{"id":83443,"date":"2020-05-31T13:42:09","date_gmt":"2020-05-31T11:42:09","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ustarevanie-kornevogo-sertifikata-addtrust-privelo-k-sboyam-v-sistemah-s-openssl-i-gnutls"},"modified":"2020-05-31T13:42:09","modified_gmt":"2020-05-31T11:42:09","slug":"ustarevanie-kornevogo-sertifikata-addtrust-privelo-k-sboyam-v-sistemah-s-openssl-i-gnutls","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/ustarevanie-kornevogo-sertifikata-addtrust-privelo-k-sboyam-v-sistemah-s-openssl-i-gnutls","title":{"rendered":"Skadimi i certifikat\u00ebs s\u00eb rr\u00ebnj\u00ebs AddTrust ka \u00e7uar n\u00eb probleme n\u00eb sistemet me OpenSSL dhe GnuTLS","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

M\u00eb 30 maj skadoi afati 20-vje\u00e7ar i certifikat\u00ebs rr\u00ebnj\u00ebsore AddTrust<\/a><\/noindex>, i cili u p\u00ebrdor<\/a><\/noindex> p\u00ebr formimin e n\u00ebnshkrimit t\u00eb kryq\u00ebzuar (cross-signed) n\u00eb certifikatat e nj\u00eb prej qendrave m\u00eb t\u00eb m\u00ebdha t\u00eb besueshm\u00ebris\u00eb Sectigo (Comodo). N\u00ebnshkrimi i kryq\u00ebzuar lejoi t\u00eb siguroj\u00eb p\u00ebrputhshm\u00ebrin\u00eb me pajisjet e vjetruara, n\u00eb magazin\u00ebn e certifikatave rr\u00ebnj\u00ebsore t\u00eb cilave nuk iu shtua certifikata e re rr\u00ebnj\u00ebsore USERTrust. <\/p>\n

\"Skadimi<\/a><\/noindex><\/center><\/p>\n

Teorikisht, skadimi i vlefshm\u00ebris\u00eb s\u00eb certifikat\u00ebs rr\u00ebnj\u00ebsore AddTrust do t\u00eb duhej t\u00eb \u00e7onte vet\u00ebm n\u00eb nj\u00eb nj\u00ebsoj t\u00eb pap\u00ebrputhshm\u00ebris\u00eb me sistemet e vjetra (Android 2.3, Windows XP, Mac OS X 10.11, iOS 9, etj.), pasi certifikata e dyt\u00eb rr\u00ebnj\u00ebsore, q\u00eb p\u00ebrdoret n\u00eb n\u00ebnshkrimin e kryq\u00ebzuar, mbetet e r\u00ebnd\u00ebsishme dhe shfletuesit modern\u00eb e konsiderojn\u00eb at\u00eb gjat\u00eb verifikimit t\u00eb zinxhirit t\u00eb besueshm\u00ebris\u00eb. N\u00eb praktik\u00eb u zbuluan<\/a><\/noindex> probleme me verifikimin e n\u00ebnshkrimit t\u00eb kryq\u00ebzuar n\u00eb klient\u00ebt e TLS q\u00eb nuk p\u00ebrdorin shfletues, p\u00ebrfshir\u00eb ato t\u00eb bazuara n\u00eb OpenSSL 1.0.x dhe GnuTLS. Lidhja e sigurt ka pushuar s\u00eb u krijuari me nj\u00eb mesazh gabimi q\u00eb tregon skadimin e certifikat\u00ebs, n\u00ebse n\u00eb server p\u00ebrdoret nj\u00eb certifikat\u00eb Sectigo e lidhur me zinxhirin e besueshm\u00ebris\u00eb me certifikat\u00ebn rr\u00ebnj\u00ebsore AddTrust.<\/p>\n

N\u00ebse p\u00ebrdoruesit e shfletuesve modern\u00eb nuk vun\u00eb re skadimin e certifikat\u00ebs rr\u00ebnj\u00ebsore AddTrust gjat\u00eb p\u00ebrpunimit t\u00eb certifikatave t\u00eb n\u00ebnshkruara kryq\u00ebzisht nga Sectigo, problemet filluan t\u00eb shfaqen n\u00eb aplikacione t\u00eb ndryshme t\u00eb pal\u00ebve t\u00eb treta dhe procesor\u00ebt e server\u00ebve, \u00e7ka \u00e7oi n\u00eb shkeljen<\/a><\/noindex> e funksionit<\/a><\/noindex> t\u00eb shum\u00eb infrastruktrave q\u00eb p\u00ebrdorin kanale t\u00eb koduara p\u00ebr komunikim midis komponent\u00ebve. <\/p>\n

P\u00ebr shembull, u shfaq\u00ebn problemet<\/a><\/noindex> me nj\u00eb qasje n\u00eb disa depo paketash n\u00eb Debian dhe Ubuntu (apt filloi t\u00eb jap\u00eb nj\u00eb gabim verifikimi t\u00eb certifikat\u00ebs), ka filluar t\u00eb d\u00ebshtoj\u00eb p\u00ebr t\u00eb b\u00ebr\u00eb thirrje nga skriptet duke p\u00ebrdorur utilitat \u00abcurl\u00bb dhe \u00abwget\u00bb, dhe v\u00ebrehen gabime kur p\u00ebrdoret Git, u shkel<\/a><\/noindex> funksioni i platform\u00ebs s\u00eb transmetimit Roku, u ndal\u00ebn thirrjet e procesor\u00ebve Stripe<\/a><\/noindex> dhe DataDog<\/a><\/noindex>, filluan t\u00eb shfaqen \u00e7arje<\/a><\/noindex> n\u00eb aplikacionet Heroku, ndaluan<\/a><\/noindex> klient\u00ebt OpenLDAP, u v\u00ebrejt\u00ebn probleme me d\u00ebrgimin e post\u00ebs n\u00eb server\u00ebt SMTPS dhe SMTP me STARTTLS. P\u00ebr m\u00eb tep\u00ebr, u v\u00ebrejt\u00ebn probleme n\u00eb skriptet e ndryshme Ruby, PHP dhe Python, q\u00eb p\u00ebrdorin modul me klientin http. N\u00eb shfletuesit, problemi preket<\/a><\/noindex> Epiphany, n\u00eb t\u00eb cilin nuk u ngarkuan listat e bllokimit t\u00eb reklamave.<\/p>\n

Programet n\u00eb gjuh\u00ebn Go nuk jan\u00eb prekur nga problemi, pasi n\u00eb Go ofrohet implementimi i vet<\/a><\/noindex> TLS.<\/p>\n

I supozuar<\/a><\/noindex>, q\u00eb problemi prek versionet e vjetra t\u00eb distribucioneve (p\u00ebrfshir\u00eb Debian 9, Ubuntu 16.04, RHEL 6\/7<\/a><\/noindex>) n\u00eb t\u00eb cilat p\u00ebrdoren deg\u00ebt problematike t\u00eb OpenSSL, por problemi u shfaq<\/a><\/noindex> po ashtu gjat\u00eb p\u00ebrdorimit t\u00eb menaxherit t\u00eb paketave APT n\u00eb versionet aktuale t\u00eb Debian 10 dhe Ubuntu 18.04\/20.04, pasi APT p\u00ebrdor bibliotek\u00ebn GnuTLS. Thelbi i problemit \u00ebsht\u00eb se shum\u00eb bibliotekat TLS\/SSL e interpretojn\u00eb certifikat\u00ebn si nj\u00eb varg linear, nd\u00ebrsa sipas RFC 4158 certifikata mund t\u00eb p\u00ebrfaq\u00ebsoj\u00eb nj\u00eb grafik t\u00eb orientuar ciklik t\u00eb shp\u00ebrndar\u00eb me disa pik\u00ebgrindje besimi q\u00eb duhet t\u00eb merren parasysh. Kjo mang\u00ebsi \u00ebsht\u00eb raportuar p\u00ebr OpenSSL dhe GnuTLS ka qen\u00eb<\/a><\/noindex> dihet<\/a><\/noindex> m\u00eb shum\u00eb se disa vite<\/a><\/noindex>. N\u00eb OpenSSL problemi u zgjidh n\u00eb deg\u00ebn 1.1.1, nd\u00ebrsa n\u00eb GnuTLS<\/a><\/noindex> mbetet nuk \u00ebsht\u00eb zgjidhur<\/a><\/noindex>.<\/p>\n

Si nj\u00eb zgjidhje alternativa p\u00ebr t\u00eb eliminuar d\u00ebshtimin, propozohet t\u00eb hiqet nga depoja e sistemit certifikata \u00abAddTrust External CA Root\u00bb (p.sh., hiqni nga \/etc\/ca-certificates.conf dhe \/etc\/ssl\/certs, pastaj ekzekutoni \u00abupdate-ca-certificates -f -v\u00bb), pas s\u00eb cil\u00ebs OpenSSL fillon t\u00eb trajtoj\u00eb normalisht certifikatat e n\u00ebnshkruara n\u00eb kryq q\u00eb kan\u00eb p\u00ebrfshir\u00eb k\u00ebt\u00eb. Duke p\u00ebrdorur menaxherin e paketave APT mund t\u00eb \u00e7aktivizoni kontrollet e certifikatave p\u00ebr k\u00ebrkesa t\u00eb ve\u00e7anta (p.sh., \u00abapt-get update -o Acquire::https::download.jitsi.org::Verify-Peer=false\u00bb). <\/p>\n

P\u00ebr t\u00eb bllokuar problemin n\u00eb Fedora<\/a><\/noindex> dhe RHEL<\/a><\/noindex> sugjerohet t\u00eb shtohet certifikata AddTrust n\u00eb list\u00ebn e zez\u00eb:<\/p>\n

besnik grumbull —filtri «pkcs11:id=;type=cert» \
\n > \/etc\/pki\/ca-trust\/source\/blacklist\/addtrust-external-root.p11-kit
\n update-ca-trust extract<\/p>\n

Por ky metod\u00eb nuk funksionon<\/a><\/noindex> p\u00ebr GnuTLS (p.sh., vazhdon t\u00eb jepet nj\u00eb gabim verifikimi t\u00eb certifikat\u00ebs gjat\u00eb ekzekutimit t\u00eb utilitarit wget).<\/p>\n

N\u00eb an\u00ebn e serverit, mund t\u00eb ndryshoni<\/a><\/noindex> renditjen<\/a><\/noindex> numrimi i certifikatave n\u00eb zinxhirin e besimit, t\u00eb d\u00ebrguara nga serveri te klienti (n\u00ebse certifikata e lidhur me \u00abAddTrust External CA Root\u00bb do t\u00eb hiqet nga lista, at\u00ebher\u00eb kontrolli nga klienti do t\u00eb kaloj\u00eb me sukses). P\u00ebr t\u00eb kontrolluar dhe gjeneruar nj\u00eb zinxhir besimi t\u00eb ri mund t\u00eb p\u00ebrdoret sh\u00ebrbimi whatsmychaincert.com<\/a><\/noindex>. Kompania Sectigo gjithashtu ka ofruar<\/a><\/noindex> certifikata alternative e nd\u00ebrmjetme e n\u00ebnshkruar n\u00eb kryq \u00abAAA Certificate Services<\/a><\/noindex>\u00bb, e cila do t\u00eb jet\u00eb e vlefshme deri n\u00eb vitin 2028 dhe do t\u00eb leht\u00ebsoj\u00eb ruajtjen e p\u00ebrputhshm\u00ebris\u00eb me versionet e vjetra t\u00eb OS.<\/p>\n

Shtes\u00eb: Problemi gjithashtu shfaqet<\/a><\/noindex> n\u00eb LibreSSL.<\/p>\n

<\/a><\/noindex><\/p>\n

Burimi: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

30 \u043c\u0430\u044f \u0438\u0441\u0442\u0451\u043a 20-\u043b\u0435\u0442\u043d\u0438\u0439 \u0441\u0440\u043e\u043a \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u043a\u043e\u0440\u043d\u0435\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 AddTrust, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u043b\u0441\u044f \u0434\u043b\u044f \u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u0435\u0440\u0435\u043a\u0440\u0451\u0441\u0442\u043d\u043e\u0439 \u043f\u043e\u0434\u043f\u0438\u0441\u0438 (cross-signed) \u0432 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430\u0445 \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u043a\u0440\u0443\u043f\u043d\u0435\u0439\u0448\u0438\u0445 \u0443\u0434\u043e\u0441\u0442\u043e\u0432\u0435\u0440\u044f\u044e\u0449\u0438\u0445 \u0446\u0435\u043d\u0442\u0440\u043e\u0432 Sectigo (Comodo). \u041f\u0435\u0440\u0435\u043a\u0440\u0451\u0441\u0442\u043d\u0430\u044f \u043f\u043e\u0434\u043f\u0438\u0441\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u043b\u0430 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0442\u044c \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u0438\u043c\u043e\u0441\u0442\u044c \u0441 \u0443\u0441\u0442\u0430\u0440\u0435\u0432\u0448\u0438\u043c\u0438 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u043c\u0438, \u0432 \u0445\u0440\u0430\u043d\u0438\u043b\u0438\u0449\u0435 \u043a\u043e\u0440\u043d\u0435\u0432\u044b\u0445 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043d\u0435 \u0431\u044b\u043b \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d \u043d\u043e\u0432\u044b\u0439 \u043a\u043e\u0440\u043d\u0435\u0432\u043e\u0439 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 USERTRust. \u0422\u0435\u043e\u0440\u0435\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u043f\u0440\u0435\u043a\u0440\u0430\u0449\u0435\u043d\u0438\u0435 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u043a\u043e\u0440\u043d\u0435\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 AddTrust \u0434\u043e\u043b\u0436\u043d\u043e \u0431\u044b\u043b\u043e \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043b\u0438\u0448\u044c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":83444,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-83443","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Tkurrja e certifikat\u00ebs rr\u00ebnj\u00ebsore AddTrust ka shkaktuar probleme n\u00eb sistemet me OpenSSL dhe GnuTLS | ProHoster","description":"30 maj, u skadua periudha 20-vje\u00e7are e vlefshm\u00ebris\u00eb s\u00eb certifikat\u00ebs rr\u00ebnj\u00ebsore AddTrust, e cila","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/news\/ustarevanie-kornevogo-sertifikata-addtrust-privelo-k-sboyam-v-sistemah-s-openssl-i-gnutls","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u0441\u0442\u0430\u0440\u0435\u0432\u0430\u043d\u0438\u0435 \u043a\u043e\u0440\u043d\u0435\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 AddTrust \u043f\u0440\u0438\u0432\u0435\u043b\u043e \u043a \u0441\u0431\u043e\u044f\u043c \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u0441 OpenSSL \u0438 GnuTLS | ProHoster","og:description":"30 \u043c\u0430\u044f \u0438\u0441\u0442\u0451\u043a 20-\u043b\u0435\u0442\u043d\u0438\u0439 \u0441\u0440\u043e\u043a \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u043a\u043e\u0440\u043d\u0435\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 AddTrust, \u043a\u043e\u0442\u043e\u0440\u044b\u0439","og:url":"https:\/\/prohoster.info\/sq\/blog\/news\/ustarevanie-kornevogo-sertifikata-addtrust-privelo-k-sboyam-v-sistemah-s-openssl-i-gnutls","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-05-31T11:42:09+00:00","article:modified_time":"2020-05-31T11:42:09+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"83443","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 15:17:29","updated":"2022-09-28 18:33:53","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/83443","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=83443"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/83443\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media\/83444"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=83443"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=83443"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=83443"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}