola mus\u00ed by\u0165 vykonan\u00e1 najnesk\u00f4r 8 hod\u00edn pred vydan\u00edm nov\u00e9ho certifik\u00e1tu (t.j. ak pri \u017eiadosti o nov\u00fd certifik\u00e1t uplynulo od poslednej kontroly 8 hod\u00edn, vy\u017eaduje sa op\u00e4tovn\u00e1 kontrola).<\/p>\n

Chyba sa prejavuje, ak po\u017eiadavka na certifik\u00e1t zastre\u0161uje s\u00fa\u010dasne nieko\u013eko dom\u00e9nov\u00fdch n\u00e1zvov, pre ktor\u00e9 je potrebn\u00e9 overenie z\u00e1znamu CAA. Podstata chyby spo\u010d\u00edva v tom, \u017ee v \u010dase op\u00e4tovn\u00e9ho overenia sa namiesto valid\u00e1cie v\u0161etk\u00fdch dom\u00e9n vykonalo op\u00e4tovn\u00e9 overenie iba jednej dom\u00e9ny zo zoznamu (ak bolo v po\u017eiadavke N dom\u00e9n, namiesto N r\u00f4znych overen\u00ed sa jedna dom\u00e9na overovala N-kr\u00e1t). Pre ostatn\u00e9 dom\u00e9ny op\u00e4tovn\u00e9 overenie nebolo vykonan\u00e9 a pri rozhodovan\u00ed sa pou\u017e\u00edvali \u00fadaje prvej kontroly (t.j. pou\u017eili sa \u00fadaje star\u00e9 30 dn\u00ed). Ako d\u00f4sledok, po dobu 30 dn\u00ed po prvej kontrole mohol Let's Encrypt vyda\u0165 certifik\u00e1t, aj ke\u010f sa hodnota z\u00e1znamu CAA zmenila a Let's Encrypt bol odstr\u00e1nen\u00fd zo zoznamu povolen\u00fdch certifika\u010dn\u00fdch \u00faradov.<\/p>\n

Pou\u017e\u00edvate\u013eom, ktor\u00fdch sa probl\u00e9m t\u00fdka, bolo zaslan\u00e9 upozornenie na email, ak pri z\u00edskavan\u00ed certifik\u00e1tu boli vyplnen\u00e9 kontaktn\u00e9 \u00fadaje. Svoje certifik\u00e1ty si m\u00f4\u017eete skontrolova\u0165 nahrat\u00edm a list<\/a><\/noindex> s\u00e9riov\u00fdch \u010d\u00edsel odobran\u00fdch certifik\u00e1tov alebo vyu\u017eit\u00edm online slu\u017eby<\/a><\/noindex> (umiestnenej na IP adrese, blokovanej<\/a><\/noindex> v RF Roskomnadzorom). S\u00e9riov\u00e9 \u010d\u00edslo certifik\u00e1tu pre zauj\u00edmav\u00fa dom\u00e9nu m\u00f4\u017eete zisti\u0165 pomocou pr\u00edkazu:<\/p>\n

openssl s_client -connect example.com:443 -showcerts \/dev\/null \\
\n | openssl x509 -text -noout | grep -A 1 Serial\\ Number | tr -d :<\/p>\n

<\/a><\/noindex><\/p>\n

Zdroj: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041d\u0435\u043a\u043e\u043c\u043c\u0435\u0440\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0434\u043e\u0441\u0442\u043e\u0432\u0435\u0440\u044f\u044e\u0449\u0438\u0439 \u0446\u0435\u043d\u0442\u0440 Let’s Encrypt, \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u044b\u0439 \u0441\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e\u043c \u0438 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0439 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u044b \u0431\u0435\u0437\u0432\u043e\u0437\u043c\u0435\u0437\u0434\u043d\u043e \u0432\u0441\u0435\u043c \u0436\u0435\u043b\u0430\u044e\u0449\u0438\u043c, \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b \u043e \u043f\u0440\u0435\u0434\u0441\u0442\u043e\u044f\u0449\u0435\u043c \u043e\u0442\u0437\u044b\u0432\u0435 \u043c\u043d\u043e\u0433\u0438\u0445 \u0440\u0430\u043d\u0435\u0435 \u0432\u044b\u0434\u0430\u043d\u043d\u044b\u0445 TLS\/SSL \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432. \u0418\u0437 116 \u043c\u043b\u043d \u043d\u044b\u043d\u0435 \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0445 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 Let’s Encrypt \u0431\u0443\u0434\u0435\u0442 \u043e\u0442\u043e\u0437\u0432\u0430\u043d\u043e \u0447\u0443\u0442\u044c \u0431\u043e\u043b\u044c\u0448\u0435 3 \u043c\u043b\u043d (2.6%), \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u0440\u0438\u043c\u0435\u0440\u043d\u043e 1 \u043c\u043b\u043d \u044f\u0432\u043b\u044f\u044e\u0442\u0441\u044f \u0434\u0443\u0431\u043b\u0438\u043a\u0430\u0442\u0430\u043c\u0438, \u043f\u0440\u0438\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u043c\u0438 \u043a \u043e\u0434\u043d\u043e\u043c\u0443 \u0434\u043e\u043c\u0435\u043d\u0443 (\u043e\u0448\u0438\u0431\u043a\u0430 \u0432 \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u043c \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u043b\u0430 \u043e\u0447\u0435\u043d\u044c \u0447\u0430\u0441\u0442\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u044f\u0435\u043c\u044b\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-72754","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Hromadn\u00e9 odobratie certifik\u00e1tov Let's Encrypt | ProHoster","description":"Neziskov\u00e1 certifika\u010dn\u00e1 autorita Let's Encrypt, kontrolovan\u00e1 komunitou a poskytuj\u00faca certifik\u00e1ty bezplatne ka\u017ed\u00e9mu, kto m\u00e1 z\u00e1ujem,","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/massovyj-otzyv-sertifikatov-lets-encrypt","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041c\u0430\u0441\u0441\u043e\u0432\u044b\u0439 \u043e\u0442\u0437\u044b\u0432 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 Let&apos;s Encrypt | ProHoster","og:description":"\u041d\u0435\u043a\u043e\u043c\u043c\u0435\u0440\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0434\u043e\u0441\u0442\u043e\u0432\u0435\u0440\u044f\u044e\u0449\u0438\u0439 \u0446\u0435\u043d\u0442\u0440 Let's Encrypt, \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u044b\u0439 \u0441\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e\u043c \u0438 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0439 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u044b \u0431\u0435\u0437\u0432\u043e\u0437\u043c\u0435\u0437\u0434\u043d\u043e \u0432\u0441\u0435\u043c \u0436\u0435\u043b\u0430\u044e\u0449\u0438\u043c,","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/massovyj-otzyv-sertifikatov-lets-encrypt","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-03-03T23:42:36+00:00","article:modified_time":"2020-03-03T23:42:36+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"72754","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 18:46:21","updated":"2022-09-28 12:43:03","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/72754","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=72754"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/72754\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=72754"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=72754"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=72754"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}