{"id":30214,"date":"2019-10-31T21:34:16","date_gmt":"2019-10-31T18:34:16","guid":{"rendered":"https:\/\/prohoster.info\/blog\/ietf-odobrili-acme-eto-standart-dlya-raboty-s-ssl-sertifikatami\/"},"modified":"2019-10-31T21:34:16","modified_gmt":"2019-10-31T18:34:16","slug":"ietf-odobrili-acme-eto-standart-dlya-raboty-s-ssl-sertifikatami","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/ietf-odobrili-acme-eto-standart-dlya-raboty-s-ssl-sertifikatami","title":{"rendered":"IETF miratoi ACME \u2014 kjo \u00ebsht\u00eb nj\u00eb standard p\u00ebr funksionimin me certifikatat SSL","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

IETF miratoi standard<\/a><\/noindex> Mjedisi i Menaxhimit t\u00eb Certifikatave Automatik (ACME), i cili do t\u00eb ndihmoj\u00eb n\u00eb automatizimin e marrjes s\u00eb certifikatave SSL. Do t'ju tregojm\u00eb se si funksionon.<\/p>\n

\"IETF<\/a><\/noindex><\/a><\/noindex>
\n\/ Flickr \/ Cliff Johnson<\/a><\/noindex> \/ CC BY-SA<\/a><\/noindex><\/i><\/p>\n

Pse nevojitet standardi<\/h2>\n

\nMesatarisht, p\u00ebr konfigurimin SSL-certifikat<\/a><\/noindex> e nj\u00eb domeni, administrator\u00ebt mund t\u00eb shpenzojn\u00eb nga nj\u00eb deri n\u00eb tre or\u00eb. N\u00ebse ndodh nj\u00eb gabim, do t\u00eb duhet t\u00eb pritet q\u00eb aplikimi t\u00eb refuzohet, vet\u00ebm at\u00ebher\u00eb mund t\u00eb paraqitet p\u00ebrs\u00ebri. E gjith\u00eb kjo e v\u00ebshtir\u00ebson shp\u00ebrndarjen e sistemeve t\u00eb m\u00ebdha.<\/p>\n

Procedura e validimit t\u00eb domenit mund t\u00eb ndryshoj\u00eb nga nj\u00eb qend\u00ebr certifikimi n\u00eb tjetr\u00ebn. Mungesa e standardizimit her\u00eb pas here \u00e7on n\u00eb probleme me sigurin\u00eb. Nj\u00eb rast i njohur ishte<\/a><\/noindex>, kur p\u00ebr shkak t\u00eb nj\u00eb defekti n\u00eb sistem, nj\u00eb CA verifikoi t\u00eb gjitha domenet e deklaruara. N\u00eb k\u00ebto situata, certifikat SSL mund t'i jepen burimeve mashtruese.<\/p>\n

Protokolli i miratuar nga IETF ACME (specifikimi RFC8555<\/a><\/noindex>) ka p\u00ebr q\u00ebllim t\u00eb automatizoj\u00eb dhe standardizoj\u00eb procesin e marrjes s\u00eb certifikatave. Dhe p\u00ebrjashtimi i faktor\u00ebve njer\u00ebzor\u00eb do t\u00eb ndihmoj\u00eb n\u00eb rritjen e besueshm\u00ebris\u00eb dhe siguris\u00eb s\u00eb verifikimit t\u00eb emrit t\u00eb domenit.<\/p>\n

Standardi \u00ebsht\u00eb t\u00eb hapur, dhe kushdo q\u00eb d\u00ebshiron mund t\u00eb kontribuoj\u00eb n\u00eb zhvillimin e tij. N\u00eb repo n\u00eb GitHub<\/a><\/noindex> jan\u00eb publikuar udh\u00ebzime p\u00ebrkat\u00ebse.<\/p>\n

Si funksionon<\/h2>\n

\nShk\u00ebmbimi i k\u00ebrkesave n\u00eb ACME ndodh p\u00ebrmes HTTPS duke p\u00ebrdorur mesazhe JSON. P\u00ebr t\u00eb punuar me protokollin, duhet t\u00eb instaloni nj\u00eb klient ACME n\u00eb hostin e synuar, i cili gjeneron nj\u00eb \u00e7ift \u00e7el\u00ebsash unik n\u00eb bised\u00ebn e par\u00eb me CA. M\u00eb pas, ata do t\u00eb p\u00ebrdoren p\u00ebr t\u00eb firmosur t\u00eb gjitha mesazhet midis klientit dhe serverit.<\/p>\n

Mesazhi i par\u00eb p\u00ebrmban informacionin kontaktues p\u00ebr pronarin e domenit. Ai n\u00ebnshkruhet me \u00e7el\u00ebsin privat dhe s\u00eb bashku me \u00e7el\u00ebsin publik d\u00ebrgohet te serveri. Ai verifikon autenticitetin e n\u00ebnshkrimit dhe n\u00ebse gjith\u00e7ka \u00ebsht\u00eb n\u00eb rregull, fillon procedur\u00ebn e l\u00ebshimit t\u00eb certifikat\u00ebs SSL.<\/p>\n

P\u00ebr t\u00eb marr\u00eb certifikat\u00ebn, klienti duhet t\u00eb d\u00ebshmoj\u00eb serverit se zot\u00ebron domenin. P\u00ebr k\u00ebt\u00eb, ai kryen disa veprime q\u00eb jan\u00eb t\u00eb arritshme vet\u00ebm p\u00ebr pronarin. P\u00ebr shembull, qendra e certifikimit mund t\u00eb gjeneroj\u00eb nj\u00eb token unik dhe t\u00eb k\u00ebrkoj\u00eb nga klienti ta vendos\u00eb at\u00eb n\u00eb faqen e internetit. M\u00eb pas, CA formon nj\u00eb k\u00ebrkes\u00eb web ose DNS p\u00ebr t\u00eb nxjerr\u00eb \u00e7el\u00ebsin nga ky token.<\/p>\n

P\u00ebr shembull, n\u00eb rastin e HTTP, \u00e7el\u00ebsi nga tokeni duhet t\u00eb vendoset n\u00eb nj\u00eb sked\u00eb q\u00eb do t\u00eb sh\u00ebrbehet nga serveri web. N\u00eb verifikimin DNS, qendra e certifikimit do t\u00eb k\u00ebrkoj\u00eb \u00e7el\u00ebsin unik n\u00eb dokumentin tekstor t\u00eb regjistrit DNS. N\u00ebse gjith\u00e7ka \u00ebsht\u00eb n\u00eb rregull, serveri konfirmon se klienti ka kaluar validimin dhe CA l\u00ebshon certifikat\u00ebn.<\/p>\n

\"IETF
\n\/ Flickr \/ Blondinrikard Fr\u00f6berg<\/a><\/noindex> \/ CC BY<\/a><\/noindex><\/i><\/p>\n

Mendime<\/h2>\n

\nSipas autoreve, sistemi do t\u00eb zvog\u00ebloj\u00eb shpenzimet p\u00ebr energjin\u00eb me dyfish.<\/a><\/noindex> IETF, ACME do t\u00eb jet\u00eb i dobish\u00ebm p\u00ebr administrator\u00ebt q\u00eb duhet t\u00eb punojn\u00eb me disa emra domenesh. Standardi do t\u00eb ndihmoj\u00eb t\u00eb lidh\u00eb secilin prej tyre me SSL t\u00eb duhur.<\/p>\n

Nd\u00ebr p\u00ebrfitimet e standardit, ekspert\u00ebt gjithashtu p\u00ebrmendin disa mekanizma sigurie<\/a><\/noindex>. Ata duhet t\u00eb garantojn\u00eb q\u00eb certifikat SSL t\u00eb l\u00ebshohen vet\u00ebm p\u00ebr pronar\u00ebt e v\u00ebrtet\u00eb t\u00eb domain\u00ebve. N\u00eb ve\u00e7anti, p\u00ebr t\u00eb mbrojtur nga sulmet DNS, aplikohet nj\u00eb grup zgjidhjesh DNSSEC<\/a><\/noindex>, dhe p\u00ebr t\u00eb mbrojtur nga DoS, standardi kufizon shpejt\u00ebsin\u00eb e ekzekutimit t\u00eb k\u00ebrkesave t\u00eb caktuara \u2014 p\u00ebr shembull, HTTP p\u00ebr metod\u00ebn POST<\/a><\/noindex>. Vet\u00eb zhvilluesit e ACME k\u00ebshillojn\u00eb<\/a><\/noindex> p\u00ebr t\u00eb rritur sigurin\u00eb, shtojn\u00eb entropi n\u00eb k\u00ebrkesat DNS dhe i ekzekutojn\u00eb ato nga disa pika n\u00eb rrjet.<\/p>\n

Zgjidhje t\u00eb ngjashme<\/h2>\n

\nP\u00ebr marrjen e certifikatave p\u00ebrdoren gjithashtu protokolle SCEP<\/a><\/noindex> dhe EST<\/a><\/noindex>.<\/p>\n

SCEP \u00ebsht\u00eb zhvilluar n\u00eb Cisco Systems. Q\u00ebllimi i tij ishte t\u00eb thjeshtoj\u00eb procedur\u00ebn e l\u00ebshimit t\u00eb certifikatave digjitale X.509 dhe ta b\u00ebj\u00eb at\u00eb sa m\u00eb t\u00eb shkall\u00ebzueshme. Para se t\u00eb shfaqej SCEP, ky proces k\u00ebrkonte pjes\u00ebmarrje aktive nga administratoret dhe nuk shkall\u00ebzohej mir\u00eb. Sot, ky protokoll \u00ebsht\u00eb nj\u00eb nga m\u00eb t\u00eb p\u00ebrhapurit.<\/p>\n

Sa i p\u00ebrket EST, ai lejon klient\u00ebt PKI t\u00eb marrin certifikata p\u00ebrmes kanaleve t\u00eb sigurta. Ai aplikon TLS p\u00ebr d\u00ebrgimin e mesazheve dhe l\u00ebshimin e SSL, si dhe p\u00ebr t\u00eb lidhur CSR me d\u00ebrguesin. P\u00ebr m\u00eb tep\u00ebr, EST mb\u00ebshtet metoda t\u00eb kriptografis\u00eb eliptike, duke krijuar nj\u00eb nivel shtes\u00eb mbrojtjeje.<\/p>\n

Sipas sipas ekspert\u00ebve<\/a><\/noindex>, zgjidhjet si ACME pritet t\u00eb fitojn\u00eb nj\u00eb shp\u00ebrndarje m\u00eb t\u00eb gjer\u00eb. Ato ofrojn\u00eb nj\u00eb model t\u00eb thjeshtuar dhe t\u00eb sigurt p\u00ebr konfigurimin e SSL dhe gjithashtu p\u00ebrshpejtojn\u00eb procesin.<\/p>\n

Postime t\u00eb tjera nga blogu yn\u00eb korporativ:<\/h5>\n

<\/p>\n