{"id":5939,"date":"2026-10-30T09:07:34","date_gmt":"2026-10-30T06:07:34","guid":{"rendered":"https:\/\/www.dchost.com\/blog\/?p=5939"},"modified":"2026-10-30T06:26:56","modified_gmt":"2026-10-30T03:26:56","slug":"ssl-ozel-anahtar-sizintisi-iptal-yeniden-kurulum","status":"publish","type":"post","link":"https:\/\/www.dchost.com\/blog\/ssl-ozel-anahtar-sizintisi-iptal-yeniden-kurulum\/","title":{"rendered":"SSL \u00d6zel Anahtar\u0131 S\u0131zd\u0131ysa: \u0130ptal ve Yeniden Kurulum"},"content":{"rendered":"<div class=\"dchost-blog-content-wrapper\"><div class=\"aiw-summary\">\n<p class=\"aiw-box-title\">H\u0131zl\u0131 \u00f6zet<\/p>\n<p>SSL \u00f6zel anahtar\u0131n\u0131z s\u0131zd\u0131ysa dosyay\u0131 silmek veya sertifikay\u0131 rutin bi\u00e7imde yenilemek yetmez. \u00d6nce s\u0131zan dosyaya eri\u015fimi kapat\u0131n, ard\u0131ndan yeni bir \u00f6zel anahtarla sertifika al\u0131n ve s\u0131zan anahtara ba\u011fl\u0131 sertifikalar\u0131 iptal ettirin.<\/p>\n<ul>\n<li>Payla\u015f\u0131m\u0131 kapat\u0131rken s\u0131z\u0131nt\u0131n\u0131n zaman\u0131n\u0131 ve kapsam\u0131n\u0131 belirlemeye yarayan kay\u0131tlar\u0131 koruyun.<\/li>\n<li>Yeni sertifikay\u0131 s\u0131zm\u0131\u015f anahtarla \u00fcretmeyin; anahtar\u0131n ger\u00e7ekten de\u011fi\u015fti\u011fini kontrol edin.<\/li>\n<li>Aktif k\u00f6t\u00fcye kullan\u0131m varsa hizmette eri\u015fim sorunu ya\u015fanabilecek olsa da acil iptali \u00f6ne al\u0131n.<\/li>\n<li>Yay\u0131ndaki sertifikay\u0131 sunucu d\u0131\u015f\u0131ndan kontrol edin ve s\u0131z\u0131nt\u0131ya yol a\u00e7an eri\u015fimi kapat\u0131n.<\/li>\n<\/ul>\n<\/div>\n<p>\u00d6zel anahtar, sunucunuzun HTTPS ba\u011flant\u0131s\u0131nda kimli\u011fini kan\u0131tlamak i\u00e7in kulland\u0131\u011f\u0131 gizli bilgidir. Bu anahtar\u0131 yanl\u0131\u015fl\u0131kla Git deposuna g\u00f6ndermi\u015f, destek kayd\u0131na eklemi\u015f veya herkese a\u00e7\u0131k bir dizinde b\u0131rakm\u0131\u015f olabilirsiniz. Dosyay\u0131 kald\u0131rman\u0131z ba\u015fkalar\u0131n\u0131n ald\u0131\u011f\u0131 kopyalar\u0131 ge\u00e7ersiz k\u0131lmaz. Taray\u0131c\u0131da ba\u011flant\u0131n\u0131n g\u00fcvenli g\u00f6r\u00fcnmesi de anahtar\u0131n yaln\u0131zca sizde oldu\u011funu g\u00f6stermez.<\/p>\n<p>A\u015fa\u011f\u0131daki m\u00fcdahale s\u0131ras\u0131n\u0131 izleyerek hangi sertifikalar\u0131n etkilendi\u011fini belirleyebilir, yeni anahtarla kurulumu tamamlayabilir ve eski sertifikalar\u0131n iptalini takip edebilirsiniz. Ad\u0131mlar, Ubuntu \u00fczerinde Nginx web sunucusu ve sertifika i\u015flemlerini otomatikle\u015ftiren Certbot arac\u0131n\u0131n kullan\u0131ld\u0131\u011f\u0131 tek bir \u00f6rnek ortam\u0131 izler. Bu \u00f6rnekte yaln\u0131zca \u00f6zel anahtar\u0131n Git deposuna s\u0131zd\u0131\u011f\u0131 varsay\u0131l\u0131r. Sunucu veya sertifika y\u00f6netim hesab\u0131 da ele ge\u00e7irilmi\u015fse yeni anahtara ge\u00e7meden \u00f6nce g\u00fcvenilir, temiz bir ortam gerekir.<\/p>\n<div id=\"toc_container\" role=\"navigation\" aria-label=\"Table of Contents\" data-nosnippet class=\"toc_transparent no_bullets toc_numbered toc_title_center\"><p class=\"toc_title\">\u0130\u00e7indekiler<\/p><ul class=\"toc_list\"><li><a href=\"#SSL_ozel_anahtar_sizintisinda_ilk_mudahale_sirasi\"><span class=\"toc_number toc_depth_1\">1.<\/span> SSL \u00f6zel anahtar s\u0131z\u0131nt\u0131s\u0131nda ilk m\u00fcdahale s\u0131ras\u0131<\/a><ul><li><a href=\"#Once_erisimi_sinirlayin_olay_izini_koruyun\"><span class=\"toc_number toc_depth_2\">1.1.<\/span> \u00d6nce eri\u015fimi s\u0131n\u0131rlay\u0131n, olay izini koruyun<\/a><\/li><li><a href=\"#Ayni_anahtara_bagli_sertifikalari_belirleyin\"><span class=\"toc_number toc_depth_2\">1.2.<\/span> Ayn\u0131 anahtara ba\u011fl\u0131 sertifikalar\u0131 belirleyin<\/a><\/li><li><a href=\"#Iptalin_ne_kadar_acil_olduguna_karar_verin\"><span class=\"toc_number toc_depth_2\">1.3.<\/span> \u0130ptalin ne kadar acil oldu\u011funa karar verin<\/a><\/li><\/ul><\/li><li><a href=\"#Temiz_ortamda_yeni_ozel_anahtar_ve_sertifika_olusturun\"><span class=\"toc_number toc_depth_1\">2.<\/span> Temiz ortamda yeni \u00f6zel anahtar ve sertifika olu\u015fturun<\/a><ul><li><a href=\"#Araclari_kurun_ve_mevcut_ayarlari_koruyun\"><span class=\"toc_number toc_depth_2\">2.1.<\/span> Ara\u00e7lar\u0131 kurun ve mevcut ayarlar\u0131 koruyun<\/a><\/li><li><a href=\"#DNS_ve_HTTP_dogrulamasini_hazirlayin\"><span class=\"toc_number toc_depth_2\">2.2.<\/span> DNS ve HTTP do\u011frulamas\u0131n\u0131 haz\u0131rlay\u0131n<\/a><\/li><li><a href=\"#Ayri_kayit_olusturun_ve_anahtarin_degistigini_dogrulayin\"><span class=\"toc_number toc_depth_2\">2.3.<\/span> Ayr\u0131 kay\u0131t olu\u015fturun ve anahtar\u0131n de\u011fi\u015fti\u011fini do\u011frulay\u0131n<\/a><\/li><\/ul><\/li><li><a href=\"#Yeni_sertifikayi_yayina_alin_ve_sizan_sertifikayi_iptal_edin\"><span class=\"toc_number toc_depth_1\">3.<\/span> Yeni sertifikay\u0131 yay\u0131na al\u0131n ve s\u0131zan sertifikay\u0131 iptal edin<\/a><ul><li><a href=\"#Anahtar_eslesmesini_kontrol_edip_Nginx_yollarini_degistirin\"><span class=\"toc_number toc_depth_2\">3.1.<\/span> Anahtar e\u015fle\u015fmesini kontrol edip Nginx yollar\u0131n\u0131 de\u011fi\u015ftirin<\/a><\/li><li><a href=\"#Disaridan_sunulan_sertifikayi_dogrulayin\"><span class=\"toc_number toc_depth_2\">3.2.<\/span> D\u0131\u015far\u0131dan sunulan sertifikay\u0131 do\u011frulay\u0131n<\/a><\/li><li><a href=\"#Eski_sertifikalari_anahtar_sizintisi_nedeniyle_iptal_edin\"><span class=\"toc_number toc_depth_2\">3.3.<\/span> Eski sertifikalar\u0131 anahtar s\u0131z\u0131nt\u0131s\u0131 nedeniyle iptal edin<\/a><\/li><\/ul><\/li><li><a href=\"#Kurulum_sorunlarini_ayirin_ve_yeniden_sizintiyi_onleyin\"><span class=\"toc_number toc_depth_1\">4.<\/span> Kurulum sorunlar\u0131n\u0131 ay\u0131r\u0131n ve yeniden s\u0131z\u0131nt\u0131y\u0131 \u00f6nleyin<\/a><ul><li><a href=\"#Eski_sertifika_ve_dogrulama_hatasini_ayirin\"><span class=\"toc_number toc_depth_2\">4.1.<\/span> Eski sertifika ve do\u011frulama hatas\u0131n\u0131 ay\u0131r\u0131n<\/a><\/li><li><a href=\"#Anahtar_izinlerini_dar_kapsamda_duzeltin\"><span class=\"toc_number toc_depth_2\">4.2.<\/span> Anahtar izinlerini dar kapsamda d\u00fczeltin<\/a><\/li><li><a href=\"#Yenileme_ve_yeniden_yuklemeyi_birlikte_sinayin\"><span class=\"toc_number toc_depth_2\">4.3.<\/span> Yenileme ve yeniden y\u00fcklemeyi birlikte s\u0131nay\u0131n<\/a><\/li><li><a href=\"#Git_gecmisini_temizleyin_ve_diger_uclari_kontrol_edin\"><span class=\"toc_number toc_depth_2\">4.4.<\/span> Git ge\u00e7mi\u015fini temizleyin ve di\u011fer u\u00e7lar\u0131 kontrol edin<\/a><\/li><\/ul><\/li><li><a href=\"#Sik_Sorulan_Sorular\"><span class=\"toc_number toc_depth_1\">5.<\/span> S\u0131k Sorulan Sorular<\/a><ul><li><a href=\"#Sizan_ozel_anahtarla_gecmis_HTTPS_trafigi_cozulebilir_mi\"><span class=\"toc_number toc_depth_2\">5.1.<\/span> S\u0131zan \u00f6zel anahtarla ge\u00e7mi\u015f HTTPS trafi\u011fi \u00e7\u00f6z\u00fclebilir mi?<\/a><\/li><li><a href=\"#WordPress_ve_musteri_parolalarini_da_degistirmeli_misiniz\"><span class=\"toc_number toc_depth_2\">5.2.<\/span> WordPress ve m\u00fc\u015fteri parolalar\u0131n\u0131 da de\u011fi\u015ftirmeli misiniz?<\/a><\/li><li><a href=\"#CSR_dosyasini_paylasmak_ozel_anahtar_sizintisi_midir\"><span class=\"toc_number toc_depth_2\">5.3.<\/span> CSR dosyas\u0131n\u0131 payla\u015fmak \u00f6zel anahtar s\u0131z\u0131nt\u0131s\u0131 m\u0131d\u0131r?<\/a><\/li><li><a href=\"#HSTS_aciksa_sizintiya_karsi_korunmus_olur_musunuz\"><span class=\"toc_number toc_depth_2\">5.4.<\/span> HSTS a\u00e7\u0131ksa s\u0131z\u0131nt\u0131ya kar\u015f\u0131 korunmu\u015f olur musunuz?<\/a><\/li><\/ul><\/li><li><a href=\"#Mudahaleyi_kapatmadan_once_kontrol_listesi\"><span class=\"toc_number toc_depth_1\">6.<\/span> M\u00fcdahaleyi kapatmadan \u00f6nce kontrol listesi<\/a><\/li><\/ul><\/div>\n<h2><span id=\"SSL_ozel_anahtar_sizintisinda_ilk_mudahale_sirasi\">SSL \u00f6zel anahtar s\u0131z\u0131nt\u0131s\u0131nda ilk m\u00fcdahale s\u0131ras\u0131<\/span><\/h2>\n<p>SSL \u00f6zel anahtar s\u0131z\u0131nt\u0131s\u0131 do\u011fruland\u0131\u011f\u0131nda, anahtar\u0131n ba\u015fkalar\u0131 taraf\u0131ndan kopyalanm\u0131\u015f olabilece\u011fini kabul edin. Dosyay\u0131 silmek yeni eri\u015fimleri azalt\u0131r; daha \u00f6nce al\u0131nm\u0131\u015f kopyalar\u0131 ge\u00e7ersiz k\u0131lmaz. Rutin sertifika yenilemesi de ayn\u0131 anahtar\u0131 kullanabilir. Bu nedenle m\u00fcdahalenin hedefi <strong>yeni anahtara ge\u00e7mek ve s\u0131zan anahtara ba\u011fl\u0131 sertifikalar\u0131 iptal ettirmektir.<\/strong><\/p>\n<figure class=\"aiw-figure\" data-aiw-visual-id=\"5935\" data-aiw-visual-key=\"d8e9d4b6aa3227b6c75b5c73829e4bd5aad9cc8cbc1014de4a53a9e55fa07674\"><img decoding=\"async\" src=\"https:\/\/www.dchost.com\/blog\/wp-content\/uploads\/2026\/10\/dchost-flow-tr-4bbb252718793f12efc2.png\" alt=\"Eri\u015fimi s\u0131n\u0131rlamadan sertifikalar\u0131 belirlemeye ve k\u00f6t\u00fcye kullan\u0131m durumuna g\u00f6re iptal \u00f6nceli\u011fini se\u00e7meye uzanan m\u00fcdahale ak\u0131\u015f\u0131.\" width=\"840\" height=\"987\" loading=\"lazy\" class=\"aiw-article-visual wp-image-5935\" srcset=\"https:\/\/www.dchost.com\/blog\/wp-content\/uploads\/2026\/10\/dchost-flow-tr-4bbb252718793f12efc2.png 840w, https:\/\/www.dchost.com\/blog\/wp-content\/uploads\/2026\/10\/dchost-flow-tr-4bbb252718793f12efc2-255x300.png 255w, https:\/\/www.dchost.com\/blog\/wp-content\/uploads\/2026\/10\/dchost-flow-tr-4bbb252718793f12efc2-768x902.png 768w\" sizes=\"auto, (max-width: 840px) 100vw, 840px\" \/><figcaption>Ak\u0131\u015f \u015femas\u0131: M\u00fcdahale s\u0131ras\u0131, aktif k\u00f6t\u00fcye kullan\u0131m durumunda de\u011fi\u015fir: eri\u015filebilirlik kayb\u0131 pahas\u0131na acil iptal gerekebilir.<\/figcaption><\/figure>\n<div class=\"aiw-note aiw-note-example\">\n<p class=\"aiw-box-title\">\u00d6rnek senaryo<\/p>\n<p>Ubuntu 24.04 \u00fczerinde Nginx web sunucusu ve sertifika i\u015flemlerini y\u00fcr\u00fcten Certbot kullan\u0131yorsunuz. example.com ve www.example.com ayn\u0131 sunucuya y\u00f6neliyor; i\u00e7erik da\u011f\u0131t\u0131m a\u011f\u0131 (CDN) yok, HTTP ve HTTPS i\u00e7in 80\/443 portlar\u0131 a\u00e7\u0131k ve y\u00f6netici komutlar\u0131n\u0131 \u00e7al\u0131\u015ft\u0131rmak i\u00e7in sudo yetkiniz var. Yaln\u0131z \u00f6zel anahtar Git deposuna s\u0131zm\u0131\u015f; sunucunun ve otomatik sertifika i\u015flemlerinde kullan\u0131lan ACME hesab\u0131n\u0131n ele ge\u00e7irilmedi\u011fi varsay\u0131l\u0131yor. Bu varsay\u0131m ge\u00e7erli de\u011filse yeni anahtar\u0131 mevcut sunucuda \u00fcretmeyin; temiz sunucuya ge\u00e7i\u015f gerekir.<\/p>\n<\/div>\n<h3><span id=\"Once_erisimi_sinirlayin_olay_izini_koruyun\">\u00d6nce eri\u015fimi s\u0131n\u0131rlay\u0131n, olay izini koruyun<\/span><\/h3>\n<p>Git sa\u011flay\u0131c\u0131n\u0131z\u0131n depo ayarlar\u0131nda g\u00f6r\u00fcn\u00fcrl\u00fck b\u00f6l\u00fcm\u00fcn\u00fc a\u00e7\u0131n ve eri\u015fimi yaln\u0131z yetkili ki\u015filerle s\u0131n\u0131rlay\u0131n. Anahtar destek kayd\u0131ndaysa ekin eri\u015fimini kapatt\u0131r\u0131n; web dizinindeyse dosyay\u0131 web \u00fczerinden sunulan k\u00f6k dizinin d\u0131\u015f\u0131na ta\u015f\u0131y\u0131n. Oturum a\u00e7\u0131lmam\u0131\u015f bir taray\u0131c\u0131yla eski adresi ziyaret edin; dosyan\u0131n art\u0131k okunamad\u0131\u011f\u0131n\u0131 veya indirilemedi\u011fini kontrol edin.<\/p>\n<p>Ge\u00e7mi\u015fi temizlemeden \u00f6nce belirleyebildi\u011finiz ilk s\u0131z\u0131nt\u0131 zaman\u0131n\u0131, dosya yolunu, ilgili commit kimli\u011fini, yani Git de\u011fi\u015fiklik kayd\u0131n\u0131n kimli\u011fini ve mevcut eri\u015fim kay\u0131tlar\u0131n\u0131 saklay\u0131n. Anahtar\u0131 yeni bir destek kayd\u0131na yap\u0131\u015ft\u0131rmay\u0131n. \u00d6rnekte mevcut sertifikan\u0131n a\u015fa\u011f\u0131daki yolda bulundu\u011fu varsay\u0131l\u0131yor. Sunucunun terminalinde yaln\u0131z y\u00f6netici hesab\u0131 root&#8217;un eri\u015febilece\u011fi olay dizinini olu\u015fturup eski sertifikay\u0131 buraya kopyalay\u0131n:<\/p>\n<pre class=\"language-bash line-numbers\"><code class=\"language-bash\">sudo install -d -m 700 \/root\/ssl-incident\nsudo cp -L \/etc\/letsencrypt\/live\/example.com\/cert.pem \/root\/ssl-incident\/old-cert.pem<\/code><\/pre>\n<p>Komutlar hatas\u0131z tamamland\u0131\u011f\u0131nda olay dizininde eski sertifikan\u0131n bir kopyas\u0131 bulunur. Bu kopya iptal edilecek sertifikay\u0131 belirlemek i\u00e7indir; s\u0131zm\u0131\u015f anahtar\u0131 yeniden kullanaca\u011f\u0131n\u0131z bir geri d\u00f6n\u00fc\u015f noktas\u0131 de\u011fildir.<\/p>\n<h3><span id=\"Ayni_anahtara_bagli_sertifikalari_belirleyin\">Ayn\u0131 anahtara ba\u011fl\u0131 sertifikalar\u0131 belirleyin<\/span><\/h3>\n<p>Dosya adlar\u0131n\u0131n farkl\u0131 olmas\u0131 anahtarlar\u0131n farkl\u0131 oldu\u011funu g\u00f6stermez. Sunucuda OpenSSL kuruluysa a\u015fa\u011f\u0131daki komutlar\u0131 terminalde \u00e7al\u0131\u015ft\u0131r\u0131n. Komutlar, \u00f6zel anahtardan ve sertifikadan \u00e7\u0131kar\u0131lan a\u00e7\u0131k anahtar\u0131n SHA-256 \u00f6zetini, yani kar\u015f\u0131la\u015ft\u0131r\u0131labilir parmak izini verir; \u00f6zel anahtar\u0131n kendisini ekrana yazd\u0131rmaz:<\/p>\n<pre class=\"language-bash line-numbers\"><code class=\"language-bash\">sudo openssl pkey -in \/etc\/letsencrypt\/live\/example.com\/privkey.pem -pubout -outform DER | openssl dgst -sha256\nopenssl x509 -in \/etc\/letsencrypt\/live\/example.com\/cert.pem -pubkey -noout | openssl pkey -pubin -outform DER | openssl dgst -sha256<\/code><\/pre>\n<p>Her iki komuttaki t\u00fcm i\u015flemler hatas\u0131z tamamland\u0131\u011f\u0131nda \u00f6zetlerin e\u015fitli\u011fi, sertifikan\u0131n bu \u00f6zel anahtarla e\u015fle\u015fti\u011fini g\u00f6sterir. Dosya okuma veya izin hatas\u0131 g\u00f6r\u00fcrseniz \u00e7\u0131kt\u0131lar\u0131 kar\u015f\u0131la\u015ft\u0131rmay\u0131n; \u00f6nce belirtilen dosyaya eri\u015fim sorununu \u00e7\u00f6z\u00fcn. Di\u011fer mevcut sertifikalar i\u00e7in ikinci komuttaki sertifika yolunu de\u011fi\u015ftirip \u00e7\u0131kan \u00f6zeti ilk komutun \u00f6zetiyle kar\u015f\u0131la\u015ft\u0131r\u0131n.<\/p>\n<p>Bulgular\u0131 sertifika sa\u011flay\u0131c\u0131n\u0131z\u0131n kay\u0131tlar\u0131yla birlikte inceleyin. Ayn\u0131 anahtar\u0131 kullanan, s\u00fcresi dolmam\u0131\u015f sertifikalar\u0131 ve bunlar\u0131n kurulu oldu\u011fu sunucular\u0131 listeleyin. Yenileme \u00f6ncesindeki sertifikalar\u0131 da kontrol edin; yeni sertifika al\u0131nm\u0131\u015f olmas\u0131 \u00f6ncekinin s\u00fcresinin doldu\u011fu veya iptal edildi\u011fi anlam\u0131na gelmez.<\/p>\n<h3><span id=\"Iptalin_ne_kadar_acil_olduguna_karar_verin\">\u0130ptalin ne kadar acil oldu\u011funa karar verin<\/span><\/h3>\n<p>Aktif k\u00f6t\u00fcye kullan\u0131m belirtisi yoksa yeni anahtar ve sertifikay\u0131 h\u0131zla haz\u0131rlay\u0131p yay\u0131na al\u0131n, ard\u0131ndan eskileri gecikmeden iptal ettirin. Yeni sertifikay\u0131 \u00f6nce yay\u0131na almak, s\u0131zm\u0131\u015f anahtarla \u00e7al\u0131\u015f\u0131lan s\u00fcreyi k\u0131sa tutarken iptal nedeniyle ziyaret\u00e7ilerinizin sertifika hatas\u0131yla kar\u015f\u0131la\u015fma riskini azalt\u0131r.<\/p>\n<p><strong>Aktif k\u00f6t\u00fcye kullan\u0131m varsa yeni kurulumu beklemeden iptal talebini \u00f6ne al\u0131n.<\/strong> Sertifikay\u0131 veren kurulu\u015fun iptal kanal\u0131na anahtar s\u0131z\u0131nt\u0131s\u0131n\u0131, yani <code>keyCompromise<\/code> nedenini bildirin. Siteye eri\u015fimde sorun ya\u015fanabilir. Ayr\u0131ca taray\u0131c\u0131lar\u0131n ve di\u011fer istemcilerin iptal kontrol\u00fc farkl\u0131 oldu\u011fundan iptal, k\u00f6t\u00fcye kullan\u0131m\u0131 her yerde an\u0131nda durdurma garantisi de\u011fildir. \u0130ptal talebinden sonra da yeni anahtara ge\u00e7i\u015fi tamamlay\u0131n.<\/p>\n<h2><span id=\"Temiz_ortamda_yeni_ozel_anahtar_ve_sertifika_olusturun\">Temiz ortamda yeni \u00f6zel anahtar ve sertifika olu\u015fturun<\/span><\/h2>\n<p>Bu \u00f6rnekte sunucu ve sertifika i\u015flemlerini y\u00f6neten ACME hesab\u0131 g\u00fcvende kabul edildi\u011finden yeni anahtar\u0131 ayn\u0131 Ubuntu sunucusunda \u00fcretebilirsiniz. \u0130\u015flemleri sudo yetkili SSH oturumunda yap\u0131n. Yeni sertifikay\u0131 ayr\u0131 bir Certbot kayd\u0131nda tutaca\u011f\u0131z; b\u00f6ylece Nginx&#8217;in mevcut sertifika yollar\u0131na dokunmadan yeni dosyalar\u0131 haz\u0131rlayabilirsiniz.<\/p>\n<h3><span id=\"Araclari_kurun_ve_mevcut_ayarlari_koruyun\">Ara\u00e7lar\u0131 kurun ve mevcut ayarlar\u0131 koruyun<\/span><\/h3>\n<p>\u00d6rnek ortamda Ubuntu 24.04 \u00fczerinde Nginx zaten kurulu ve siteyi sunuyor; Certbot i\u00e7in Ubuntu paketleri kullan\u0131l\u0131yor. Certbot sertifika ba\u015fvurusunu, OpenSSL anahtar kar\u015f\u0131la\u015ft\u0131rmas\u0131n\u0131, di\u011fer ara\u00e7lar DNS ve eri\u015fim kontrollerini yapacak. Sunucunun terminalinde paketleri kurun, ard\u0131ndan de\u011fi\u015fiklikten \u00f6nce site ayar\u0131n\u0131 yaln\u0131z root kullan\u0131c\u0131s\u0131n\u0131n eri\u015febildi\u011fi olay dizinine kopyalay\u0131n:<\/p>\n<pre class=\"language-bash line-numbers\"><code class=\"language-bash\">sudo apt update\nsudo apt install certbot openssl dnsutils curl\nsudo install -d -m 700 \/root\/ssl-incident\nsudo cp -a \/etc\/nginx\/sites-available\/example.com \/root\/ssl-incident\/example.com.nginx.before\nsudo certbot certificates<\/code><\/pre>\n<p>Son komutun \u00e7\u0131kt\u0131s\u0131nda eski <code>example.com<\/code> kayd\u0131n\u0131 g\u00f6rmelisiniz. Yeni kullanaca\u011f\u0131m\u0131z <code>example-com-incident<\/code> ad\u0131 listede bulunmamal\u0131; varsa devam etmeden bu kayd\u0131n hangi sertifikaya ait oldu\u011funu ve nerede kullan\u0131ld\u0131\u011f\u0131n\u0131 belirleyin. B\u00f6ylece mevcut bir kayd\u0131 yanl\u0131\u015fl\u0131kla de\u011fi\u015ftirmemi\u015f olursunuz.<\/p>\n<h3><span id=\"DNS_ve_HTTP_dogrulamasini_hazirlayin\">DNS ve HTTP do\u011frulamas\u0131n\u0131 haz\u0131rlay\u0131n<\/span><\/h3>\n<p>DNS y\u00f6netim panelinizde iki ad\u0131n <code>A<\/code> kay\u0131tlar\u0131n\u0131n bu sunucunun genel IPv4 adresini g\u00f6sterdi\u011fini kontrol edin. <code>AAAA<\/code> kayd\u0131 varsa IPv6 \u00fczerinden de ayn\u0131 siteye ula\u015f\u0131lmal\u0131. A\u015fa\u011f\u0131daki ilk d\u00f6rt komutla yay\u0131nlanan DNS yan\u0131tlar\u0131n\u0131 inceleyin. Yanl\u0131\u015f kay\u0131t varsa geri d\u00f6n\u00fc\u015f i\u00e7in mevcut de\u011ferini kaydedip panelden d\u00fczeltin; do\u011fru yan\u0131t g\u00f6r\u00fcnmeden sertifika ba\u015fvurusu yapmay\u0131n. Son iki komut do\u011frulama dosyalar\u0131n\u0131n dizinini olu\u015fturur ve site ayar\u0131n\u0131 nano d\u00fczenleyicisinde a\u00e7ar:<\/p>\n<pre class=\"language-bash line-numbers\"><code class=\"language-bash\">dig +short example.com A\ndig +short example.com AAAA\ndig +short www.example.com A\ndig +short www.example.com AAAA\nsudo install -d -m 755 \/var\/www\/acme\/.well-known\/acme-challenge\nsudo nano \/etc\/nginx\/sites-available\/example.com<\/code><\/pre>\n<p>Let&#8217;s Encrypt, HTTP-01 y\u00f6nteminde alan ad\u0131n\u0131z \u00fczerinden ge\u00e7ici bir dosyay\u0131 okuyarak alan ad\u0131n\u0131 kontrol etti\u011finizi do\u011frular. Bu do\u011frulama i\u00e7in 80 numaral\u0131 porta d\u0131\u015far\u0131dan eri\u015filebilmelidir. A\u00e7t\u0131\u011f\u0131n\u0131z dosyada iki alan ad\u0131n\u0131 kar\u015f\u0131layan <code>listen 80<\/code> sunucu blo\u011funa a\u015fa\u011f\u0131daki b\u00f6l\u00fcm\u00fc ekleyin. Buradaki <code>root<\/code>, do\u011frulama dosyalar\u0131n\u0131n tutulaca\u011f\u0131 web k\u00f6k\u00fcn\u00fc belirtir:<\/p>\n<pre class=\"language-nginx line-numbers\"><code class=\"language-nginx\">location ^~ \/.well-known\/acme-challenge\/ {\n    root \/var\/www\/acme;\n    default_type text\/plain;\n    try_files $uri =404;\n}<\/code><\/pre>\n<p>Sunucu blo\u011funda, location b\u00f6l\u00fcmlerinin d\u0131\u015f\u0131nda HTTPS&#8217;ye y\u00f6nlendiren bir <code>return<\/code> varsa bu kural do\u011frulama iste\u011fini de y\u00f6nlendirir. Bu \u00f6rnekte dosyan\u0131n do\u011frudan HTTP \u00fczerinden okunmas\u0131 i\u00e7in y\u00f6nlendirmeyi mevcut <code>location \/<\/code> i\u00e7ine ta\u015f\u0131y\u0131n; ikinci bir <code>location \/<\/code> olu\u015fturmay\u0131n. Dosyay\u0131 kaydettikten sonra a\u015fa\u011f\u0131daki komutlarla ayar\u0131 test edin, test ba\u015far\u0131l\u0131ysa yeniden y\u00fckleyin ve d\u0131\u015f eri\u015fimi s\u0131namak i\u00e7in ge\u00e7ici bir dosya olu\u015fturun:<\/p>\n<pre class=\"language-bash line-numbers\"><code class=\"language-bash\">sudo nginx -t &amp;&amp; sudo systemctl reload nginx\nprintf &#039;acme-ok\\n&#039; | sudo tee \/var\/www\/acme\/.well-known\/acme-challenge\/probe<\/code><\/pre>\n<p>Test ba\u015far\u0131s\u0131zsa yeniden y\u00fckleme komutu \u00e7al\u0131\u015fmaz. Hata verilen sat\u0131r\u0131 d\u00fczeltin; haz\u0131rl\u0131k de\u011fi\u015fikli\u011fini geri almak gerekirse olay dizinindeki example.com.nginx.before kopyas\u0131n\u0131 \u00f6zg\u00fcn site dosyas\u0131n\u0131n \u00fczerine geri kopyalay\u0131p testi tekrarlay\u0131n. Bu geri d\u00f6n\u00fc\u015f yaln\u0131z haz\u0131rl\u0131k ayar\u0131 i\u00e7indir; s\u0131zm\u0131\u015f anahtar\u0131 kullanmaya devam etmek i\u00e7in bir \u00e7\u00f6z\u00fcm de\u011fildir.<\/p>\n<p>Ba\u015fka bir internet ba\u011flant\u0131s\u0131ndaki bilgisayar\u0131n terminalinde a\u015fa\u011f\u0131daki iki komutu \u00e7al\u0131\u015ft\u0131r\u0131n. \u0130kisi de <code>acme-ok<\/code> d\u00f6nd\u00fcrmeli. Bu yan\u0131t, alan adlar\u0131n\u0131n d\u0131\u015far\u0131dan eri\u015filebildi\u011fini ve Nginx&#8217;in do\u011frulama dosyas\u0131n\u0131 do\u011fru dizinden sundu\u011funu g\u00f6sterir:<\/p>\n<pre class=\"language-bash line-numbers\"><code class=\"language-bash\">curl --fail example.com\/.well-known\/acme-challenge\/probe\ncurl --fail www.example.com\/.well-known\/acme-challenge\/probe<\/code><\/pre>\n<h3><span id=\"Ayri_kayit_olusturun_ve_anahtarin_degistigini_dogrulayin\">Ayr\u0131 kay\u0131t olu\u015fturun ve anahtar\u0131n de\u011fi\u015fti\u011fini do\u011frulay\u0131n<\/span><\/h3>\n<p>\u0130ki adresten de beklenen yan\u0131t\u0131 ald\u0131ktan sonra sunucunun terminaline d\u00f6n\u00fcn. A\u015fa\u011f\u0131daki komut, haz\u0131rlad\u0131\u011f\u0131n\u0131z web k\u00f6k\u00fcn\u00fc kullanarak iki alan ad\u0131 i\u00e7in sertifika ister. Sorulursa takip etti\u011finiz e-posta adresini girin ve hizmet ko\u015fullar\u0131n\u0131 inceleyin. <code>--duplicate<\/code> ayn\u0131 alan adlar\u0131 i\u00e7in ayr\u0131 kay\u0131t a\u00e7\u0131lmas\u0131n\u0131 sa\u011flar; <code>certonly<\/code> ise sertifikay\u0131 al\u0131r, Nginx&#8217;in sertifika yollar\u0131n\u0131 de\u011fi\u015ftirmez. Komut a\u015fa\u011f\u0131da sat\u0131rlara b\u00f6l\u00fcnm\u00fc\u015f g\u00f6steriliyor; \u00e7al\u0131\u015ft\u0131rmadan \u00f6nce sat\u0131rlar\u0131 aralar\u0131nda bo\u015fluk b\u0131rakarak birle\u015ftirin:<\/p>\n<pre class=\"language-bash line-numbers\"><code class=\"language-bash\">sudo certbot certonly --webroot -w \/var\/www\/acme \n  --cert-name example-com-incident --duplicate \n  -d example.com -d www.example.com<\/code><\/pre>\n<p><strong>Yukar\u0131daki komutu terminalde tek sat\u0131r olarak \u00e7al\u0131\u015ft\u0131r\u0131n.<\/strong> Ba\u015far\u0131 \u00e7\u0131kt\u0131s\u0131nda yeni dosyalar <code>\/etc\/letsencrypt\/live\/example-com-incident\/<\/code> alt\u0131nda g\u00f6r\u00fcnmeli. Ard\u0131ndan eski sertifikan\u0131n a\u00e7\u0131k anahtar\u0131yla yeni \u00f6zel anahtardan t\u00fcretilen a\u00e7\u0131k anahtar\u0131n SHA-256 \u00f6zetlerini kar\u015f\u0131la\u015ft\u0131r\u0131n. \u0130lk iki komut bu \u00f6zetleri g\u00f6sterir; son komut art\u0131k gerekmeyen eri\u015fim denemesi dosyas\u0131n\u0131 siler:<\/p>\n<pre class=\"language-bash line-numbers\"><code class=\"language-bash\">sudo openssl x509 -in \/root\/ssl-incident\/old-cert.pem -pubkey -noout | openssl pkey -pubin -outform DER | openssl dgst -sha256\nsudo openssl pkey -in \/etc\/letsencrypt\/live\/example-com-incident\/privkey.pem -pubout -outform DER | openssl dgst -sha256\nsudo rm \/var\/www\/acme\/.well-known\/acme-challenge\/probe<\/code><\/pre>\n<p>\u0130lk iki komuttaki t\u00fcm i\u015flemler hatas\u0131z tamamlanmal\u0131 ve \u00f6zetler <strong>farkl\u0131<\/strong> olmal\u0131. Yaln\u0131z bir \u00f6zet sat\u0131r\u0131 g\u00f6r\u00fcnmesi yeterli de\u011fildir; dosya okuma veya anahtar i\u015fleme hatas\u0131 varsa kar\u015f\u0131la\u015ft\u0131rmaya g\u00fcvenmeyin. Hatas\u0131z elde edilen farkl\u0131 \u00f6zetler, eski anahtar\u0131n yeniden kullan\u0131lmad\u0131\u011f\u0131n\u0131 g\u00f6sterir. Yeni sertifika art\u0131k haz\u0131rd\u0131r; Nginx h\u00e2l\u00e2 eski yollar\u0131 kulland\u0131\u011f\u0131ndan s\u0131radaki i\u015flem yeni sertifika ile anahtar\u0131n e\u015fle\u015fmesini kontrol edip dosyalar\u0131 yay\u0131na almakt\u0131r.<\/p>\n<h2><span id=\"Yeni_sertifikayi_yayina_alin_ve_sizan_sertifikayi_iptal_edin\">Yeni sertifikay\u0131 yay\u0131na al\u0131n ve s\u0131zan sertifikay\u0131 iptal edin<\/span><\/h2>\n<h3><span id=\"Anahtar_eslesmesini_kontrol_edip_Nginx_yollarini_degistirin\">Anahtar e\u015fle\u015fmesini kontrol edip Nginx yollar\u0131n\u0131 de\u011fi\u015ftirin<\/span><\/h3>\n<p>Yeni sertifikay\u0131 yay\u0131na almadan \u00f6nce do\u011fru \u00f6zel anahtarla e\u015fle\u015fti\u011fini kontrol edin. Sunucunun SSH terminalinde a\u015fa\u011f\u0131daki komutlar\u0131 \u00e7al\u0131\u015ft\u0131r\u0131n. \u0130kisi de hatas\u0131z tamamlanmal\u0131 ve a\u00e7\u0131k anahtar i\u00e7in ayn\u0131 SHA-256 \u00f6zetini vermeli. Sertifika dosyas\u0131n\u0131 okurken izin hatas\u0131 al\u0131rsan\u0131z kontrol\u00fc root yetkili terminalde yap\u0131n; dosya izinlerini geni\u015fletmeyin.<\/p>\n<figure class=\"aiw-figure\" data-aiw-visual-id=\"5937\" data-aiw-visual-key=\"2c4e6acf9d9394f215cdc8b64d22178a9efc3d8822ae644d0d7b40c0691a566e\"><img decoding=\"async\" src=\"https:\/\/www.dchost.com\/blog\/wp-content\/uploads\/2026\/10\/dchost-flow-tr-f4c07c978a3f4e676106.png\" alt=\"Anahtar e\u015fle\u015fmesi kontrol\u00fcnden Nginx ge\u00e7i\u015fine, d\u0131\u015f do\u011frulamaya ve eski sertifikalar\u0131n iptaline ilerleyen be\u015f ad\u0131m.\" width=\"840\" height=\"1227\" loading=\"lazy\" class=\"aiw-article-visual wp-image-5937\" srcset=\"https:\/\/www.dchost.com\/blog\/wp-content\/uploads\/2026\/10\/dchost-flow-tr-f4c07c978a3f4e676106.png 840w, https:\/\/www.dchost.com\/blog\/wp-content\/uploads\/2026\/10\/dchost-flow-tr-f4c07c978a3f4e676106-205x300.png 205w, https:\/\/www.dchost.com\/blog\/wp-content\/uploads\/2026\/10\/dchost-flow-tr-f4c07c978a3f4e676106-701x1024.png 701w, https:\/\/www.dchost.com\/blog\/wp-content\/uploads\/2026\/10\/dchost-flow-tr-f4c07c978a3f4e676106-768x1122.png 768w\" sizes=\"auto, (max-width: 840px) 100vw, 840px\" \/><figcaption>Ak\u0131\u015f \u015femas\u0131: Aktif k\u00f6t\u00fcye kullan\u0131m saptanmayan \u00f6rnek senaryoda yeni sertifika \u00f6nce yay\u0131na al\u0131n\u0131r. Ard\u0131ndan s\u0131zan anahtara ba\u011fl\u0131 eski sertifikalar iptal edilir.<\/figcaption><\/figure>\n<pre class=\"language-bash line-numbers\"><code class=\"language-bash\">openssl x509 -in \/etc\/letsencrypt\/live\/example-com-incident\/cert.pem -pubkey -noout | openssl pkey -pubin -outform DER | openssl dgst -sha256\nsudo openssl pkey -in \/etc\/letsencrypt\/live\/example-com-incident\/privkey.pem -pubout -outform DER | openssl dgst -sha256<\/code><\/pre>\n<p>\u00d6zetler farkl\u0131ysa iki dosya yolunun da yeni olu\u015fturdu\u011funuz sertifika kayd\u0131na ait oldu\u011funu kontrol edin. E\u015fle\u015fme sa\u011fland\u0131ktan sonra Nginx&#8217;in kullanaca\u011f\u0131 dosya yollar\u0131n\u0131 de\u011fi\u015ftirmek i\u00e7in site ayar\u0131n\u0131 a\u00e7\u0131n:<\/p>\n<pre class=\"language-bash line-numbers\"><code class=\"language-bash\">sudo nano \/etc\/nginx\/sites-available\/example.com<\/code><\/pre>\n<p><code>example.com<\/code> ve <code>www.example.com<\/code> i\u00e7in HTTPS sunan bloklardaki mevcut iki sertifika sat\u0131r\u0131n\u0131 a\u015fa\u011f\u0131dakilerle de\u011fi\u015ftirin. <code>ssl_certificate<\/code> sunucu sertifikas\u0131 ile ara sertifikalar\u0131 i\u00e7eren zincir dosyas\u0131n\u0131, <code>ssl_certificate_key<\/code> ise \u00f6zel anahtar\u0131 g\u00f6sterir. Eski sat\u0131rlar\u0131n yan\u0131na ikinci bir \u00e7ift eklemek yerine mevcut yollar\u0131 de\u011fi\u015ftirin.<\/p>\n<pre class=\"language-bash line-numbers\"><code class=\"language-bash\">ssl_certificate \/etc\/letsencrypt\/live\/example-com-incident\/fullchain.pem;\nssl_certificate_key \/etc\/letsencrypt\/live\/example-com-incident\/privkey.pem;<\/code><\/pre>\n<p>Dosyay\u0131 kaydettikten sonra sunucuda a\u015fa\u011f\u0131daki komutu \u00e7al\u0131\u015ft\u0131r\u0131n. Bu komut \u00f6nce Nginx ayarlar\u0131n\u0131 test eder; yaln\u0131z test ba\u015far\u0131l\u0131ysa \u00e7al\u0131\u015fan servise yeni ayarlar\u0131 y\u00fckler:<\/p>\n<pre class=\"language-bash line-numbers\"><code class=\"language-bash\">sudo nginx -t &amp;&amp; sudo systemctl reload nginx<\/code><\/pre>\n<p>Test \u00e7\u0131kt\u0131s\u0131nda <code>syntax is ok<\/code> ve <code>test is successful<\/code> mesajlar\u0131n\u0131 g\u00f6rmelisiniz. Test hata verirse yeniden y\u00fckleme ad\u0131m\u0131 \u00e7al\u0131\u015fmaz ve Nginx mevcut ayarlarla hizmet vermeyi s\u00fcrd\u00fcr\u00fcr. Belirtilen dosya veya sat\u0131r\u0131 d\u00fczeltip tekrar deneyin. \u00d6nceki b\u00f6l\u00fcmde ald\u0131\u011f\u0131n\u0131z ayar yede\u011fini kar\u015f\u0131la\u015ft\u0131rma i\u00e7in kullan\u0131n; <strong>geri d\u00f6n\u00fc\u015f amac\u0131yla s\u0131zm\u0131\u015f anahtar\u0131 yeniden yay\u0131na almay\u0131n.<\/strong> Yeniden y\u00fckleme ba\u015far\u0131l\u0131 oldu\u011funda d\u0131\u015far\u0131dan hangi sertifikan\u0131n sunuldu\u011funu kontrol edin.<\/p>\n<h3><span id=\"Disaridan_sunulan_sertifikayi_dogrulayin\">D\u0131\u015far\u0131dan sunulan sertifikay\u0131 do\u011frulay\u0131n<\/span><\/h3>\n<p>Nginx testinin ba\u015far\u0131l\u0131 olmas\u0131, ziyaret\u00e7ilerin yeni sertifikay\u0131 g\u00f6rd\u00fc\u011f\u00fcn\u00fc tek ba\u015f\u0131na kan\u0131tlamaz. Kar\u015f\u0131la\u015ft\u0131rma i\u00e7in \u00f6nce sunucudaki yeni sertifikan\u0131n parmak izini al\u0131n. Bu de\u011fer, \u00f6nceki ad\u0131mda kar\u015f\u0131la\u015ft\u0131rd\u0131\u011f\u0131n\u0131z a\u00e7\u0131k anahtar \u00f6zetinden farkl\u0131 olarak sertifikan\u0131n tamam\u0131n\u0131 tan\u0131mlar:<\/p>\n<pre class=\"language-bash line-numbers\"><code class=\"language-bash\">openssl x509 -in \/etc\/letsencrypt\/live\/example-com-incident\/cert.pem -noout -fingerprint -sha256<\/code><\/pre>\n<p>Ard\u0131ndan OpenSSL bulunan, ba\u015fka bir internet ba\u011flant\u0131s\u0131ndaki bilgisayar\u0131n Bash terminalinde iki alan ad\u0131n\u0131 kontrol edin. <code>-servername<\/code> hangi sitenin sertifikas\u0131n\u0131n istendi\u011fini belirtir; do\u011frulama se\u00e7enekleri sertifikan\u0131n g\u00fcven zincirini ve alan ad\u0131yla e\u015fle\u015fmesini denetler. Kontrol bilgisayar\u0131n\u0131n g\u00fcvenilir k\u00f6k sertifika deposu g\u00fcncel olmal\u0131d\u0131r.<\/p>\n<pre class=\"language-bash line-numbers\"><code class=\"language-bash\">set -o pipefail\nfor host in example.com www.example.com; do\n  printf &#039;\\n%s\\n&#039; &quot;$host&quot;\n  openssl s_client -connect &quot;${host}:443&quot; -servername &quot;$host&quot; -verify_hostname &quot;$host&quot; -verify_return_error &lt;\/dev\/null | openssl x509 -noout -fingerprint -sha256\ndone<\/code><\/pre>\n<p>Her iki ba\u011flant\u0131da da do\u011frulama hatas\u0131 olmamal\u0131 ve g\u00f6r\u00fcnen sertifika parmak izi sunucudan ald\u0131\u011f\u0131n\u0131z de\u011ferle ayn\u0131 olmal\u0131. Yaln\u0131z parmak izinin yazd\u0131r\u0131lm\u0131\u015f olmas\u0131 yeterli de\u011fildir; hata \u00e7\u0131kt\u0131s\u0131n\u0131 da inceleyin. IPv4 ve IPv6 birlikte yay\u0131nlan\u0131yorsa <code>s_client<\/code> komutuna s\u0131ras\u0131yla <code>-4<\/code> ve <code>-6<\/code> ekleyerek iki ba\u011flant\u0131 yolunu ayr\u0131 ayr\u0131 s\u0131nay\u0131n.<\/p>\n<h3><span id=\"Eski_sertifikalari_anahtar_sizintisi_nedeniyle_iptal_edin\">Eski sertifikalar\u0131 anahtar s\u0131z\u0131nt\u0131s\u0131 nedeniyle iptal edin<\/span><\/h3>\n<p>Aktif k\u00f6t\u00fcye kullan\u0131m saptanmayan \u00f6rnek senaryomuzda, yeni sertifikay\u0131 d\u0131\u015far\u0131dan do\u011frulad\u0131ktan hemen sonra eski sertifika i\u00e7in iptal iste\u011fi g\u00f6nderin. Sunucunun SSH terminalinde \u00e7al\u0131\u015ft\u0131raca\u011f\u0131n\u0131z komut, olay dizininde korudu\u011funuz eski sertifikay\u0131 kullan\u0131r. <code>keycompromise<\/code>, \u00f6zel anahtar\u0131n s\u0131zd\u0131\u011f\u0131n\u0131 bildiren iptal nedenidir:<\/p>\n<pre class=\"language-bash line-numbers\"><code class=\"language-bash\">sudo certbot revoke --cert-path \/root\/ssl-incident\/old-cert.pem --reason keycompromise --no-delete-after-revoke<\/code><\/pre>\n<p>Bu i\u015flem, g\u00fcvende oldu\u011funu varsayd\u0131\u011f\u0131m\u0131z mevcut ACME hesab\u0131yla, yani otomatik sertifika i\u015flemlerini y\u00f6neten hesapla yetkilendirilir. <code>--no-delete-after-revoke<\/code> se\u00e7ene\u011fi iptalden sonra yerel sertifika kayd\u0131n\u0131 korur; dosyay\u0131 silmek sertifikay\u0131 iptal etmez. Ayn\u0131 s\u0131zm\u0131\u015f anahtara ba\u011fl\u0131 di\u011fer ge\u00e7erli sertifikalar i\u00e7in de ilgili sertifika dosyas\u0131n\u0131 kullanarak i\u015flemi tekrarlay\u0131n.<\/p>\n<p>Certbot \u00e7\u0131kt\u0131s\u0131nda iptal iste\u011finin ba\u015far\u0131yla tamamland\u0131\u011f\u0131n\u0131 kontrol edin. Hata veya belirsiz yan\u0131t varsa <code>\/var\/log\/letsencrypt\/letsencrypt.log<\/code> kayd\u0131n\u0131 inceleyin; gerekirse sertifikay\u0131 veren kurulu\u015fun iptal kanal\u0131ndan teyit al\u0131n. Ba\u015far\u0131 yan\u0131t\u0131n\u0131 olay kayd\u0131na ekleyin. <strong>Taray\u0131c\u0131daki kilit simgesi eski sertifikan\u0131n iptal edildi\u011fini kan\u0131tlamaz;<\/strong> istemcilerin iptal bilgisini kontrol etme ve uygulama bi\u00e7imi farkl\u0131 olabilir.<\/p>\n<h2><span id=\"Kurulum_sorunlarini_ayirin_ve_yeniden_sizintiyi_onleyin\">Kurulum sorunlar\u0131n\u0131 ay\u0131r\u0131n ve yeniden s\u0131z\u0131nt\u0131y\u0131 \u00f6nleyin<\/span><\/h2>\n<h3><span id=\"Eski_sertifika_ve_dogrulama_hatasini_ayirin\">Eski sertifika ve do\u011frulama hatas\u0131n\u0131 ay\u0131r\u0131n<\/span><\/h3>\n<p>D\u0131\u015f kontrolde eski sertifika g\u00f6r\u00fcn\u00fcyorsa \u00f6nce IPv4 ve IPv6 sonu\u00e7lar\u0131n\u0131 kar\u015f\u0131la\u015ft\u0131r\u0131n. Yaln\u0131z birinde eski sertifika sunuluyorsa ilgili DNS kayd\u0131 ba\u015fka bir sunucuya gidiyor olabilir. \u0130kisinde de eski sertifika g\u00f6r\u00fcn\u00fcyorsa Ubuntu sunucusunun SSH terminalinde Nginx&#8217;in okudu\u011fu ayarlar\u0131 ve yeniden y\u00fckleme kay\u0131tlar\u0131n\u0131 inceleyin:<\/p>\n<pre class=\"language-bash line-numbers\"><code class=\"language-bash\">sudo nginx -T 2&gt;&amp;1 | grep -E &#039;server_name|ssl_certificate&#039;\nsudo journalctl -u nginx -n 30 --no-pager<\/code><\/pre>\n<p>\u0130lgili alan ad\u0131n\u0131n HTTPS blo\u011fu <code>example-com-incident<\/code> yollar\u0131n\u0131 kullanmal\u0131. Yanl\u0131\u015f yol veya ayn\u0131 alan ad\u0131n\u0131 kar\u015f\u0131layan \u00e7ak\u0131\u015fan bir blok bulursan\u0131z site dosyas\u0131n\u0131n mevcut kopyas\u0131n\u0131 koruyup yaln\u0131z ilgili ayar\u0131 d\u00fczeltin. Ard\u0131ndan <code>sudo nginx -t &amp;&amp; sudo systemctl reload nginx<\/code> komutunu \u00e7al\u0131\u015ft\u0131r\u0131n ve d\u0131\u015f parmak izi kontrol\u00fcn\u00fc tekrarlay\u0131n. B\u00f6ylece d\u00fczeltmenin yaln\u0131z dosyada kalmad\u0131\u011f\u0131n\u0131, ziyaret\u00e7iye sunulan sertifikaya da yans\u0131d\u0131\u011f\u0131n\u0131 g\u00f6rebilirsiniz.<\/p>\n<p>Alan ad\u0131 do\u011frulamas\u0131 ba\u015far\u0131s\u0131zsa \u00f6nceki b\u00f6l\u00fcmdeki <code>probe<\/code> dosyas\u0131n\u0131 yeniden olu\u015fturup iki adrese de sunucu d\u0131\u015f\u0131ndan eri\u015fmeyi deneyin. <code>404<\/code> yan\u0131t\u0131, iste\u011fin bir web sunucusuna ula\u015ft\u0131\u011f\u0131n\u0131 ancak dosyan\u0131n bulunamad\u0131\u011f\u0131n\u0131 g\u00f6sterir; web k\u00f6k\u00fcn\u00fc, iste\u011fi kar\u015f\u0131layan sunucu blo\u011funu ve y\u00f6nlendirmeleri inceleyin. Zaman a\u015f\u0131m\u0131nda DNS yan\u0131tlar\u0131n\u0131, g\u00fcvenlik duvar\u0131n\u0131 ve 80 numaral\u0131 port eri\u015fimini kontrol edin. Bulguyla ilgili ayar\u0131 d\u00fczelttikten sonra dosyan\u0131n i\u00e7eri\u011fini iki adresten de okuyabildi\u011finizi g\u00f6r\u00fcn; sertifika ba\u015fvurusunu bundan sonra tekrarlay\u0131n.<\/p>\n<h3><span id=\"Anahtar_izinlerini_dar_kapsamda_duzeltin\">Anahtar izinlerini dar kapsamda d\u00fczeltin<\/span><\/h3>\n<p><code>Permission denied<\/code>, yani eri\u015fim izni hatas\u0131 al\u0131rsan\u0131z \u00f6nce sunucuda anahtar ba\u011flant\u0131s\u0131n\u0131n hangi ger\u00e7ek dosyaya gitti\u011fini ve \u00fcst dizinlerin izinlerini inceleyin:<\/p>\n<pre class=\"language-bash line-numbers\"><code class=\"language-bash\">sudo namei -l \/etc\/letsencrypt\/live\/example-com-incident\/privkey.pem\nsudo systemctl show nginx -p User<\/code><\/pre>\n<p>Standart Ubuntu Nginx servisinde ana s\u00fcre\u00e7 root olarak ba\u015flar; servis \u00e7\u0131kt\u0131s\u0131ndaki bo\u015f <code>User=<\/code> alan\u0131 da bu d\u00fczende beklenir. Ana s\u00fcre\u00e7 sertifikay\u0131 ve anahtar\u0131 okuyabildi\u011fi i\u00e7in anahtar\u0131 <code>www-data<\/code> kullan\u0131c\u0131s\u0131na a\u00e7man\u0131z gerekmez. \u00c7\u0131kt\u0131da yeni anahtar\u0131n sahipli\u011fi veya dosya izinleri yanl\u0131\u015fsa mevcut de\u011ferleri olay kayd\u0131na not edin ve yaln\u0131z bu anahtar\u0131n hedef dosyas\u0131n\u0131 d\u00fczeltin:<\/p>\n<pre class=\"language-bash line-numbers\"><code class=\"language-bash\">sudo chown root:root \/etc\/letsencrypt\/live\/example-com-incident\/privkey.pem\nsudo chmod 600 \/etc\/letsencrypt\/live\/example-com-incident\/privkey.pem\nsudo nginx -t<\/code><\/pre>\n<p>Bu ayarlar anahtar\u0131 yaln\u0131z root kullan\u0131c\u0131s\u0131n\u0131n okuyup yazabilece\u011fi hale getirir. Nginx testi ba\u015far\u0131l\u0131ysa eri\u015fim sorunu giderilmi\u015ftir; bekleyen ayar de\u011fi\u015fikli\u011fini \u00f6nceki test ve yeniden y\u00fckleme ad\u0131m\u0131yla yay\u0131na alabilirsiniz. Test h\u00e2l\u00e2 ba\u015far\u0131s\u0131zsa hata mesaj\u0131ndaki yolu ve \u00fcst dizinlere eri\u015fimi inceleyin; t\u00fcm <code>\/etc\/letsencrypt<\/code> a\u011fac\u0131na toplu izin vermek yerine sorunun bulundu\u011fu dosya veya dizine odaklan\u0131n.<\/p>\n<h3><span id=\"Yenileme_ve_yeniden_yuklemeyi_birlikte_sinayin\">Yenileme ve yeniden y\u00fcklemeyi birlikte s\u0131nay\u0131n<\/span><\/h3>\n<p>Yeni sertifikan\u0131n bug\u00fcn \u00e7al\u0131\u015fmas\u0131, sonraki yenilemenin de sorunsuz olaca\u011f\u0131n\u0131 g\u00f6stermez. Sunucunun SSH terminalinde \u00f6nce yeni kayd\u0131n deneme yenilemesini \u00e7al\u0131\u015ft\u0131r\u0131n ve bu \u00f6rnekte paketle kurulan Certbot zamanlay\u0131c\u0131s\u0131n\u0131n durumuna bak\u0131n:<\/p>\n<pre class=\"language-bash line-numbers\"><code class=\"language-bash\">sudo certbot renew --cert-name example-com-incident --dry-run\nsudo systemctl status certbot.timer --no-pager<\/code><\/pre>\n<p><code>--dry-run<\/code> canl\u0131 sertifikay\u0131 de\u011fi\u015ftirmeden yenileme ak\u0131\u015f\u0131n\u0131 s\u0131nar; \u00e7\u0131kt\u0131da denemenin ba\u015far\u0131l\u0131 oldu\u011funu g\u00f6rmelisiniz. Zamanlay\u0131c\u0131 etkin de\u011filse <code>sudo systemctl enable --now certbot.timer<\/code> \u00e7al\u0131\u015ft\u0131r\u0131n ve durum komutuyla etkinle\u015fti\u011fini kontrol edin.<\/p>\n<p>Sertifika yenilendi\u011finde Nginx&#8217;in yeni dosyalar\u0131 okumas\u0131 i\u00e7in bir <em>deploy hook<\/em>, yani ba\u015far\u0131l\u0131 yenileme sonras\u0131 \u00e7al\u0131\u015facak betik ekleyin. A\u015fa\u011f\u0131daki reload-nginx.sh dosyas\u0131 zaten varsa komutlar\u0131 \u00e7al\u0131\u015ft\u0131rmadan \u00f6nce dosyay\u0131 korumal\u0131 olay dizinine kopyalay\u0131n ve i\u00e7eri\u011fini inceleyin; mevcut ba\u015fka i\u015flemleri yanl\u0131\u015fl\u0131kla kald\u0131rmay\u0131n. Betik de\u011fi\u015fikli\u011fi sorun \u00e7\u0131kar\u0131rsa bu kopyay\u0131 geri y\u00fckleyebilirsiniz; bunun i\u00e7in s\u0131zm\u0131\u015f anahtara d\u00f6nmeniz gerekmez.<\/p>\n<pre class=\"language-bash line-numbers\"><code class=\"language-bash\">sudo install -d -m 755 \/etc\/letsencrypt\/renewal-hooks\/deploy\nsudo tee \/etc\/letsencrypt\/renewal-hooks\/deploy\/reload-nginx.sh &gt;\/dev\/null &lt;&lt;&#039;EOF&#039;\n#!\/bin\/sh\n\/usr\/sbin\/nginx -t &amp;&amp; \/usr\/bin\/systemctl reload nginx\nEOF\nsudo chmod 750 \/etc\/letsencrypt\/renewal-hooks\/deploy\/reload-nginx.sh\nsudo certbot renew --cert-name example-com-incident --dry-run --run-deploy-hooks<\/code><\/pre>\n<p>Bu ikinci deneme, ba\u015far\u0131l\u0131 yenilemenin ard\u0131ndan beti\u011fi de \u00e7al\u0131\u015ft\u0131r\u0131r ve Nginx&#8217;i mevcut canl\u0131 sertifikayla yeniden y\u00fckler. \u00c7\u0131kt\u0131da hem yenileme denemesinin hem beti\u011fin hatas\u0131z tamamland\u0131\u011f\u0131n\u0131 kontrol edin.<\/p>\n<p>Eski kayd\u0131 kald\u0131rmadan \u00f6nce sertifika iptalinin ba\u015far\u0131yla tamamland\u0131\u011f\u0131ndan ve Nginx d\u0131\u015f\u0131nda hi\u00e7bir servisin eski sertifika yollar\u0131n\u0131 kullanmad\u0131\u011f\u0131ndan emin olun. Gerekli olay kay\u0131tlar\u0131n\u0131 eri\u015fimi k\u0131s\u0131tl\u0131 dizinde koruduktan sonra <code>sudo certbot delete --cert-name example.com<\/code> ile eski Certbot kayd\u0131n\u0131 ve ona ba\u011fl\u0131 yerel sertifika dosyalar\u0131n\u0131 kald\u0131r\u0131n. Bu i\u015flem sertifika iptalinin yerine ge\u00e7mez; kullan\u0131lmayan kayd\u0131n yeniden yenilenmesini \u00f6nler.<\/p>\n<h3><span id=\"Git_gecmisini_temizleyin_ve_diger_uclari_kontrol_edin\">Git ge\u00e7mi\u015fini temizleyin ve di\u011fer u\u00e7lar\u0131 kontrol edin<\/span><\/h3>\n<p>Dosyay\u0131 son commit&#8217;ten, yani son kay\u0131tl\u0131 de\u011fi\u015fiklikten silmek ge\u00e7mi\u015f kopyalar\u0131n\u0131 kald\u0131rmaz. Ge\u00e7mi\u015fi temizlerken yeni de\u011fi\u015fikliklerle \u00e7ak\u0131\u015fmamak i\u00e7in depoya yazmay\u0131 ge\u00e7ici durdurun; \u00f6nce eri\u015fimi k\u0131s\u0131tl\u0131 olay ar\u015fivinde ge\u00e7mi\u015fin kopyas\u0131n\u0131 koruyun. Bu ar\u015fiv s\u0131zm\u0131\u015f anahtar\u0131 da i\u00e7erebilece\u011finden normal proje yede\u011fi gibi payla\u015f\u0131lmamal\u0131d\u0131r.<\/p>\n<p>Git ge\u00e7mi\u015fini yeniden yazan <code>git-filter-repo<\/code> arac\u0131yla dosyay\u0131 ge\u00e7mi\u015fte bulundu\u011fu t\u00fcm yollardan \u00e7\u0131kar\u0131n; yaln\u0131z bug\u00fcnk\u00fc dosya ad\u0131n\u0131 temizlemek eski adlar\u0131 ka\u00e7\u0131rabilir. Ard\u0131ndan deponuzun bar\u0131nd\u0131rma hizmetindeki hassas veri temizleme s\u00fcrecini uygulay\u0131n, dal ve etiketleri g\u00fcncelleyin ve ekipten temiz depoyu yeniden klonlamas\u0131n\u0131 isteyin. Fork olarak olu\u015fturulan depo kopyalar\u0131n\u0131, \u00f6nbellekleri ve indirilmi\u015f dosyalar\u0131 tamamen geri alamazs\u0131n\u0131z. Bu y\u00fczden ge\u00e7mi\u015f temizli\u011fi, anahtar de\u011fi\u015fiminin ve sertifika iptalinin yerine ge\u00e7mez.<\/p>\n<p>Yeni anahtar\u0131 Git&#8217;e, destek kayd\u0131na veya uygulama paketine koymay\u0131n. <code>.gitignore<\/code> yaln\u0131z ek korumad\u0131r; Git&#8217;in zaten izledi\u011fi dosyalar\u0131 korumaz. <a href=\"https:\/\/www.dchost.com\/blog\/vpste-env-ve-gizli-anahtar-yonetimi\/\">VPS \u00fczerinde gizli anahtar y\u00f6netimi<\/a> yakla\u015f\u0131m\u0131yla anahtar\u0131 web k\u00f6k\u00fcn\u00fcn d\u0131\u015f\u0131nda, yaln\u0131z gerekli servis eri\u015fimiyle tutun. Depoya g\u00f6nderim \u00f6ncesinde \u00f6zel anahtar ve parola gibi s\u0131rlar\u0131 arayan bir tarama eklemek, ayn\u0131 hatan\u0131n tekrarlanmas\u0131n\u0131 \u00f6nlemeye yard\u0131mc\u0131 olur.<\/p>\n<p>\u00d6rne\u011fimizde CDN, yani i\u00e7erik da\u011f\u0131t\u0131m a\u011f\u0131 yoktur. HTTPS ba\u011flant\u0131s\u0131n\u0131 CDN \u00fczerinde sonland\u0131r\u0131yorsan\u0131z ziyaret\u00e7iye sunulan sertifika ile kaynak sunucudaki sertifika ayr\u0131 y\u00f6netilir. S\u0131zan anahtar hangi noktada kullan\u0131l\u0131yorsa de\u011fi\u015fim ve iptal i\u015flemlerini orada yap\u0131n; ayn\u0131 anahtar iki tarafta da kullan\u0131l\u0131yorsa ikisini de kapsama al\u0131n. <a href=\"https:\/\/www.dchost.com\/blog\/cdn-arkasinda-gercek-https-ve-full-strict-ssl-kurulumu\/\">CDN arkas\u0131nda Full (Strict) SSL kurulumu<\/a> bu iki ba\u011flant\u0131n\u0131n nas\u0131l korundu\u011funu a\u00e7\u0131klar.<\/p>\n<p>cPanel veya Plesk kullan\u0131yorsan\u0131z ilgili alan ad\u0131n\u0131n SSL\/TLS y\u00f6netim ekran\u0131nda yeni \u00f6zel anahtar\u0131, sertifikay\u0131 ve ara sertifika zincirini birlikte y\u00fckleyin. Yaln\u0131z sertifikay\u0131 yeniden d\u00fczenletmek anahtar\u0131 de\u011fi\u015ftirmeyebilir; ba\u015fka sa\u011flay\u0131c\u0131larda da ba\u015fvuruyu yeni anahtarla yap\u0131n. Let&#8217;s Encrypt&#8217;ten wildcard, yani ayn\u0131 d\u00fczeydeki alt alan adlar\u0131n\u0131 kapsayan joker sertifika al\u0131rken HTTP-01 yerine DNS kayd\u0131yla alan ad\u0131 kontrol\u00fcn\u00fc kan\u0131tlayan DNS-01 do\u011frulamas\u0131 gerekir. <a href=\"https:\/\/www.dchost.com\/blog\/lets-encrypt-wildcard-ssl-otomasyonu-dns-01-ile-cpanel-plesk-ve-nginxte\/\">DNS-01 ile wildcard sertifika otomasyonu<\/a> bu alternatif ak\u0131\u015f\u0131 a\u00e7\u0131klar; otomasyonda kullan\u0131lan DNS eri\u015fim anahtarlar\u0131n\u0131 da s\u0131r olarak koruyun.<\/p>\n<h2><span id=\"Sik_Sorulan_Sorular\">S\u0131k Sorulan Sorular<\/span><\/h2>\n<h3><span id=\"Sizan_ozel_anahtarla_gecmis_HTTPS_trafigi_cozulebilir_mi\">S\u0131zan \u00f6zel anahtarla ge\u00e7mi\u015f HTTPS trafi\u011fi \u00e7\u00f6z\u00fclebilir mi?<\/span><\/h3>\n<p>Her ba\u011flant\u0131 i\u00e7in de\u011fil; yan\u0131t, ba\u011flant\u0131 kurulurken kullan\u0131lan anahtar de\u011fi\u015fimi y\u00f6ntemine ba\u011fl\u0131d\u0131r. <strong>\u0130leri gizlilik<\/strong>, oturuma \u00f6zel ge\u00e7ici anahtarlar sayesinde sertifikan\u0131n \u00f6zel anahtar\u0131 sonradan s\u0131zsa bile ge\u00e7mi\u015f trafi\u011fi korur. HTTPS ba\u011flant\u0131s\u0131n\u0131 koruyan TLS protokol\u00fcn\u00fcn 1.3 s\u00fcr\u00fcm\u00fcn\u00fc kullanan ba\u011flant\u0131lar ve TLS 1.2&#8217;de ECDHE gibi ge\u00e7ici anahtar de\u011fi\u015fimi kullanan ba\u011flant\u0131lar, yaln\u0131z sertifika \u00f6zel anahtar\u0131n\u0131n ele ge\u00e7irilmesiyle \u00e7\u00f6z\u00fclemez.<\/p>\n<p>Eski TLS ba\u011flant\u0131lar\u0131nda RSA anahtar de\u011fi\u015fimi kullan\u0131lm\u0131\u015fsa sald\u0131rgan\u0131n daha \u00f6nce kaydetti\u011fi trafik s\u0131zan anahtarla \u00e7\u00f6z\u00fclebilir. Sertifikan\u0131n RSA olmas\u0131 tek ba\u015f\u0131na bu riskin bulundu\u011funu g\u00f6stermez; ba\u011flant\u0131da kullan\u0131lan anahtar de\u011fi\u015fimi belirleyicidir. Ge\u00e7mi\u015f riski de\u011ferlendirirken olay d\u00f6nemindeki TLS ayarlar\u0131na ve varsa ba\u011flant\u0131 kay\u0131tlar\u0131na bak\u0131n. Bug\u00fcnk\u00fc ayarlar, ge\u00e7mi\u015f ba\u011flant\u0131lar\u0131n nas\u0131l kuruldu\u011funu kan\u0131tlamaz.<\/p>\n<h3><span id=\"WordPress_ve_musteri_parolalarini_da_degistirmeli_misiniz\">WordPress ve m\u00fc\u015fteri parolalar\u0131n\u0131 da de\u011fi\u015ftirmeli misiniz?<\/span><\/h3>\n<p>Yaln\u0131z SSL \u00f6zel anahtar\u0131n\u0131n s\u0131zmas\u0131, WordPress parolalar\u0131n\u0131n veya veritaban\u0131n\u0131n ele ge\u00e7irildi\u011fini g\u00f6stermez. \u00d6rnek senaryodaki gibi s\u0131z\u0131nt\u0131 tek dosyayla s\u0131n\u0131rl\u0131ysa ve ba\u015fka bir k\u00f6t\u00fcye kullan\u0131m bulgusu yoksa t\u00fcm kullan\u0131c\u0131lara otomatik olarak parola s\u0131f\u0131rlatmak gerekmez.<\/p>\n<p>Ancak ayn\u0131 depoda veritaban\u0131 parolas\u0131, eri\u015fim anahtar\u0131 veya oturumlar\u0131n do\u011frulu\u011funu denetlemek i\u00e7in kullan\u0131lan bir imzalama s\u0131rr\u0131 da a\u00e7\u0131\u011fa \u00e7\u0131kt\u0131ysa bunlar\u0131 ayr\u0131 ayr\u0131 de\u011fi\u015ftirin. Sahte site \u00fczerinden giri\u015f bilgilerinin topland\u0131\u011f\u0131na, sunucuya izinsiz eri\u015fildi\u011fine veya parola i\u00e7eren trafi\u011fin \u00e7\u00f6z\u00fclebildi\u011fine dair bulgu varsa etkilenen hesaplar\u0131n parolalar\u0131n\u0131 s\u0131f\u0131rlay\u0131n ve oturumlar\u0131n\u0131 sonland\u0131r\u0131n. Karar\u0131n\u0131z\u0131 yaln\u0131z anahtar\u0131n s\u0131zmas\u0131na de\u011fil, a\u00e7\u0131\u011fa \u00e7\u0131kan veriye ve izinsiz eri\u015fimin kapsam\u0131na g\u00f6re verin.<\/p>\n<h3><span id=\"CSR_dosyasini_paylasmak_ozel_anahtar_sizintisi_midir\">CSR dosyas\u0131n\u0131 payla\u015fmak \u00f6zel anahtar s\u0131z\u0131nt\u0131s\u0131 m\u0131d\u0131r?<\/span><\/h3>\n<p>Hay\u0131r. <strong>CSR<\/strong>, sertifika imzalama iste\u011fidir; a\u00e7\u0131k anahtar\u0131 ve sertifika ba\u015fvurusu bilgilerini ta\u015f\u0131r, \u00f6zel anahtar\u0131 i\u00e7ermez. Normal bir CSR&#8217;den \u00f6zel anahtar \u00e7\u0131kar\u0131lamaz. Yine de i\u00e7indeki alan ad\u0131 veya kurulu\u015f bilgilerini herkese a\u00e7\u0131klamak istemeyebilirsiniz.<\/p>\n<p>Dosya uzant\u0131s\u0131na g\u00fcvenmek yerine dosyan\u0131n i\u00e7indeki ba\u015fl\u0131k sat\u0131r\u0131n\u0131 kontrol edin. <code>BEGIN CERTIFICATE REQUEST<\/code> bir iste\u011fi, <code>BEGIN PRIVATE KEY<\/code> veya <code>BEGIN RSA PRIVATE KEY<\/code> ise \u00f6zel anahtar\u0131 i\u015faret eder. Bunlar yayg\u0131n ba\u015fl\u0131k \u00f6rnekleridir; farkl\u0131 bir ba\u015fl\u0131k g\u00f6rmeniz dosyan\u0131n payla\u015f\u0131lmas\u0131n\u0131n g\u00fcvenli oldu\u011funu g\u00f6stermez. Destek kayd\u0131na g\u00f6nderdi\u011finiz pakette CSR yan\u0131nda \u00f6zel anahtar dosyas\u0131n\u0131n bulunmad\u0131\u011f\u0131n\u0131 da kontrol edin.<\/p>\n<h3><span id=\"HSTS_aciksa_sizintiya_karsi_korunmus_olur_musunuz\">HSTS a\u00e7\u0131ksa s\u0131z\u0131nt\u0131ya kar\u015f\u0131 korunmu\u015f olur musunuz?<\/span><\/h3>\n<p>Hay\u0131r. <strong>HSTS<\/strong>, taray\u0131c\u0131ya siteye yaln\u0131z HTTPS \u00fczerinden ba\u011flanmas\u0131n\u0131 s\u00f6yleyen g\u00fcvenlik politikas\u0131d\u0131r. Ba\u011flant\u0131n\u0131n \u015fifrelenmemi\u015f HTTP&#8217;ye d\u00fc\u015f\u00fcr\u00fclmesini \u00f6nlemeye yard\u0131mc\u0131 olur; \u00f6zel anahtar\u0131 de\u011fi\u015ftirmez veya sertifikay\u0131 iptal etmez.<\/p>\n<p>Sald\u0131rgan trafi\u011fi kendisine y\u00f6nlendirebiliyor ve taray\u0131c\u0131n\u0131n h\u00e2l\u00e2 kabul etti\u011fi sertifikayla s\u0131zan anahtar\u0131 kullanabiliyorsa HSTS tek ba\u015f\u0131na yeterli de\u011fildir. HSTS&#8217;yi a\u00e7\u0131k tutun; ancak bunu anahtar de\u011fi\u015fiminin ve sertifika iptalinin yerine koymay\u0131n. HSTS, bu i\u015flemlerden ayr\u0131 olarak HTTPS ba\u011flant\u0131 politikan\u0131z\u0131 korumaya devam eder.<\/p>\n<h2><span id=\"Mudahaleyi_kapatmadan_once_kontrol_listesi\">M\u00fcdahaleyi kapatmadan \u00f6nce kontrol listesi<\/span><\/h2>\n<p>Taray\u0131c\u0131da sitenin a\u00e7\u0131lmas\u0131, m\u00fcdahalenin tamamland\u0131\u011f\u0131n\u0131 tek ba\u015f\u0131na g\u00f6stermez. Olay kayd\u0131n\u0131 kapatmadan \u00f6nce a\u015fa\u011f\u0131daki maddelerin her birini kontrol edin. Do\u011frulama \u00e7\u0131kt\u0131lar\u0131n\u0131, \u00f6zel anahtar\u0131 i\u00e7ermeyecek \u015fekilde korumal\u0131 olay dizininde saklay\u0131n.<\/p>\n<ul>\n<li><strong>Yeni anahtar ger\u00e7ekten farkl\u0131:<\/strong> Yeni ve eski anahtardan t\u00fcretilen a\u00e7\u0131k anahtarlar\u0131n parmak izleri farkl\u0131; yeni sertifikan\u0131n a\u00e7\u0131k anahtar\u0131 ise yeni \u00f6zel anahtarla e\u015fle\u015fiyor. Bu iki kontrol, hem s\u0131zan anahtar\u0131n de\u011fi\u015fti\u011fini hem de yeni sertifikan\u0131n do\u011fru anahtarla kullan\u0131laca\u011f\u0131n\u0131 g\u00f6sterir.<\/li>\n<li><strong>T\u00fcm adreslerde do\u011fru sertifika sunuluyor:<\/strong> Sunucu d\u0131\u015f\u0131ndan hem <code>example.com<\/code> hem <code>www.example.com<\/code> i\u00e7in kontrol tamamland\u0131. IPv4 ve IPv6 birlikte kullan\u0131l\u0131yorsa ikisi de s\u0131nand\u0131. Sunulan sertifikan\u0131n parmak izi yeni sertifikayla ayn\u0131; alan ad\u0131 e\u015fle\u015fmesi ve sertifika zinciri kontrolleri hatas\u0131z.<\/li>\n<li><strong>S\u0131zan anahtara ba\u011fl\u0131 eski sertifikalar iptal edildi:<\/strong> Eski sertifikalar\u0131 yaln\u0131z Nginx&#8217;ten kald\u0131rmakla yetinilmedi. Belirlenen, s\u00fcresi dolmam\u0131\u015f eski sertifikalar\u0131n her biri i\u00e7in <code>keyCompromise<\/code> nedeniyle yap\u0131lan iptalin ba\u015far\u0131 yan\u0131t\u0131 kaydedildi. Eski Certbot kayd\u0131n\u0131n silinmesi, iptal kan\u0131t\u0131 olarak kullan\u0131lmad\u0131.<\/li>\n<li><strong>S\u0131z\u0131nt\u0131ya a\u00e7\u0131k eri\u015fimler kapat\u0131ld\u0131:<\/strong> Git deposundaki dosya ve ge\u00e7mi\u015f kopyalar\u0131 i\u00e7in temizlik yap\u0131ld\u0131; bar\u0131nd\u0131rma hizmetindeki eri\u015fim ve \u00f6nbellek i\u015flemleri takip edildi. Bu temizli\u011fin daha \u00f6nce indirilmi\u015f kopyalar\u0131 geri almad\u0131\u011f\u0131 hesaba kat\u0131ld\u0131. Yeni anahtar Git deposunda, web k\u00f6k\u00fcnde veya destek eklerinde bulunmuyor. Olay kan\u0131tlar\u0131na yaln\u0131z yetkili ki\u015filer eri\u015febiliyor.<\/li>\n<li><strong>Yenileme ve yeniden y\u00fckleme s\u0131nand\u0131:<\/strong> <code>example-com-incident<\/code> kayd\u0131n\u0131n deneme yenilemesi ba\u015far\u0131l\u0131, Certbot zamanlay\u0131c\u0131s\u0131 etkin ve yenileme sonras\u0131 Nginx&#8217;i yeniden y\u00fckleyen betik \u00e7al\u0131\u015f\u0131yor. Hi\u00e7bir etkin servis veya geri d\u00f6n\u00fc\u015f plan\u0131 s\u0131zm\u0131\u015f anahtara dayanm\u0131yor.<\/li>\n<\/ul>\n<p>Bu kontrollerden biri eksikse olay kayd\u0131nda a\u00e7\u0131k i\u015f olarak b\u0131rak\u0131n; sorumlusunu ve hedef tamamlanma tarihini yaz\u0131n. Sertifikay\u0131 de\u011fi\u015ftirmeyi ve s\u0131z\u0131nt\u0131n\u0131n kayna\u011f\u0131n\u0131 gidermeyi ayr\u0131 i\u015fler olarak takip edin. B\u00f6ylece site yeniden g\u00fcvenli sertifika sunmaya ba\u015flad\u0131\u011f\u0131nda, s\u0131z\u0131nt\u0131ya yol a\u00e7an sorunu da \u00e7\u00f6z\u00fclm\u00fc\u015f saymazs\u0131n\u0131z.<\/p>\n<p>Bir sonraki ad\u0131m\u0131n\u0131z, anahtar\u0131n Git&#8217;e nas\u0131l girdi\u011fini bulmak olsun. Da\u011f\u0131t\u0131m beti\u011fi sunucudaki anahtarlar\u0131 proje dizinine kopyal\u0131yorsa bu ad\u0131m\u0131 kald\u0131r\u0131n. Dosya yanl\u0131\u015fl\u0131kla eklenmi\u015fse depoya g\u00f6nderim \u00f6ncesinde \u00f6zel anahtar ve parola gibi gizli bilgileri arayan bir tarama ve inceleme kural\u0131 ekleyin. D\u00fczeltmeyi ger\u00e7ek anahtar\u0131 yeniden payla\u015fmadan kontrol edin ve ald\u0131\u011f\u0131n\u0131z \u00f6nlemi olay kayd\u0131na yaz\u0131n.<\/p>\n<\/div>","protected":false},"excerpt":{"rendered":"<p>\u00d6zel anahtar\u0131n\u0131z\u0131 Git deposundan silmek s\u0131z\u0131nt\u0131y\u0131 gidermez. Ubuntu, Nginx ve Certbot \u00fczerinden yeni anahtar \u00fcretme, sertifikay\u0131 de\u011fi\u015ftirme, eski sertifikalar\u0131 iptal etme ve yenilemeyi kontrol etme s\u0131ras\u0131n\u0131 \u00f6\u011frenin.<\/p>\n","protected":false},"author":4,"featured_media":5931,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[33],"tags":[670,503,668,669,187],"class_list":["post-5939","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-nasil-yapilir","tag-certbot","tag-nginx","tag-ozel-anahtar-guvenligi","tag-sertifika-iptali","tag-ssl"],"_links":{"self":[{"href":"https:\/\/www.dchost.com\/blog\/wp-json\/wp\/v2\/posts\/5939","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.dchost.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.dchost.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.dchost.com\/blog\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.dchost.com\/blog\/wp-json\/wp\/v2\/comments?post=5939"}],"version-history":[{"count":1,"href":"https:\/\/www.dchost.com\/blog\/wp-json\/wp\/v2\/posts\/5939\/revisions"}],"predecessor-version":[{"id":5945,"href":"https:\/\/www.dchost.com\/blog\/wp-json\/wp\/v2\/posts\/5939\/revisions\/5945"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.dchost.com\/blog\/wp-json\/wp\/v2\/media\/5931"}],"wp:attachment":[{"href":"https:\/\/www.dchost.com\/blog\/wp-json\/wp\/v2\/media?parent=5939"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.dchost.com\/blog\/wp-json\/wp\/v2\/categories?post=5939"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.dchost.com\/blog\/wp-json\/wp\/v2\/tags?post=5939"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}