How I tricked Symantec with a Fake Private Key - Hanno's blog
Lately, some attention was drawn to a widespread problem with TLS certificates. Many people are accidentally publishing their private keys. Sometimes they are released as part of applications, in Github repositories or with common filenames on web servers. If a private key is compromised, a certificate authority is obliged to revoke it. The Baseline Requirements – a set of rules that browsers and
HTTPS Certificate Revocation is broken, and it’s time for some new tools
This article was originally published on Scott Helme's blog and is reprinted here with his permission. We have a little problem on the web right now and I can only see it becoming a larger concern as time goes by: more and more sites are obtaining certificates, vitally important documents needed to deploy HTTPS, but we have no way of protecting ourselves when things go wrong. Certificates We're cu
è‡ªå •è½ãªæŠ€è¡“者ã®æ—¥è¨˜ : HPKP(HTTP Public Key Pinning)公開éµãƒ”ニングã«ã¤ã„ã¦è€ƒãˆã‚‹ - livedoor Blog（ブãƒã‚°ï¼‰
ã‚‚ã㘠1. ã¯ã˜ã‚ã« 2. HPKPãŒç”Ÿã¾ã‚ŒãŸèƒŒæ™¯ 3. HPKPã®ä»•çµ„ã¿ 4. ピンã®è¨å®šã®è€ƒå¯Ÿ 4.1. ピンã®å€¤ã®å–得方法 4.2. 証明書ãƒã‚§ãƒ¼ãƒ³ã«ä¸€è‡´ã™ã‚‹ãƒ”ンã®é¸æŠž 4.3. 証明書更新ã¨HPKPヘッダã®è¨å®šå¤‰æ›´ã®é‹ç”¨æ–¹æ³• 4.4. ãƒãƒƒã‚¯ã‚¢ãƒƒãƒ—ピンã¨ã„ã†åå‰ã®ã‚¤ã‚±ã¦ãªã• 4.5. CAéµã®ãƒãƒƒã‚¯ã‚¢ãƒƒãƒ—ピンã®ã‚ªã‚¹ã‚¹ãƒ¡ã®å€¤ 4.6. 証明書ãƒã‚§ãƒ¼ãƒ³ä¸ã§è¤‡æ•°ãƒ”ンをã¤ã‘ã¦ã‚‚æ„味ã¯ãªã„ 4.7. åŒã˜CA証明書ã«Pinã—続ã‘ã‚‹å ´åˆã®èª²é¡Œ 4.8. 2ã¤ã®CA証明書ã«Pinã™ã‚‹å ´åˆã®èª²é¡Œ 4.9. max-ageã®ã‚ªã‚¹ã‚¹ãƒ¡å€¤ã‚’考ãˆã‚‹ 5. HPKPã¯ã©ã®ç¨‹åº¦ä½¿ã‚ã‚Œã¦ã„ã‚‹ã®ã‹ 6. 今ã®HPKPã®ä½•ãŒã„ã‘ãªã‹ã£ãŸã®ã‹ 7. ãŠã‚ã‚Šã« 8. (å‚考) HPKP関連ã®å‹‰å¼·ã«ãªã‚‹ãƒªãƒ³ã‚¯ 9. 追記 9.1. 追記(2017.02.26) HPKPã®ãƒ–ラウザサãƒãƒ¼ãƒˆçŠ¶æ³ 9.2. 追記(2017.
1
ランã‚ング
ランã‚ング
ランã‚ング
リリースã€éšœå®³æƒ…å ±ãªã©ã®ã‚µãƒ¼ãƒ“スã®ãŠçŸ¥ã‚‰ã›
最新ã®äººæ°—エントリーã®é…ä¿¡
処ç†ã‚’実行ä¸ã§ã™
j次ã®ãƒ–ックマーク
kå‰ã®ãƒ–ックマーク
lã‚ã¨ã§èªã‚€
eコメント一覧を開ã
oページを開ã
{{#tags}}- {{label}}
{{/tags}}