{"id":83443,"date":"2020-05-31T13:42:09","date_gmt":"2020-05-31T11:42:09","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ustarevanie-kornevogo-sertifikata-addtrust-privelo-k-sboyam-v-sistemah-s-openssl-i-gnutls"},"modified":"2020-05-31T13:42:09","modified_gmt":"2020-05-31T11:42:09","slug":"ustarevanie-kornevogo-sertifikata-addtrust-privelo-k-sboyam-v-sistemah-s-openssl-i-gnutls","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/ustarevanie-kornevogo-sertifikata-addtrust-privelo-k-sboyam-v-sistemah-s-openssl-i-gnutls","title":{"rendered":"Dhaloja e skem\u00ebs rr\u00ebnj\u00ebsore AddTrust \u00e7oi n\u00eb d\u00ebshtime n\u00eb sistemet me OpenSSL dhe GnuTLS","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

30 maj u skadenc\u00ebn 20-vje\u00e7are t\u00eb certifikat\u00ebs rr\u00ebnj\u00ebsore AddTrust<\/a><\/noindex>, i cili u p\u00ebrdor<\/a><\/noindex> p\u00ebr formimin e n\u00ebnshkrimit nd\u00ebrmjet\u00ebs (cross-signed) n\u00eb certifikatat e nj\u00eb prej qendrave t\u00eb m\u00ebdha t\u00eb certifikimit Sectigo (Comodo). N\u00ebnshkrimi nd\u00ebrmjet\u00ebs siguron kompatibilitet me pajisje t\u00eb vjetra, n\u00eb memorjen e certifikatave rr\u00ebnj\u00ebsore t\u00eb cilave nuk u \u00ebsht\u00eb shtuar certifikata e re USERTRust. <\/p>\n

\"Dhaloja<\/a><\/noindex><\/center><\/p>\n

Teorikisht, skadimi i certifikat\u00ebs rr\u00ebnj\u00ebsore AddTrust do t\u00eb rezultonte n\u00eb nj\u00eb humbje t\u00eb vet\u00ebm t\u00eb kompatibilitetit me sistemet e vjetra (Android 2.3, Windows XP, Mac OS X 10.11, iOS 9 etj.), pasi certifikata e dyt\u00eb rr\u00ebnj\u00ebsore, e p\u00ebrdorur n\u00eb n\u00ebnshkrimin nd\u00ebrmjet\u00ebs, mbetet e vlefshme dhe shfletuesit modern\u00eb e konsiderojn\u00eb at\u00eb n\u00eb verifikimin e zinxhirit t\u00eb besimit. N\u00eb praktik\u00eb u zbuluan<\/a><\/noindex> probleme me verifikimin e n\u00ebnshkrimit nd\u00ebrmjet\u00ebs n\u00eb klient\u00ebt q\u00eb nuk p\u00ebrdorin shfletuesit TLS, p\u00ebrfshir\u00eb ata t\u00eb bazuar n\u00eb OpenSSL 1.0.x dhe GnuTLS. Koneksioni i sigurt ka pushuar s\u00eb funksionuari duke nxjerr\u00eb nj\u00eb mesazh gabimi p\u00ebr skadimin e certifikat\u00ebs, n\u00ebse n\u00eb server p\u00ebrdoret nj\u00eb certifikat\u00eb Sectigo, e lidhur me zinxhirin e besimit me certifikat\u00ebn rr\u00ebnj\u00ebsore AddTrust.<\/p>\n

N\u00ebse p\u00ebrdoruesit e shfletuesve modern\u00eb nuk v\u00ebn\u00eb re skadimin e certifikat\u00ebs rr\u00ebnj\u00ebsore AddTrust gjat\u00eb p\u00ebrpunimit t\u00eb certifikatave t\u00eb n\u00ebnshkruara nd\u00ebrmjet\u00ebsisht nga Sectigo, problemet filluan t\u00eb shfaqen n\u00eb aplikacione t\u00eb ndryshme dhe p\u00ebrpunues server\u00ebsh, \u00e7ka \u00e7oi n\u00eb shkelje t\u00eb<\/a><\/noindex> punimin<\/a><\/noindex> e shum\u00eb infrastrukturave q\u00eb p\u00ebrdorin kanale t\u00eb enkriptuara p\u00ebr interaksionin midis komponenteve. <\/p>\n

P\u00ebr shembull, u shfaq\u00ebn problemet<\/a><\/noindex> me lidhje me disa depozit\u00eb paketash n\u00eb Debian dhe Ubuntu (apt filloi t\u00eb jepte nj\u00eb gabim verifikimi certifikate), po ndodhin d\u00ebshtime n\u00eb thirrjet nga skriptet duke p\u00ebrdorur mjetet \u00abcurl\u00bb dhe \u00abwget\u00bb, si dhe gabime gjat\u00eb p\u00ebrdorimit t\u00eb Git. u prish<\/a><\/noindex> funksionimi i platform\u00ebs s\u00eb transmetimit Roku, ndaluar thirrjet e p\u00ebrpunuesve Stripe<\/a><\/noindex> dhe DataDog<\/a><\/noindex>, filluan t\u00eb shfaqen d\u00ebshtime<\/a><\/noindex> n\u00eb aplikacionet Heroku, ndal\u00ebn<\/a><\/noindex> klient\u00ebt OpenLDAP, u p\u00ebrjetuan probleme me d\u00ebrgimin e post\u00ebs n\u00eb server\u00ebt SMTPS dhe SMTP me STARTTLS. P\u00ebr m\u00eb tep\u00ebr, v\u00ebrehen probleme n\u00eb skriptet e ndryshme Ruby, PHP, dhe Python q\u00eb p\u00ebrdorin modul me klientin http. Nga shfletuesit, problemi dhe<\/a><\/noindex> Epiphany, n\u00eb t\u00eb cilin ndaluan ngarkimin e listave t\u00eb bllokimit t\u00eb reklamave.<\/p>\n

Programet n\u00eb gjuh\u00ebn Go nuk preken nga problemi, pasi n\u00eb Go ofrohet implementimi i tij<\/a><\/noindex> TLS.<\/p>\n

Pritej<\/a><\/noindex>, q\u00eb problemi prekte versionet e vjetra t\u00eb distribucioneve (p\u00ebrfshir\u00eb Debian 9, Ubuntu 16.04, RHEL 6\/7<\/a><\/noindex>) n\u00eb t\u00eb cilat p\u00ebrdoren deg\u00ebt problematike t\u00eb OpenSSL, por problemi u shfaq<\/a><\/noindex> edhe gjat\u00eb funksionimit t\u00eb menaxherit t\u00eb pakove APT n\u00eb versionet aktuale Debian 10 dhe Ubuntu 18.04\/20.04, pasi APT p\u00ebrdor bibliotek\u00ebn GnuTLS. Problemi n\u00eb thelb \u00ebsht\u00eb se shum\u00eb libra TLS\/SSL interpretojn\u00eb certifikat\u00ebn si nj\u00eb zinxhir linear, nd\u00ebrsa sipas RFC 4158, certifikata mund t\u00eb paraqes\u00eb nj\u00eb graf t\u00eb orientuar t\u00eb shp\u00ebrndar\u00eb ciklik me disa anker\u00eb besimi q\u00eb duhet t\u00eb merren parasysh. Ky problem i pap\u00ebrfunduar n\u00eb OpenSSL dhe GnuTLS t\u00eb ket\u00eb<\/a><\/noindex> dihet<\/a><\/noindex> ka qen\u00eb i njohur p\u00ebr shum\u00eb vite<\/a><\/noindex>. N\u00eb OpenSSL problemi u zgjidh n\u00eb deg\u00ebn 1.1.1, nd\u00ebrsa GnuTLS<\/a><\/noindex> mbetet nuk \u00ebsht\u00eb rregulluar<\/a><\/noindex>.<\/p>\n

Si nj\u00eb zgjidhje p\u00ebr problemin, propozohet q\u00eb t\u00eb hiqet nga depoja e sistemit certifikata \u00abAddTrust External CA Root\u00bb (p.sh., hiqeni nga \/etc\/ca-certificates.conf dhe \/etc\/ssl\/certs, pastaj nisni \u00abupdate-ca-certificates -f -v\u00bb), pas s\u00eb cil\u00ebs OpenSSL fillon t\u00eb p\u00ebrpunoj\u00eb normalisht certifikatat me n\u00ebnshkrim t\u00eb kryq\u00ebzuar t\u00eb implikuara. Kur p\u00ebrdorni menaxherin e paketave APT, mund t\u00eb \u00e7aktivizoni verifikimin e certifikatave p\u00ebr k\u00ebrkesa t\u00eb caktuara me rrezik t\u00eb plot\u00eb (p.sh., \u00abapt-get update -o Acquire::https::download.jitsi.org::Verify-Peer=false\u00bb). <\/p>\n

P\u00ebr t\u00eb bllokuar problemin n\u00eb Fedora<\/a><\/noindex> dhe RHEL<\/a><\/noindex> propozohet t\u00eb shtohet certifikata AddTrust n\u00eb list\u00ebn e bardh\u00eb:<\/p>\n

trust dump —filter «pkcs11:id=%AD%BD%98%7A%34%B4%26%F7%FA%C4%26%54%EF%03%BD%E0%24%CB%54%1A;type=cert» \
\n > \/etc\/pki\/ca-trust\/source\/blacklist\/addtrust-external-root.p11-kit
\n update-ca-trust extract<\/p>\n

Por ky metod\u00eb nuk funksionon<\/a><\/noindex> p\u00ebr GnuTLS (p\u00ebr shembull, vazhdon t\u00eb jepet nj\u00eb gabim verifikimi certifikate gjat\u00eb ekzekutimit t\u00eb utilit wget).<\/p>\n

Nga ana e serverit, mund t\u00eb ndryshoni<\/a><\/noindex> rendin<\/a><\/noindex> list\u00ebn e certifikatave n\u00eb zinxhirin e besueshm\u00ebris\u00eb, t\u00eb d\u00ebrguara nga serveri te klienti (n\u00ebse certifikata e lidhur me \u00abAddTrust External CA Root\u00bb hiqet nga lista, verifikimi nga klienti do t\u00eb kaloj\u00eb me sukses). P\u00ebr verifikimin dhe gjenerimin e nj\u00eb zinxhiri t\u00eb ri t\u00eb besueshm\u00ebris\u00eb, mund t\u00eb p\u00ebrdorni sh\u00ebrbimin whatsmychaincert.com<\/a><\/noindex>. Kompania Sectigo gjithashtu ofroi<\/a><\/noindex> certifikata alternative e n\u00ebnshkruar nd\u00ebrsjellt\u00eb \u00abAAA Certificate Services<\/a><\/noindex>\u00bb, e cila do t\u00eb jet\u00eb n\u00eb fuqi deri n\u00eb vitin 2028 dhe do t\u00eb lejoj\u00eb ruajtjen e p\u00ebrputhshm\u00ebris\u00eb me versionet e vjetra t\u00eb OS.<\/p>\n

Shtes\u00eb: Problemi gjithashtu shfaqet<\/a><\/noindex> n\u00eb LibreSSL.<\/p>\n

<\/a><\/noindex><\/p>\n

Burimi: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

30 \u043c\u0430\u044f \u0438\u0441\u0442\u0451\u043a 20-\u043b\u0435\u0442\u043d\u0438\u0439 \u0441\u0440\u043e\u043a \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u043a\u043e\u0440\u043d\u0435\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 AddTrust, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u043b\u0441\u044f \u0434\u043b\u044f \u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u0435\u0440\u0435\u043a\u0440\u0451\u0441\u0442\u043d\u043e\u0439 \u043f\u043e\u0434\u043f\u0438\u0441\u0438 (cross-signed) \u0432 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430\u0445 \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u043a\u0440\u0443\u043f\u043d\u0435\u0439\u0448\u0438\u0445 \u0443\u0434\u043e\u0441\u0442\u043e\u0432\u0435\u0440\u044f\u044e\u0449\u0438\u0445 \u0446\u0435\u043d\u0442\u0440\u043e\u0432 Sectigo (Comodo). \u041f\u0435\u0440\u0435\u043a\u0440\u0451\u0441\u0442\u043d\u0430\u044f \u043f\u043e\u0434\u043f\u0438\u0441\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u043b\u0430 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0442\u044c \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u0438\u043c\u043e\u0441\u0442\u044c \u0441 \u0443\u0441\u0442\u0430\u0440\u0435\u0432\u0448\u0438\u043c\u0438 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u043c\u0438, \u0432 \u0445\u0440\u0430\u043d\u0438\u043b\u0438\u0449\u0435 \u043a\u043e\u0440\u043d\u0435\u0432\u044b\u0445 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043d\u0435 \u0431\u044b\u043b \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d \u043d\u043e\u0432\u044b\u0439 \u043a\u043e\u0440\u043d\u0435\u0432\u043e\u0439 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 USERTRust. \u0422\u0435\u043e\u0440\u0435\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u043f\u0440\u0435\u043a\u0440\u0430\u0449\u0435\u043d\u0438\u0435 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u043a\u043e\u0440\u043d\u0435\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 AddTrust \u0434\u043e\u043b\u0436\u043d\u043e \u0431\u044b\u043b\u043e \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043b\u0438\u0448\u044c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":83444,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-83443","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Skadimi i certifikat\u00ebs rr\u00ebnj\u00ebsore AddTrust \u00e7oi n\u00eb gabime n\u00eb sistemet me OpenSSL dhe GnuTLS | ProHoster","description":"M\u00eb 30 maj skadoi afati 20-vje\u00e7ar i certifikat\u00ebs rr\u00ebnj\u00ebsore AddTrust, e cila","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/news\/ustarevanie-kornevogo-sertifikata-addtrust-privelo-k-sboyam-v-sistemah-s-openssl-i-gnutls","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u0441\u0442\u0430\u0440\u0435\u0432\u0430\u043d\u0438\u0435 \u043a\u043e\u0440\u043d\u0435\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 AddTrust \u043f\u0440\u0438\u0432\u0435\u043b\u043e \u043a \u0441\u0431\u043e\u044f\u043c \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u0441 OpenSSL \u0438 GnuTLS | ProHoster","og:description":"30 \u043c\u0430\u044f \u0438\u0441\u0442\u0451\u043a 20-\u043b\u0435\u0442\u043d\u0438\u0439 \u0441\u0440\u043e\u043a \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u043a\u043e\u0440\u043d\u0435\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 AddTrust, \u043a\u043e\u0442\u043e\u0440\u044b\u0439","og:url":"https:\/\/prohoster.info\/sq\/blog\/news\/ustarevanie-kornevogo-sertifikata-addtrust-privelo-k-sboyam-v-sistemah-s-openssl-i-gnutls","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-05-31T11:42:09+00:00","article:modified_time":"2020-05-31T11:42:09+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"83443","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 15:17:29","updated":"2022-09-28 18:33:53","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/83443","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=83443"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/83443\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media\/83444"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=83443"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=83443"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=83443"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}