{"id":52168,"date":"2019-11-02T00:00:00","date_gmt":"2019-11-01T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/mozilla-cloudflare-i-facebook-predstavili-tls-rasshirenie-dlya-delegirovaniya-korotkozhivushhih-sertifikatov"},"modified":"2020-02-18T13:59:50","modified_gmt":"2020-02-18T10:59:50","slug":"mozilla-cloudflare-i-facebook-predstavili-tls-rasshirenie-dlya-delegirovaniya-korotkozhivushhih-sertifikatov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/news\/mozilla-cloudflare-i-facebook-predstavili-tls-rasshirenie-dlya-delegirovaniya-korotkozhivushhih-sertifikatov","title":{"rendered":"Mozilla, Cloudflare och Facebook har presenterat en TLS-till\u00e4gg f\u00f6r delegering av kortlivade certifikat","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Mozilla<\/a><\/noindex>, Cloudflare<\/a><\/noindex> och Facebook<\/a><\/noindex> tillsammans tillk\u00e4nnagav en ny TLS-f\u00f6rl\u00e4ngning Delegated Credentials<\/a><\/noindex> (DC), vilket l\u00f6ser problemet med certifikat n\u00e4r man organiserar \u00e5tkomst till webbplatsen via inneh\u00e5llsdistributionsn\u00e4tverk. De certifikat som utf\u00e4rdas av certifieringsmyndigheter har l\u00e5ng giltighet, vilket skapar sv\u00e5righeter n\u00e4r det \u00e4r n\u00f6dv\u00e4ndigt att organisera \u00e5tkomst till webbplatsen via en tredjepartstj\u00e4nst, vilket kr\u00e4ver uppr\u00e4ttande av en s\u00e4ker anslutning, eftersom \u00f6verf\u00f6ringen av webbplatsens certifikat till den externa tj\u00e4nsten skapar ytterligare s\u00e4kerhetshot. <\/p>\n

Den nya f\u00f6rl\u00e4ngningen kan ocks\u00e5 vara anv\u00e4ndbar f\u00f6r webbplatser vars verksamhet st\u00f6ds av stora distribuerade infrastrukturer med m\u00e5nga belastningsbalanserare. Delegated Credentials g\u00f6r det m\u00f6jligt att undvika lagring av kopior av privata nycklar f\u00f6r huvudcertifikat p\u00e5 varje nod som levererar inneh\u00e5ll. Vid den klassiska metoden kan en framg\u00e5ngsrik attack p\u00e5 n\u00e5gon av servrarna som deltar i leveransen av HTTPS-trafik leda till att hela certifikatet \u00e4ventyras. N\u00e4r privata nycklar \u00f6verf\u00f6rs till inneh\u00e5llsdistributionsn\u00e4tverk uppst\u00e5r hot om dataf\u00f6rlust till f\u00f6ljd av \u00e5tg\u00e4rder fr\u00e5n personal, underr\u00e4ttelsetj\u00e4nster eller kompromettering av CDN-infrastruktur. <\/p>\n

Om l\u00e4ckan av nycklar f\u00f6rblir ouppt\u00e4ckt kan de som f\u00e5tt tillg\u00e5ng till nycklarna under en l\u00e4ngre tid g\u00e5 obem\u00e4rkt in i webbplatsens trafik (MITM), eftersom certifikatens giltighetsperioder r\u00e4knas i m\u00e5nader och \u00e5r. F\u00f6r att skydda certifikatnycklarna hos Cloudflare kan anv\u00e4ndas<\/a><\/noindex> speciella nyckelservrar anv\u00e4ndas, som arbetar p\u00e5 webbplats\u00e4garens sida, men arbete i det l\u00e4get medf\u00f6r m\u00e4rkbara f\u00f6rdr\u00f6jningar i trafikleveransen, minskar tillf\u00f6rlitligheten p\u00e5 grund av ett extra led och kr\u00e4ver en komplex infrastruktur.<\/p>\n

Den f\u00f6reslagna TLS-f\u00f6rl\u00e4ngningen Delegated Credentials introducerar en ytterligare mellanliggande privat nyckel, vars giltighetstid \u00e4r begr\u00e4nsad till timmar eller n\u00e5gra dagar (h\u00f6gst 7 dagar). Denna nyckel genereras baserat p\u00e5 det certifikat som utf\u00e4rdats av certifieringsmyndigheten och g\u00f6r det m\u00f6jligt att h\u00e5lla den ursprungliga certifikatets privata nyckel hemlig f\u00f6r inneh\u00e5llsdistributionssituationer, och ger dem endast ett tillf\u00e4lligt certifikat med kort livsl\u00e4ngd. <\/p>\n

\"Mozilla,<\/a><\/noindex><\/center><\/p>\n

F\u00f6r att undvika \u00e5tkomstproblem efter att livsl\u00e4ngden f\u00f6r den intermedi\u00e4ra nyckeln har g\u00e5tt ut, finns det en teknik f\u00f6r automatisk uppdatering som utf\u00f6rs p\u00e5 sidan av den ursprungliga TLS-servern. Ingen manuell \u00e5tg\u00e4rd eller skript k\u00f6rning kr\u00e4vs f\u00f6r generationen \u2014 den auktoriserade servern, som beh\u00f6ver den privata nyckeln, kontaktar den ursprungliga TLS-servern p\u00e5 webbplatsen innan den f\u00f6reg\u00e5ende nyckeln g\u00e5r ut och den genererar en intermedi\u00e4r nyckel f\u00f6r en ny kort tidsperiod.<\/p>\n

\"Mozilla,<\/a><\/noindex><\/center><\/p>\n

Webbl\u00e4sare som st\u00f6der TLS-till\u00e4gget Delegated Credentials kommer att uppfatta s\u00e5dana derivatcertifikat som betrodda. Till exempel har st\u00f6det f\u00f6r detta till\u00e4gg redan lagts till i nattliga byggen och beta-versioner av Firefox och kan aktiveras i about:config genom att \u00e4ndra inst\u00e4llningen \"security.tls.enable_delegated_credentials\". I mitten av november planeras ocks\u00e5 ett experiment bland en viss procent av anv\u00e4ndarna av testversionerna av Firefox.TLS Delegated Credentials Experiment<\/a><\/noindex>I ramverket av detta experiment kommer en testf\u00f6rfr\u00e5gan att skickas till DC-servern p\u00e5 Cloudflare f\u00f6r att kontrollera kvalit\u00e9n p\u00e5 implementeringen av det nya TLS-till\u00e4gget. St\u00f6det f\u00f6r Delegated Credentials \u00e4r ocks\u00e5 redan inbyggt i biblioteket. Fizz<\/a><\/noindex> med implementeringen av TLS 1.3.<\/p>\n

Specifikationen f\u00f6r Delegated Credentials har \u00f6verl\u00e4mnats till IETF-kommitt\u00e9n (Internet Engineering Task Force), som ansvarar f\u00f6r utveckling av protokoll och arkitektur f\u00f6r Internet, och \u00e4r f\u00f6r n\u00e4rvarande utkast<\/a><\/noindex>, som ans\u00f6ker om att bli en internetstandard. Till\u00e4gget Delegated Credentials kan endast anv\u00e4ndas med TLSv1.3.
\nF\u00f6r att generera mellanliggande nycklar kr\u00e4vs en TLS-certifikat som inkluderar ett speciellt X.509-till\u00e4gg, som f\u00f6r n\u00e4rvarande endast st\u00f6ds av certifikatutf\u00e4rdaren DigiCert. <\/p>\n

<\/a><\/noindex><\/p>\n

K\u00e4lla: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

Mozilla, Cloudflare \u0438 Facebook \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u043e \u0430\u043d\u043e\u043d\u0441\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u043d\u043e\u0432\u043e\u0435 TLS-\u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u0435 Delegated Credentials (DC), \u0440\u0435\u0448\u0430\u044e\u0449\u0435\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443 c \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430\u043c\u0438 \u043f\u0440\u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0441\u0430\u0439\u0442\u0443 \u0447\u0435\u0440\u0435\u0437 \u0441\u0435\u0442\u0438 \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u0430. \u0412\u044b\u0434\u0430\u0432\u0430\u0435\u043c\u044b\u0435 \u0443\u0434\u043e\u0441\u0442\u043e\u0432\u0435\u0440\u044f\u044e\u0449\u0438\u043c\u0438 \u0446\u0435\u043d\u0442\u0440\u0430\u043c\u0438 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u044b \u0438\u043c\u0435\u044e\u0442 \u0434\u043b\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0439 \u0441\u0440\u043e\u043a \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f, \u0447\u0442\u043e \u0441\u043e\u0437\u0434\u0430\u0451\u0442 \u0442\u0440\u0443\u0434\u043d\u043e\u0441\u0442\u0438 \u043f\u0440\u0438 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0441\u0430\u0439\u0442\u0443 \u0447\u0435\u0440\u0435\u0437 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0439 \u0441\u0435\u0440\u0432\u0438\u0441, \u043e\u0442 \u043b\u0438\u0446\u0430 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0434\u043e\u043b\u0436\u043d\u043e \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0442\u044c\u0441\u044f \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u043e\u0435 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0435, \u0442\u0430\u043a \u043a\u0430\u043a \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0430 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-52168","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Mozilla, Cloudflare och Facebook presenterade TLS-till\u00e4gget f\u00f6r att delegera kortlivade certifikat | ProHoster","description":"Mozilla,","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/news\/mozilla-cloudflare-i-facebook-predstavili-tls-rasshirenie-dlya-delegirovaniya-korotkozhivushhih-sertifikatov","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Mozilla, Cloudflare \u0438 Facebook \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0438 TLS-\u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u0435 \u0434\u043b\u044f \u0434\u0435\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043a\u043e\u0440\u043e\u0442\u043a\u043e\u0436\u0438\u0432\u0443\u0449\u0438\u0445 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 | ProHoster","og:description":"Mozilla,","og:url":"https:\/\/prohoster.info\/sv\/blog\/news\/mozilla-cloudflare-i-facebook-predstavili-tls-rasshirenie-dlya-delegirovaniya-korotkozhivushhih-sertifikatov","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-11-01T21:00:00+00:00","article:modified_time":"2020-02-18T10:59:50+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"52168","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 02:44:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 13:40:57","updated":"2026-01-24 02:44:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/52168","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=52168"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/52168\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=52168"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=52168"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=52168"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}