『プロフェッショナル SSL/TLS 読書会』 第 10 章

07b02dd38e4e3a53caf0e528e3bc9e6c?s=47 Ryo Kato
June 22, 2018
Technology
1
120

『プロフェッショナル SSL/TLS 読書会』 第 10 章

2018-06-22 https://ptls-study.connpass.com/event/90706/

07b02dd38e4e3a53caf0e528e3bc9e6c?s=128

Ryo Kato

June 22, 2018
Tweet

More Decks by Ryo Kato

See All by Ryo Kato
07b02dd38e4e3a53caf0e528e3bc9e6c?s=48 hashedhyphen
3
670
07b02dd38e4e3a53caf0e528e3bc9e6c?s=48 hashedhyphen
0
240
07b02dd38e4e3a53caf0e528e3bc9e6c?s=48 hashedhyphen
0
200

Other Decks in Technology

See All in Technology
457ada693e168bd1102fec3914040b5d?s=48 uipath_friends
0
130
Add4ea030be9e6aa7a319fc8c1b587c6?s=48 hashhub
2
2.1k
84907687e50c8ac2a09b02e0d1b36ab1?s=48 toricls
12
2.5k
C82711d1ecc5cc7a4474dd9314736f33?s=48 macole
0
150
2102a6b8760bd6f57f672805723dd83a?s=48 line_developers_tw
0
400
Ecad9d801d79f6c6e5df93094690685e?s=48 sinsoku
6
1.3k
53850955f15249a1a9dc49df6113e400?s=48 line_developers
1
420
D5a8875907107294786ee8cba72c7f4c?s=48 torufuru
0
150
457ada693e168bd1102fec3914040b5d?s=48 uipath_friends
0
150
97a7f7899e0df28c3636b8d44bbe6578?s=48 korodroid
3
580
0102ef8594b9d3a74f45dfd5daa5ede4?s=48 yskmjp
0
270
457ada693e168bd1102fec3914040b5d?s=48 uipath_friends
0
130

Featured

See All Featured
E76911cbe088e5b850d966de3fc7435b?s=48 robhawkes
52
2.7k
462dad0dd24c568a32dcdb0ae895ae1b?s=48 rasmusluckow
316
18k
7c8469ee8c9e594c65c59b919626c08d?s=48 scottboms
250
11k
E837d2996f52008ace055a08fbfff992?s=48 frogandcode
123
20k
E4f5d494ebdc9e7cce1aecf3ce3e8bc1?s=48 shpigford
165
18k
Bfd6b681ec6e8c9bef82ff0521c364f7?s=48 kastner
52
1.8k
5ce91fa49a613cbc3e20d5f96856473f?s=48 edds
55
9.2k
48c098b6579220a67a6ba949be6e4b5a?s=48 revolveconf
197
9.5k
Eb8975af8e49e19e3dd6b6b84a542e26?s=48 qrush
283
18k
F383c6a4dc55e331bbe2987b622cee6b?s=48 stephaniewalter
256
11k
8ec1383b240b5ba15ffb9743fceb3c0e?s=48 philnash
4
280
D83926c323d4f9289f947b4b4e76b939?s=48 jensimmons
205
10k

Transcript

  1.  )454 $41 BOE1JOOJOH ʰϓϩϑΣογϣφϧ44-5-4ʱಡॻձ

  2. !IBTIFEIZQIFO w )BTI !IBTIFEIZQIFO  w 8FCEFWFMPQFS w +4 3VCZ

    4DBMB 3VTU 4FDVSJUZ FUDʜ w 44-ͱಉڃੜ

  3.  )454 ઈର)5514ڧ੍͢ΔϚϯ ূ໌ॻΤϥʔΛແࢹ͢Δ உͷࢠͷΠϥετ

  4. )454֓ཁ w 3'$)5514USJDU5SBOTQPSU4FDVSJUZ *&5'   w <XFCαΠτଆ>
 )5514ͷΈڐՄ͍ͯ͠ΔࢫΛϢʔβ΁એݴͰ͖Δ w

    <Ϣʔβଆ>
 ΞΫηε࣌ʹϒϥ΢β΁)5514Λڧ੍Ͱ͖Δ w ϓϩτίϧ͸)551ϔομ Strict-Transport-Security: max-age=expireTime [; includeSubDomains]

  5. )454͕ແ͍ੈք w 63-όʔʹlFYBNQMFDPNJOEFYIUNMͱೖྗ
 ͞ΕͨΒɺ௨ৗϒϥ΢β͸)551ͰϦΫΤετ
 ࠷ॳ͔Β)5514͕ར༻Ͱ͖͔ͨ΋͠Εͳ͍ w ϒϥ΢β͕ग़͢ূ໌ॻΤϥʔΛϢʔβ͸ແࢹ͕ͪ͠ $MJDL5ISPVHI*OTFDVSJUZzGSPN3'$ 
 ຊ౰ʹෆਖ਼ͳূ໌ॻͰ΋௨աͯ͠͠·͏

    w ࠞࡏίϯςϯπ
 JNHͰεΩʔϜΛमਖ਼͠๨Ε෦෼తʹ)551ͷ݀ w $PPLJFͷ4FDVSFଐੑͱ%PNBJOଐੑ
 ଘࡏ͠ͳ͍αϒυϝΠϯ΁ͷ༠ಋ࣌ʹϢʔβ͕
 ূ໌ॻΤϥʔΛແࢹ͢Δͱ$PPLJF͕઄औ͞ΕΔ


  6. )454͕ղܾ͢Δ͜ͱ w )5514Λڧ੍Ͱ͖Δ w εΩʔϜͳ͠Ͱ63-όʔʹೖྗ͞Εͯ΋ )5514Ͱ௨৴Λ։࢝ w ূ໌ॻΤϥʔ࣌ʹʮྫ֎Λ௥Ճʯͤ͞ͳ͍
 l/P6TFS3FDPVSTFz 

    w εΩʔϜΛमਖ਼͠๨ΕͨϦιʔε͕͋ͬͯ΋
 ࣗಈͰ)5514ͰGFUDIͯ͘͠ΕΔ w AJODMVEF4VC%PNBJOTAΛซ༻͢Δ͜ͱͰ 
 ೚ҙͷαϒυϝΠϯ΋)5514ڧ੍Ͱ͖Δ w %PNBJO$PPLJFͷ4FDVSFଐੑ໰୊

  7. )454ͷ࢖͍ํ w ʮূ໌ॻΤϥʔͷͳ͍)5514ʯͷϨεϙϯεͰ
 A4USJDU5SBOTQPSU4FDVSJUZAϔομΛฦ͚ͩ͢ w NBYBHF͜ͷϙϦγʔ͕༗ޮͳඵ਺ w JODMVEF4VC%PNBJOTαϒυϝΠϯͰ΋༗ޮʹ w QSFMPBE<࢓༷ະఆٛ>ϒϥ΢βͷ)4541SFMPBE

    ର৅ͱͯ͠XFCαΠτΛਃ੥͢Δͱ͖ʹࢦఆ w ্هͷϔομΛϒϥ΢β͕ड͚औ͔ͬͯΒ༗ޮ Strict-Transport-Security: max-age=expireTime [; includeSubDomains] [; preload]

  8. )4541SFMPBE w 4USJDU5SBOTQPSU4FDVSJUZϔομΛड͚औΔલ͸ ґવͱͯ͠)5514ར༻Մೳੑ͸ෆ໌ w )454ΛσϓϩΠ͍ͯ͠Δ͜ͱΛ͋Β͔͡Ίϒϥ΢ βʹొ࿥͓͍ͯͯ͠ɺॳճ͔Β)454Λ༗ޮʹ͠ ͓ͯ͘ 5XJUUFS $ZCP[V

    FUD  w ϒϥ΢βϕϯμʔΛ୅දͯ͠(PPHMF͕ਃ੥ϑΥʔ ϜΛ؅ཧ͍ͯ͠Δ IUUQTITUTQSFMPBEPSH  w NBYBHF೥Ҏ্ɾJODMVEF4VCEPNBJOT  QSFMPBEଐੑඞਢ w l5-%1SFMPBEJOHz85'

  9. 4FDVSJUZ$POTJEFSBUJPOT 3'$͸l4FDVSJUZ$POTJEFSBUJPOTz͕໘ന͍ w ͳͥ4USJDU5SBOTQPSU4FDVSJUZϔομ͸
 ʮূ໌ॻΤϥʔͷͳ͍)5514ʯ͕ඞཁͳͷ͔  ຊདྷ)454͕༗ޮͳXFCαΠτͩͬͨ৔߹
 ূ໌ॻΤϥʔ͕ແࢹ͞Εͨঢ়ଶͰNBYBHFͷ ϔομΛฦ͞ΕΔͱ)454͕ແޮԽ͞ΕΔ 

    ຊདྷ)551͔͠ͳ͍XFCαΠτͩͬͨ৔߹
 )551Ϩεϙϯε͕վ᜵͞Εͯ)454Λ༗ޮʹ͞ Εͯ͠·͏ͱɺϦΫΤετ͕)5514ʹม׵͞Ε ͯ͠·͍%P4߈ܸ͕੒ཱ͢Δ  ࣾ಺ϓϩΩγαʔόͱ͸૬ੑѱ͍ΑͶ

  10. 4FDVSJUZ$POTJEFSBUJPOT ଞʹ΋ w AJODMVEF4VC%PNBJOTA͕%PNBJO$PPLJFͷ
 อޢʹ΋໾ཱͭ͜ͱ w 04ͷ࣌ܭΛਐΊΒΕΕ͹ϙϦγʔ͸౰વແޮԽ͞ Ε͏Δ͜ͱ w ِͷϧʔτূ໌ॻ

    %/4ΩϟογϡϙΠζχϯά ͷ߹Θٕͤ w ϒϥ΢β಺ʹอଘ͞ΕΔ֤XFCαΠτͷ)454
 ৘ใΛ࢖ͬͯ8FC5SBDLJOHͰ͖Δ͜ͱ

  11. )454ΛτϥοΩϯάʹ࢖͏ w )454ʹ͓͚Δϒϥ΢βͷڍಈ͸ɺຊ࣭తʹ
 XFCαΠτ΁ͷ๚໰༗ແΛه࿥͢ΔCJU৘ใ w ϫΠϧυΧʔυূ໌ॻΛ༻ҙͯ͠Oݸͷαϒυϝ ΠϯΛ࡞ΓɺͦΕͧΕʹҟͳΔ)454ϙϦγʔΛ ઃఆ͢Ε͹ɺO<CJU>ͷ৘ใΛϒϥ΢β͔Βऔಘ͢ Δ͜ͱ͕Մೳ w

    ୺తʹมଶ w IUUQTXXXMFWJBUIBOTFDVSJUZDPNCMPHUIF EPVCMFFEHFETXPSEPGITUTQFSTJTUFODFBOE QSJWBDZ

  12. ͦͷଞͷ࿩୊ w NBYBHF͕ܻʹͳΔΑ͏ʹڧ੍੾அ߈ܸΛ͢Δ ͜ͱͰɺ༗ޮظؒΛ࠷େඵ·ͰݮΒͤΔ w

  13.  $41 ϔομઃఆ೉͢͠ ΅͘ͷ͔Μ͕͍͖͑ͨ͞ΐ͏ͷ
 $41ઃఆΛߟ͍͑ͯΔ
 உͷࢠͷΠϥετ

  14. None
  15. None

  16. $41֓ཁ w $POUFOU4FDVSJUZ1PMJDZ 8$XFCBQQTFD  w $41  $41-FWFM 

     w ݱࡏ$41-FWFM 8% ͷࡦఆத w ࢓༷ΑΓҾ༻
 l5IJTEPDVNFOUEFpOFTBNFDIBOJTNCZ XIJDIXFCEFWFMPQFSTDBODPOUSPMUIF SFTPVSDFTXIJDIBQBSUJDVMBSQBHFDBOGFUDI PSFYFDVUF BTXFMMBTBOVNCFSPGTFDVSJUZ SFMFWBOUQPMJDZEFDJTJPOTz w ϒϥ΢β͕औಘɾ࣮ߦ͢ΔϦιʔεͷ؅ཧ
 ͦͷଞԿͰ΋ʢ࣮ࡍ৭ʑ͋Γ͗͢Δʣ

  17. $41ͷ࢖༻ྫ w ϒϥ΢β͕࣮ߦ͢Δ+4ͷಡࠐݩʢΦϦδϯʣΛط ஌ͷ$%/ʹ੍ݶ͠ɺΠϯϥΠϯεΫϦϓτΛແޮ Խͯ͠944Λ๷͍͗ͨ TDSJQUTSD  w ϓϥάΠϯͷ࣮ߦΛېࢭ͍ͨ͠ PCKFDUTSD

     w A$POUFOU4FDVSJUZ1PMJDZAϔομ͕Ϩεϙϯεʹ ؚ·Ε͍ͯͨϖʔδͰ༗ޮʹͳΔ w ͓खܰʹࢼ͍ͨ͠ͱ͖͸
 <meta http-equiv="Content-Security-Policy"> Content-Security-Policy: script-src https://cdn.example.com/scripts/; object-src 'none'

  18. )454ͱͷҧ͍ w ༗ޮظؒͷ֓೦͕ͳ͍ w $POUFOU4FDVSJUZ1PMJDZϔομ͕Ϩεϙϯεʹ ؚ·Ε͍ͯͨͱ͖͚ͩద༻͞ΕΔ w $41ͷઃఆΛؒҧͬͯσϓϩΠͯ͠͠·ͬͯ΋ ൺֱతૣΊʹແޮԽɾमਖ਼Ͱ͖Δ w

    $POUFOU4FDVSJUZ1PMJDZ3FQPSU0OMZϔομΛ ࢖͏ͱESZSVO͕Ͱ͖ΔʢϒϩοΫର৅ͱͳΔεΫ ϦϓτͳͲΛใࠂ͚ͩͯ͘͠ΕΔʣ

  19. $41ͷσΟϨΫςΟϒ w IUUQTXXXXPSH53$41DTQEJSFDUJWFT w DIJMETSD w DPOOFDUTSD w EFGBVMUTSD w

    GPOUTSD w GSBNFTSD w JNHTSD w NBOJGFTUTSD w NFEJBTSD w PCKFDUTSD w TDSJQUTSD w TUZMFTSD w XPSLFSTSD w CBTFVSJ w QMVHJOUZQFT w TBOECPY w EJTPXOPQFOFS w GPSNBDUJPO w GSBNFBODFTUPST w SFQPSUVSJ w SFQPSUUP

  20. $41ͷσΟϨΫςΟϒ σΟϨΫςΟϒ͕ແݶʹ૿͖͑ͯͨͷͰɺ
 ֎෦࢓༷ͱͯ͠σΟϨΫςΟϒΛ௥ՃͰ͖ΔΑ͏ lNPEVMBSFYUFOTJCJMJUZzΛ೦಄ʹஔ͔Ε͍ͯΔ ྫ w ACMPDLBMMNJYFEDPOUFOUA w AVQHSBEFJOTFDVSFSFRVFTUTA w

    ASFRVJSFTSJGPSA 4VCSFTPVSDF*OUFHSJUZ  ৽͍͠σΟϨΫςΟϒͷڍಈͱͯ͠ఆٛ͢΂͖΋ͷ͕ 5FNQMBUF.FUIPE1BUUFSOతʹ$41ͷ࢓༷͕ఆٛ
 ͍ͯ͠ΔͨΊɺ֎෦࢓༷ʹΑΔ֦ு͕Մೳ

  21. $41ͷσΟϨΫςΟϒ w ACMPDLBMMNJYFEDPOUFOUA w )5514ͰTFSWF͞Εͨϖʔδ಺͔Β෭࣍తͳ )551ϦΫΤετΛ͢΂ͯःஅ w AVQHSBEFJOTFDVSFSFRVFTUTA w ೚ҙͷ)551ϦΫΤετΛ͢Δલʹ͢΂ͯ

    )5514΁มߋ )454ͱ΄΅ಉ͡

  22. "DLOPXMFEHFNFOUT͕೤͍ w l-PUTPGQFPQMFBSFBXFTPNF'PSJOTUBODF .BSJPBOEBMMPG$VSFʜz w ͝ଘ஌$VSFͷ%S*OH.BSJP)FJEFSJDI w )4$.JOJDIBMMFOHFl4I U JUT$41zͰ$41

    Λ୊ࡐͱͨ͠944$IBMMFOHFΛߟҊ͢ΔͳͲ
 ଟେͳߩݙ w $POUFOU4FDVSJUZ1PMJDZEFGBVMUTSDTFMG BKBYHPPHMFBQJTDPNͷঢ়گͰ944͢Δʹ͸ w IUUQTHJUIVCDPNDVSF944$IBMMFOHF8JLJXJLJ )4$.JOJDIBMMFOHF4I U JUT$41

  23.  ϐϯχϯά 50'6ٕज़ͷҰྫ 50'6

  24. ϐϯχϯά֓ཁ w ϐϯχϯάͱ͍͑͹)5511VCMJD,FZ1JOOJOH )1,1 Λ࿈૝͢Δํ΋ଟ͍ʁ w ͜ͷষͰ͸ɺূ໌ॻ΍ެ։伴ʹ͓͍ͯ
 ΑΓҰൠతͳϐϯχϯάٕज़ʹ͍ͭͯઆ໌ w ূ໌ॻɾެ։伴͸ຊ࣭తʹ೚ҙͷओମͷࣝผࢠ

    w ࣝผࢠͱಛఆͷαʔϏεΛ݁ͼ͚ͭΔʢϐϯཹΊʣ ͜ͱ͕ʮϐϯχϯάʯ

  25. ͳͥϐϯχϯάΛ͢Δ͔ ূ໌ॻΛൃߦ͢Δ$"Λݶఆ͢Δ w 1VCMJD$"ϞσϧͰ͸ɺূ໌ॻΛൃߦ͢Δࡍʹυϝ Πϯॴ༗ऀͷঝೝ͕ʮ͍Βͳ͍ʯ w ༩Γ஌Β͵ͱ͜ΖͰ୭͔͕ͳΓ͢·ͯ͠ূ໌ॻΛൃ ߦ͢ΔՄೳੑ͕͋Δ w ͋Δ$"͔Βൃߦ͞Εͨূ໌ॻΛαʔϏεʹϐϯ

    χϯά͢Δ͜ͱͰɺͦΕҎ֎ͷ$"Ͱޡൃߦ͞Εͯ ѱ༻͞ΕΔϦεΫΛݮΒͤΔ

  26. ͳͥϐϯχϯάΛ͢Δ͔ 伴ܧଓ؅ཧ ,FZ$POUJOVJUZ ʹ࢖͏ w ݕূͰ͖ͳ͍αʔόূ໌ॻΛϒϥ΢βʹྫ֎ͱͯ͠ ొ࿥͢Δɺ44)Ͱ઀ଓઌͷࢦ໲ΛهԱ͢ΔͳͲ w Ұ౓ਖ਼͍͠ʢͱ৴ͨ͡ʣ΋ͷΛهԱ͢Ε͹
 ࣍ճҎ߱ʹड͚औͬͨ΋ͷΛਖ਼͍͠ʢͱ৴͍ͯ͡Δʣ

    ΋ͷͱൺֱͰ͖Δ w 5SVTU0O'JSTU6TF50'6 w l50'6zͷॳग़͸6TFOJYͷQBQFSΒ͍͠

  27. ͳͥϐϯχϯάΛ͢Δ͔ 伴ܧଓ؅ཧ ,FZ$POUJOVJUZ ʹ࢖͏ w ݕূͰ͖ͳ͍αʔόূ໌ॻΛϒϥ΢βʹྫ֎ͱͯ͠ ొ࿥͢Δɺ44)Ͱ઀ଓઌͷࢦ໲ΛهԱ͢ΔͳͲ w Ұ౓ਖ਼͍͠ʢͱ৴ͨ͡ʣ΋ͷΛهԱ͢Ε͹
 ࣍ճҎ߱ʹड͚औͬͨ΋ͷΛਖ਼͍͠ʢͱ৴͍ͯ͡Δʣ

    ΋ͷͱൺֱͰ͖Δ w 5SVTU0O'JSTU6TF50'6 w l50'6zͷॳग़͸6TFOJYͷQBQFSΒ͍͠

  28. ԿΛϐϯχϯά͢Δ͔ w ಉ͡ެ։伴ʹෳ਺ͷূ໌ॻ͕ඥ෇͖͏Δ w ެ։伴Λϐϯχϯά͢Δࡍʹ͸ 4VCKFDU1VCMJD,FZ*OGP 41,* ͕ศར w "MHPSJUIN*EFOUJpFS͕ਅਖ਼ੑͷݕূʹ΋࢖͑Δ

    # RFC 5280 Sec. 4.1 SubjectPublicKeyInfo ::= SEQUENCE { algorithm AlgorithmIdentifier, subjectPublicKey BIT STRING }

  29. Subject: CN=hashedhyphen.com Subject Public Key Info: Public Key Algorithm: rsaEncryption

    RSA Public Key: (2048 bit) Modulus (2048 bit): 00:a8:f2:7d:cb:39:e3:d6:9c:30:7d:63:eb:cc:f2: ff:ea:40:07:b3:bb:30:21:4f:2a:1c:fb:ba:1b:f5: 1c:af:36:a6:03:f9:85:3f:50:5b:21:05:b6:f5:79: bb:e9:f9:f1:30:bc:28:07:85:13:0c:33:6e:8a:24: 33:9f:83:6d:f6:69:27:ee:4f:a8:13:b2:fe:52:e1: 06:cb:da:a0:85:df:b8:09:a3:97:1b:8d:e7:20:0b: 70:40:53:0a:ea:50:e7:60:03:70:ce:f4:35:4d:2c: 5c:ae:d0:4c:b8:7c:a3:d5:d7:13:c0:e0:d3:85:8b: 2d:7e:f2:0a:08:f1:06:9d:79:2d:40:c1:4d:93:71: 2d:d3:12:05:29:50:f6:a4:2e:7e:3d:27:7e:38:81: 51:21:0b:32:f7:37:b9:24:82:0b:e1:78:05:50:2c: e0:63:1d:d3:44:fb:57:be:ca:d0:e6:3f:31:1c:0c: 45:5c:43:df:69:cd:6f:fd:5c:2e:c9:e9:93:91:18: f7:e3:28:d3:2e:68:0f:bd:a7:59:1a:98:c9:08:61: 04:e7:e1:81:74:31:3d:43:1f:91:c7:90:c7:f6:54: 10:10:77:88:e8:fa:82:8f:8e:79:3d:05:e0:3a:96: c0:8e:60:28:e1:ab:1b:8e:51:36:45:c2:be:f8:2b: a2:ff Exponent: 65537 (0x10001)

  30. Ͳ͜ʹϐϯཹΊ͢Δ͔ *.0Ͳ͜ʮΛʯϐϯཹΊ͢Δ͔ɺͱಡΈ͍ͨ w αʔόূ໌ॻʢͷ41,*ʣΛϐϯχϯά͢Δ৔߹ɺެ։伴Λఆ ظతͳೖΕସ͑΍ɺಉ͡ϗετ໊Ͱෳ਺ͷূ໌ॻΛར༻͢Δ৔ ߹ʹ໘౗ w தؒ$"΍ϧʔτ$"ͷূ໌ॻΛϐϯχϯά͢Δ৔߹ɺαʔ όূ໌ॻ͕औΓಘΔ೚ҙͷݕূύεΛαϙʔτ͢Δඞཁɺ࣍ճ ͷαʔόূ໌ॻߋ৽࣌ʹطଘͷݕূύε্ʹ͓͚Δ$"͕ม

    ΘΔՄೳੑ͕͋ͬͯ໘౗ w αʔόূ໌ॻʹॺ໊͕ඞؚͣ·Ε͍ͯΔͷͰɺ
 ࠷Լ૚ͷதؒ$"Λϐϯχϯάͯ͠ɺ࣍ճͷূ໌ॻߋ৽࣌ʹ ϐϯχϯά͕յΕͳ͍Α͏ͳӡ༻Λґཔʁ w ଞͷ$"͔Βऔಘͨ͠ূ໌ॻΛ༧උʹඞͣ༻ҙ͢Δ w BOETPPOʜ

  31. Ͳ͜ʹϐϯཹΊ͢Δ͔ ʮϐϯχϯάͷӡ༻Ͱ࠷΋ޮՌతͳͷ͸ɺࣗ෼ࣗ਎Ͱ தؒ$"Λॴ༗͢Δ͜ͱͰ͢ɻʯ

  32. Ͳ͜ʹϐϯཹΊ͢Δ͔ ͦΕ͸ͦ͏

  33. ωΠςΟϒΞϓϦͰͷϐϯχϯά w ΞϓϦͷόΠφϦ഑෍࣌ʹূ໌ॻΛόϯυϧ w +BWBͷτϥετετΞͷΠϝʔδʁ w αʔόαΠυ͕ωΠςΟϒΞϓϦ͔ΒͷΈͷΞΫη εͰ͋Ε͹ׂͱݱ࣮త w "OESPJE͸ূ໌ॻϐϯχϯάΛαϙʔτ͍ͯ͠Δ

    ʢΒ͍͠ʣ

  34. )1,1 w 3'$1VCMJD,FZ1JOOJOH&YUFOTJPOGPS )551   w ϓϩτίϧ͸)551ͷ1VCMJD,FZ1JOTϔομ w )454ͱಉ͘͡NBYBHFΛࢦఆ͠ɺϋογϡؔ਺

    ͷΞϧΰϦζϜͱ41,*ͷϋογϡ஋Λࢦఆͯ͠ϐ ϯχϯάΛද໌͢Δ Public-Key-Pins: max-age=2592000; pin-sha256="E9CZ9INDbd+2eRQozYqqbQ2yXLVKB9+xcprMF+44U1g="; pin-sha256="LPJNul+wow4m6DsqxbninhsWHlwfp0JecwQzYpOLmCQ="

  35. )1,1 w ඞͣͭҎ্ϐϯχϯά͢Δඞཁ͕͋Δ w ͔֤ͭʑ͕ผʑͷূ໌ॻνΣʔϯʹ͋Δඞཁ w )1,1͕ಈ࡞ͤͣʹCVH[JMMBNP[JMMBPSHʹ ʮ)1,1ಈ͍ͯͳ͍Μ͚ͩͲόάʁʯͬͯฉ͍ͨΒ ʮূ໌ॻݸ͔͠ϐϯχϯάͯ͠ͳ͍΍Μ͚ʯ
 ͬͯࢦఠ͞Εͨࢥ͍ग़ʢஏ͔͍ͣ͠ʣ

    Public-Key-Pins: max-age=2592000; pin-sha256="E9CZ9INDbd+2eRQozYqqbQ2yXLVKB9+xcprMF+44U1g="; pin-sha256="LPJNul+wow4m6DsqxbninhsWHlwfp0JecwQzYpOLmCQ="

  36. )1,1 w ඞͣͭҎ্ϐϯχϯά͢Δඞཁ͕͋Δ w ͔֤ͭʑ͕ผʑͷূ໌ॻνΣʔϯʹ͋Δඞཁ w )1,1͕ಈ࡞ͤͣʹCVH[JMMBNP[JMMBPSHʹ ʮ)1,1ಈ͍ͯͳ͍Μ͚ͩͲόάʁʯͬͯฉ͍ͨΒ ʮূ໌ॻݸ͔͠ϐϯχϯάͯ͠ͳ͍΍Μ͚ʯ
 ͬͯࢦఠ͞Εͨࢥ͍ग़ʢஏ͔͍ͣ͠ʣ

    w 1VCMJD,FZ1JOT3FQPSU0OMZϔομΛ࢖͑͹ ESZSVOͰ͖Δ Public-Key-Pins: max-age=2592000; pin-sha256="E9CZ9INDbd+2eRQozYqqbQ2yXLVKB9+xcprMF+44U1g="; pin-sha256="LPJNul+wow4m6DsqxbninhsWHlwfp0JecwQzYpOLmCQ="

  37. %"/& w %/4#BTFE"VUIFOUJDBUJPOPG/BNFE&OUJUJFT w )5514PO5-4͸αʔόূ໌ॻͷݕূΛ5-4্ Ͱ΍Δ΋ͷ w ͦΕ%/44&$Ͱ΍Ε͹ྑ͘ͳ͍ʁ

  38. %"/&WT5-4 ݱࡏͷ5-4ೝূͷϞσϧ͸ w ʢʣຊ෺ͷυϝΠϯ໊ॴ༗ऀʹͷΈূ໌ॻΛൃߦ ͢ΔΑ͏ͳ৴པͰ͖Δ$"͕·ͣ͋ͬͯɺ ͦͷ͏͑Ͱ w αΠτʹΞΫηε͕͋ͬͨͱ͖ʹ͸͍ͭ΋ɺʢʣ ҙਤ໊ͨ͠લͲ͓Γূ໌ॻ͕ਖ਼͍͜͠ͱΛϢʔβΤʔ δΣϯτʢϒϥ΢βͳͲʣ͕͔֬ΊΔɺ

    ͱ͍͏ஈ֊ͷϞσϧͰߏ੒

  39. %"/&WT5-4 ݱࡏͷ5-4ೝূͷϞσϧ͸ w ʢʣຊ෺ͷυϝΠϯ໊ॴ༗ऀʹͷΈূ໌ॻΛൃߦ͢ ΔΑ͏ͳ৴པͰ͖Δ$"͕·ͣ͋ͬͯɺ ͦͷ͏͑Ͱ w αΠτʹΞΫηε͕͋ͬͨͱ͖ʹ͸͍ͭ΋ɺʢʣҙ ਤ໊ͨ͠લͲ͓Γূ໌ॻ͕ਖ਼͍͜͠ͱΛϢʔβΤʔδΣ ϯτʢϒϥ΢βͳͲʣ͕͔֬ΊΔɺ

    ͱ͍͏ஈ֊ͷϞσϧͰߏ੒ w %/44&$͕࢖͑Ε͹ɺड৴ͨ͠υϝΠϯʹ͍ͭͯͷ ৘ใ͸υϝΠϯ໊ॴ༗ऀ͔Βͷ΋ͷͰ͋Δͱ֬৴Ͱ ͖ΔͷͰ$"͕ඞཁͰ͸ͳ͍

  40. %"/&ͷϢʔεέʔε  ࣗݾॺ໊ূ໌ॻͷ҆શͳσϓϩΠ w ࠓ·Ͱͷ5-4ͩͱඞͣূ໌ॻΤϥʔ͕ग़Δ w ʮҰൠతͳʯϢʔβ͸ແࢹ͢Δ͚Ͳʜ·͋ w ໰୊͸ʮਖ਼͍͠ʯΤϥʔͱࣗݾূ໌ॻͷݕূΤϥʔ ͕۠ผ͔ͭͳ͍

    w %/44&$͕͋Ε͹ɺ໊લղܾ͢ΔυϝΠϯॴ༗ ऀͷਅਖ਼ੑΛ֬อͰ͖Δ͔ΒԿͰ΋҆શʹϐϯχ ϯάͰ͖ΔΑͶ w ಠࣗϧʔτূ໌ॻͩͬͯϐϯχϯάͰ͖ͪΌ͏

  41. %"/&ͷ࣮૷ɾσϓϩΠ w 5-4"ϨίʔυΛκʔϯϑΝΠϧͰఆٛ  ϙʔτ൪߸ʢΞϯμʔείΞલஔʣ  ϓϩτίϧʢΞϯμʔείΞલஔʣ  ׬શम০υϝΠϯ໊ _443._tcp.www.example.com.

    IN TLSA ( 0 1 1 d2abde240d7cd3ee6b4b28c54df034b9 7983a1d16e8a410e4561cb106618e971 )

  42. %"/&ͷ࣮૷ɾσϓϩΠ w 5-4"ϨίʔυΛκʔϯϑΝΠϧͰఆٛ w $FSUJpDBUF6TBHF w  1,*95" $"ূ໌ॻ νΣʔϯ্

     w  1,*9&& &OE&OUJUZূ໌ॻ νΣʔϯઌ಄  w ʜ _443._tcp.www.example.com. IN TLSA ( 0 1 1 d2abde240d7cd3ee6b4b28c54df034b9 7983a1d16e8a410e4561cb106618e971 )

  43. %"/&ͷ࣮૷ɾσϓϩΠ w 5-4"ϨίʔυΛκʔϯϑΝΠϧͰఆٛ w 4FMFDUPS w  $FSU ূ໌ॻϐϯχϯά w

     41,* ެ։伴 41,* ϐϯχϯά _443._tcp.www.example.com. IN TLSA ( 0 1 1 d2abde240d7cd3ee6b4b28c54df034b9 7983a1d16e8a410e4561cb106618e971 )

  44. %"/&ͷ࣮૷ɾσϓϩΠ w 5-4"ϨίʔυΛκʔϯϑΝΠϧͰఆٛ w .BUDIJOH5ZQF w  'VMM ௚઀ൺֱ w

     4)" ϋογϡൺֱ w  4)" ϋογϡൺֱ PQUJPOBM _443._tcp.www.example.com. IN TLSA ( 0 1 1 d2abde240d7cd3ee6b4b28c54df034b9 7983a1d16e8a410e4561cb106618e971 )

  45. %"/&ͷ࣮૷ɾσϓϩΠ w 5-4"ϨίʔυΛκʔϯϑΝΠϧͰఆٛ w $FSUJpDBUF"TTPDJBUJPO%BUB w લͭͷ஋ͷ૊߹ͤʹରԠ͢Δϐϯχϯά஋ _443._tcp.www.example.com. IN TLSA

    ( 0 1 1 d2abde240d7cd3ee6b4b28c54df034b9 7983a1d16e8a410e4561cb106618e971 )

  46. %"/&WT)1,1 w ෳ਺ͷ5-4"ϨίʔυΛ࢖ͬͯෳ਺ϐϯχϯάͰ ͖Δʢಉ͡ʣ w %/4ͷ55-ͱ͍͏༗ޮظ͕ؒ͋Δʢಉ͡ʣ w ͨͩ͠ɺϓϩτίϧࣗମ͸໌ࣔతͳ༗ޮظؒΛ࣋ͬ ͍ͯͳ͍ͷͰɺ%/4ͷઃఆมߋͰमਖ਼Մೳʢڧʣ w

    ESZSVOతͳϨϙʔτػೳ͕ͳ͍ʢऑʣ

  47. %"/&JOݱ৔ w ओཁϒϥ΢βະαϙʔτ

  48. 5"$, w 5SVTU"TTFSUJPOTGPS$FSUJpDBUF,FZT w 1VCMJD$"ͱ%/4͔Β΋ಠཱٕͨ͠ज़ఏҊ w 5-4ͷ$MJFOU)FMMPΛ֦ு͢Δ w αʔόࣗ਎͕ੜ੒ͨ͠ॺ໊伴Ͱϐϯχϯά w

    ೚ҙͷϓϩτίϧ͔Βಠཱ͍ͯ͠Δ͕ෳࡶ