Satifiketi Yopanga ya SSL/TLS Yatha Ntchito: Kukonza Zowonongeka Kwambiri za HSTS ndipo Tiyeni Tilembetse Midawu ya CAA/Rate-Limit¶

Pamene kupanga SSL/TLS (HTTPS) satifiketi imatha - ngakhale mphindi imodzi yadutsa notAfter sitampu yanthawi ya UTC - msakatuli aliyense wamakono (Chrome, Safari, Firefox, Edge), pulogalamu yam'manja (iOS App Transport Security, Android Network Security Config), wolandila webhook (Stripe, Shopify, Twilio, GitHub), ndi kasitomala wakumtunda wa API nthawi yomweyo amadula kulumikizana ndi NET::ERR_CERT_DATE_INVALID kapena SSL_ERROR_RX_RECORD_TOO_LONG. Choyipa kwambiri, ngati domain yanu itumiza fayilo ya Strict-Transport-Security (HSTS) mutu kapena wapangidwa mu msakatuli HSTS Preload List, Chrome ndi Safari amachotsa "Advanced -> Pitilizani ku tsamba (osatetezeka)" batani lolambalala kwathunthu, zomwe zimapangitsa kuti 100 peresenti yalephera kwa ogwiritsa ntchito aliyense padziko lonse lapansi. Nthawi zambiri, cronjob yosinthira yokha (Certbot, acme.sh, Caddy, cert-manager, kapena AWS ACM) wakhala akulephera mwakachetechete kwa masiku 30 chifukwa cha DNS yoletsa CAA mbiri, DNSSEC yosweka DS rekodi, doko lotchinga ma firewall 80 (HTTP-01 zovuta), kapena seva yapaintaneti (nginx / haproxy) yomwe idakonzanso fayilo pa diski (fullchain.pem) koma sanalowetsenso machitidwe ake okumbukira. Ngati kuzimitsa kwanu kudachitika chifukwa cha kulembetsa kwa domain komwe kwatha ntchito kapena ma seva omwe adabedwa m'malo mwa satifiketi ya X.509 yokha, sinthani nthawi yomweyo kuba dzina la domain, DNS yatha, ndi kulandidwa kwa webusayiti; ngati seva yanu siyikupezeka konse kapena kunja kwa disk space kotero certbot sindingathe kulembera /etc/letsencrypt, mwawona seva disk 100% yodzaza ndi zero-space kuchira kapena vuto la kuchititsa intaneti, kusamuka, ndi kubwezeretsanso zosunga zobwezeretsera. Ngati kuyimitsidwa kwa TLSku kuyimitsa telemetry yakuchipatala, ma API otumiza mwadzidzidzi, kapena chitetezo cha anthu, imbani nambala yanu yadzidzidzi yakudera lanu (911 ku United States ndi Canada, 112 ku European Union, 999 ku United Kingdom) kapena funsani buku lathu lapadziko lonse lapansi la manambala angozi.

Chitani izi tsopano¶

1. Yang'anani mumasekondi 10 ngati satifiketi yomwe ili pa disk yakonzedwanso kale, ndipo seva yanu yapaintaneti kapena cholemetsa cholemetsa chalephera kuyiyikanso mu RAM:
2. Fananizani socket ya TLS yamoyo ndi .pem fayilo pa disk pompano:

   # 1. What the live server is serving over the network:
   echo | openssl s_client -servername example.com -connect example.com:443 2>/dev/null | openssl x509 -noout -dates -issuer -serial
   # 2. What is actually sitting on disk in /etc/letsencrypt/live/:
   sudo openssl x509 -in /etc/letsencrypt/live/example.com/fullchain.pem -noout -dates -issuer -serial
   

3. ** Ngati fayilo pa disk ikuwonetsa tsogolo loyenera notAfter tsiku pamene live doko 443 ikuwonetsa tsiku lotha ntchito**: kasitomala wanu wa ACME (certbot / acme.sh) adachita bwino masabata apitawo, koma nginx, apache2, haproxy, kapena postfix sichinakhazikitsidwenso, kapena (haproxy / vault) amafuna fullchain.pem + privkey.pem zolumikizidwa mu mtolo umodzi. Thamangani sudo nginx -t && sudo systemctl reload nginx (kapena sudo systemctl reload apache2 haproxy) ndipo kuzimitsa kwanu kutha mu 2 masekondi.
4. OSATI kuthamanga certbot renew --force-renewal mobwereza bwereza ngati kukonzanso kulephera: Tiyeni Tilembetseni malire okhwima a masatifiketi obwereza 5 pamasiku 7 ndi zitsimikiziro zolephera 5 pa akaunti iliyonse, dzina la olandila, pa ola. Kuthamanga --force-renewal kasanu mwamantha popanda kukonza zapansi nginx reload kapena DNS/firewall bug itseka domain yanu kuti isatulutsidwe ndi Let's Encrypt kwa masiku 7.
5. Mukagunda malire a Let Encrypt Rate (429 Too Many Requests), sinthani kasitomala wanu wa ACME kupita ku Ulamuliro wa Chiphaso chaulere chachiwiri (ZeroSSL, Buypass Go SSL, kapena Google Trust Services) kapena onjezani malo otayirapo SAN nthawi yomweyo:
6. Aliyense ACME kasitomala (certbot, acme.sh, caddy, cert-manager) akhoza kupempha satifiketi yodalirika yaulere kuchokera ku CA ina mumasekondi 30 (--server https://acme.zerossl.com/v2/DV90 kapena https://api.buypass.com/acme/directory), kudutsa malire a Let Encrypt's rate.
7. Kapenanso, Let's Encrypt's "5 duplicate certificates per 7 days" malire amangogwira ku magawo enieni a Mayina Ena a Nkhani (SANs). Kuwonjezera subdomain imodzi yowonjezera (-d example.com -d www.example.com -d tlsfix1.example.com) imapanga satifiketi yosakhala yobwereza ndipo imadutsa malire a Setifiketi Yobwereza nthawi yomweyo.
8. ** Onani ngati DNS ndi CAA mbiri kapena yosweka DNSSEC ikuletsa Wolamulira Satifiketi yanu kuti asakupatseni (CAA record for example.com prevents issuance)**:
9. Funsani za Certification Authority Authorization ya domeni yanu (CAA) zolemba: dig +short CAA example.com. Ngati DNS yanu ili nayo 0 issue "sectigo.com" kapena 0 issue "amazon.com" (kapena pamtundu wa makolo), Let's Encrypt (letsencrypt.org) ndi ZeroSSL (sectigo.com) amaletsedwa ndi RFC 8659 kupereka mpaka mutawonjezera 0 issue "letsencrypt.org" ku zone yanu ya DNS.
10. ** Ngati port 80 (HTTP-01 chopinga) chatsekedwa ndi firewall, CDN, kapena ISP, kapena ngati seva yanu ikukana kuyambitsa chifukwa chosowa cert, gwiritsani ntchito --standalone kapena --dns (DNS-01) kutsimikizira **:
11. Imani nginx/apache pafupi ndi kuthamanga sudo certbot certonly --standalone -d example.com, kapena kugwiritsa ntchito --manual --preferred-challenges dns kutsimikizira polemba a _acme-challenge.example.com TXT Lembani mu DNS console yanu popanda kukhudza doko 80.
12. Ngati tsamba lanu likukhala kumbuyo kwa Cloudflare, AWS CloudFront, kapena Mwachangu, onetsetsani ngati satifiketi yomwe yathayo ili pa CDN Edge kapena pa Origin Server yanu (Error 526 Invalid SSL Certificate):
13. Pa Cloudflare, ngati satifiketi yanu yoyambira seva itatha ndipo Cloudflare yakhazikitsidwa Full (Strict), ogwiritsa ntchito akuwona Error 526. Pamene mukukonza satifiketi yoyambira, mutha kubwezeretsa kuchuluka kwazomwe zikuchitika m'masekondi 5 ndikupanga satifiketi yazaka 15 Cloudflare Origin CA mu Cloudflare dashboard (kapena kusintha kwakanthawi SSL/TLS mode kuchokera Full (Strict) ku Full kwa mphindi 10 zimatengera kusintha chiyambi .pem wapamwamba).

Mtengo wosankha: kuzindikira ndi kukonza satifiketi ya SSL/TLS yomwe yatha¶

Tsatirani mtengo wachigamulochi kuti muwonetsetse kulephera kwenikweni (CDN Edge vs. Origin Daemon Memory vs. ACME Challenge vs. CA Rate Limit) ndikubwezeretsanso kuchuluka kwa magalimoto a HTTPS mumphindi:

flowchart TD
    Start["Ogwiritsa / Malipoti a API NET::ERR_CERT_DATE_INVALID kapena Cloudflare Error 526"] --> CheckLive["Thamangani: openssl s_client -servername domain -connect domain:443 | openssl x509 -noout -deti -wopereka"]

    CheckLive --> WhereExpired{"Ndi Satifiketi Iti Imene Yatha Ntchito?"}

    WhereExpired -->|"Disk fullchain.pem Ndi YOvomerezeka, Koma Live Port 443 YATHA"| StaleDaemon["Memory ya Stale Daemon kapena Split Cert Store: Kwezaninso nginx / apache2 / haproxy / postfix, kapena Panganinso Mtolo Wophatikiza HAProxy PEM"]
    WhereExpired -->|"CDN Edge Cert (Cloudflare / CloudFront / Mofulumira) Yatha"| CDNFix["Onani Zolemba za DNS CAA za CDN CA (letsencrypt.org / pki.goog / digicert.com / amazon.com) ndi Sinthani Universal SSL kapena Kutsimikiziranso ACM"]
    WhereExpired -->|"Origin Server fullchain.pem pa Disk YATHA"| DryRun["Thamangani: sudo certbot renew --dry-run (kapena acme.sh --renew -d domain --debug)"]

    DryRun --> WhyFailed{"Chifukwa Chiyani Kukonzanso kwa ACME Kunalephera?"}

    WhyFailed -->|"429 Zopempha Zambiri (Malirelo a Mlingo Apitilira)"| RateLimit["Bypass Nthawi yomweyo: Kutulutsa kuchokera ku ZeroSSL / Buypass / Google Trust Services OR Onjezani 1 Subdomain Yowonjezera SAN (-d fix1.example.com)"]
    WhyFailed -->|"CAA Record Imalepheretsa Kutulutsidwa kapena SERVFAIL (DNSSEC)"| CAADNS["Thamangani: dig CAA example.com -> Onjezani nkhani 0 'letsencrypt.org' (ndi 'sectigo.com') kapena Konzani Zowonongeka za DNSSEC DS Record pa Registrar"]
    WhyFailed -->|"Kulumikizana Kwakanidwa / Nthawi Yatha / 404 pa /.well-known/acme-challenge/"| HttpBlock["Port 80 Yotsekedwa kapena Yolondoleranso Lupu: Tsegulani TCP Port 80 mu Firewall, Osapatula /.odziwika bwino/ kuchokera ku Auth/Rewrite, kapena Gwiritsani Ntchito DNS-01 Challenge"]
    WhyFailed -->|"Kubernetes cert-manager Order Idakali Poyembekezera"| K8sFix["Thamangani: kubectl fotokozani zovuta -> Chongani Ingress class annotation, HTTP01 solver pod network policy, kapena Webhook TLS"]

    StaleDaemon --> VerifyAll["Tsimikizani Chain & OCSP Stapling: openssl s_client -connect domain:443 -status"]
    CDNFix --> VerifyAll
    RateLimit --> VerifyAll
    CAADNS --> VerifyAll
    HttpBlock --> VerifyAll
    K8sFix --> VerifyAll

Gawo 1: Kumvetsetsa chifukwa chake HSTS (Strict-Transport-Security) kumayambitsa kuzimitsa kwathunthu¶

Tsamba likakhala osa kugwiritsa ntchito HSTS, satifiketi yomwe yatha ntchito imawonetsa chenjezo lapakati (Your connection is not private) ndi ulalo wa "Zapamwamba -> Pitilizani ku example.com (osatetezeka)" womwe umalola ogwiritsa ntchito kuti adutse.

Komabe, pafupifupi mapulogalamu onse amakono opanga mawebusayiti, mabanki, nsanja za SaaS, ndi .dev / .app / .page / .bank madera apamwamba amakakamiza HTTP Strict Transport Security (HSTS, RFC 6797): 1. Dynamic HSTS (max-age=31536000): Msakatuli aliyense yemwe adayendera tsamba lanu mkati mwa masiku 365 apitawa adasunga malamulowo Strict-Transport-Security: max-age=31536000; includeSubDomains. Mpaka nthawiyo itatha, msakatuli ** amaletsa ** wosuta kuti asadutse cholakwika chilichonse cha satifiketi (ERR_CERT_DATE_INVALID, ERR_CERT_COMMON_NAME_INVALID, kapena ERR_CERT_AUTHORITY_INVALID). 2. Static HSTS Preload (preload list kapena .dev / .app gTLD): Ngati domain yanu idatumizidwa ku hstspreload.org - kapena ngati dera lanu likugwiritsa ntchito Registry-Preloaded TLD ngati .dev, .app, .page, .new, .chrome, kapena .bank - Chikopi chilichonse cha Chrome, Edge, Firefox, Safari, ndi Android WebView Padziko Lapansi chili ndi domain yanu yokhazikika mubizinesi yake monga HSTS-ikakamizika wogwiritsa ntchito asanafike patsamba lanu koyamba. 3. **Chifukwa includeSubDomains imaphwanya zida zamkati ndi ma seva oyambira **: Ngati mizu yanu (example.com) kutumiza Strict-Transport-Security: max-age=31536000; includeSubDomains, subdomain iliyonse (vpn.example.com, internal-jira.example.com, printer.example.com) imatsekedwanso mu HSTS hard-fail mode. 4. **Chifukwa chiyani kuphatikiza kwa API ndi Webhook (Stripe, Twilio, Slack, iOS ATS) kulephera nthawi yomweyo **: Makasitomala a TLS Server-to-server (libcurl, Python requests/urllib3, Node.js undici, Pitani crypto/tls, Java SSLContext) gwiritsani ntchito RFC 5280 notAfter kutsimikizira mwachisawawa ndipo alibe lingaliro la wosuta "click-through." Pakutha kwa TLS, Stripe ndi Shopify ma webhooks adzalephera kutumiza ndikulowetsanso mizere yoyesanso.

Gawo 2: Kuzindikira kwa masekondi 60 - Kodi satifiketiyo yasinthidwa kale pa disk?¶

Pafupifupi ** 35 peresenti ya kupanga Let's Encrypt outages **, satifiketi idakonzedwanso pa disk masabata apitawo ndi certbot.timer kapena acme.sh, koma daemon yomwe ikuyenda ikugwiritsabe ntchito satifiketi yakale yomwe yatha kuchokera ku RAM.

Khwerero 1: Fananizani soketi ya netiweki yamoyo ndi fayilo ya pa-disk¶

Pangani malamulo onse awiri pa seva yanu:

# Check what the live port 443 socket is presenting in RAM:
echo | openssl s_client -servername example.com -connect 127.0.0.1:443 2>/dev/null | openssl x509 -noout -subject -issuer -dates -serial

# Check what is actually sitting on the filesystem:
sudo openssl x509 -in /etc/letsencrypt/live/example.com/fullchain.pem -noout -subject -issuer -dates -serial

Khwerero 2: Konzani misampha ya 4 ya "Kusinthidwanso pa Disk, Yatha mu RAM".¶

Gawo 3: Kukonza DNS CAA mbiri midadada ndi DNSSEC zolephera zotsimikizira¶

Ngati muthamanga sudo certbot renew --dry-run ndi kuwona: - urn:ietf:params:acme:error:caa :: CAA record for example.com prevents issuance - urn:ietf:params:acme:error:dns :: DNS problem: SERVFAIL looking up A/CAA for example.com

1. Momwe DNS CAA (RFC 8659) imaletsa kukonzanso satifiketi¶

Ulamuliro uliwonse wa Ziphaso wa boma umafunidwa mwalamulo ndi CA/Browser Forum Baseline Requirements kuti ufunse DNS CAA zolemba musanapereke satifiketi iliyonse. CA imayenda ** kukwera mtengo wa DNS ** kuchokera sub.app.example.com -> app.example.com -> example.com: - Ngati example.com ali **zero CAA zolemba **, CA iliyonse imaloledwa kupereka. - Ngati example.com ali ndi ** ngakhale imodzi CAA mbiri ** (mwachitsanzo, 0 issue "amazon.com" adangowonjezera pomwe wina adapanga kugawa kwa AWS CloudFront, kapena 0 issue "digicert.com"), **Chilichonse Chovomerezeka Padziko Lapansi ndicholetsedwa kupereka satifiketi example.com kapena madera ake aliwonse . - Kuphatikiza apo, ngati mukupempha ** satifiketi yaku Wildcard (*.example.com) ndipo domain yanu imatanthauzira zenizeni 0 issuewild "ca.example" tag, CA imayang'ana issuewild katundu osati issue.

Diagnostic ndi pompopompo kukonza kwa CAA midadada:¶

1. Onani CAA amalemba pa onse hostname ndi apex domain:

   dig +short CAA sub.example.com
   dig +short CAA example.com
   

2. Onaninso ngati sub.example.com ndi a CNAME kuloza kudera lina (Per RFC 8659, CAs imayang'ananso ma CAA zolemba pa CNAME chandamale).
3. Mu dashboard ya opereka anu a DNS (Cloudflare, Route 53, Cloud DNS, Namecheap), **musafufute zomwe zilipo CAA zolemba ** zogwiritsidwa ntchito ndi CDN kapena AWS ACM yanu; m'malo mwake, ** onjezerani ** zowonjezera CAA zolemba zololeza Tiyeni Tilembetse ndi ma CA anu osunga:

   example.com.  300  IN  CAA  0 issue "letsencrypt.org"
   example.com.  300  IN  CAA  0 issue "sectigo.com"
   example.com.  300  IN  CAA  0 issue "pki.goog"
   example.com.  300  IN  CAA  0 issuewild "letsencrypt.org"
   example.com.  300  IN  CAA  0 issuewild "sectigo.com"
   

4. (Zindikirani: ZeroSSL imagwiritsa ntchito sectigo.com monga chizindikiritso chake cha CAA, ndi Google Trust Services amagwiritsa ntchito pki.goog.)*
5. Dikirani masekondi 60 kuti ma seva anu ovomerezeka asinthe (dig @ns1.yourdns.com CAA example.com) ndipo nthawi yomweyo yambitsaninso sudo certbot renew. Popeza ma CA amayang'ana mobwerezabwereza podutsa ma cache a anthu poyesanso, kutulutsa kumayenda bwino nthawi yomweyo.

2. Kukonza DNS problem: SERVFAIL looking up CAA (DNSSEC kusagwirizana)¶

Tiyeni Tilembe Mwachinsinsi, Google Trust Services, ndi ZeroSSL titsatire mosamalitsa DNSSEC kutsimikizira pamawonekedwe onse a DNS (A, AAAA, TXT,ndi CAA). Ngakhale domain ili ndi **ayi CAA mbiri **, CA iyenera kulandira cryptographically yovomerezeka NOERROR (yankho lopanda kanthu) kapena NXDOMAIN (NSEC / NSEC3 kukana kotsimikizika kukhalako) yankho. - Ngati domain registrar yanu ili ndi nthawi yayitali DS (Delegation Signer) mbiri mutasamutsidwa ndi othandizira a DNS (mwachitsanzo, kuchoka ku GoDaddy kupita ku Cloudflare kapena Route 53 popanda kuletsa DNSSEC poyamba), otsutsa obwereza omwe amakakamiza kubwerera kwa DNSSEC SERVFAIL. - Tsimikizirani mumasekondi 5: Thamangani delv @8.8.8.8 example.com CAA kapena kuyesa pa dnsviz.net. Ngati dig @8.8.8.8 example.com zobwerera status: SERVFAIL pamene dig +cd @8.8.8.8 example.com (+cd = Kuyang'ana Olemala, kunyalanyaza DNSSEC) kukubwezerani adilesi yanu ya IP, **unyolo wanu wa DNSSEC wasweka **. Lowani mu registrar yanu ya domain nthawi yomweyo ndipo mwina chotsani stale DS lembani kapena kukopera zomwe zilipo DS magawo kuchokera kwa omwe akugwira nawo ntchito a DNS.

Gawo 4: Kudutsa Tiyeni Tilembe Malire a Rate (429 Too Many Requests) panthawi yopuma¶

Panthawi yachisokonezo, mainjiniya nthawi zambiri amayambiranso zotengera kapena kuthamanga certbot mobwerezabwereza mpaka Let Encrypt akane zopempha zonse ndi: - urn:ietf:params:acme:error:rateLimited :: Error creating new order :: too many certificates (5) already issued for this exact set of domains in the last 168h0m0s - urn:ietf:params:acme:error:rateLimited :: Error creating new order :: too many failed authorizations (5) recently

Nthawi zodikira zimachokera ku 1 ola (kwa zilolezo zomwe zalephera) mpaka masiku 7 (maola 168) (pa malire a satifiketi 5 obwereza). Musadikire ola limodzi kapena masiku 7 pomwe malo anu opangira zinthu ali pansi. Muli ndi njira ziwiri zovomerezeka, zomwe zachitika posachedwa:

Workaround A (Best): Sinthani ACME Certificate Authority kukhala ZeroSSL, Buypass, kapena Google Trust Services mumasekondi 30¶

ACME protocol (RFC 8555) ndi muyezo wotseguka. Msakatuli aliyense wamkulu ndi makina ogwiritsira ntchito amadalira ZeroSSL (mizu ya Sectigo), Buypass Go SSL (Norwegian CA), ndi Google Trust Services (pki.goog) chimodzimodzi kuti Let's Encrypt (ISRG Root X1). Palibe amene amagawana malire ndi Let's Encrypt.

• Njira 1: Itulutseni mwachangu kudzera Certbot kugwiritsa ntchito Buypass Go SSL (Palibe akaunti/EAB kiyi yofunikira, zovomerezeka za masiku 180): (Zindikirani: Buypass imathandizira ziphaso zamitundu yambiri mpaka ma SAN 5, ngakhale osati wildcard *.example.com mbiri)

  sudo certbot certonly --webroot -w /var/www/html \
    --server "https://api.buypass.com/acme/directory" \
    -d example.com -d www.example.com \
    --email admin@example.com --agree-tos
  

• Njira 2: Itulutseni mwachangu kudzera acme.sh (yomwe imasinthira ku ZeroSSL kapena kusintha ma CA ndi --server):

  # Using ZeroSSL:
  acme.sh --register-account -m admin@example.com --server zerossl
  acme.sh --issue -d example.com -d www.example.com -w /var/www/html --server zerossl
  

• Njira 3: Kutulutsidwa kudzera pa Google Trust Services (pki.goog) Public ACME: Mu Google Cloud Console (kapena kudzera gcloud publicca external-account-keys create), pangani Kumanga Kwaulere Kwa Akaunti Yakunja (EAB) kiyi mu masekondi 10 ndikuthamanga:

  sudo certbot certonly --webroot -w /var/www/html \
    --server "https://dv.acme-v02.api.pki.goog/directory" \
    --eab-kid "YOUR_EAB_KEY_ID" \
    --eab-hmac-key "YOUR_EAB_HMAC_KEY" \
    -d example.com -d www.example.com
  

Workaround B: Dulani malire a Tiyeni Tilembetse "5 Duplicate Certificates" powonjezera dzina limodzi lowonjezera la SAN¶

Tiyeni Tilembe malire obwereza a maola 168 (too many certificates (5) already issued for this exact set of domains) amatsata mayimba enieni a SAN hostnames pa satifiketi, pomwe malire onse a Registered Domain ndi masatifiketi 50 pa sabata. 1. Pangani DNS yopanda vuto A mbiri yolozera ku seva yomweyo: tls-recovery-01.example.com -> <your_server_ip>. 2. Funsani satifiketi yokhala ndi madambwe anu oyambilira kuphatikiza dzina latsopano la alendo:

sudo certbot certonly --nginx --cert-name example.com \
  -d example.com -d www.example.com -d tls-recovery-01.example.com

Gawo 5: Kukonza kosweka HTTP-01 zovuta (Port 80) kapena kugwiritsa ntchito DNS-01 kutsimikizira mwadzidzidzi¶

Pamene certbot renew amalephera ndi Timeout during connect (likely firewall problem) kapena Invalid response from http://example.com/.well-known/acme-challenge/...: 404 (kapena 403), ma seva ovomerezeka a CA sangathe kufikira chizindikiro chanu cha HTTP chovuta pa TCP port 80.

Chifukwa chiyani? HTTP-01 imasweka mwadzidzidzi pa ma seva omwe adagwira ntchito masiku 60 apitawo¶

1. ** Cloud Security Group / UFW / iptables chatsekedwa Port 80**: Wina anaumitsa chowotcha moto kuti alole doko lokha 443 (HTTPS), kuyiwala kuti RFC 8555 HTTP-01 kutsimikizira **nthawi zonse kumayamba pa doko la HTTP 80 ** (ngakhale litsatira a 301 lunjika ku https:// pa doko 443).
2. ** IPv6 yosweka (AAAA) Record **: Malo anu ali ndi IPv4 (A) mbiri ndi IPv6 (AAAA) mbiri. Tiyeni Tilembe nthawi zonse timakonda IPv6 (AAAA) poyamba. Ngati adilesi yanu ya IPv6 sinayendetsedwe molakwika, iletsedwa ndi ip6tables, kapena osamangidwa mu Nginx (listen [::]:80;), nthawi zotsimikizira zatha ngakhale IPv4 imagwira ntchito bwino.
3. ** Nginx / Application Router (React / Next.js / Django / Rails) kuthamangitsa /.well-known/acme-challenge/**: yanu server block pa port 80 proxies magalimoto onse (location / { proxy_pass http://localhost:3000; }) ku pulogalamu yam'mbuyo m'malo motumikira .well-known kuchokera ku disk.

Zosintha ziwiri pompopompo zosweka HTTP-01 kutsimikizira¶

Konzani 1: Onjezani odzipereka kwambiri /.well-known/acme-challenge/ chipika ku Nginx (Port 80)¶

Onetsetsani kuti doko lanu 80 likutchinga mkati /etc/nginx/sites-enabled/ amapereka zizindikiro za ACME mwachindunji kuchokera /var/www/letsencrypt ** pamaso ** iliyonse return 301 https://... kapena proxy_pass malangizo:

server {
    listen 80;
    listen [::]:80;
    server_name example.com www.example.com;

    location ^~ /.well-known/acme-challenge/ {
        default_type "text/plain";
        root /var/www/letsencrypt;
        allow all;
    }

    location / {
        return 301 https://$host$request_uri;
    }
}

sudo mkdir -p /var/www/letsencrypt/.well-known/acme-challenge
sudo nginx -t && sudo systemctl reload nginx
sudo certbot certonly --webroot -w /var/www/letsencrypt -d example.com -d www.example.com

Konzani 2: Bypass Port 80 ndi ma seva apaintaneti kwathunthu ndi buku DNS-01 (TXT) zovuta¶

Ngati port 80 yatsekedwa ndi ISP/firewall yakumtunda kapena chosungira chanu sichingayende .well-known ku ma node angapo akumbuyo, tsimikizirani kudzera pa DNS mumphindi ziwiri:

sudo certbot certonly --manual --preferred-challenges dns -d example.com -d "*.example.com"

dig +short TXT _acme-challenge.example.com @8.8.8.8

Gawo 6: Kutsimikizira pambuyo pochira (Chain Chapakati, OCSP Stapling, ndi CDN Purge)¶

Kulakwitsa kofala pambuyo posintha satifiketi yadzidzidzi ndikukhazikitsa cert.pem (satifiketi yatsamba yokha) m'malo mwa fullchain.pem (satifiketi yatsamba + satifiketi yapakatikati ya CA). Masakatuli apakompyuta (Chrome, Firefox) nthawi zambiri amabisa chiphaso chapakati chosowa kudzera pa AIA (Authority Information Access) kuthamangitsa kapena kusungitsa pakati, pomwe curl, Python, OpenSSL, mapulogalamu a Android, ndi ma webhooks a Stripe/Twilio amalephera nthawi yomweyo ndi unable to verify the first certificate (SSL certificate problem: unable to get local issuer certificate).

• Tsimikizirani kuti seva yanu imatumiza unyolo wonse wapakati (fullchain.pem): Thamangani:

  echo | openssl s_client -servername example.com -connect example.com:443 2>/dev/null | grep -E "Verify return code|depth="
  

  Muyenera kuwona osachepera magawo awiri* (depth=0 domain yanu ndi depth=1 wapakati CA monga Let's Encrypt E5/R11 kapena ZeroSSL RSA Domain Secure Site CA) ndi Verify return code: 0 (ok). Ngati mukuwona Verify return code: 21 (unable to verify the first certificate), sinthani makina anu a seva kuchokera cert.pem ku fullchain.pem.
• **Chotsani OCSP Stapling cache mu Nginx / Apache **: Ngati ssl_stapling on; yayatsidwa, kwezaninso seva yapaintaneti ndikuwunikanso openssl s_client -servername example.com -connect example.com:443 -status 2>/dev/null | grep -A 15 "OCSP response".
• Sinthani kuwunika kwakutali kwa SSL kwamitundu yambiri (Cheke chakunja cha TCP + Prometheus blackbox_exporter): Osadalira zikumbutso za imelo zokha (Tiyeni Tilembetse maimelo osiya zikumbutso zakutha kwa ntchito mu 2025). Yang'anirani doko lamoyo 443 socket kunja (probe_ssl_earliest_cert_expiry - time() < 86400 * 14) ndikukhazikitsa cheke chatsiku ndi tsiku sudo certbot renew --dry-run.

Nambala zangozi zachigawo ndi ndondomeko za bungwe¶

Ngakhale satifiketi ya TLS yomwe yatha ntchito nthawi zambiri imathetsedwa ndi magulu a uinjiniya, kutha kwa satifiketi komwe kumaphwanya malo azachipatala, ma webhooks otumiza mwadzidzidzi, kutsimikizika kubanki, kapena zomangamanga zaboma zitha kuyambitsa kayendetsedwe ka ntchito:

• United States ndi Canada:
• **Chitetezo Chamoyo / Zachipatala / Kutha Kwakatundu **: Imbani 911 ngati kulephera kwa satifiketi ya TLS kumadula telemetry ya odwala, ma e-prescribing, kapena mauthenga otumiza mwadzidzidzi.
• Cybersecurity and Infrastructure Security Agency (CISA) (US): Mabungwe a boma omwe ali pansi pa CISA Binding Operational Directive (BOD) 18-01 ndi ogwira ntchito za zomangamanga omwe akukumana ndi kuperekedwa kwa satifiketi mosaloledwa (CA compromise kapena kubera kwa BGP/DNS) afotokozere 1-844-Say-CISA (1-844-729-2472) kapena cisa.gov/report.
• Canadian Center for Cyber ​​Security: Lumikizanani 1-833-CYBER-88 (1-833-292-3788).
• United Kingdom:
• Ntchito Zadzidzidzi: Imbani 999 ngati kutha kwa TLS kukhudza machitidwe azachipatala a NHS kapena chitetezo chamoyo.
• ** National Cyber ​​Security Center (NCSC)**: Mukapeza chiphaso chosaloleka choperekedwa kudera lanu mu Certificate Transparency (crt.sh) zipika zosonyeza kubedwa kwa DNS, lipoti kudzera ncsc.gov.uk.
• European Union:
• Ntchito Zadzidzidzi: Imbani 112 kudutsa mayiko onse a EU.
• NIS2 Directive & eIDAS Qualified Website Authentication Certificates (QWACs): Mabungwe ofunikira komanso ofunikira pansi pa NIS2 Directive akukumana ndi kutha kwa nthawi yayitali kapena makiyi a PKI omwe asokonezedwa ayenera kudziwitsa dziko lawo CSIRT mkati mwa maola 24.
• Australia ndi New Zealand:
• Ntchito Zadzidzidzi: Imbani 000 ku Australia kapena 111 ku New Zealand; lumikizanani ndi ACSC (1300 CYBER1) pazochitika zachitukuko.
• India ndi Asia-Pacific:
• India (CERT-In / Woyang'anira Maulamuliro Otsimikizira CCA): Imbani 112 poyankha mwadzidzidzi; nenani kusagwirizana kwa PKI kapena kuwonongeka kwakukulu kwa zomangamanga incident@cert-in.org.in mkati mwa maola 6.

Mafunso omwe amafunsidwa pafupipafupi¶

Chifukwa chiyani ine kapena ogwiritsa ntchito sindingathe kudina "Zapamwamba -> Pitilizani patsamba (osatetezeka)" mu Chrome kapena Safari panthawiyi?¶

Pamene domain yanu imatumiza fayilo ya Zovuta-Zoyenda-Zachitetezo (Zithunzi za HSTS) Mutu wa HTTP - kapena amagwiritsa ntchito dera lapamwamba ngati .dev, .app, tsamba, kapena .banki zomwe zimakhala zolimba mumsakatuli wa HSTS Preload List - RFC 6797 imafuna kuti osatsegula asamachite chiphaso chomwe chinatha, chodzisainira, kapena chosagwirizana ngati cholakwika chomwe sichingabwezedwe. Msakatuli amachotsa dala batani la "Pitilizanibe" kuti aletse omwe akuchitapo kanthu a Man-in-the-Middle (MitM) kuti asanyengere ogwiritsa ntchito kuti adutse satifiketi yosokoneza. Pomwe wopanga pa desktop Chrome amatha kulemba mndandanda wobisika wa kiyibodi izi ndi zotetezeka molunjika pa zenera lolakwika kuti mulambalale kwanuko kuti muyesedwe, ogwiritsa ntchito enieni sangathe; muyenera kukhazikitsa satifiketi yovomerezeka padoko 443.

Tiyeni Encrypt tisiye kutumiza maimelo ochenjeza otha ntchito ndipo cert yanga idatha popanda kuzindikira - chifukwa chiyani zidachitika?¶

Tiyeni Encrypt tisiye ntchito yake yodziwitsa za kutha kwa ntchito mkati mwa 2025 kuti tichepetse kusungirako deta komanso chifukwa makina okhazikika a ACME amayenera kuyang'anira kukonzanso mwachindunji. Kuti mupewe zodabwitsa zamtsogolo, muyenera kuwunika nthawi yeniyeni ya TLS yogwirana chanza pamaneti pogwiritsa ntchito chowunikira chakunja (monga Prometheus. blackbox_exporter, Uptime Kuma, Better Stack, kapena Datadog Synthetic TLS macheke) kuchenjeza masiku 21, masiku 14, ndi masiku 7 zisanachitike. osati Pambuyo.

Chifukwa chiyani tsamba langa limagwira ntchito bwino mu Chrome ndi Firefox pa laputopu yanga, koma zimalephera pa mafoni a Android, curl, ndi Stripe webhooks nditasintha satifiketi?¶

Mwakonza seva yanu yapaintaneti (ssl_certificate mu Nginx kapena SSLCertificateFile in Apache) kuloza cert.pem (satifiketi yatsamba yokha) m'malo mwa fullchain.pem (satifiketi yatsamba yophatikizidwa ndi satifiketi ya Intermediate CA). Asakatuli apakompyuta monga Chrome ndi Firefox amatsitsa okha satifiketi apakati omwe akusowa kumbuyo pogwiritsa ntchito fayilo ya Authority Information Access (AIA) URL mkati mwa tsamba lanu, kubisala kusasinthika kwa seva yanu. Komabe, kupindika, OpenSSL, Android's trust trust verifier, Python, ndi ma seva a webhook sachita AIA kuthamangitsa ndipo nthawi yomweyo amakana kulumikizana ndi osatha kupeza satifiketi yopereka kwanuko. Lozani config yanu ku fullchain.pem ndikutsitsanso seva yanu.

Ndimayang'ana bwanji ngati wobera kapena wolamulira wankhanza wapereka satifiketi ya SSL yosaloleka pa domain yanga?¶

Ulamuliro uliwonse wa Satifiketi wodalirika pagulu umayenera kulemba satifiketi iliyonse yoperekedwa kwa anthu Zipika za Certificate Transparency (CT). (RFC 6962) asakatuli asanakhulupirire. Tsegulani https://crt.sh/?q=%25.yourdomain.com kapena Cloudflare's Certificate Transparency Monitor kuti muwone satifiketi iliyonse yomwe idaperekedwa pa domeni yanu ndi madera ake. Ngati muwona satifiketi yoperekedwa ndi CA yosadziwika yomwe simunaivomereze, yang'anani nthawi yomweyo olembetsa anu a DNS ndi malo ovomerezeka a DNS kuti asinthe mosavomerezeka, chotsani satifiketi yoyipa yokhala ndi CA yotulutsa, ndikutseka DNS yanu ndi CAA zolemba (`0 issue "letsencrypt.org"`).

Bwanji ngati gulu langa la Kubernetes cert-manager adalephera kukonzanso satifiketi yathu ya Ingress ndipo Order idakhazikikamo Pending?¶

Thamangani kubectl get order,challenge -A ndiyeno kubectl fotokozani zovuta -n . Mu 90 peresenti ya Kubernetes cert-manager kuzimitsa, ndi cm-acme-http-solver-* Pod kwakanthawi ikuyenda, koma mwina (1) gwero la Ingress lili ndi zofotokozera zachikale za ingress kotero njira yosinthira siyinaphatikizidwe ndi zolemetsa zanu, (2) a Kubernetes. NetworkPolicy ikuletsa kuchuluka kwa magalimoto kupita ku solver pod pa doko 8089, kapena (3) vuto la NAT / split-horizon DNS limaletsa cert-managerkudzifufuza kwamkati kuti mufikire IP yanu yapagulu yolemetsa (yokhazikika podutsa --dns01-recursive-nameservers=8.8.8.8:53,1.1.1.1:53 ku ku cert-manager kutumiza args).

Kodi ndingakopere wanga /etc/letsencrypt/ foda ku seva yatsopano panthawi yakusamuka kwadzidzidzi m'malo moperekanso?¶

Inde. Ngati seva yanu yoyamba yafa ndipo mukusamukira ku seva yatsopano pomwe mulingo wocheperako ndi Let's Encrypt, sungani ma symlink pokopera. /etc/letsencrypt/ kugwiritsa ntchito tar -czpf lesencrypt_backup.tar.gz /etc/letsencrypt (osagwiritsa ntchito plain scp ndi, yomwe imatembenuza ma symlink /etc/letsencrypt/live/ kukhala mafayilo obwerezabwereza ndikuphwanya zosintha zamtsogolo). Chotsani zosungidwazo ku seva yatsopano (`sudo tar -xzpf letsencrypt_backup.tar.gz -C /`), lozani Nginx/Apache ku `/etc/letsencrypt/live/domain/fullchain.pem`, ndipo satifiketi yanu yomwe ilipo igwira ntchito nthawi yomweyo pa adilesi yatsopano ya IP.

Maupangiri ogwirizana¶

• Kubera dzina la domain, DNS yatha ntchito, ndi kulanda tsamba lawebusayiti
• Seva disk 100% yodzaza (0 byte yaulere): database ndi kuchira kwa zero
• Google Workspace kapena Microsoft 365 custom admin lockout ndi DNS TXT rescue
• Vuto la kuchititsa pa intaneti, kusamuka, ndi kubwezeretsanso zosunga zobwezeretsera
• DNS hijacking, ISP rauta WAN reconfiguration, ndi wogwidwa portal spoofing
• Nambala zadzidzidzi malinga ndi dziko

Magwero ndi malangizo ovomerezeka¶

• Internet Engineering Task Force (IETF): RFC 8555 (Automatic Certificate Management Environment / ACME), RFC 8659 (DNS Certification Authority Authorization / CAA), ndi RFC 6797 (HTTP Strict Transport Security / HSTS).
• National Institute of Standards and Technology (NIST) (United States): Special Publication 800-52 Rev. 2: Malangizo a Kusankhidwa, Kukonzekera, ndi Kugwiritsa Ntchito Transport Layer Security (TLS) Implementations & SP 1800-16: Kutetezedwa kwa Web Transaction: TLS Server Certificate Management.
• Internet Security Research Group (ISRG / Tiyeni Tibisire Zolemba Zovomerezeka): Reference Limits Reference, Malamulo Obwereza a Satifiketi, ndi ACME Challenge Troubleshooting.
• Cybersecurity and Infrastructure Security Agency (CISA) (United States): Binding Operational Directive 18-01: Kupititsa patsogolo Kutetezedwa kwa Imelo ndi Webusaiti (HTTPS ndi HSTS Implementation Guidance).
• National Cyber ​​Security Center (NCSC) (United Kingdom): Kugwiritsa Ntchito TLS Kuteteza Deta Mokwanira Paulendo ndi Chitsogozo Choyang'anira Chidziwitso Chowonekera.