{"id":30214,"date":"2019-10-31T21:34:16","date_gmt":"2019-10-31T18:34:16","guid":{"rendered":"https:\/\/prohoster.info\/blog\/ietf-odobrili-acme-eto-standart-dlya-raboty-s-ssl-sertifikatami\/"},"modified":"2019-10-31T21:34:16","modified_gmt":"2019-10-31T18:34:16","slug":"ietf-odobrili-acme-eto-standart-dlya-raboty-s-ssl-sertifikatami","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/ietf-odobrili-acme-eto-standart-dlya-raboty-s-ssl-sertifikatami","title":{"rendered":"IETF miratoi ACME \u2014 nj\u00eb standard p\u00ebr menaxhimin e certifikatave SSL","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

IETF miratoi ACME, i cili automatizon marrjen e certifikatave SSL. Ai do t\u00eb shtoj\u00eb mekanizma t\u00eb tjer\u00eb p\u00ebr verifikimin e pronarit t\u00eb sitit. M\u00eb shum\u00eb n\u00eb lidhje me t\u00eb<\/a><\/noindex> Mjedisi Automatik i Menaxhimit t\u00eb Certifikatave (ACME), i cili ndihmon p\u00ebr t\u00eb automatizuar marrjen e certifikatave SSL. Do t\u00eb tregojm\u00eb se si funksionon.<\/p>\n

\"IETF<\/a><\/noindex><\/a><\/noindex>
\n\/ Flickr \/ Cliff Johnson<\/a><\/noindex> \/ CC BY-SA<\/a><\/noindex><\/i><\/p>\n

Pse nevojitej standardi<\/h2>\n

\nN\u00eb mesatare, p\u00ebr konfigurimin Certifikat\u00eb SSL<\/a><\/noindex> e nj\u00eb domene, administrator\u00ebt mund t\u00eb shpenzojn\u00eb nga nj\u00eb deri n\u00eb tre or\u00eb. N\u00ebse b\u00ebhet nj\u00eb gabim, do t\u00eb duhet t\u00eb pritet q\u00eb aplikimi t\u00eb refuzohet, vet\u00ebm at\u00ebher\u00eb mund t\u00eb rishqyrtohet. E gjith\u00eb kjo e b\u00ebn t\u00eb v\u00ebshtir\u00eb shp\u00ebrndarjen e sistemeve t\u00eb m\u00ebdha.<\/p>\n

Procedura e validimit t\u00eb domeneve mund t\u00eb ndryshoj\u00eb nga \u00e7do qend\u00ebr certifikimi. Mungesa e standardizimit nganj\u00ebher\u00eb sjell probleme me sigurin\u00eb. Nj\u00eb rast i njohur n\u00eb t\u00eb cilin p\u00ebr shkak t\u00eb nj\u00eb gabimi n\u00eb sistem, nj\u00eb CA verifikoi t\u00eb gjitha domenet e deklaruara. N\u00eb k\u00ebto situata, certifikatat SSL mund t'u jepen burimeve mashtruese.<\/a><\/noindex>Protokolli ACME i miratuar nga IETF (specifikimi<\/p>\n

RFC8555 ) duhet t\u00eb automatizoj\u00eb dhe standardizoj\u00eb procesin e marrjes s\u00eb certifikatave. Dhe p\u00ebrjashtimi i faktor\u00ebve njer\u00ebzor\u00eb do t\u00eb ndihmoj\u00eb n\u00eb rritjen e besueshm\u00ebris\u00eb dhe siguris\u00eb n\u00eb verifikimin e emrave t\u00eb domeneve.<\/a><\/noindex>Standardi \u00ebsht\u00eb i hapur dhe \u00e7do i interesuar mund t\u00eb kontribuoj\u00eb n\u00eb zhvillimin e tij. N\u00eb<\/p>\n

jan\u00eb publikuar udh\u00ebzime p\u00ebrkat\u00ebse. repozytorin n\u00eb GitHub<\/a><\/noindex> Nd\u00ebrrimi i k\u00ebrkesave n\u00eb ACME ndodh n\u00ebp\u00ebrmjet HTTPS me mesazhe JSON. P\u00ebr t\u00eb punuar me protokollin, \u00ebsht\u00eb e nevojshme t\u00eb instalohet nj\u00eb klient ACME n\u00eb nodin e cakut, i cili gjeneron nj\u00eb \u00e7ift unik \u00e7el\u00ebsash gjat\u00eb bised\u00ebs s\u00eb par\u00eb me CA. M\u00eb pas, ato do t\u00eb p\u00ebrdoren p\u00ebr t\u00eb n\u00ebnshkruar t\u00eb gjitha mesazhet midis klientit dhe serverit.<\/p>\n

Si funksionon kjo<\/h2>\n

\nMesazhi i par\u00eb p\u00ebrmban informacione kontakte p\u00ebr pronarin e domenit. Ai n\u00ebnshkruhet me \u00e7el\u00ebsin privat dhe d\u00ebrgohet me \u00e7el\u00ebsin publik n\u00eb server. Ai verifikon autenticitetin e n\u00ebnshkrimit dhe, n\u00ebse gjith\u00e7ka \u00ebsht\u00eb n\u00eb rregull, fillon procedur\u00ebn e l\u00ebshimit t\u00eb certifikat\u00ebs SSL.<\/p>\n

P\u00ebr t\u00eb marr\u00eb certifikat\u00ebn, klienti duhet t\u00eb provoj\u00eb serverit faktin e posedimit t\u00eb domenit. P\u00ebr k\u00ebt\u00eb, ai kryen disa veprime, t\u00eb cilat jan\u00eb t\u00eb aksesueshme vet\u00ebm p\u00ebr pronar\u00ebt. P\u00ebr shembull, qendra e certifikimit mund t\u00eb gjeneroj\u00eb nj\u00eb tok\u00ebn unik dhe t\u00eb k\u00ebrkoj\u00eb nga klienti ta vendos\u00eb at\u00eb n\u00eb faqen e tij t\u00eb internetit. M\u00eb pas, CA formon nj\u00eb k\u00ebrkes\u00eb p\u00ebr ueb ose DNS p\u00ebr t\u00eb nxjerr\u00eb \u00e7el\u00ebsin nga ky token.<\/p>\n

P\u00ebr t\u00eb marr\u00eb nj\u00eb certifikat\u00eb, klienti duhet t\u00eb d\u00ebshmoj\u00eb serverit faktin e pron\u00ebsis\u00eb s\u00eb domainit. P\u00ebr k\u00ebt\u00eb, ai kryen disa veprime q\u00eb jan\u00eb vet\u00ebm p\u00ebr pronar\u00ebt. P\u00ebr shembull, qendra e certifikimit mund t\u00eb gjeneroj\u00eb nj\u00eb token unik dhe t'i k\u00ebrkoj\u00eb klientit ta vendos\u00eb at\u00eb n\u00eb faqen e internetit. M\u00eb pas, CA formon nj\u00eb k\u00ebrkes\u00eb p\u00ebr web ose DNS p\u00ebr t\u00eb nxjerr\u00eb \u00e7el\u00ebsin nga ky token.<\/p>\n

P\u00ebr shembull, n\u00eb rastin e HTTP, \u00e7el\u00ebsi nga tokeni duhet vendosur n\u00eb nj\u00eb sked\u00eb q\u00eb do t\u00eb sh\u00ebrbehet nga serveri i uebit. Gjat\u00eb verifikimit DNS, qendra e certifikimit do t\u00eb k\u00ebrkoj\u00eb \u00e7el\u00ebsin unik n\u00eb dokumentin tekstual t\u00eb regjistrit DNS. N\u00ebse gjith\u00e7ka \u00ebsht\u00eb n\u00eb rregull, serveri konfirmon se klienti ka kaluar verifikimin dhe CA l\u00ebshon certifikat\u00ebn.<\/p>\n

\"IETF
\n\/ Flickr \/ Blondinrikard Fr\u00f6berg<\/a><\/noindex> \/ CC BY<\/a><\/noindex><\/i><\/p>\n

Mendimet<\/h2>\n

\nSipas fjal\u00ebve<\/a><\/noindex> IETF, ACME do t\u00eb jet\u00eb i dobish\u00ebm p\u00ebr administrator\u00ebt q\u00eb punojn\u00eb me disa emra domain. Standardi do t\u00eb ndihmoj\u00eb p\u00ebr t\u00eb lidhur secilin prej tyre me SSL-in e duhur.<\/p>\n

Mes p\u00ebrfitimeve t\u00eb standardit, ekspert\u00ebt gjithashtu p\u00ebrmendin disa mekanizma sigurie<\/a><\/noindex>. Ata duhet t\u00eb garantojn\u00eb q\u00eb certifikatat SSL l\u00ebshohen vet\u00ebm p\u00ebr pronar\u00ebt e v\u00ebrtet\u00eb t\u00eb domain-eve. N\u00eb ve\u00e7anti, p\u00ebr t\u00eb mbrojtur nga sulmet DNS p\u00ebrdoret nj\u00eb grup zgjerimesh DNSSEC<\/a><\/noindex>, dhe p\u00ebr t\u00eb mbrojtur nga sulmet DoS, standardi kufizon shpejt\u00ebsin\u00eb e kryerjes s\u00eb k\u00ebrkesave t\u00eb ve\u00e7anta \u2014 p\u00ebr shembull, HTTP p\u00ebr metod\u00ebn POST<\/a><\/noindex>. Vet\u00eb zhvilluesit e ACME rekomandojn\u00eb<\/a><\/noindex> p\u00ebr t\u00eb rritur sigurin\u00eb duhet t\u00eb shtojn\u00eb entropi n\u00eb k\u00ebrkesat DNS dhe t'i kryejn\u00eb ato nga disa pika n\u00eb rrjet.<\/p>\n

Zgjidhje t\u00eb ngjashme<\/h2>\n

\nP\u00ebr t\u00eb marr\u00eb certifikata p\u00ebrdoren gjithashtu protokollet SCEP<\/a><\/noindex> dhe EST<\/a><\/noindex>.<\/p>\n

E para u zhvillua n\u00eb Cisco Systems. Q\u00ebllimi i saj ishte t\u00eb thjeshtonte procedur\u00ebn e l\u00ebshimit t\u00eb certifikatave dixhitale X.509 dhe ta b\u00ebnte at\u00eb sa m\u00eb t\u00eb shkall\u00ebzueshme. Para shfaqjes s\u00eb SCEP, ky proces k\u00ebrkonte angazhim aktiv nga administratoret e sistemeve dhe ishte keq i shkall\u00ebzuesh\u00ebm. Sot, ky protokoll \u00ebsht\u00eb nj\u00eb nga m\u00eb t\u00eb p\u00ebrhapurit.<\/p>\n

Sa i p\u00ebrket EST, ai lejon klient\u00ebt PKI t\u00eb marrin certifikata p\u00ebrmes kanaleve t\u00eb sigurta. Ai p\u00ebrdor TLS p\u00ebr t\u00eb d\u00ebrguar mesazhe dhe p\u00ebr t\u00eb l\u00ebshuar SSL, si dhe p\u00ebr t\u00eb lidhur CSR me d\u00ebrguesin. P\u00ebr m\u00eb tep\u00ebr, EST mb\u00ebshtet metodat e kriptografis\u00eb eliptike, duke krijuar nj\u00eb nivel shtes\u00eb mbrojtjeje.<\/p>\n

Sipas sip\u00ebr ekspert\u00ebve<\/a><\/noindex>, zgjidhjet si ACME do t\u00eb duhet t\u00eb p\u00ebrhapen m\u00eb gjer\u00ebsisht. Ato ofrojn\u00eb nj\u00eb model t\u00eb thjesht\u00ebzuar dhe t\u00eb sigurt p\u00ebr konfigurimin e SSL, si dhe shpejtojn\u00eb procesin.<\/p>\n

Postime t\u00eb tjera nga blogu yn\u00eb korporativ:<\/h5>\n

<\/p>\n