{"id":83443,"date":"2020-05-31T13:42:09","date_gmt":"2020-05-31T11:42:09","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ustarevanie-kornevogo-sertifikata-addtrust-privelo-k-sboyam-v-sistemah-s-openssl-i-gnutls"},"modified":"2020-05-31T13:42:09","modified_gmt":"2020-05-31T11:42:09","slug":"ustarevanie-kornevogo-sertifikata-addtrust-privelo-k-sboyam-v-sistemah-s-openssl-i-gnutls","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/news\/ustarevanie-kornevogo-sertifikata-addtrust-privelo-k-sboyam-v-sistemah-s-openssl-i-gnutls","title":{"rendered":"F\u00f6r\u00e5ldringen av rotcertifikatet AddTrust ledde till nedbrutna system med OpenSSL och GnuTLS","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

30 maj gick den 20-\u00e5riga giltighetstiden f\u00f6r rotcertifikatet ut AddTrust<\/a><\/noindex>, som anv\u00e4ndes<\/a><\/noindex> f\u00f6r att skapa en korssignatur i certifikat fr\u00e5n en av de st\u00f6rsta certifikatutf\u00e4rdarna Sectigo (Comodo). Korssignaturen m\u00f6jliggjorde kompatibilitet med gammal utrustning som inte hade lagt till det nya rotcertifikatet USERTrust i sitt rotcertifikatlager. <\/p>\n

\"F\u00f6r\u00e5ldringen<\/a><\/noindex><\/center><\/p>\n

Teoretiskt skulle upph\u00f6randet av rotcertifikatet AddTrust enbart ha lett till en f\u00f6rlust av kompatibilitet med gamla system (Android 2.3, Windows XP, Mac OS X 10.11, iOS 9 etc.), eftersom det andra rotcertifikatet som anv\u00e4nds i korssignaturen f\u00f6rblir aktuellt och moderna webbl\u00e4sare beaktar det vid verifiering av f\u00f6rtroendekedjan. I praktiken uppt\u00e4cktes<\/a><\/noindex> problem med verifiering av korssignaturen i TLS-klienter som inte anv\u00e4nder webbl\u00e4sare, inklusive de som baseras p\u00e5 OpenSSL 1.0.x och GnuTLS. En s\u00e4ker anslutning kunde inte uppr\u00e4ttas, med ett felmeddelande om att certifikatet har upph\u00f6rt att g\u00e4lla, om servern anv\u00e4nder ett Sectigo-certifikat som \u00e4r kopplat till f\u00f6rtroendekedjan med rotcertifikatet AddTrust.<\/p>\n

Om anv\u00e4ndarna av moderna webbl\u00e4sare inte m\u00e4rkte att rotcertifikatet AddTrust hade upph\u00f6rt vid hantering av korssignerade certifikat fr\u00e5n Sectigo, s\u00e5 b\u00f6rjade problem dyka upp i olika tredjepartsapplikationer och serverbehandlare, vilket ledde till till st\u00f6rningar<\/a><\/noindex> drift<\/a><\/noindex> av m\u00e5nga infrastrukturer som anv\u00e4nder krypterade kommunikationskanaler f\u00f6r interaktion mellan komponenter. <\/p>\n

Till exempel uppstod det problem<\/a><\/noindex> med tillg\u00e5ng till vissa paketf\u00f6rr\u00e5d i Debian och Ubuntu (apt b\u00f6rjade ge felmeddelande vid certifikatverifiering), slutade skriptanrop med hj\u00e4lp av verktygen \u00abcurl\u00bb och \u00abwget\u00bb att fungera, och det observeras fel vid anv\u00e4ndning av Git, komplicerades<\/a><\/noindex> driften av streamingplattformen Roku, behandlingarna f\u00f6r Stripe<\/a><\/noindex> och DataDog<\/a><\/noindex>, b\u00f6rjade krascha<\/a><\/noindex> i Heroku-applikationer, klienter till OpenLDAP kunde inte ansluta, det blev problem med att skicka e-post till SMTPS- och SMTP-servrar med STARTTLS. Dessutom observerades problem i olika Ruby-, PHP- och Python-skript som anv\u00e4nder en modul med HTTP-klient. Fr\u00e5n webbl\u00e4sarna var problemet<\/a><\/noindex> Epiphany, d\u00e4r blocklistorna slutade laddas. l\u00f6sningar baserade p\u00e5 det \u00f6ppna UPnP-stacket<\/a><\/noindex> Program p\u00e5 Go-spr\u00e5ket \u00e4r inte drabbade av problemet, eftersom Go erbjuder<\/p>\n

sin egen implementering av TLS.<\/a><\/noindex> TLS.<\/p>\n

Det antogs<\/a><\/noindex>, att problemet p\u00e5verkar \u00e4ldre versioner av distributioner (inklusive Debian 9, Ubuntu 16.04, RHEL 6\/7<\/a><\/noindex>) d\u00e4r problematiska OpenSSL-grenar anv\u00e4nds, men problemet upptr\u00e4dde<\/a><\/noindex> \u00e4ven vid anv\u00e4ndning av paketchefen APT i aktuella versioner av Debian 10 och Ubuntu 18.04\/20.04, eftersom APT anv\u00e4nder GnuTLS-biblioteket. Problemet \u00e4r att m\u00e5nga TLS\/SSL-bibliotek tolkar certifikat som en linj\u00e4r kedja, medan enligt RFC 4158 kan ett certifikat representera en riktad distribuerad cyklisk graf med flera f\u00f6rtroendepunkter som m\u00e5ste beaktas. Detta problem i OpenSSL och GnuTLS var<\/a><\/noindex> har varit k\u00e4nt<\/a><\/noindex> i m\u00e5nga \u00e5r<\/a><\/noindex>. I OpenSSL har problemet \u00e5tg\u00e4rdats i version 1.1.1, medan i GnuTLS<\/a><\/noindex> f\u00f6rblir oudelad<\/a><\/noindex>.<\/p>\n

Som en tillf\u00e4llig l\u00f6sning p\u00e5 felet f\u00f6resl\u00e5s att ta bort certifikatet \u00abAddTrust External CA Root\u00bb fr\u00e5n systemlagringen (till exempel, ta bort det fr\u00e5n \/etc\/ca-certificates.conf och \/etc\/ssl\/certs, och k\u00f6r sedan \u00abupdate-ca-certificates -f -v\u00bb), efter vilket OpenSSL b\u00f6rjar hantera korssignerade certifikat korrekt. Vid anv\u00e4ndning av paketf\u00f6rvaltaren APT kan certifikatverifiering inaktiveras p\u00e5 egen risk f\u00f6r vissa f\u00f6rfr\u00e5gningar (till exempel \u00abapt-get update -o Acquire::https::download.jitsi.org::Verify-Peer=false\u00bb). <\/p>\n

F\u00f6r att blockera problemet i Fedora<\/a><\/noindex> och RHEL<\/a><\/noindex> f\u00f6resl\u00e5s att l\u00e4gga certifikatet AddTrust p\u00e5 svarta listan:<\/p>\n

trust dump \u2014filter \u00abpkcs11:id=;type=cert\u00bb \\
\n > \/etc\/pki\/ca-trust\/source\/blacklist\/addtrust-external-root.p11-kit
\n update-ca-trust extract<\/p>\n

Men denna metod funkar inte<\/a><\/noindex> f\u00f6r GnuTLS (till exempel forts\u00e4tter certifikatvalideringsfelet att visas vid k\u00f6rning av wget-verktyget).<\/p>\n

P\u00e5 serversidan kan man \u00e4ndra<\/a><\/noindex> ordningen<\/a><\/noindex> uppr\u00e4kning av certifikat i kedjan av f\u00f6rtroende som servern skickar till klienten (om det certifikat som \u00e4r kopplat till \u00abAddTrust External CA Root\u00bb tas bort fr\u00e5n listan, s\u00e5 kommer verifieringen av klienten att lyckas). F\u00f6r att verifiera och generera en ny kedja av f\u00f6rtroende kan tj\u00e4nsten anv\u00e4ndas whatsmychaincert.com<\/a><\/noindex>. F\u00f6retaget Sectigo har \u00e4ven tillhandah\u00e5llit<\/a><\/noindex> alternativt korssignerat mellancertifikat \u00abAAA Certificate Services<\/a><\/noindex>\u00ab, som kommer att vara giltigt till 2028 och m\u00f6jligg\u00f6ra kompatibilitet med gamla versioner av operativsystem.<\/p>\n

Till\u00e4gg: Problemet upptr\u00e4der ocks\u00e5 i LibreSSL.<\/a><\/noindex> VMware kommer att \u00f6verg\u00e5 till distansarbete p\u00e5 heltid f\u00f6r upp till 60 % av personalen<\/p>\n

<\/a><\/noindex><\/p>\n

K\u00e4lla: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

30 \u043c\u0430\u044f \u0438\u0441\u0442\u0451\u043a 20-\u043b\u0435\u0442\u043d\u0438\u0439 \u0441\u0440\u043e\u043a \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u043a\u043e\u0440\u043d\u0435\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 AddTrust, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u043b\u0441\u044f \u0434\u043b\u044f \u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u0435\u0440\u0435\u043a\u0440\u0451\u0441\u0442\u043d\u043e\u0439 \u043f\u043e\u0434\u043f\u0438\u0441\u0438 (cross-signed) \u0432 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430\u0445 \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u043a\u0440\u0443\u043f\u043d\u0435\u0439\u0448\u0438\u0445 \u0443\u0434\u043e\u0441\u0442\u043e\u0432\u0435\u0440\u044f\u044e\u0449\u0438\u0445 \u0446\u0435\u043d\u0442\u0440\u043e\u0432 Sectigo (Comodo). \u041f\u0435\u0440\u0435\u043a\u0440\u0451\u0441\u0442\u043d\u0430\u044f \u043f\u043e\u0434\u043f\u0438\u0441\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u043b\u0430 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0442\u044c \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u0438\u043c\u043e\u0441\u0442\u044c \u0441 \u0443\u0441\u0442\u0430\u0440\u0435\u0432\u0448\u0438\u043c\u0438 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u043c\u0438, \u0432 \u0445\u0440\u0430\u043d\u0438\u043b\u0438\u0449\u0435 \u043a\u043e\u0440\u043d\u0435\u0432\u044b\u0445 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043d\u0435 \u0431\u044b\u043b \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d \u043d\u043e\u0432\u044b\u0439 \u043a\u043e\u0440\u043d\u0435\u0432\u043e\u0439 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 USERTRust. \u0422\u0435\u043e\u0440\u0435\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u043f\u0440\u0435\u043a\u0440\u0430\u0449\u0435\u043d\u0438\u0435 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u043a\u043e\u0440\u043d\u0435\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 AddTrust \u0434\u043e\u043b\u0436\u043d\u043e \u0431\u044b\u043b\u043e \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043b\u0438\u0448\u044c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":83444,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-83443","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Upph\u00f6randet av rotcertifikatet AddTrust ledde till fel i system med OpenSSL och GnuTLS | ProHoster","description":"Den 30 maj l\u00f6pte den 20-\u00e5riga giltighetstiden f\u00f6r rotcertifikatet AddTrust ut, vilket","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/news\/ustarevanie-kornevogo-sertifikata-addtrust-privelo-k-sboyam-v-sistemah-s-openssl-i-gnutls","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u0441\u0442\u0430\u0440\u0435\u0432\u0430\u043d\u0438\u0435 \u043a\u043e\u0440\u043d\u0435\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 AddTrust \u043f\u0440\u0438\u0432\u0435\u043b\u043e \u043a \u0441\u0431\u043e\u044f\u043c \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u0441 OpenSSL \u0438 GnuTLS | ProHoster","og:description":"30 \u043c\u0430\u044f \u0438\u0441\u0442\u0451\u043a 20-\u043b\u0435\u0442\u043d\u0438\u0439 \u0441\u0440\u043e\u043a \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u043a\u043e\u0440\u043d\u0435\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 AddTrust, \u043a\u043e\u0442\u043e\u0440\u044b\u0439","og:url":"https:\/\/prohoster.info\/sv\/blog\/news\/ustarevanie-kornevogo-sertifikata-addtrust-privelo-k-sboyam-v-sistemah-s-openssl-i-gnutls","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-05-31T11:42:09+00:00","article:modified_time":"2020-05-31T11:42:09+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"83443","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 15:17:29","updated":"2022-09-28 18:33:53","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/83443","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=83443"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/83443\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media\/83444"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=83443"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=83443"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=83443"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}