)454ͷ͍ํ w ʮূ໌ॻΤϥʔͷͳ͍)5514ʯͷϨεϙϯεͰ A4USJDU5SBOTQPSU4FDVSJUZAϔομΛฦ͚ͩ͢ w NBYBHF͜ͷϙϦγʔ͕༗ޮͳඵ w JODMVEF4VC%PNBJOTαϒυϝΠϯͰ༗ޮʹ w QSFMPBE<༷ະఆٛ>ϒϥβͷ)4541SFMPBE ରͱͯ͠XFCαΠτΛਃ͢Δͱ͖ʹࢦఆ w ্هͷϔομΛϒϥβ͕ड͚औ͔ͬͯΒ༗ޮ Strict-Transport-Security: max-age=expireTime [; includeSubDomains] [; preload]
4FDVSJUZ$POTJEFSBUJPOT ଞʹ w AJODMVEF4VC%PNBJOTA͕%PNBJO$PPLJFͷ อޢʹཱͭ͜ͱ w 04ͷ࣌ܭΛਐΊΒΕΕϙϦγʔવແޮԽ͞ Ε͏Δ͜ͱ w ِͷϧʔτূ໌ॻ%/4ΩϟογϡϙΠζχϯά ͷ߹Θٕͤ w ϒϥβʹอଘ͞ΕΔ֤XFCαΠτͷ)454 ใΛͬͯ8FC5SBDLJOHͰ͖Δ͜ͱ
)454ΛτϥοΩϯάʹ͏ w )454ʹ͓͚Δϒϥβͷڍಈɺຊ࣭తʹ XFCαΠτͷ๚༗ແΛه͢ΔCJUใ w ϫΠϧυΧʔυূ໌ॻΛ༻ҙͯ͠Oݸͷαϒυϝ ΠϯΛ࡞ΓɺͦΕͧΕʹҟͳΔ)454ϙϦγʔΛ ઃఆ͢ΕɺOͷใΛϒϥβ͔Βऔಘ͢ Δ͜ͱ͕Մೳ w తʹมଶ w IUUQTXXXMFWJBUIBOTFDVSJUZDPNCMPHUIF EPVCMFFEHFETXPSEPGITUTQFSTJTUFODFBOE QSJWBDZ
w ݱࡏ$41-FWFM 8% ͷࡦఆத w ༷ΑΓҾ༻ l5IJTEPDVNFOUEFpOFTBNFDIBOJTNCZ XIJDIXFCEFWFMPQFSTDBODPOUSPMUIF SFTPVSDFTXIJDIBQBSUJDVMBSQBHFDBOGFUDI PSFYFDVUF
BTXFMMBTBOVNCFSPGTFDVSJUZ SFMFWBOUQPMJDZEFDJTJPOTz w ϒϥβ͕औಘɾ࣮ߦ͢ΔϦιʔεͷཧ ͦͷଞԿͰʢ࣮ࡍ৭ʑ͋Γ͗͢Δʣ
)454ͱͷҧ͍ w ༗ޮظؒͷ֓೦͕ͳ͍ w $POUFOU4FDVSJUZ1PMJDZϔομ͕Ϩεϙϯεʹ ؚ·Ε͍ͯͨͱ͖͚ͩద༻͞ΕΔ w $41ͷઃఆΛؒҧͬͯσϓϩΠͯ͠͠·ͬͯ ൺֱతૣΊʹແޮԽɾमਖ਼Ͱ͖Δ w $POUFOU4FDVSJUZ1PMJDZ3FQPSU0OMZϔομΛ ͏ͱESZSVO͕Ͱ͖ΔʢϒϩοΫରͱͳΔεΫ ϦϓτͳͲΛใࠂ͚ͩͯ͘͠ΕΔʣ
$41ͷσΟϨΫςΟϒ w IUUQTXXXXPSH53$41DTQEJSFDUJWFT w DIJMETSD w DPOOFDUTSD w EFGBVMUTSD w GPOUTSD w GSBNFTSD w JNHTSD w NBOJGFTUTSD w NFEJBTSD w PCKFDUTSD w TDSJQUTSD w TUZMFTSD w XPSLFSTSD w CBTFVSJ w QMVHJOUZQFT w TBOECPY w EJTPXOPQFOFS w GPSNBDUJPO w GSBNFBODFTUPST w SFQPSUVSJ w SFQPSUUP
$41ͷσΟϨΫςΟϒ σΟϨΫςΟϒ͕ແݶʹ૿͖͑ͯͨͷͰɺ ֎෦༷ͱͯ͠σΟϨΫςΟϒΛՃͰ͖ΔΑ͏ lNPEVMBSFYUFOTJCJMJUZzΛ೦಄ʹஔ͔Ε͍ͯΔ ྫ w ACMPDLBMMNJYFEDPOUFOUA w AVQHSBEFJOTFDVSFSFRVFTUTA w ASFRVJSFTSJGPSA 4VCSFTPVSDF*OUFHSJUZ
"DLOPXMFEHFNFOUT͕͍ w l-PUTPGQFPQMFBSFBXFTPNF'PSJOTUBODF .BSJPBOEBMMPG$VSFʜz w ͝ଘ$VSFͷ%S*OH.BSJP)FJEFSJDI w )4$.JOJDIBMMFOHFl4IU
JUT$41zͰ$41 Λࡐͱͨ͠944$IBMMFOHFΛߟҊ͢ΔͳͲ ଟେͳߩݙ w $POUFOU4FDVSJUZ1PMJDZEFGBVMUTSDTFMG BKBYHPPHMFBQJTDPNͷঢ়گͰ944͢Δʹ w IUUQTHJUIVCDPNDVSF944$IBMMFOHF8JLJXJLJ )4$.JOJDIBMMFOHF4IU
JUT$41
ϐϯχϯά֓ཁ w ϐϯχϯάͱ͍͑)5511VCMJD,FZ1JOOJOH )1,1 Λ࿈͢Δํଟ͍ʁ w ͜ͷষͰɺূ໌ॻެ։伴ʹ͓͍ͯ ΑΓҰൠతͳϐϯχϯάٕज़ʹ͍ͭͯઆ໌ w ূ໌ॻɾެ։伴ຊ࣭తʹҙͷओମͷࣝผࢠ w ࣝผࢠͱಛఆͷαʔϏεΛ݁ͼ͚ͭΔʢϐϯཹΊʣ ͜ͱ͕ʮϐϯχϯάʯ
ͳͥϐϯχϯάΛ͢Δ͔ ূ໌ॻΛൃߦ͢Δ$"Λݶఆ͢Δ w 1VCMJD$"ϞσϧͰɺূ໌ॻΛൃߦ͢Δࡍʹυϝ Πϯॴ༗ऀͷঝೝ͕ʮ͍Βͳ͍ʯ w ༩ΓΒ͵ͱ͜ΖͰ୭͔͕ͳΓ͢·ͯ͠ূ໌ॻΛൃ ߦ͢ΔՄೳੑ͕͋Δ w ͋Δ$"͔Βൃߦ͞Εͨূ໌ॻΛαʔϏεʹϐϯ χϯά͢Δ͜ͱͰɺͦΕҎ֎ͷ$"Ͱޡൃߦ͞Εͯ ѱ༻͞ΕΔϦεΫΛݮΒͤΔ
ͳͥϐϯχϯάΛ͢Δ͔ 伴ܧଓཧ ,FZ$POUJOVJUZ ʹ͏ w ݕূͰ͖ͳ͍αʔόূ໌ॻΛϒϥβʹྫ֎ͱͯ͠ ొ͢Δɺ44)ͰଓઌͷࢦΛهԱ͢ΔͳͲ w Ұਖ਼͍͠ʢͱ৴ͨ͡ʣͷΛهԱ͢Ε ࣍ճҎ߱ʹड͚औͬͨͷΛਖ਼͍͠ʢͱ৴͍ͯ͡Δʣ ͷͱൺֱͰ͖Δ w 5SVTU0O'JSTU6TF50'6 w l50'6zͷॳग़6TFOJYͷQBQFSΒ͍͠
ͳͥϐϯχϯάΛ͢Δ͔ 伴ܧଓཧ ,FZ$POUJOVJUZ ʹ͏ w ݕূͰ͖ͳ͍αʔόূ໌ॻΛϒϥβʹྫ֎ͱͯ͠ ొ͢Δɺ44)ͰଓઌͷࢦΛهԱ͢ΔͳͲ w Ұਖ਼͍͠ʢͱ৴ͨ͡ʣͷΛهԱ͢Ε ࣍ճҎ߱ʹड͚औͬͨͷΛਖ਼͍͠ʢͱ৴͍ͯ͡Δʣ ͷͱൺֱͰ͖Δ w 5SVTU0O'JSTU6TF50'6 w l50'6zͷॳग़6TFOJYͷQBQFSΒ͍͠
ԿΛϐϯχϯά͢Δ͔ w ಉ͡ެ։伴ʹෳͷূ໌ॻ͕ඥ͖͏Δ w ެ։伴Λϐϯχϯά͢Δࡍʹ 4VCKFDU1VCMJD,FZ*OGP 41,* ͕ศར w "MHPSJUIN*EFOUJpFS͕ਅਖ਼ੑͷݕূʹ͑Δ # RFC 5280 Sec. 4.1 SubjectPublicKeyInfo ::= SEQUENCE { algorithm AlgorithmIdentifier, subjectPublicKey BIT STRING }
Ͳ͜ʹϐϯཹΊ͢Δ͔ *.0Ͳ͜ʮΛʯϐϯཹΊ͢Δ͔ɺͱಡΈ͍ͨ w αʔόূ໌ॻʢͷ41,*ʣΛϐϯχϯά͢Δ߹ɺެ։伴Λఆ ظతͳೖΕସ͑ɺಉ͡ϗετ໊Ͱෳͷূ໌ॻΛར༻͢Δ ߹ʹ໘ w தؒ$"ϧʔτ$"ͷূ໌ॻΛϐϯχϯά͢Δ߹ɺαʔ όূ໌ॻ͕औΓಘΔҙͷݕূύεΛαϙʔτ͢Δඞཁɺ࣍ճ ͷαʔόূ໌ॻߋ৽࣌ʹطଘͷݕূύε্ʹ͓͚Δ$"͕ม ΘΔՄೳੑ͕͋ͬͯ໘ w αʔόূ໌ॻʹॺ໊͕ඞؚͣ·Ε͍ͯΔͷͰɺ ࠷Լͷதؒ$"Λϐϯχϯάͯ͠ɺ࣍ճͷূ໌ॻߋ৽࣌ʹ ϐϯχϯά͕յΕͳ͍Α͏ͳӡ༻Λґཔʁ w ଞͷ$"͔Βऔಘͨ͠ূ໌ॻΛ༧උʹඞͣ༻ҙ͢Δ w BOETPPOʜ
w ϓϩτίϧ)551ͷ1VCMJD,FZ1JOTϔομ w )454ͱಉ͘͡NBYBHFΛࢦఆ͠ɺϋογϡؔ ͷΞϧΰϦζϜͱ41,*ͷϋογϡΛࢦఆͯ͠ϐ ϯχϯάΛද໌͢Δ Public-Key-Pins: max-age=2592000; pin-sha256="E9CZ9INDbd+2eRQozYqqbQ2yXLVKB9+xcprMF+44U1g="; pin-sha256="LPJNul+wow4m6DsqxbninhsWHlwfp0JecwQzYpOLmCQ="
)1,1 w ඞͣͭҎ্ϐϯχϯά͢Δඞཁ͕͋Δ w ͔֤ͭʑ͕ผʑͷূ໌ॻνΣʔϯʹ͋Δඞཁ w )1,1͕ಈ࡞ͤͣʹCVH[JMMBNP[JMMBPSHʹ ʮ)1,1ಈ͍ͯͳ͍Μ͚ͩͲόάʁʯͬͯฉ͍ͨΒ ʮূ໌ॻݸ͔͠ϐϯχϯάͯ͠ͳ͍Μ͚ʯ ͬͯࢦఠ͞Εͨࢥ͍ग़ʢஏ͔͍ͣ͠ʣ Public-Key-Pins: max-age=2592000; pin-sha256="E9CZ9INDbd+2eRQozYqqbQ2yXLVKB9+xcprMF+44U1g="; pin-sha256="LPJNul+wow4m6DsqxbninhsWHlwfp0JecwQzYpOLmCQ="
)1,1 w ඞͣͭҎ্ϐϯχϯά͢Δඞཁ͕͋Δ w ͔֤ͭʑ͕ผʑͷূ໌ॻνΣʔϯʹ͋Δඞཁ w )1,1͕ಈ࡞ͤͣʹCVH[JMMBNP[JMMBPSHʹ ʮ)1,1ಈ͍ͯͳ͍Μ͚ͩͲόάʁʯͬͯฉ͍ͨΒ ʮূ໌ॻݸ͔͠ϐϯχϯάͯ͠ͳ͍Μ͚ʯ ͬͯࢦఠ͞Εͨࢥ͍ग़ʢஏ͔͍ͣ͠ʣ w 1VCMJD,FZ1JOT3FQPSU0OMZϔομΛ͑ ESZSVOͰ͖Δ Public-Key-Pins: max-age=2592000; pin-sha256="E9CZ9INDbd+2eRQozYqqbQ2yXLVKB9+xcprMF+44U1g="; pin-sha256="LPJNul+wow4m6DsqxbninhsWHlwfp0JecwQzYpOLmCQ="
%"/&WT5-4 ݱࡏͷ5-4ೝূͷϞσϧ w ʢʣຊͷυϝΠϯ໊ॴ༗ऀʹͷΈূ໌ॻΛൃߦ͢ ΔΑ͏ͳ৴པͰ͖Δ$"͕·ͣ͋ͬͯɺ ͦͷ͏͑Ͱ w αΠτʹΞΫηε͕͋ͬͨͱ͖ʹ͍ͭɺʢʣҙ ਤ໊ͨ͠લͲ͓Γূ໌ॻ͕ਖ਼͍͜͠ͱΛϢʔβΤʔδΣ ϯτʢϒϥβͳͲʣ͕͔֬ΊΔɺ ͱ͍͏ஈ֊ͷϞσϧͰߏ w %/44&$͕͑Εɺड৴ͨ͠υϝΠϯʹ͍ͭͯͷ ใυϝΠϯ໊ॴ༗ऀ͔ΒͷͷͰ͋Δͱ֬৴Ͱ ͖ΔͷͰ$"͕ඞཁͰͳ͍
%"/&ͷϢʔεέʔε ࣗݾॺ໊ূ໌ॻͷ҆શͳσϓϩΠ w ࠓ·Ͱͷ5-4ͩͱඞͣূ໌ॻΤϥʔ͕ग़Δ w ʮҰൠతͳʯϢʔβແࢹ͢Δ͚Ͳʜ·͋ w ʮਖ਼͍͠ʯΤϥʔͱࣗݾূ໌ॻͷݕূΤϥʔ ͕۠ผ͔ͭͳ͍ w %/44&$͕͋Εɺ໊લղܾ͢ΔυϝΠϯॴ༗ ऀͷਅਖ਼ੑΛ֬อͰ͖Δ͔ΒԿͰ҆શʹϐϯχ ϯάͰ͖ΔΑͶ w ಠࣗϧʔτূ໌ॻͩͬͯϐϯχϯάͰ͖ͪΌ͏
%"/&ͷ࣮ɾσϓϩΠ w 5-4"ϨίʔυΛκʔϯϑΝΠϧͰఆٛ w 4FMFDUPS w $FSU ূ໌ॻϐϯχϯά w 41,* ެ։伴 41,* ϐϯχϯά _443._tcp.www.example.com. IN TLSA ( 0 1 1 d2abde240d7cd3ee6b4b28c54df034b9 7983a1d16e8a410e4561cb106618e971 )
%"/&ͷ࣮ɾσϓϩΠ w 5-4"ϨίʔυΛκʔϯϑΝΠϧͰఆٛ w $FSUJpDBUF"TTPDJBUJPO%BUB w લͭͷͷ߹ͤʹରԠ͢Δϐϯχϯά _443._tcp.www.example.com. IN TLSA ( 0 1 1 d2abde240d7cd3ee6b4b28c54df034b9 7983a1d16e8a410e4561cb106618e971 )
hashedhyphen
is_ryo
shibuiwilliam
inureyes
akiroom
ouchi2501
cybozuinsideout
muziyoshiz
comucal
wakamatsu_takumu
coconala_engineer
palark
colopl
zenorocha
gr2m
edds
denniskardys
jakevdp
samlambert
stephaniewalter
chriscoyier
jnunemaker
sachag
geeforr
kastner