Icemezo ca SSL/TLS c'umusaruro caraheze: Gukosora HSTS idakora cane kandi reka dushiremwo amabarabara ya CAA/Rate-Limit¶

Igihe umusaruro SSL/TLS (HTTPS) icemeza ko gihera - mbere n'isegonda rimwe gusa ryaheze notAfter Ikidodo c'isaha UTC - umucukumbuzi wese wa none (Chrome, Safari, Firefox, Edge), porogaramu yo kuri telefone ngendanwa (iOS App Transport Security, Android Network Security Config), uwakira urubuga (Stripe, Shopify, Twilio, GitHub), kandi umukiriya wa API wo hejuru aca ahita ahagarika ubufatanye na NET::ERR_CERT_DATE_INVALID canke SSL_ERROR_RX_RECORD_TOO_LONG. Ikibi kuruta, nimba indangarubuga yawe yohereza Strict-Transport-Security (HSTS) umutwe canke ikoranijwe mu mucukumbuzi HSTS Preload List, Chrome na Safari zikuraho buto y'uguca mu nzira "Itera imbere -> Bandanya ku rubuga (ntirutekanye)" burundu, bikaba bituma 100 kw'ijana umuntu wese akoresha kw'isi yose agira ubuzibuzi bukomeye. Akenshi, igikorwa co gusubiramwo cronjob (Certbot, acme.sh, Caddy, cert-manager, canke AWS ACM) imaze imisi 30 idakora neza kubera DNS ibujijwe CAA inyandiko, DNSSEC yavunitse DS nyandiko, uruhome rw'umuriro ruzibira icuma 80 (HTTP-01 ingorane), canke umukozi w'urubuga (nginx / haproxy) yasubiyemwo dosiye iri kuri disiki (fullchain.pem) ariko ntiyigeze asubira gushiramwo imigenderanire yayo y’abakozi bo mu bwibuke. Niba ukuzima kwawe kwatewe n’iyandikisha ry’itongo ryaheze canke amazina y’abakozi yafashwe ku nguvu aho gukoresha icemeza X.509 ubwaco, hindura ubwo nyene kuri kwiba izina ry'indangarubuga, DNS yaheze, no kwigarurira urubuga; niba server yawe idashobora gushikwako canke idafise umwanya kuri disk rero certbot ntashobora kwandika kuri /etc/letsencrypt, Raba disiki ya server 100% yuzuye kandi nta kibanza gifise canke Ingorane zo kwakira urubuga, kwimuka, no kugarura ububiko. Niba iki gicapo ca TLS kizimya telemetry y’ibitaro, APIs zo kohereza ivyihutirwa, canke ibikorwa remezo vy’umutekano wa bose, hamagara inomero y’ivyihutirwa yo mu karere kawe (911 muri Leta Zunze Ubumwe za Amerika no muri Kanada, 112 mu bihugu vyose vy’Ubumwe bw’Uburaya, 999 mu Bwongereza) canke urabe ububiko bwacu mpuzamakungu bwa . inomero z'ivyihutirwa.

Ivyo ubikore ubu¶

1. Suzuma mu masegonda 10 nimba icemeza kuri disiki mu vy'ukuri caravuguruwe, kandi server yawe y'urubuga canke load balancer yananiwe gusa kuyisubiramwo muri RAM:
2. Gereranya igikoresho ca TLS kiriho n'ivyo .pem dosiye kuri disiki ubu nyene:

   # 1. What the live server is serving over the network:
   echo | openssl s_client -servername example.com -connect example.com:443 2>/dev/null | openssl x509 -noout -dates -issuer -serial
   # 2. What is actually sitting on disk in /etc/letsencrypt/live/:
   sudo openssl x509 -in /etc/letsencrypt/live/example.com/fullchain.pem -noout -dates -issuer -serial
   

3. Nimba dosiye iri kuri disiki yerekana kazoza kabereye notAfter itariki mu gihe icambu kiriho 443 yerekana itariki yarangiriyeko: Umukiriya wawe wa ACME (certbot / acme.sh) vyarashoboye mu ndwi ziheze, ariko . nginx, apache2, haproxy, canke postfix ntiyigeze isubira gushirwako, canke (haproxy / vault) bisaba fullchain.pem + . privkey.pem bifatanye mu muganda umwe. Kwiruka sudo nginx -t && sudo systemctl reload nginx (canke sudo systemctl reload apache2 haproxy) kandi outage yawe izohera mu masegonda 2.
4. NTUKIRUKE certbot renew --force-renewal gusubiramwo mu nzira iyo gusubiramwo bidashoboka: Let's Encrypt ishiraho umupaka w'igipimo gikomeye c'Ivyemezo 5 vyisubiriza ku misi 7 na Ivyemezo 5 vyananiwe ku konti, ku izina ry'umushitsi, ku isaha. Kwiruka --force-renewal incuro zitanu mu gahinda ataco akosoye ku bijanye n’ivyo nginx reload canke DNS/firewall bug izofunga urwego rwawe rwo gusohora Let's Encrypt gushika imisi 7.
5. Niwatera Reka Dushiremwo Igipimo c'Ikigereranyo (429 Too Many Requests), hindura umukiriya wawe wa ACME ku buyobozi bwa kabiri bw'Icemezo ca Leta ku buntu (ZeroSSL, Buypass Go SSL, canke Google Trust Services) canke wongereko SAN ubwo nyene:
6. Buri mukiriya wa ACME (certbot, acme.sh, caddy, cert-manager) ashobora gusaba icemeza ko yizigirwa ku buntu ku CA itandukanye mu masegonda 30 (--server https://acme.zerossl.com/v2/DV90 canke https://api.buypass.com/acme/directory), urenga rwose umupaka w'igipimo ca Let's Encrypt.
7. Canke, Let's Encrypt's "Ivyemezo 5 vyisubiriza ku misi 7" umupaka ukora gusa ku umugwi umwe nyawo w'Amazina y'Ivyigwa (SANs). Kwongerako urwego rumwe rw'inyongera (-d example.com -d www.example.com -d tlsfix1.example.com) biyigira icemeza ko kitari co kandi ikarenga umupaka w'igipimo c'Icemezo co kwisubiriza ubwo nyene.
8. Suzuma nimba DNS CAA inyandiko canke yavunitse DNSSEC iriko irabuza Ubuyobozi bwawe bw'Icemezo gutanga (CAA record for example.com prevents issuance:
9. Baza uruhusha rw'ubuyobozi bw'icemezo c'indangarubuga yawe (CAA) amakuru: dig +short CAA example.com. Niba DNS yawe ifise 0 issue "sectigo.com" canke 0 issue "amazon.com" (canke ku rwego rw'umuvyeyi), Reka dushiremwo amakuru (letsencrypt.org) na UbusaSSL (sectigo.com) zibujijwe na RFC 8659 gusohora gushika wongeyeko . 0 issue "letsencrypt.org" ku karere kawe ka DNS.
10. Nimba icambu 80 (HTTP-01 challenge) ibujijwe n'uruhome rw'umuriro, CDN, canke ISP, canke nimba umukozi wawe w'urubuga yanse gutangura kubera icemezo kibuze, koresha --standalone canke --dns (DNS-01) kwemeza:
11. Guhagarika nginx/apache muri make maze wiruke sudo certbot certonly --standalone -d example.com, canke ukoreshe --manual --preferred-challenges dns kwemeza mu gushiramwo _acme-challenge.example.com TXT kwandika muri console yawe ya DNS utakoze ku port 80.
12. Nimba urubuga rwawe rwicaye inyuma ya Cloudflare, AWS CloudFront, canke Fastly, suzuma nimba icemeza ko caheze kiri ku ruhande rwa CDN canke kuri Serveri yawe y'inkomoko (Error 526 Invalid SSL Certificate:
13. Kuri Cloudflare, nimba icemezo ca server yawe y'inkomoko yaheze kandi Cloudflare ikaba yashizwe kuri Full (Strict), abakoresha babona Ikosa 526. Mu gihe ukosora icemeza ko inkomoko, ushobora kugarura uruja n'uruza rw'urubuga mu masegonda 5 mu gutanga icemezo c'imyaka 15 Icemezo ca Cloudflare Origin CA mu gicapo ca Cloudflare (canke guhindura uburyo bwa SSL/TLS kuva ku Full (Strict) ku Full ku minota 10 bifata kugira ngo umuntu asubirize inkomoko . .pem dosiye).

Igiti c'ingingo: gusuzuma no gukosora icemeza ko SSL/TLS yaheze¶

Kurikiza iki giti c'ingingo kugira ngo umenye neza igice nyaco c'ukunanirwa (CDN Edge vs. Inkomoko Daemon Memory vs. ACME Challenge vs. CA Rate Limit) maze usubizeho uruja n'uruza rwa HTTPS mu minota:

flowchart TD
    Start["Abakoresha / APIs zitanga raporo NET::ERR_CERT_DATE_NTIVALID canke Ikosa ry'igicu 526"] --> CheckLive["Run: openssl s_umukiriya -izina rya server -huza indangarubuga:443 | Gufungura x509 -ntaho -amatariki -uwutanga"]

    CheckLive --> WhereExpired{"Ni Icete Ikihe Mu Vy’ukuri Caheze?"}

    WhereExpired -->|"Disiki fullchain.pem irakora, ariko icuma 443 kiraheze"| StaleDaemon["Ububiko bw'Idayimoni bwa kera canke Ububiko bw'Ivyemezo: Gusubira gushiramwo nginx / apache2 / haproxy / postfix, canke Gusubira kwubaka HAProxy PEM Ihuriweko"]
    WhereExpired -->|"Icemezo ca CDN Edge (Igicu/Igicu/Vyihuse) caraheze"| CDNFix["Suzuma amadosiye ya DNS CAA ku CDN CA (inyandiko za DNS CAA) hanyuma uhindure SSL yose canke wongere wemeze ACM"]
    WhereExpired -->|"Inkomoko ya Serveri fullchain.pem kuri Disiki iraheze"| DryRun["Kwiruka: sudo certbot ivugurura --iruka-ryumye (canke acme.sh --ivugurure -d urwego --gukosora)"]

    DryRun --> WhyFailed{"Ni kuki ugusubiramwo kwa ACME kwananiwe?"}

    WhyFailed -->|"429 Ibisabwa vyinshi cane (Igipimo c'igiciro cararengewe)"| RateLimit["Ubwo nyene: Ikibazo kivuye kuri ZeroSSL / Gugura / Ibikorwa vy'ukwizigira Google CANKE Wongereko 1 y'inyongera SAN (-d fix1.akarorero.com)"]
    WhyFailed -->|"CAA Inyandiko ibuza Gusohoka canke GUKORA (DNSSEC)"| CAADNS["-> Wongereko ikibazo 0 'letsencrypt.org' (na 'sectigo.com') canke Kosora Inyandiko ya DNSSEC DS yavunitse ku Munyamabanga"]
    WhyFailed -->|"Ihuzwa ryaranse / Igihe kirangiye / 404 kuri /.bizwi cane/acme-ingorane/"| HttpBlock["Icibutso 80 Cabujijwe canke Guhindura Uruzitiro: Gufungura Icuma ca TCP 80 mu Ruhome rw'Umuriro, Gukuraho /.bizwi neza/ mu Kwemeza/Gusubira Kwandika, canke Koresha Ingorane ya DNS-01"]
    WhyFailed -->|"Itegeko ry'umuyobozi w'icete ca Kubernetes ryagumye ririndiriye"| K8sFix["Run: kubectl idondora ingorane -> Suzuma ibisobanuro vy'ishure ry'injira, politike y'urubuga rwa pod y'umutorera umuti HTTP01, canke Webhook TLS"]

    StaleDaemon --> VerifyAll["Genzura urudodo & OCSP Gufatanya: openssl s_umukiriya -huza urwego:443 -imiterere"]
    CDNFix --> VerifyAll
    RateLimit --> VerifyAll
    CAADNS --> VerifyAll
    HttpBlock --> VerifyAll
    K8sFix --> VerifyAll

Icigwa ca 1: Gutahura igituma HSTS (Strict-Transport-Security) bituma haba ukuzima kw'umuriro¶

Iyo urubuga rudakoresha HSTS, icemeza ko igihe carangije kigaragaza imburi yo hagati (Your connection is not private) n'ihuriro "Ivyiza -> Bandanya ku example.com (ntitekanye)" rituma abakoresha bihebuye bashobora gukanda.

Ariko rero, hafi amaporogarama yose y’urubuga rwo muri iki gihe, amabanki, ama platforms ya SaaS, n’ .dev / .app / .page / .bank indangarubuga zo ku rwego rwo hejuru zishira mu ngiro HTTP Umutekano w'Ivy'Itwara (HSTS, 6797): 1. HSTS ihinduka (max-age=31536000): Umucukumbuzi wese yasuye urubuga rwawe mu misi 365 iheze yabitse amategeko Strict-Transport-Security: max-age=31536000; includeSubDomains. Gushika ico gihe kirangiye, umucukumbuzi arabuza umukoresha gukanda mw'ikosa ryose ry'icete (ERR_CERT_DATE_INVALID, ERR_CERT_COMMON_NAME_INVALID, canke ERR_CERT_AUTHORITY_INVALID). 2. HSTS ihagaze imbere y'igihe (preload urutonde canke .dev / .app gTLD): Niba indangarubuga yawe yarungitswe kuri hstspreload.org - canke nimba indangarubuga yawe ikoresha TLD yashizweho imbere y'Igitabu nk' .dev, .app, .page, .new, .chrome, canke .bank - kopi yose ya Chrome, Edge, Firefox, Safari, na Android WebView kw’isi ifise urubuga rwawe rwakozwe mu buryo bukomeye nk’uko bitegekanijwe na HSTS imbere y’uko uwukoresha asura urubuga rwawe ku ncuro ya mbere. 3. Kubera iki includeSubDomains imenagura ibikoresho vyo mu mutima n'ibikoresho vyo gutegura: Niba urwego rwawe rw'umuzi (example.com) yohereza Strict-Transport-Security: max-age=31536000; includeSubDomains, buri ntara (vpn.example.com, internal-jira.example.com, printer.example.com) na yo nyene ipfungiwe mu buryo bwa HSTS bukomeye. 4. Kubera iki API na Webhook bihurizwa hamwe (Stripe, Twilio, Slack, iOS ATS) inanirwa ubwo nyene: Abaguzi ba TLS bava kuri serveri (libcurl, Inzovu requests/urllib3, Urudodo.js undici, Genda crypto/tls, Java SSLContext) gukora RFC 5280 ikomeye notAfter kwemezwa na mburabuzi kandi nta ciyumviro c'umukoresha "gukanda." Mu gihe TLS ihagaze, Stripe na Shopify webhooks zizonanirwa gushikana kandi zije mu mirongo yo gusubira inyuma.

Icigwa ca 2: Isuzuma ry’amasegonda 60 - Mbega vy’ukuri icemeza ko caramaze gusubirwamwo kuri disiki?¶

Mu 35 kw’ijana vy’ibikorwa Let’s Encrypt outages, icemeza ko mu vy’ukuri cavuguruwe kuri disiki mu ndwi ziheze n’umwaka wa 2019. certbot.timer canke acme.sh, ariko daemon iriko irakora iracariko irakoresha icemeza ca kera carangije igihe kivuye muri RAM.

Intambwe ya 1: Gereranya umurongo w'urubuga n'idosiye iri kuri disiki¶

Gukoresha amabwirizwa yose kuri server yawe:

# Check what the live port 443 socket is presenting in RAM:
echo | openssl s_client -servername example.com -connect 127.0.0.1:443 2>/dev/null | openssl x509 -noout -subject -issuer -dates -serial

# Check what is actually sitting on the filesystem:
sudo openssl x509 -in /etc/letsencrypt/live/example.com/fullchain.pem -noout -subject -issuer -dates -serial

Intambwe ya 2: Kosora imitego 4 isanzwe "Yavuguruwe kuri Disk, Yaheze muri RAM"¶

Icigwa ca 3: Gukosora DNS CAA amabuye y'inyandiko na DNSSEC Kunanirwa kwemeza¶

Niwiruka . sudo certbot renew --dry-run kandi urabe: - urn:ietf:params:acme:error:caa :: CAA record for example.com prevents issuance - urn:ietf:params:acme:error:dns :: DNS problem: SERVFAIL looking up A/CAA for example.com

1. Uko DNS CAA (RFC 8659) ibuza gusubiramwo icemeza¶

Ikigo cose c'Icemezo ca Leta gisabwa n'amategeko n'Ibisabwa vy'Ishingiro vy'Ihuriro rya CA/Browser kugira ngo ubaze DNS . CAA amadosiye imbere yo gutanga icemeza ico ari co cose. CA igenda iduga ku giti ca DNS kuva sub.app.example.com -> app.example.com -> example.com: - Niba example.com afise busa CAA amadosiye, CA iyo ari yo yose yemerewe gutanga. - Niba example.com afise mbere n'umwe CAA nyandiko (akarorero, 0 issue "amazon.com" yongeweko ubwo nyene igihe umuntu yaremye AWS CloudFront gukwirakwiza, canke 0 issue "digicert.com"), ibindi bigo vyose bitanga icemezo kw’isi birabujijwe cane gutanga icemezo c’umwaka w’2019. example.com canke iyo ari yo yose mu nzira zayo. - Ikindi, nimba uriko urasaba Icemezo c'Ikimenyetso (*.example.com) kandi urwego rwawe rusobanura ikintu kidasanzwe 0 issuewild "ca.example" tag, CA igenzura issuewild umutungo aho issue.

Gupima no gukosora ubwo nyene CAA amabuye:¶

1. Suzuma CAA amakuru ku izina ry'umushitsi no ku rwego rw'isonga:

   dig +short CAA sub.example.com
   dig +short CAA example.com
   

2. Suzuma kandi nimba sub.example.com ni CNAME yerekana ku kindi kibanza (Ku RFC 8659, CAs na zo nyene zirasuzuma CAA amadosiye ku ntumbero za CNAME).
3. Mu rubuga rw'umutanga DNS wawe (Igicu, Inzira 53, DNS y'Igicu, Namecheap), ntufute ibiriho CAA amakuru akoreshwa na CDN yawe canke AWS ACM; Ahubwo, wongereko ivyongeweko CAA amadosiye yemerera Let's Encrypt na CAs zawe zo gusubiza inyuma:

   example.com.  300  IN  CAA  0 issue "letsencrypt.org"
   example.com.  300  IN  CAA  0 issue "sectigo.com"
   example.com.  300  IN  CAA  0 issue "pki.goog"
   example.com.  300  IN  CAA  0 issuewild "letsencrypt.org"
   example.com.  300  IN  CAA  0 issuewild "sectigo.com"
   

   (Iciyumviro: ZeroSSL ikoresha sectigo.com nk'ikimenyetso ca CAA, na Google Trust Services ikoresha pki.goog.)
4. Rindira amasegonda 60 kugira ngo amazina yawe yemewe ahindure (dig @ns1.yourdns.com CAA example.com) maze ubwo nyene agasubira kwiruka . sudo certbot renew. Kubera ko CAs zikora ubushakashatsi busubira inyuma bujanye n’ububiko bwa bose ku kugerageza, ugusohora biraroranirwa ubwo nyene.

2. Gukosora DNS problem: SERVFAIL looking up CAA (DNSSEC ntibihuye)¶

Reka dushiremwo amakuru, ibikorwa vy'ukwizigira Google, na ZeroSSL bishire mu ngiro kwemeza DNSSEC ku bishaka vyose vya DNS (A, AAAA, TXT, na CAA). Naho urwego rwoba rufise oya CAA record, CA itegerezwa kwakira inyandiko ibereye mu buryo bw'ibanga NOERROR (inyishu y'ubusa) canke NXDOMAIN (NSEC / NSEC3 guhakana ko ataco bimaze vyemewe) inyishu. - Niba umunyamabanga wawe w'indangarubuga afise ivya kera DS (Delegation Signer) inyandiko inyuma y’aho wimukiye abatanga DNS (nk’akarorero, kuva kuri GoDaddy uja kuri Cloudflare canke Inzira 53 utabanje guhagarika DNSSEC), abatorera umuti ibibazo bisubiramwo bishira mu ngiro DNSSEC bigaruka SERVFAIL. - Suzuma mu masegonda 5: Kwiruka delv @8.8.8.8 example.com CAA canke ikigeragezo kuri dnsviz.net. Nimba dig @8.8.8.8 example.com kugaruka status: SERVFAIL mu gihe dig +cd @8.8.8.8 example.com (+cd = Gusuzuma Disabled, kwirengagiza DNSSEC) bigarura aderesi yawe ya IP, uruzitiro rwawe rwa DNSSEC rwacitse. Injira mu munyamabanga wawe ubwo nyene maze ukureho ivya kera DS kwandika canke gukopa ubu DS parameters zivuye ku nzira yawe ya DNS.

Icigwa ca 4: Guca mu nzira y'Imipaka y'Igiciro (429 Too Many Requests) mu gihe c'uguhagarara¶

Mu gihe habaye akajagari, abahinga barakunda gusubira gufungura ibikoresho canke bagahunga . certbot gusubiramwo gushika Let's Encrypt yanse ibisabwa vyose na: - urn:ietf:params:acme:error:rateLimited :: Error creating new order :: too many certificates (5) already issued for this exact set of domains in the last 168h0m0s - urn:ietf:params:acme:error:rateLimited :: Error creating new order :: too many failed authorizations (5) recently

Igihe co kurindira kiva ku isaha 1 (ku vyerekeye uruhusha rwananiwe) gushika ku misi 7 (amasaha 168) (ku bijanye n’umupaka w’ivyemezo 5 vyisubiriza). Ntutegereze isaha 1 canke imisi 7 mu gihe urubuga rwawe rwo gukora ruri hasi. Ufise uburyo bubiri bubereye, bwo gutorera umuti:

Umuti A (Iciza): Hindura Ububasha bw'Icemezo ca ACME kuri ZeroSSL, Buypass, canke Ibikorwa vy'Ukwizigira Google mu masegonda 30¶

Itegeko rya ACME (RFC 8555) ni itegeko ryuguruye. Buri mucukumbuzi n'uburyo bwo gukoresha vyizigira ZeroSSL (umuzi wa Sectigo), Buypass Go SSL (CA y'i Norvege), na Ibikorwa vy'ukwizigira Google (pki.goog) bisa n'ivyo Reka dushiremwo amakuru (ISRG Root X1). Nta n’umwe muri bo asangira imipaka y’igiciro na Let’s Encrypt.

• Ihitamwo rya mbere: Gusohora ubwo nyene biciye ku Certbot ukoresheje Buypass Go SSL (Nta konti/urufunguzo rwa EAB rukenewe, imisi 180): (Iciyumviro: Buypass ishigikira ivyemezo vy'intara nyinshi bishika kuri 5 SANs, naho atari wildcard *.example.com ivyemezo)

  sudo certbot certonly --webroot -w /var/www/html \
    --server "https://api.buypass.com/acme/directory" \
    -d example.com -d www.example.com \
    --email admin@example.com --agree-tos
  

• Ihitamwo rya 2: Gusohora ubwo nyene biciye ku acme.sh (ihinduka ZeroSSL canke ihindura CAs na --server:

  # Using ZeroSSL:
  acme.sh --register-account -m admin@example.com --server zerossl
  acme.sh --issue -d example.com -d www.example.com -w /var/www/html --server zerossl
  

• Ihitamwo rya 3: Ikibazo biciye ku serivisi za Google (pki.goog) ACME ya bose: Mu gicu ca Google (canke biciye ku gcloud publicca external-account-keys create), gutanga ubuntu bwo gufatanya konti y'inyuma (EAB) urufunguzo mu masegonda 10 hanyuma ukore:

  sudo certbot certonly --webroot -w /var/www/html \
    --server "https://dv.acme-v02.api.pki.goog/directory" \
    --eab-kid "YOUR_EAB_KEY_ID" \
    --eab-hmac-key "YOUR_EAB_HMAC_KEY" \
    -d example.com -d www.example.com
  

Umuti B: Reka dushireho "Ivyemezo 5 vy'Ivyiyumviro" mu kwongerako izina ry'umushitsi rimwe ry'inyongera rya SAN¶

Reka dushiremwo amasaha 168 y'ugusubiramwo (too many certificates (5) already issued for this exact set of domains) ikurikirana amazina y'abashitsi ba SAN ku cete, mu gihe umupaka wose w'Ikibanza Canditswe ari Icemezo 50 ku ndwi. 1. Rema DNS idashobora gutera ingorane A inyandiko yerekana kuri server imwe: tls-recovery-01.example.com -> <your_server_ip>. 2. Saba icemeza n'inyandiko zawe z'umwimerere wongeyeko izina rishasha ry'umushitsi:

sudo certbot certonly --nginx --cert-name example.com \
  -d example.com -d www.example.com -d tls-recovery-01.example.com

Icigwa ca 5: Gusanasana vyavunitse HTTP-01 ingorane (Port 80) canke ukoresheje DNS-01 kwemeza vyihutirwa¶

Ni ryari certbot renew inanirwa na Timeout during connect (likely firewall problem) canke Invalid response from http://example.com/.well-known/acme-challenge/...: 404 (canke 403), abakozi bo kwemeza CA ntibashobora gushika ku kimenyetso cawe c'ingorane ca HTTP ku TCP port 80.

Kubera iki HTTP-01 bukwi na bukwi bimenagurika ku maserukira yakoze imisi 60 iheze¶

1. Itsinda ry'umutekano w'igicu / UFW / iptables closed Port 80: Hari uwakomeje uruhome rw'umuriro kugira ngo rwemerere port gusa 443 (HTTPS), kwibagirwa ko RFC 8555 . HTTP-01 kwemeza kwama gutangura ku nzira ya HTTP 80 (naho izokurikira 301 guhindura inzira kuri https:// ku cambu 443).
2. IPv6 yavunitse (AAAA) Inyandiko: Indangarubuga yawe ifise IPv4 (A) inyandiko n'i IPv6 (AAAA) inyandiko. Reka dushiremwo amakuru yama akunda IPv6 (AAAA) mbere. Niba aderesi yawe ya IPv6 igenda nabi, yabujijwe na ip6tables, canke ntiboshe muri Nginx (listen [::]:80;), igihe co kwemeza kiraheze naho IPv4 ikora neza.
3. Nginx / Igikoresho co gukoresha (React / Next.js / Django / Rails) bifata /.well-known/acme-challenge/: Ivyawe server guhagarika ku cambu 80 guserukira uruja n'uruza rwose (location / { proxy_pass http://localhost:3000; }) ku rubuga rw'inyuma aho gukoresha .well-known kuva kuri disiki.

Ivyo gukosora bibiri vy'aho nyene ku vyavunitse HTTP-01 kwemeza¶

Gukosora 1: Wongereko ikintu gihambaye cane /.well-known/acme-challenge/ guhagarika muri Nginx (Icumbu 80)¶

Kumenya neza ko port yawe 80 ibujijwe muri /etc/nginx/sites-enabled/ itanga ibimenyetso vya ACME biva kuri /var/www/letsencrypt mbere y'ivyo vyose return 301 https://... canke proxy_pass amabwirizwa:

server {
    listen 80;
    listen [::]:80;
    server_name example.com www.example.com;

    location ^~ /.well-known/acme-challenge/ {
        default_type "text/plain";
        root /var/www/letsencrypt;
        allow all;
    }

    location / {
        return 301 https://$host$request_uri;
    }
}

sudo mkdir -p /var/www/letsencrypt/.well-known/acme-challenge
sudo nginx -t && sudo systemctl reload nginx
sudo certbot certonly --webroot -w /var/www/letsencrypt -d example.com -d www.example.com

Gukosora 2: Guca ku nzira ya Port 80 na serveri z'urubuga rwose n'igitabu DNS-01 (TXT) urugamba¶

Niba port 80 yabujijwe na ISP/firewall yo hejuru canke umubare w'umuzigo wawe ntashobora gutuma .well-known ku nzira nyinshi z'inyuma, kwemeza biciye kuri DNS mu minota 2:

sudo certbot certonly --manual --preferred-challenges dns -d example.com -d "*.example.com"

dig +short TXT _acme-challenge.example.com @8.8.8.8

Icigwa ca 6: Igenzura ry’inyuma y’ugukira (Uruzitiro rwo hagati, OCSP Stapling, na CDN Purge)¶

Ikosa risanzwe inyuma yo gusubirira icemeza ko ari ugushiramwo cert.pem (icete c'amababi conyene) aho fullchain.pem (icemezo c’amababi + icemezo ca CA co hagati). Mucukumbuzi zo mu biro (Chrome, Firefox) akenshi bipfuka icemeza ko hagati kibuze biciye ku AIA (Authority Information Access) gukurikirana canke gushiramwo ibintu vyo hagati, mu gihe curl, Inyuguti, OpenSSL, porogaramu za Android, n'ibikoresho vy'urubuga vy'umurongo/Twilio birananirwa ubwo nyene na unable to verify the first certificate (SSL certificate problem: unable to get local issuer certificate).

• Suzuma ko umukozi wawe yohereza uruhererekane rwo hagati rwose (fullchain.pem: Kwiruka:

  echo | openssl s_client -servername example.com -connect example.com:443 2>/dev/null | grep -E "Verify return code|depth="
  

  Utegerezwa kubona nibura ingero zibiri (depth=0 undangarubuga bwawe na depth=1 CA yo hagati nk' Let's Encrypt E5/R11 canke ZeroSSL RSA Domain Secure Site CA) na Verify return code: 0 (ok). Niwabona . Verify return code: 21 (unable to verify the first certificate), hindura urubuga rwawe rwa seriveri config kuva cert.pem ku fullchain.pem.
• Kuraho ububiko bwa OCSP bwa kera muri Nginx / Apache: Niba ssl_stapling on; birashoboka, wongere ushiremwo umukozi w'urubuga maze usuzume openssl s_client -servername example.com -connect example.com:443 -status 2>/dev/null | grep -A 15 "OCSP response".
• Gutunganya uburyo bwinshi bwo kugenzura igihe ca SSL (Igenzura rya TCP ryo hanze + Prometheus blackbox_exporter: Ntukigere wizigira gusa ivyibutsa vy’imeli (Reka dushiremwo amakuru y’ivyibutsa vy’imeli vyahagaritswe mu 2025). Gukurikirana icuma 443 hanze (probe_ssl_earliest_cert_expiry - time() < 86400 * 14) hanyuma ushireho isuzuma rya cron ry'umusi ku musi ku sudo certbot renew --dry-run.

Inomero z'ivyihutirwa zo mu karere n'amategeko y'ibigo¶

Naho icemeza ko TLS yarangije igihe gisanzwe gitorwa n’imigwi y’abahinga, guhagarara kw’icemeza gusenyura inzugi z’ubuvuzi, urubuga rwo kohereza ivyihutirwa, kwemeza amabanki, canke ibikorwa remezo vya Leta bishobora gutuma habaho ibikorwa vy’ibibazo:

• Leta Zunze Ubumwe za Amerika na Canada:
• Ubuzima-Umutekano / Ubuvuzi / Uguhagarara: Hamagara 911 iyo icemeza ko TLS kidakora neza kigaca ubuhinga bwo gukoresha telemetry bw’umurwayi, gutanga imiti ku mbuga ngurukanabumenyi, canke guhanahana amakuru y’ivyihutirwa.
• Ikigo kijejwe umutekano wo kuri internet n'ibikorwa remezo (CISA) (US): Ibiro vy’abasivile vya Leta Zunze Ubumwe za Amerika bishingiye ku Itegeko ry’Ibikorwa ry’Igihugu (BOD) 18-01 rya CISA n’abakoresha ibikorwa remezo bihambaye bashikirwa n’ugutanga icemeza ata wemerewe (ugusenyura CA canke BGP/DNS hijacking) bakwiye gutanga raporo kuri 1-844-Say-CISA (1-844-729-2472) canke cisa.gov/report.
• Ikigo ca Canada kijejwe umutekano wo kuri internet: Ushobora guhamagara 1-833-CYBER-88 (1-833-292-3788).
• Ubwami bw'Ubwongereza:
• Ibikorwa vyihutirwa: Hamagara 999 iyo TLS ihagaze igira ingaruka ku mice y’ubuvuzi ya NHS canke ku mutekano w’ubuzima.
• Ikigo c'igihugu kijejwe umutekano wo kuri internet (NCSC): Niwabona icemeza ko kitaremewe gitanzwe ku rwego rwawe mu Guseruka kw'Icemezo (crt.sh) ibitabo vyerekana ko DNS yanyazwe, raporo biciye ku ncsc.gov.uk.
• Ubumwe bw'Uburayi:
• Ibikorwa vyihutirwa: Hamagara 112 mu bihugu vyose bigize Umuryango w’Ubumwe bw’Uburayi.
• Ivyemezo vy'ukwemeza urubuga rwa NIS2 & eIDAS (QWACs): Ibigo vy’ingenzi kandi bihambaye bishingiye ku Itegeko rya NIS2 bishikiwe n’uguhagarara kw’ubuhinga bumara igihe kirekire canke imfunguruzo za PKI zishobora guhungabanywa bitegerezwa kumenyesha CSIRT y’igihugu cavyo mu masaha 24.
• Ostraliya na Nouvelle-Zélande:
• Ibikorwa vyihutirwa: Hamagara 000 muri Australiya canke 111 muri Nouvelle-Zélande; bwira ACSC (1300 CYBER1) ku bibazo vy’ibikorwa remezo.
• Ubuhinde na Aziya-Pasifike:
• Ubuhinde (CERT-In / Umugenzuzi w'inzego zitanga icemezo CCA: Hamagara 112 ku bijanye n’ugutanga inyishu vyihutirwa; raporo y'ugusenyuka kwa PKI canke uguhagarara kw'ibikorwa remezo bikomeye kuri incident@cert-in.org.in mu masaha 6 gusa.

Ibibazo bikunda kubazwa¶

Kuki jewe canke abakoresha banje tudashobora gukanda "Ivyateye imbere -> Gukomeza ku rubuga (ntibitekanye)" muri Chrome canke Safari muri iki gihe c'uguhagarara?¶

Igihe indangarubuga yawe yohereza Umutekano w'ivy'ugutwara abantu n'ibintu (HSTS) Umutwe wa HTTP - canke ukoresha urwego rwo hejuru nk' .guteza imbere, .app, .urupapuro, canke .banki iyo hardcoded mu mucukumbuzi HSTS Preload List - RFC 6797 isaba umucukumbuzi gufata icemeza cose caheze, cishizeko umukono, canke kitahuye nk'ikosa ry'urupfu ritashobora gusubirwamwo. Mucukumbuzi ikuraho n'ibigirankana buto ya "Proceed anyway" kugira ngo ibuze abatera ba Man-in-the-Middle (MitM) guhenda abakoresha ngo bafyonde biciye ku cete c'ubuhendanyi. Mugihe umuhinguzi kuri Chrome ashobora kwandika urutonde rwa klavye rwihishije Ibi ntibitekanye directement ku screen y’ikosa kugira ngo uyirengagize mu karere kugira ngo uyigerageze, abakoresha nyabo ntibashobora; utegerezwa gushiramwo icemeza ko ari co ku cambu 443.

Let's Encrypt yahagaritse kohereza ama emails y'imburi y'igihe co guhera kandi cert yanje irahera ata n'umwe abimenyeshejwe - kuki ivyo vyabaye?¶

Let’s Encrypt yasohoye ku mugaragaro igikorwa cayo co kumenyesha ko igihe co guhera hagati mu 2025 kugira ngo kigabanye amafaranga yo kubika amakuru kandi kubera ko ubuhinga bwa ACME bwikoresha bukwiye gukurikirana ubuzima bwo gusubiramwo. Kugira ngo wirinde ibitangaza vyo muri kazoza, utegerezwa kugenzura igihe nyaco co gufatanya ukuboko kwa TLS ku rubuga ukoresheje igikoresho co hanze co kugenzura igihe co gukora (nka Prometheus akazu k'umwirabura_kohereza hanze, Igihe co gukora Kuma, Ivyiza kuruta, canke Datadog Synthetic TLS igenzura) igabisha ku misi 21, imisi 14, n’imisi 7 imbere y’uko siInyuma.

Kubera iki urubuga rwanje rukora neza muri Chrome na Firefox kuri laptop yanje, ariko rugakora neza kuri telefone za Android, curl, na Stripe webhooks inyuma yo guhindura icemeza?¶

Watunganije umukozi wawe w'urubuga (ssl_icete muri Nginx canke Dosiye y'icete ca SSLC mu rurimi rwa Apache) kugira ngo werekane kuri icemezo.pem (icete c'amababi conyene) aho urudodo rwuzuye.pem (icete c’amababi gifatanye n’icete ca CA co hagati). Mucukumbuzi zo kuri mudasobwa nka Chrome na Firefox zihita zikuraho ivyemezo vy'imbere bibuze inyuma hakoreshejwe Ubuyobozi bwo kuronka amakuru (AIA) URL imbere mu cete cawe c'amababi, uhisha uburyo butari bwo bwa server yawe. Ariko rero, kwizingira, OpenSSL, umugenzuzi w'ukwizigira kwa sisitemu ya Android, Python, n'abakozi ba webhook ntibakora AIA gukurikirana kandi baca banka guhuza n' ntashobora kuronka icemeza ko ari umutanga. Erekana config yawe kuri urudodo rwuzuye.pem kandi wongere ushiremwo server yawe.

Nomenya gute nimba umunyaruyeri canke umuyobozi w’umunyaruyeri yatanze icemeza SSL kitari cemerewe ku rubuga rwanje?¶

Ikigo cose gitanga icemezo cizigirwa na bose gisabwa kwandika icemezo cose gitanzwe ku bantu bose . Icemezo c'uguseruka (CT) ibitabo (RFC 6962) imbere y’uko abashakashatsi bazoyizigira. Gufungura q=%25.indangarubuga yawe.com canke Igikoresho co Gukurikirana Uguseruka kw'Icemezo ca Cloudflare kugira ngo ubone icemezo cose casohowe ku rwego rwawe n'urwego rwaco ruto. Niwabona icemeza ko catanzwe na CA utamenyereye kandi utavyemereye, uce ubwo nyene usuzuma umunyamabanga wawe wa DNS n’aho DNS ifise uburenganzira kugira ngo ubone ko ataco yahinduye ata wemerewe, ukureho icemeza ko ari co c’ubuhendanyi kiri kumwe na CA yatanze, hanyuma ufunge DNS yawe n’ CAA amadosiye (`0 issue "letsencrypt.org"`).

Bimeze gute iyo ikigwi canje ca Kubernetes cert-manager ntiyashoboye gusubiramwo icemeza ko Ingress yacu kandi Itegeko ryagumye muri 2019. Pending?¶

Kwiruka kubectl kuronka urutonde, urugamba -A hanyuma kubectl idondora ingorane -n . Mu bice 90 kw’ijana vy’ibikoresho vya Kubernetes umuyobozi w'icete guzimya, i cm-acme-http-umutorera umuti-* pod y'igihe gito iriko irakora, ariko canke (1) umutungo w'Ingress ufise ibisobanuro vy'umugwi w'ingress vya kera rero inzira y'umutorera umuti ntiyigeze ifatanywa n'umuringanizi wawe w'umuzigo, (2) Kubernetes Itegeko ry'urubuga ni uguhagarika uruja n’uruza rw’abantu ku nzira y’ugutorera umuti ibibazo ku cambu 8089, canke (3) ikibazo c’umusatsi NAT / split-horizon DNS kibuza umuyobozi w'icete's imbere kwisuzuma kuva ku gushika ku IP yawe y'umuringanire w'umuzigo wa bose (ishobora gukosorwa mu guca --dns01-izina-ry'abakozi=8.8.8.8:53,1.1.1.1:53 ku umuyobozi w'icete gushinga args).

Ndashobora gukopa ivyanje /etc/letsencrypt/ dosiye kuri server nshasha mu gihe c’ukwimuka vyihutirwa aho gusubira gutanga?¶

Ego. Niba server yawe ya mbere yapfuye kandi uriko urimukira kuri server nshasha mu gihe igipimo-kigabanywa na Let's Encrypt, zigama amahuzu y'ibimenyetso igihe ukopa /n'ibindi/ububiko/ gukoresha tar -czpf reka gufungura_ububiko.tar.gz / n'ibindi / gusiga (ntiwigere ukoresha ibisanzwe scp -r, ihindura amahuza y'ibimenyetso mu /n'ibindi/ububiko/ubuzima/ mu madosiye adahinduka yisubiriza kandi agaca ibivugururwa muri kazoza). Kura ubwo bubiko kuri serveri nshasha (`sudo tar -xzpf letsencrypt_backup.tar.gz -C /`), yerekana Nginx/Apache kuri `/etc/letsencrypt/live/domain/fullchain.pem`, kandi icemeza cawe kiriho kizoca gikora ubwo nyene kuri aderesi IP nshasha.

Inyobora zifitaniye isano¶

• Izina ry'indangarubuga ry'ubusuma, DNS yarangije igihe, no kwigarurira urubuga
• Disiki ya server yuzuye 100% (0 bytes ku buntu): ububiko bw'amakuru n'ugusubirana kw'umwanya wa zero
• Ahantu h'akazi ka Google canke Microsoft 365 gufunga umuyobozi w'indangarubuga n'ugukiza DNS TXT
• Ingorane zo kwakira urubuga, kwimuka, no kugarura ububiko
• DNS kwiba, ISP router WAN gusubira gutunganya, no guhenda urugi rw'inyagano
• Inomero z'ivyihutirwa hakurikijwe igihugu

Amasoko n'ubuyobozi buzwi¶

• Ishirahamwe ry'ubuhinga bwa Internet (IETF): RFC 8555 (Ibidukikije vy’Uburongozi bw’Icemezo / ACME), RFC 8659 (Uruhusha rw’Ubuyobozi bw’Icemezo ca DNS / CAA), na RFC 6797 (Umutekano w’Ivy’Itwara Ukomeye wa HTTP / HSTS).
• Ikigo c’Igihugu c’Ivyagezwe n’Ikoranabuhanga (NIST) (Leta Zunze Ubumwe za Amerika): Igitabu kidasanzwe 800-52 Ivyahishuriwe 2: Amabwirizwa yerekeye uguhitamwo, ugutunganya, n’ugukoresha umutekano w’ivy’ugutwara abantu n’ibintu (TLS) & SP 1800-16: Gucungera umutekano w’ibikorwa vyo ku rubuga: Ugucungera icemezo ca TLS Server.
• Ishirahamwe ry’ubushakashatsi ku bijanye n’umutekano wa Internet (ISRG / Reka Dushiremwo Inyandiko Yemewe): Igipimo c'Imipaka y'Igiciro, Amategeko y'Icemezo c'Ivyiyumviro, n'Ingorane za ACME.
• Ikigo kijejwe umutekano wo kuri Internet n’ibikorwa remezo (CISA) (Leta Zunze Ubumwe za Amerika): Itegeko ry’Ibikorwa ry’Igihugu 18-01: Gutuma habaho umutekano wa Email n’Urubuga (Impanuro zo Gushira mu Ngiro HTTPS na HSTS).
• Ikigo c'igihugu kijejwe umutekano wo kuri Internet (NCSC) (Ubwongereza): Gukoresha TLS kugira ngo ukinge amakuru neza mu bijanye n’uguca mu nzira n’ubuyobozi bwo kugenzura uguseruka kw’ivyemezo.