{"id":307,"date":"2019-10-19T14:51:06","date_gmt":"2019-10-19T05:51:06","guid":{"rendered":"https:\/\/blog.daichang.me\/?p=307"},"modified":"2019-10-19T14:51:06","modified_gmt":"2019-10-19T05:51:06","slug":"dns-caa-%e3%81%a8-tls-1-3-%e3%81%b8%e3%81%ae%e5%af%be%e5%bf%9c","status":"publish","type":"post","link":"https:\/\/blog.daichang.me\/?p=307","title":{"rendered":"DNS CAA \u3068 TLS 1.3 \u3078\u306e\u5bfe\u5fdc"},"content":{"rendered":"<p>\u3053\u306e\u30c9\u30e1\u30a4\u30f3\u3092 DNS CAA \u304a\u3088\u3073 TLS 1.3 \u3078\u5bfe\u5fdc\u3055\u305b\u305f\uff08\u52a0\u3048\u3066 TLS 1.0\/1.1 \u3092\u7121\u52b9\u5316\u3057\u305f\uff09\u8a18\u9332\u3092\u30e1\u30e2\u3068\u3057\u3066\u6b8b\u3057\u3066\u304a\u304d\u307e\u3059\u3002<br \/>\n<!--more--><\/p>\n<ul>\n\u4f5c\u696d\u5b9f\u65bd\u30d0\u30fc\u30b8\u30e7\u30f3<\/p>\n<li>Ubuntu 18.04.2 LTS<\/li>\n<li>OpenSSL 1.1.1<\/li>\n<li>nginx\/1.14.0 (Ubuntu)<\/li>\n<\/ul>\n<blockquote><p>1. DNS CAA (Certificate Authority Authorization) \u3078\u306e\u5bfe\u5fdc<\/p><\/blockquote>\n<p>DNS CAA \u3068\u306f\u3001\u3056\u3063\u304f\u308a\u8a00\u3046\u3068\u3001\u610f\u56f3\u3057\u306a\u3044\u8a8d\u8a3c\u5c40 (CA; Certification Authority) \u304b\u3089 SSL (TLS) \u30b5\u30fc\u30d0\u8a3c\u660e\u66f8\u304c\u52dd\u624b\u306b\u767a\u884c\u3055\u308c\u306a\u3044\u3088\u3046\u306b\u3059\u308b\u4ed5\u7d44\u307f\u3067\u3059\u3002<\/p>\n<p>2019\u5e7410\u6708\u73fe\u5728\u3067\u306f\u3001\u8a8d\u8a3c\u5c40\u304c\u30b5\u30fc\u30d0\u8a3c\u660e\u66f8\u3092\u767a\u884c\u3059\u308b\u969b\u306b\u306f\u5fc5\u305a DNS \u306e CAA \u30ec\u30b3\u30fc\u30c9\u3092\u78ba\u8a8d\u3057\u3001\u81ea\u8eab\uff08\u81ea\u793e\uff09\u306b\u5bfe\u3057\u3066\u30c9\u30e1\u30a4\u30f3\uff08\u3042\u308b\u3044\u306f\u30b5\u30d6\u30c9\u30e1\u30a4\u30f3\uff09\u306e\u6240\u6709\u8005\u304c\u610f\u56f3\u3057\u3066\u8a3c\u660e\u66f8\u767a\u884c\u4f9d\u983c\u3092\u3057\u3066\u3044\u308b\u304b\u3069\u3046\u304b\u3092\u78ba\u8a8d\u3059\u308b\u3053\u3068\u304c\u7fa9\u52d9\u4ed8\u3051\u3089\u308c\u3066\u3044\u307e\u3059\u3002<br \/>\n\u8a8d\u8a3c\u5c40\u306f CAA \u30ec\u30b3\u30fc\u30c9\u3092\u78ba\u8a8d\u3057\u3001\u81ea\u8eab\uff08\u81ea\u793e\uff09\u304c\u8a3c\u660e\u66f8\u3092\u767a\u884c\u3067\u304d\u308b\u8a8d\u8a3c\u5c40\u3067\u7121\u3044\u3068\u78ba\u8a8d\u3067\u304d\u305f\u3089\u8a3c\u660e\u66f8\u3092\u767a\u884c\u305b\u305a\u306b\u3001\u30c9\u30e1\u30a4\u30f3\u7ba1\u7406\u8005\u306b\u305d\u306e\u65e8\u3092\u5831\u544a\u3059\u308b\u3068\u3044\u3046\u72b6\u6cc1\u3067\u3059\u3002<\/p>\n<p>\u3057\u304b\u3057\u306a\u304c\u3089\u30012019\u5e7410\u6708\u73fe\u5728\u3067\u306f\u3001DNS CAA \u30ec\u30b3\u30fc\u30c9\u3092\u30c9\u30e1\u30a4\u30f3\u306b\u5bfe\u3057\u3066\u767b\u9332\u3059\u308b\u304b\u3069\u3046\u304b\u306f\u30e6\u30fc\u30b6\u306e\u4efb\u610f\u3068\u3055\u308c\u3066\u3044\u308b\u305f\u3081\u3001\u4eee\u306b\u8a2d\u5b9a\u3057\u306a\u304f\u3068\u3082\u8a3c\u660e\u66f8\u767a\u884c\u306f\u554f\u984c\u306a\u304f\u884c\u3048\u307e\u3059\u3002<br \/>\n\u3088\u3063\u3066\u3001\u3042\u304f\u307e\u3067\u5bfe\u5fdc\u3092\u5f37\u5236\u3055\u308c\u3066\u3044\u308b\u306e\u306f\u8a8d\u8a3c\u5c40\u5074\u3067\u3042\u3063\u3066\u3001\u30e6\u30fc\u30b6\u7684\u89b3\u70b9\u3067\u898b\u308b\u3068\u300c\u30c9\u30e1\u30a4\u30f3\u306b\u5bfe\u3057\u3066 CAA \u30ec\u30b3\u30fc\u30c9\u3092\u767b\u9332\u3057\u3066\u304a\u304f\u3068\u3001\u8a3c\u660e\u66f8\u306e\u8aa4\u767a\u884c\u9632\u6b62\u306b\u3064\u306a\u304c\u308a\u307e\u3059\u3088\u300d\u7a0b\u5ea6\u306e\u30ec\u30d9\u30eb\u3067\u3059\u3002\u3002\u3002<\/p>\n<p>\u307e\u305f\u3001DNS CAA \u3078\u306e\u5bfe\u5fdc\u306f\u3001\u3082\u3061\u308d\u3093\u3067\u3059\u304c DNS \u30b5\u30fc\u30d0\u5074\u304c\u5bfe\u5fdc\u3057\u3066\u3044\u308b\u5fc5\u8981\u304c\u3042\u308a\u307e\u3059\u3002\u4eca\u56de\u3001\u79c1\u304c\u4f7f\u7528\u3057\u3066\u3044\u308b DNS \u30b5\u30fc\u30d0\u306f\u5bfe\u5fdc\u3057\u3066\u3044\u308b\u305f\u3081\u3001CAA \u30ec\u30b3\u30fc\u30c9\u306e\u767b\u9332\u3092\u3057\u307e\u3057\u305f\u3002<br \/>\n\u306a\u304a\u3001\u767b\u9332\u3059\u308b CAA \u30ec\u30b3\u30fc\u30c9\u3067\u3059\u304c\u3001\u4f5c\u6210\u306b\u5f53\u305f\u3063\u3066\u306f <a href=\"https:\/\/sslmate.com\/\">SSLMate<\/a> \u306e <a href=\"https:\/\/sslmate.com\/caa\/\">CAA Record Helper<\/a> \u3092\u4f7f\u7528\u3057\u3001\u3067\u304d\u305f\u30ec\u30b3\u30fc\u30c9\u3092 DNS \u30b5\u30fc\u30d0\u306e\u8a2d\u5b9a\u306b\u30b3\u30d4\u30da\u3057\u307e\u3057\u305f\u3002<br \/>\n\u306a\u306e\u3067\u3001\u7279\u306b\u96e3\u3057\u3044\u3053\u3068\u306f\u3057\u3066\u3044\u307e\u305b\u3093w<\/p>\n<p>\u305f\u3060\u3057\u3001CAA \u30ec\u30b3\u30fc\u30c9\u306e\u767b\u9332\u306b\u5f53\u305f\u3063\u3066\u6ce8\u610f\u3057\u306a\u3051\u308c\u3070\u306a\u3089\u306a\u3044\u4e8b\u9805\u3068\u3057\u3066\u306f\u3001\u89aa\u30c9\u30e1\u30a4\u30f3\uff08\u4f8b\u3048\u3070 example.com\uff09\u306b CAA \u30ec\u30b3\u30fc\u30c9\u3092\u767b\u9332\u3057\u3066\u3044\u308b\u5834\u5408\u3001\u30b5\u30d6\u30c9\u30e1\u30a4\u30f3\uff08\u4f8b\u3048\u3070 sub.example.com\uff09\u3082\u305d\u306e\u5f71\u97ff\u3092\u53d7\u3051\u307e\u3059\u306e\u3067\u3001\u4ed6\u8005\u3078\u30b5\u30d6\u30c9\u30e1\u30a4\u30f3\u3092\u59d4\u8b72\u3057\u3066\u3044\u308b\u5834\u5408\u306b\u306f\u30b5\u30d6\u30c9\u30e1\u30a4\u30f3\u306e\u3053\u3068\u3082\u8003\u616e\u3057\u305f\u8a2d\u5b9a\u3092\u3059\u308b\u5fc5\u8981\u304c\u3042\u308a\u307e\u3059\u3002<\/p>\n<blockquote><p>2. TLS 1.3 \u3078\u306e\u5bfe\u5fdc<\/p><\/blockquote>\n<p>2020\u5e74\u4e0a\u534a\u671f\u4e2d\u306b\u306f TLS 1.0\/1.1 \u304c\u4e3b\u8981\u30d6\u30e9\u30a6\u30b6\u5168\u3066\u3067\u95b2\u89a7\u3067\u304d\u306a\u304f\u306a\u308b\u3068\u3044\u3046\u72b6\u6cc1\u3092\u8fce\u3048\u3066\u3044\u307e\u3059\u3002<br \/>\n\u305d\u306e\u305f\u3081\u3001HTTPS \u3067\u30b5\u30fc\u30d3\u30b9\u3092\u63d0\u4f9b\u3059\u308b\u5834\u5408\u306b\u306f TLS 1.2\/1.3 \u3067\u52d5\u4f5c\u3092\u3055\u305b\u308b\u5fc5\u8981\u304c\u3042\u308a\u307e\u3059\u3002<br \/>\n\u76f4\u8fd1\u306f TLS 1.2 \u306b\u5bfe\u5fdc\u3057\u3066\u3044\u308c\u3070\u30d6\u30e9\u30a6\u30b6\u3067\u95b2\u89a7\u3067\u304d\u306a\u304f\u306a\u308b\u3068\u3044\u3046\u72b6\u6cc1\u3092\u51cc\u3052\u308b\u3053\u3068\u306f\u78ba\u304b\u3067\u3059\u304c\u3001\u3044\u3044\u30bf\u30a4\u30df\u30f3\u30b0\u306a\u306e\u3067\u3001TLS 1.0\/1.1 \u306e\u5bfe\u5fdc\u7d42\u4e86\u3068 TLS 1.3 \u3078\u306e\u5bfe\u5fdc\u3092\u5b9f\u65bd\u3057\u307e\u3057\u305f\u3002<\/p>\n<p>TLS 1.3 \u3078\u306e\u5bfe\u5fdc\u306f\u3001OpenSSL 1.1.1 \u4ee5\u964d\u306e\u30d0\u30fc\u30b8\u30e7\u30f3\u304c\u52d5\u4f5c\u3057\u3066\u3044\u308b\u5fc5\u8981\u304c\u3042\u308b\u305f\u3081\u3001OpenSSL \u306e\u30d0\u30fc\u30b8\u30e7\u30f3\u3092\u4e0a\u3052\u307e\u3057\u305f\u3002<br \/>\n\u306a\u304a\u3001Ubuntu \u3067\u306f\u7279\u5b9a\u306e\u30d1\u30c3\u30b1\u30fc\u30b8\u3060\u3051\u30d0\u30fc\u30b8\u30e7\u30f3\u3092\u4e0a\u3052\u308b\u5834\u5408\u306b\u306f update \u3067\u306f\u306a\u304f install \u3092\u4f7f\u3046\u3088\u3046\u3067\u3059\u3002<\/p>\n<pre class=\"prettyprint linenums\">\n% sudo apt install openssl\nReading package lists... Done\nBuilding dependency tree       \nReading state information... Done\nThe following packages were automatically installed and are no longer required:\n  apache2-data apache2-utils libopts25 sntp\nUse &#39;sudo apt autoremove&#39; to remove them.\nThe following additional packages will be installed:\n  libssl1.1\nThe following packages will be upgraded:\n  libssl1.1 openssl\n2 upgraded, 0 newly installed, 0 to remove and 202 not upgraded.\nNeed to get 1913 kB of archives.\nAfter this operation, 660 kB of additional disk space will be used.\nDo you want to continue? &#91;Y&#47;n&#93;\n<\/pre>\n<p>\u6b63\u3057\u304f &#8220;The following packages will be upgraded:&#8221; \u3068\u3042\u308b\u306e\u3067\u3001\u30a2\u30c3\u30d7\u30b0\u30ec\u30fc\u30c9\u3057\u3001nginx \u5074\u3067\u4e0b\u8a18\u306e\u3088\u3046\u306a\u8a2d\u5b9a\u3092\u52a0\u3048\u3001TLS 1.0\/1.1 \u3092\u7121\u52b9\u5316\u3057 TLS 1.3 \u3092\u6709\u52b9\u306b\u3057\u307e\u3057\u305f\u3002<\/p>\n<pre class=\"prettyprint linenums\">ssl_protocols           TLSv1.2 TLSv1.3;<\/pre>\n<p>\u4e0b\u8a18\u306e\u3068\u304a\u308a\u3001DNS CAA \u3068 TLS 1.3 \u306b\u5bfe\u5fdc\u3057\u3066\u3044\u308b\u3053\u3068\u3092\u78ba\u8a8d\u3059\u308b\u3053\u3068\u304c\u3067\u304d\u307e\u3057\u305f\u3002<br \/>\n<a href=\"https:\/\/blog.daichang.me\/wp-content\/uploads\/2019\/10\/9bfb278abb7dbe50696211f968c7cf3f.png\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/blog.daichang.me\/wp-content\/uploads\/2019\/10\/9bfb278abb7dbe50696211f968c7cf3f.png\" alt=\"We support DNS CAA &amp; TLS 1.3\" width=\"2120\" height=\"1398\" class=\"aligncenter size-full wp-image-311\" \/><\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u3053\u306e\u30c9\u30e1\u30a4\u30f3\u3092 DNS CAA \u304a\u3088\u3073 TLS 1.3 \u3078\u5bfe\u5fdc\u3055\u305b\u305f\uff08\u52a0\u3048\u3066 TLS 1.0\/1.1 \u3092\u7121\u52b9\u5316\u3057\u305f\uff09\u8a18\u9332\u3092\u30e1\u30e2\u3068\u3057\u3066\u6b8b\u3057\u3066\u304a\u304d\u307e\u3059\u3002 [&#8230;]<\/p>\n<p><a class=\"btn btn-secondary understrap-read-more-link\" href=\"https:\/\/blog.daichang.me\/?p=307\">\u7d9a\u304d\u3092\u8aad\u3080&#8230;<span class=\"screen-reader-text\"> from DNS CAA \u3068 TLS 1.3 \u3078\u306e\u5bfe\u5fdc<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[10,21,25],"class_list":["post-307","post","type-post","status-publish","format-standard","hentry","category-tech","tag-internet","tag-security","tag-ubuntu"],"_links":{"self":[{"href":"https:\/\/blog.daichang.me\/index.php?rest_route=\/wp\/v2\/posts\/307","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.daichang.me\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.daichang.me\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.daichang.me\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.daichang.me\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=307"}],"version-history":[{"count":0,"href":"https:\/\/blog.daichang.me\/index.php?rest_route=\/wp\/v2\/posts\/307\/revisions"}],"wp:attachment":[{"href":"https:\/\/blog.daichang.me\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=307"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.daichang.me\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=307"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.daichang.me\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=307"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}