en	[[!meta date="Fri, 06 Jan 2012 22:01:54 +0100"]]

en	[[!pagetemplate template="news.tmpl"]]

en	[[!meta title="New SSL certificate for tails.boum.org"]]
zh-tw	[[!meta title=" tails.boum.org 新的SSL 安全證書"]]

en	[[!tag announce]]

en	[[!toc levels=2]]

en	On the same day Tails 0.10 was put out, our website started to use a commercial SSL certificate. This new certificate replaces the previous one that was delivered by the non-commercial [CACert certificate authority](http://www.cacert.org/).
zh-tw	在 Tails 0.10 釋出的同一天，我們的官網也開始使用商用的 SSL 憑證。這個新的憑證取代了之前舊有的非商業[CACert certificate authority](http://www.cacert.org/)憑證。

en	What are SSL certificates?
zh-tw	什麼是 SSL 證書？

en	Using HTTPS instead of plain HTTP to connect to a website allows you to encrypt your communication with the server. But encryption alone does not guarantee that you are talking with the right server, and not someone impersonating it, for example in case of a man-in-the-middle attack.
zh-tw	使用 HTTPS 取代明文的 HTTP 來進行網站連線，可以加密訪客與伺服器之間的通訊。但只有加密並不能保證用戶是和正確的伺服器通話，難保不會有人假借身份，例如在[[中間人攻擊|doc/about/warning#man-in-the-middle]]的情況下。

en	SSL certificates try to solve this problem. A SSL certificate is usually issued by a certificate authority to certify the identity of a server. When you reach a website your web browser might trust an SSL certificate automatically if it trusts the authority that issued it.
zh-tw	SSL 憑證正試圖克服這個難題， SSL 憑證通常由憑證授權機關所發以證明某個伺服器的身份。當用戶利用瀏覽器訪問某網站時，如果瀏覽器信任這個憑證單位的話，即會可自動相信它的 SSL 憑證。

en	Commercial certificate authorities are making a living out of selling SSL certificates; they are usually trusted automatically by most of the browsers. Other non-commercial authorities, such as [CACert](http://www.cacert.org/), need to be installed by the operating system or by the user to avoid displaying a security warning when visiting the website.
zh-tw	商用憑證機構靠出售 SSL 憑證為生，它們往往為大多數瀏覽器所自動信任。其它的非商業授權機構如 [CACert](http://www.cacert.org/)，則需要安裝作業系統或是用戶在訪問該網站時手動來避免顯示安全警告訊息。

en	Weaknesses of the system
zh-tw	系統的弱點

en	But this trust system has proven to be flawed in many ways. For example, during 2011, two certificate authorities were compromised, and many fake certificates were issued and used in the wild. See [Comodo: The Recent RA Compromise](https://blog.comodo.com/other/the-recent-ra-compromise/) and [The Tor Project: The DigiNotar Debacle, and what you should do about it](https://blog.torproject.org/blog/diginotar-debacle-and-what-you-should-do-about-it).
zh-tw	但這個信任系統有一些缺點，例如在2011年，二個憑證機構受到破壞，發出了許多假造的憑證且被廣泛使用。 請見[Comodo: The Recent RA Compromise](http://blogs.comodo.com/it-security/data-security/the-recent-ra-compromise/) 以及[The Tor Project: The DigiNotar Debacle, and what you should do about it](https://blog.torproject.org/blog/diginotar-debacle-and-what-you-should-do-about-it).

en	It is clear for us that getting an commercial SSL certificate is not enough to strongly authenticate our website, and for example authenticity of our releases. That's why we always propose you stronger ways of authenticating our Tails release using OpenPGP signatures.

en	Why get a commercial certificate then?
zh-tw	為何要採用商用證書？

en	Still we decided to get a commercial certificate for the following reasons:
zh-tw	我們決定採用商用證書有以下的原因：

en	It makes it harder to setup a simplistic man-in-the-middle attacks against the people who didn't use HTTPS so far to visit our website.
zh-tw	讓想對那些不使用 HTTPS 來訪問官網的使用，更難以進行簡單[[中間人攻擊|doc/about/warning#man-in-the-middle]] 操作。

en	Our website now is only available with HTTPS enabled. This may be important to provide some confidentiality while posting on the forum for example.
zh-tw	我們的網站現在只有透過 HTTPS 訪問，例如這對於想在論壇上張貼資訊更具保密的重要。