{"id":8600,"date":"2020-08-11T12:05:52","date_gmt":"2020-08-11T10:05:52","guid":{"rendered":"https:\/\/www.proid.cz\/produkty\/ocsp-server-online-seznam-odvolanych-certifikatu\/"},"modified":"2021-06-21T11:34:05","modified_gmt":"2021-06-21T09:34:05","slug":"ocsp-online-zoznam-zrusenych-certifikatov","status":"publish","type":"dt_portfolio","link":"https:\/\/proid.cz\/sk\/produkty\/ocsp-online-zoznam-zrusenych-certifikatov\/","title":{"rendered":"OCSP
Online zoznam zru\u0161en\u00fdch certifik\u00e1tov"},"content":{"rendered":"

[vc_row type=”vc_default” bg_type=”grad” bg_override=”full” css=”.vc_custom_1604323404026{margin-top: -70px !important;}” bg_grad=”background: -webkit-gradient(linear, left top, left bottom, color-stop(0%, #002828), color-stop(100%, #00B49F));background: -moz-linear-gradient(left,#002828 0%,#00B49F 100%);background: -webkit-linear-gradient(left,#002828 0%,#00B49F 100%);background: -o-linear-gradient(left,#002828 0%,#00B49F 100%);background: -ms-linear-gradient(left,#002828 0%,#00B49F 100%);background: linear-gradient(left,#002828 0%,#00B49F 100%);”][vc_column][vc_empty_space height=”100″][vc_row_inner][vc_column_inner width=”5\/6″][vc_column_text]<\/p>\n

OCSP
\nOnline zoznam zru\u0161en\u00fdch certifik\u00e1tov<\/span><\/h1>\n

[\/vc_column_text][vc_column_text]Z\u00edskejte absolutn\u00ed p\u0159ehled o v\u0161ech odvolan\u00fdch certifik\u00e1tech, a to v re\u00e1ln\u00e9m \u010dase, bez prodlev. OCSP (Online Certificate Status Protocol) je modul pro zji\u0161\u0165ov\u00e1n\u00ed stavu odvol\u00e1n\u00ed certifik\u00e1t\u016f. D\u00edky n\u011bmu v re\u00e1ln\u00e9m \u010dase zjist\u00edte aktu\u00e1ln\u00ed stav uvnit\u0159 cel\u00e9 organizace. <\/span>[\/vc_column_text][\/vc_column_inner][vc_column_inner width=”1\/6″][\/vc_column_inner][\/vc_row_inner][vc_empty_space height=”100″][\/vc_column][\/vc_row][vc_row type=”vc_default” bg_type=”bg_color” bg_override=”full” bg_color_value=”#f5f5f5″][vc_column][vc_row_inner][vc_column_inner width=”1\/2″][vc_column_text css=”.vc_custom_1603970868569{border-left-width: 4px !important;padding-left: 20px !important;border-left-color: #d8d8d8 !important;border-left-style: solid !important;}”]\"\"<\/p>\n

Modul pro spr\u00e1vu u\u017eivatelsk\u00fdch certifik\u00e1t\u016f<\/strong><\/span>[\/vc_column_text][\/vc_column_inner][vc_column_inner width=”1\/2″][vc_column_text css=”.vc_custom_1604047163728{border-left-width: 4px !important;padding-left: 20px !important;border-left-color: #d8d8d8 !important;border-left-style: solid !important;}”]\"\"<\/p>\n

Modul pro spr\u00e1vu technologick\u00fdch certifik\u00e1t\u016f<\/strong><\/span>[\/vc_column_text][\/vc_column_inner][\/vc_row_inner][\/vc_column][\/vc_row][vc_row][vc_column][vc_empty_space height=”30″][vc_column_text]<\/p>\n

Pro spr\u00e1vce PKI infrastruktury organizace je \u017eivotn\u011b d\u016fle\u017eit\u00e9 m\u00edt v\u017edy p\u0159ehled o platnosti certifik\u00e1t\u016f \u2013 ty toti\u017e maj\u00ed omezenou dobu pou\u017eit\u00ed. Stejn\u011b tak v\u0161ak sami \u010dasto odvol\u00e1vaj\u00ed certifik\u00e1ty<\/strong>, kter\u00e9 cht\u011bj\u00ed zneplatnit. Probl\u00e9m je, \u017ee certifika\u010dn\u00ed autority informace o platnosti certifik\u00e1t\u016f publikuj\u00ed opo\u017ed\u011bn\u011b (v tzv. CRL<\/strong> – Certificate Revocation List). Modul OCSP tento statick\u00fd list nahrazuje<\/strong> a p\u0159ed\u00e1v\u00e1 informace o odvolan\u00fdch certifik\u00e1tech ve stavu, v jak\u00e9m jsou v dan\u00e9m okam\u017eiku – bez zpo\u017ed\u011bn\u00ed a tedy s nulovou chybovost\u00ed<\/strong>.<\/p>\n

[\/vc_column_text][\/vc_column][\/vc_row][vc_row][vc_column][vc_empty_space height=”30″][vc_row_inner css=”.vc_custom_1603804943038{padding: 20px !important;background-color: rgba(221,51,51,0.1) !important;*background-color: rgb(221,51,51) !important;border-radius: 15px !important;}”][vc_column_inner]

PRO \u0158E\u0160EN\u00cd JAK\u00ddCH PROBL\u00c9M\u016e JSME MODUL VYVINULI?<\/h3>\n
    \n
  • Bez modulu OCSP se v p\u0159\u00edpad\u011b expirace certifik\u00e1tu o tom spr\u00e1vce dozv\u00ed a\u017e zp\u011btn\u011b<\/strong> na z\u00e1klad\u011b vydan\u00e9ho CRL<\/li>\n
  • Je pro n\u011b tak\u00e9 t\u011b\u017ek\u00e9 ur\u010dit, kter\u00fdm certifik\u00e1t\u016fm hroz\u00ed expirace<\/strong> a maj\u00ed b\u00fdt obnoveny.<\/li>\n
  • Stejn\u011b tak je v p\u0159\u00edpad\u011b z\u00e1m\u011brn\u00e9ho odvol\u00e1n\u00ed<\/strong> certifik\u00e1tu spr\u00e1vcem nemo\u017en\u00e9 v re\u00e1ln\u00e9m \u010dase zjistit, zda byl skute\u010dn\u011b odvol\u00e1n.<\/li>\n
  • Modul OCSP v\u00fdrazn\u011b zjednodu\u0161uje<\/strong> tyto \u010dinnosti a \u0161et\u0159\u00ed tak obrovsk\u00e9 mno\u017estv\u00ed \u010dasu na spr\u00e1vu \u017eivotn\u00edho cyklu certifik\u00e1t\u016f.<\/li>\n<\/ul>\n<\/div>[\/vc_column_inner][\/vc_row_inner][vc_empty_space height=”30″][vc_row_inner equal_height=”yes” content_placement=”middle”][vc_column_inner width=”1\/2″][vc_column_text]<\/p>\n

    P\u0159edejd\u011bte bezpe\u010dnostn\u00edm rizik\u016fm a m\u011bjte v\u0161e pod kontrolou<\/h3>\n

    P\u0159edstavte si organizaci, kter\u00e1 vyd\u00e1v\u00e1 a spravuje velk\u00e9 mno\u017estv\u00ed certifik\u00e1t\u016f. A z\u00e1rove\u0148 pracuje s certifik\u00e1ty vydan\u00fdmi extern\u00edmi certifika\u010dn\u00edmi autoritami. Elektronick\u00e9 podpisy, opr\u00e1vn\u011bn\u00ed k p\u0159\u00edstup\u016fm do prostor \u010di do webov\u00fdch slu\u017eeb a dal\u0161\u00ed.<\/p>\n

    Pokud spr\u00e1vci s\u00edt\u011b cht\u011bj\u00ed zjistit aktu\u00e1ln\u00ed stav (\u010di platnost) t\u011bchto certifik\u00e1t\u016f, mus\u00ed standardn\u011b pou\u017e\u00edvat CRL<\/strong> – soubor vyd\u00e1van\u00fd certifika\u010dn\u00edmi autoritami. Tento soubor je v\u0161ak vyd\u00e1v\u00e1n d\u00e1vkov\u011b<\/strong> (nap\u0159. 1x t\u00fddn\u011b) a nav\u00edc v ne\u010diteln\u00e9m, bin\u00e1rn\u00edm form\u00e1tu.<\/p>\n

    N\u00e1\u0161 modul OCSP<\/strong> \u0159e\u0161\u00ed tyto probl\u00e9my a d\u00e1v\u00e1 spr\u00e1vc\u016fm mo\u017enost jednodu\u0161e a rychle zjistit stav<\/strong> konkr\u00e9tn\u00edho certifik\u00e1tu.[\/vc_column_text][\/vc_column_inner][vc_column_inner width=”1\/2″][vc_single_image image=”1302″ img_size=”full” alignment=”center”][\/vc_column_inner][\/vc_row_inner][\/vc_column][\/vc_row][vc_row type=”vc_default” disable_element=”yes”][vc_column][vc_empty_space height=”100″][vc_row_inner equal_height=”yes” content_placement=”middle”][vc_column_inner width=”1\/2″][vc_single_image image=”2893″ img_size=”full”][\/vc_column_inner][vc_column_inner width=”1\/2″][vc_column_text]<\/p>\n

    Neomezen\u00e9 certifika\u010dn\u00ed autority<\/h3>\n
      \n
    • NTFmail neklade \u017e\u00e1dn\u00e1 omezen\u00ed na certifika\u010dn\u00ed autoritu, kter\u00e1 generuje certifik\u00e1ty. Um\u00ed zpracov\u00e1vat jak\u00e9koli certifik\u00e1ty, odpov\u00eddaj\u00edc\u00ed standardu X.509<\/strong> a RFC 5280<\/strong>.<\/li>\n
    • NTFmail podporuje zpracov\u00e1n\u00ed certifik\u00e1t\u016f, vydan\u00fdch z:\n
        \n
      • Dom\u00e9nov\u00e9 certifika\u010dn\u00ed autority, provozovan\u00e9 na platform\u011b MS Windows Server<\/strong>.<\/li>\n
      • Komer\u010dn\u00edch \/ ve\u0159ejn\u00fdch<\/strong> certifika\u010dn\u00edch autorit.<\/li>\n
      • Kvalifikovan\u00fdch certifika\u010dn\u00edch autorit<\/strong> (kvalifikovan\u00fdch poskytovatel\u016f slu\u017eeb vytv\u00e1\u0159ej\u00edc\u00edch d\u016fv\u011bru \u2013 podle na\u0159\u00edzen\u00ed eIDAS<\/strong>)<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n

        [\/vc_column_text][\/vc_column_inner][\/vc_row_inner][\/vc_column][\/vc_row][vc_row][vc_column][vc_empty_space height=”30″][vc_column_text]<\/p>\n

        Spr\u00e1va certifik\u00e1t\u016f a ProID OCSP server<\/h2>\n

        [\/vc_column_text][vc_row_inner][vc_column_inner width=”1\/2″][vc_column_text]ProID OCSP<\/strong> je server, kter\u00fd publikuje informace o certifik\u00e1tech na z\u00e1klad\u011b SQL datab\u00e1ze. V datab\u00e1zi jsou ulo\u017eeny informace o certifik\u00e1tech, v\u010detn\u011b stavu odvol\u00e1n\u00ed. Na dotaz klienta OCSP server v datab\u00e1zi vyhled\u00e1 stav odvol\u00e1n\u00ed p\u0159\u00edslu\u0161n\u00fdch certifik\u00e1t\u016f, podep\u00ed\u0161e odpov\u011b\u010f kl\u00ed\u010dem a certifik\u00e1tem a ode\u0161le informaci klientovi.<\/p>\n

        OCSP protokol je standardizov\u00e1n. Dodr\u017eov\u00e1n\u00ed standard\u016f je z\u00e1rukou interoperability mezi serverem a klienty, p\u0159i\u010dem\u017e ka\u017ed\u00e1 z\u00a0komunikuj\u00edc\u00edch stran m\u016f\u017ee b\u00fdt implementov\u00e1na jin\u00fdm dodavatelem.[\/vc_column_text][\/vc_column_inner][vc_column_inner width=”1\/2″][vc_column_text]Datov\u00fdm zdrojem informac\u00ed o certifik\u00e1tech je pro ProID OCSP<\/strong> typicky datab\u00e1ze syst\u00e9mu SaRS<\/strong> (Save and Recovery System<\/em>). ProID OCSP v\u0161ak lze provozovat i nad jinou datab\u00e1z\u00ed, pokud datab\u00e1ze obsahuje pot\u0159ebn\u00e9 \u00fadaje.<\/p>\n

        Lze jej provozovat i mimo prost\u0159ed\u00ed dom\u00e9ny a bez vazby na certifika\u010dn\u00ed slu\u017ebu MS Windows Serveru. Jedinou komponentou, kter\u00e1 je pro fungov\u00e1n\u00ed nezbytn\u00e1 je SQL datab\u00e1ze<\/strong> s informacemi o certifik\u00e1tech.[\/vc_column_text][\/vc_column_inner][\/vc_row_inner][vc_empty_space height=”30″][\/vc_column][\/vc_row][vc_row][vc_column][vc_column_text]<\/p>\n

        Kompatibilita a\u00a0\u0161k\u00e1lovatelnost OSCP<\/h2>\n

        [\/vc_column_text][vc_row_inner][vc_column_inner width=”1\/2″][vc_column_text]OCSP je implementov\u00e1n s vlastnostmi, kter\u00e9 zaji\u0161\u0165uj\u00ed vysokou m\u00edru kompatibility s b\u011b\u017en\u011b pou\u017e\u00edvan\u00fdmi OCSP klienty. Je pou\u017eiteln\u00fd jak v mal\u00fdch organizac\u00edch s mal\u00fdm po\u010dtem vydan\u00fdch certifik\u00e1t\u016f, tak ve velk\u00fdch organizac\u00edch s velk\u00fdm mno\u017estv\u00edm certifik\u00e1t\u016f a syst\u00e9m\u016f. ProID OCSP je postaven na robustn\u00edm z\u00e1kladu s vysokou propustnost\u00ed dotaz\u016f.[\/vc_column_text][\/vc_column_inner][vc_column_inner width=”1\/2″][vc_column_text]V p\u0159\u00edpad\u011b instalace do prost\u0159ed\u00ed s velk\u00fdm zat\u00ed\u017een\u00edm dotaz\u016f lze plugin \u0161k\u00e1lovat. Pokud by jedna instance OCSP byla saturov\u00e1na dotazy, lze instalovat druhou instanci a rozlo\u017eit z\u00e1t\u011b\u017e mezi n\u011b.[\/vc_column_text][\/vc_column_inner][\/vc_row_inner][vc_empty_space height=”30″][vc_column_text]<\/p>\n

        Princip fungov\u00e1n\u00ed ProID OCSP serveru<\/h2>\n

        [\/vc_column_text][vc_row_inner][vc_column_inner width=”1\/2″][vc_column_text]OCSP zpracov\u00e1v\u00e1 jednotliv\u00e9 klientsk\u00e9 po\u017eadavky jako webov\u00e9 slu\u017eby: paraleln\u011b a nez\u00e1visle. Odd\u011blen\u00e9 zpracov\u00e1n\u00ed po\u017eadavk\u016f je \u0159\u00edzeno prost\u0159edky webov\u00e9ho serveru, ve kter\u00e9m je slu\u017eba hostov\u00e1na. Informace o stavu certifik\u00e1tu se zji\u0161\u0165uj\u00ed v SQL datab\u00e1zi. Jakmile jsou dohled\u00e1ny datab\u00e1zov\u00e9 identifik\u00e1tory pro v\u0161echny certifik\u00e1ty v klientsk\u00e9m po\u017eadavku, OCSP server postupn\u011b v datov\u00e9m zdroji zji\u0161\u0165uje stav jednotliv\u00fdch certifik\u00e1t\u016f.[\/vc_column_text][\/vc_column_inner][vc_column_inner width=”1\/2″][vc_column_text]V\u00fdsledkem dohled\u00e1n\u00ed informac\u00ed o stavu certifik\u00e1t\u016f je dopln\u011bn\u00e1 datov\u00e1 struktura. Zji\u0161t\u011bn\u00e9 rozd\u00edly se automaticky zapisuj\u00ed do \u017eurn\u00e1lu \u010dinnosti.[\/vc_column_text][\/vc_column_inner][\/vc_row_inner][vc_empty_space height=”30″][\/vc_column][\/vc_row][vc_row][vc_column][\/vc_column][\/vc_row][vc_row][vc_column][\/vc_column][\/vc_row][vc_row][vc_column][\/vc_column][\/vc_row][vc_row][vc_column][\/vc_column][\/vc_row][vc_row][vc_column width=”1\/2″]

        \t\t
        [vc_single_image image=”4237″ img_size=”full”][vc_column_text css=”.vc_custom_1607500327184{padding-right: 20px !important;padding-left: 20px !important;}”]Ke sta\u017een\u00ed<\/span>
        \nBro\u017eury a p\u0159\u00edpadov\u00e9 studie<\/strong><\/span>
        \n[\/vc_column_text]