{"id":439,"date":"2025-12-19T10:49:36","date_gmt":"2025-12-19T07:49:36","guid":{"rendered":"https:\/\/www.sectrail.com\/cm\/?p=439"},"modified":"2026-03-24T14:22:03","modified_gmt":"2026-03-24T11:22:03","slug":"public-calarda-client-auth-bitiyor","status":"publish","type":"post","link":"https:\/\/www.sectrail.com\/cm\/public-calarda-client-auth-bitiyor\/","title":{"rendered":"Public CA Client Auth Deste\u011fi Bitiyor"},"content":{"rendered":"\n<h3 class=\"wp-block-heading\">Ne Oluyor?<\/h3>\n\n\n\n<p>May\u0131s 2026&#8217;dan itibaren, Let&#8217;s Encrypt, DigiCert, Sectigo gibi t\u00fcm b\u00fcy\u00fck public sertifika otoriteleri, TLS client authentication i\u00e7in sertifika imzalamay\u0131 durduracak. Bu de\u011fi\u015fiklik, Google Chrome&#8217;un yeni k\u00f6k program gereksinimlerinden kaynaklan\u0131yor ve sekt\u00f6r genelinde zorunlu bir ge\u00e7i\u015fi tetikliyor.<\/p>\n\n\n\n<p><h3 class=\"wp-block-heading\">Kritik Tarihler<\/h3><\/p>\n\n\n\n<p><strong>2025 Ekim:<\/strong> \u00c7o\u011fu CA, varsay\u0131lan olarak client authentication EKU&#8217;sunu kald\u0131rmaya ba\u015flayacak<br><strong>2026 May\u0131s:<\/strong> Hi\u00e7bir public CA&#8217;dan client authentication sertifikas\u0131 al\u0131namayacak<br><strong>2026 Haziran:<\/strong> Chrome, TLS server authentication i\u00e7in \u00f6zel olarak ayr\u0131lm\u0131\u015f root certificate hierarchy&#8217;lerini kabul edecek (client auth ve server auth farkl\u0131 root&#8217;lardan gelecek)<\/p>\n\n\n\n<p><h3 class=\"wp-block-heading\">Kimler Etkileniyor?<\/h3><\/p>\n\n\n\n<p><strong>Etkilenmiyorsunuz<\/strong><\/p>\n\n\n\n<p>Sertifikalar\u0131n\u0131z\u0131 sadece web sitelerini g\u00fcvenli hale getirmek (HTTPS) i\u00e7in kullan\u0131yorsan\u0131z, hi\u00e7bir \u015fey yapman\u0131za gerek yok.<\/p>\n\n\n\n<p><strong>Dikkat: Bu Senaryolardan Biri Varsa<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>VPN ve uzaktan eri\u015fim<\/strong>: \u00c7al\u0131\u015fan cihazlar\u0131na sertifika ile kimlik do\u011frulama yap\u0131yorsan\u0131z<\/li>\n\n\n\n<li><strong>Kurumsal Wi-Fi (802.1X)<\/strong>: Cihaz bazl\u0131 network authentication kullan\u0131yorsan\u0131z<\/li>\n\n\n\n<li><strong>Mutual TLS (mTLS)<\/strong>: API&#8217;ler ve mikroservisler aras\u0131 g\u00fcvenlik sa\u011fl\u0131yorsan\u0131z<\/li>\n\n\n\n<li><strong>Kubernetes\/Service Mesh<\/strong>: Pod-to-pod authentication i\u00e7in sertifika kullan\u0131yorsan\u0131z<\/li>\n\n\n\n<li><strong>IoT\/M2M<\/strong>: Cihazlar aras\u0131 kimlik do\u011frulama yap\u0131yorsan\u0131z<\/li>\n\n\n\n<li><strong>Kurumsal uygulamalar<\/strong>: Client certificate tabanl\u0131 SSO kullan\u0131yorsan\u0131z<\/li>\n<\/ul>\n\n\n\n<p>Public CA&#8217;lardan al\u0131nan ve client authentication i\u00e7in kullan\u0131lan her sertifika, 2026&#8217;dan sonra yenilenemeyecek.<\/p>\n\n\n\n<p><h3 class=\"wp-block-heading\">\u00c7\u00f6z\u00fcm: Private PKI&#8217;a Ge\u00e7i\u015f<\/h3><\/p>\n\n\n\n<p>Art\u0131k client authentication i\u00e7in tek ge\u00e7erli \u00e7\u00f6z\u00fcm, organizasyonlar\u0131n kendi private PKI altyap\u0131lar\u0131n\u0131 kurmas\u0131. \u0130yi haber \u015fu ki, modern ara\u00e7lar sayesinde bu ge\u00e7i\u015f eskisi kadar karma\u015f\u0131k de\u011fil.<\/p>\n\n\n\n<p><strong>Private PKI&#8217;n\u0131n Avantajlar\u0131<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Tam kontrol<\/strong>: Sertifika profillerini, ya\u015fam d\u00f6ng\u00fcs\u00fcn\u00fc ve politikalar\u0131 siz belirlersiniz<\/li>\n\n\n\n<li><strong>Esneklik<\/strong>: \u0130\u00e7 kullan\u0131mlar\u0131n\u0131za \u00f6zel sertifikalar olu\u015fturabilirsiniz<\/li>\n\n\n\n<li><strong>Ba\u011f\u0131ms\u0131zl\u0131k<\/strong>: D\u0131\u015f politika de\u011fi\u015fikliklerinden etkilenmezsiniz<\/li>\n\n\n\n<li><strong>Maliyet<\/strong>: B\u00fcy\u00fck \u00f6l\u00e7ekte daha ekonomik<\/li>\n\n\n\n<li><strong>H\u0131z<\/strong>: Daha h\u0131zl\u0131 iptal, yenileme ve da\u011f\u0131t\u0131m<\/li>\n<\/ul>\n\n\n\n<p><h3 class=\"wp-block-heading\">Ba\u015far\u0131l\u0131 Ge\u00e7i\u015f \u0130\u00e7in Gerekenler<\/h3><\/p>\n\n\n\n<p><strong>1. Sertifika Envanteri<\/strong><\/p>\n\n\n\n<p>\u0130lk ad\u0131m, mevcut durumu anlamak. Hangi sertifikalar\u0131n client authentication i\u00e7in kullan\u0131ld\u0131\u011f\u0131n\u0131, hangi sistemlerin etkilenece\u011fini ve \u00f6ncelik s\u0131ralamas\u0131n\u0131 belirlemek kritik.<\/p>\n\n\n\n<p><strong>2. Private CA Altyap\u0131s\u0131<\/strong><\/p>\n\n\n\n<p>Modern \u00e7\u00f6z\u00fcmler, root CA ve intermediate CA hiyerar\u015fisi kurman\u0131z\u0131, farkl\u0131 kullan\u0131m durumlar\u0131 i\u00e7in \u00f6zel sertifika profilleri olu\u015fturman\u0131z\u0131 ve ACME, EST, SCEP gibi standart protokollerle entegrasyon yapman\u0131z\u0131 sa\u011fl\u0131yor.<\/p>\n\n\n\n<p><strong>3. Certificate Lifecycle Management (CLM)<\/strong><\/p>\n\n\n\n<p>Artan sertifika say\u0131s\u0131 ve daha s\u0131k&nbsp;renewal&nbsp;gereksinimleri&nbsp;g\u00f6z \u00f6n\u00fcne al\u0131nd\u0131\u011f\u0131nda, manuel y\u00f6netim art\u0131k s\u00fcrd\u00fcr\u00fclebilir de\u011fil. Ba\u015far\u0131l\u0131 bir ge\u00e7i\u015f i\u00e7in ihtiya\u00e7 duydu\u011funuz yetenekler:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Otomatik ke\u015fif<\/strong>: Organizasyondaki t\u00fcm sertifikalar\u0131 bulma<\/li>\n\n\n\n<li><strong>Merkezi y\u00f6netim<\/strong>: Public ve private sertifikalar\u0131 tek yerden izleme<\/li>\n\n\n\n<li><strong>Otomatik imzalama<\/strong>: Private CA ile entegre sertifika \u00fcretimi<\/li>\n\n\n\n<li><strong>Ak\u0131ll\u0131 da\u011f\u0131t\u0131m<\/strong>: \u0130mzalanan sertifikalar\u0131 hedef sistemlere otomatik deploy etme<\/li>\n\n\n\n<li><strong>Ya\u015fam d\u00f6ng\u00fcs\u00fc otomasyonu<\/strong>: Yenileme, iptal ve rotation s\u00fcre\u00e7leri<\/li>\n\n\n\n<li><strong>Uyumluluk kontrol\u00fc<\/strong>: Politika ihlallerini \u00f6nleme<\/li>\n<\/ul>\n\n\n\n<p><h3 class=\"wp-block-heading\">Ge\u00e7i\u015f Stratejisi<\/h3><\/p>\n\n\n\n<p><strong>A\u015fama 1: De\u011ferlendirme (Hemen)<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Mevcut sertifika envanterini \u00e7\u0131kar\u0131n<\/li>\n\n\n\n<li>Client authentication kullanan sertifikalar\u0131 belirleyin<\/li>\n\n\n\n<li>Etkilenecek sistemleri ve kritiklik seviyelerini listeleyin<\/li>\n\n\n\n<li>Ge\u00e7i\u015f i\u00e7in gereken kaynaklar\u0131 planlay\u0131n<\/li>\n<\/ul>\n\n\n\n<p><strong>A\u015fama 2: Pilot (2025 Q4)<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Kritik olmayan bir sistemde private PKI&#8217;\u0131 test edin<\/li>\n\n\n\n<li>CLM platformu ile otomasyon s\u00fcre\u00e7lerini kurun<\/li>\n\n\n\n<li>Renewal ve da\u011f\u0131t\u0131m senaryolar\u0131n\u0131 do\u011frulay\u0131n<\/li>\n<\/ul>\n\n\n\n<p><strong>A\u015fama 3: \u00dcretim Ge\u00e7i\u015fi (2026 Q1-Q2)<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>VPN sistemleri ve kullan\u0131c\u0131 sertifikalar\u0131n\u0131 ge\u00e7irin<\/li>\n\n\n\n<li>mTLS API&#8217;ler ve mikroservisleri g\u00fcncelleyin<\/li>\n\n\n\n<li>IoT ve embedded cihazlar\u0131 yap\u0131land\u0131r\u0131n<\/li>\n\n\n\n<li>Eski public CA sertifikalar\u0131n\u0131 planl\u0131 \u015fekilde iptal edin<\/li>\n\n\n\n<li><strong>Kritik:<\/strong> May\u0131s 2026&#8217;dan \u00f6nce t\u00fcm sistemlerin private PKI&#8217;a ge\u00e7mi\u015f olmas\u0131 gerekiyor.<\/li>\n<\/ul>\n\n\n\n<p><h3 class=\"wp-block-heading\">Teknoloji Se\u00e7imi: Nelere Dikkat Etmeli?<\/h3><\/p>\n\n\n\n<p><strong>Must-have \u00d6zellikler<\/strong><\/p>\n\n\n\n<p>Se\u00e7ece\u011finiz platformun mutlaka sunmas\u0131 gerekenler:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Kapsaml\u0131 ke\u015fif ve envanter y\u00f6netimi<\/li>\n\n\n\n<li>Private CA entegrasyonu ve sertifika imzalama yetenegi<\/li>\n\n\n\n<li>Hedef sistemlere otomatik da\u011f\u0131t\u0131m (Kubernetes, load balancer, web server vb.)<\/li>\n\n\n\n<li>ACME\/EST\/SCEP protokol deste\u011fi<\/li>\n\n\n\n<li>RESTful API ve webhook entegrasyonu<\/li>\n\n\n\n<li>Detayl\u0131 audit log ve raporlama<\/li>\n<\/ul>\n\n\n\n<p><strong>Entegrasyon Ekosistemi<\/strong><\/p>\n\n\n\n<p>Platform, mevcut altyap\u0131n\u0131zla uyumlu olmal\u0131:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Microsoft ADCS, OpenSSL, EJBCA gibi CA&#8217;lar<\/li>\n\n\n\n<li>Kubernetes, Docker, OpenShift gibi container platformlar\u0131<\/li>\n\n\n\n<li>Nginx, Apache, IIS gibi web sunucular\u0131<\/li>\n\n\n\n<li>F5, HAProxy, Citrix gibi load balancer&#8217;lar<\/li>\n<\/ul>\n\n\n\n<p><h3 class=\"wp-block-heading\">Pratik \u00d6neriler<\/h3><\/p>\n\n\n\n<p><strong>G\u00fcvenlik<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>K\u00f6k CA&#8217;y\u0131 offline tutun, intermediate CA&#8217;lar kullan\u0131n<\/li>\n\n\n\n<li>HSM ile private key&#8217;leri koruyun<\/li>\n\n\n\n<li>Minimum RSA 2048 veya ECC P-256 kullan\u0131n<\/li>\n\n\n\n<li>D\u00fczenli denetim ve uyumluluk kontrol\u00fc yap\u0131n<\/li>\n<\/ul>\n\n\n\n<p><strong>Otomasyon<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Manuel s\u00fcre\u00e7lerden tamamen ka\u00e7\u0131n\u0131n<\/li>\n\n\n\n<li>K\u0131sa \u00f6m\u00fcrl\u00fc sertifikalar + otomatik renewal<\/li>\n\n\n\n<li>Pre\/post deployment script&#8217;leri yap\u0131land\u0131r\u0131n<\/li>\n\n\n\n<li>Health check ve validation otomasyonu<\/li>\n<\/ul>\n\n\n\n<p><strong>Organizasyon<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Merkezi y\u00f6netim uygulay\u0131n<\/li>\n\n\n\n<li>Role-based access control tan\u0131mlay\u0131n<\/li>\n\n\n\n<li>Ekip e\u011fitimi ve dok\u00fcmantasyon haz\u0131rlay\u0131n<\/li>\n\n\n\n<li>Disaster recovery plan\u0131 olu\u015fturun<\/li>\n<\/ul>\n\n\n\n<p><h3 class=\"wp-block-heading\">Ara\u00e7 Se\u00e7erken Kar\u015f\u0131la\u015ft\u0131rma Kriterleri<\/h3><\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><td><strong>Kriter<\/strong><\/td><td><strong>Neden \u00d6nemli<\/strong><\/td><td><strong>Kontrol Edilmesi Gerekenler<\/strong><\/td><\/tr><\/thead><tbody><tr><td>Ke\u015fif kapasitesi<\/td><td>Gizli sertifikalar\u0131 bulma<\/td><td>Multi-platform scan, agent\/agentless, scheduling<\/td><\/tr><tr><td>\u0130mzalama esnekli\u011fi<\/td><td>\u00d6zel kullan\u0131m durumlar\u0131<\/td><td>Custom profiles, EKU kontrol\u00fc, CA agnostic<\/td><\/tr><tr><td>Da\u011f\u0131t\u0131m otomasyonu<\/td><td>Operasyonel y\u00fck<\/td><td>Platform deste\u011fi say\u0131s\u0131, API\/webhook, rollback<\/td><\/tr><tr><td>Protokol deste\u011fi<\/td><td>Cihaz\/sistem uyumlulu\u011fu<\/td><td>ACME, EST, SCEP, RESTful API<\/td><\/tr><tr><td>\u00d6l\u00e7eklenebilirlik<\/td><td>B\u00fcy\u00fcme ve y\u00fck<\/td><td>Sertifika say\u0131s\u0131 limiti, performance, high availability<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">Sonu\u00e7<\/h3>\n\n\n\n<p>Public CA&#8217;lar\u0131n 2026&#8217;da client authentication deste\u011fini sonland\u0131rmas\u0131, sadece bir politika de\u011fi\u015fikli\u011fi de\u011fil &#8211; organizasyonlar\u0131 daha kontroll\u00fc ve g\u00fcvenli bir PKI modeline ge\u00e7meye zorlayan yap\u0131sal bir d\u00f6n\u00fc\u015f\u00fcm.<\/p>\n\n\n\n<p><strong>Son uyar\u0131:<\/strong> May\u0131s 2026&#8217;dan sonra public CA&#8217;lardan client authentication sertifikas\u0131 almak imkans\u0131z hale gelecek. S\u00fcrprizlerle kar\u015f\u0131la\u015fmamak i\u00e7in ge\u00e7i\u015f plan\u0131n\u0131z\u0131 bug\u00fcn olu\u015fturun.<\/p>\n\n\n\n<p>Modern CLM platformlar\u0131, bu ge\u00e7i\u015fi hem kolay hem de de\u011fer yaratan bir f\u0131rsata d\u00f6n\u00fc\u015ft\u00fcrebilir. Do\u011fru ara\u00e7 se\u00e7imi ve iyi bir planlama ile, bu zorunlu ge\u00e7i\u015f organizasyonunuz i\u00e7in uzun vadeli bir kazan\u0131ma d\u00f6n\u00fc\u015fecektir.<\/p>\n\n\n\n<p>SecTrail CM, sertifika ya\u015fam d\u00f6ng\u00fcs\u00fc y\u00f6netimi i\u00e7in kapsaml\u0131 bir platform sunuyor. Sertifika envanteri \u00e7\u0131karma, otomasyondan, hedef sistemlere sertifika da\u011f\u0131t\u0131m\u0131na kadar t\u00fcm s\u00fcre\u00e7lerde destek sa\u011fl\u0131yoruz. Daha fazla bilgi i\u00e7in <a href=\"https:\/\/www.sectrail.com\/cm\/#iletisim\" data-type=\"link\" data-id=\"https:\/\/www.sectrail.com\/cm\/#iletisim\">bizlere ula\u015f\u0131n<\/a>.<\/p>\n\n\n\n<p><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Ne Oluyor? May\u0131s 2026&#8217;dan itibaren, Let&#8217;s Encrypt, DigiCert, Sectigo gibi t\u00fcm b\u00fcy\u00fck public sertifika otoriteleri, TLS client authentication i\u00e7in sertifika imzalamay\u0131 durduracak. Bu de\u011fi\u015fiklik, Google Chrome&#8217;un<span class=\"excerpt-hellip\"> [\u2026]<\/span><\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12],"tags":[],"class_list":["post-439","post","type-post","status-publish","format-standard","hentry","category-uncategorized-tr"],"_links":{"self":[{"href":"https:\/\/www.sectrail.com\/cm\/wp-json\/wp\/v2\/posts\/439","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.sectrail.com\/cm\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.sectrail.com\/cm\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.sectrail.com\/cm\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/www.sectrail.com\/cm\/wp-json\/wp\/v2\/comments?post=439"}],"version-history":[{"count":24,"href":"https:\/\/www.sectrail.com\/cm\/wp-json\/wp\/v2\/posts\/439\/revisions"}],"predecessor-version":[{"id":624,"href":"https:\/\/www.sectrail.com\/cm\/wp-json\/wp\/v2\/posts\/439\/revisions\/624"}],"wp:attachment":[{"href":"https:\/\/www.sectrail.com\/cm\/wp-json\/wp\/v2\/media?parent=439"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.sectrail.com\/cm\/wp-json\/wp\/v2\/categories?post=439"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.sectrail.com\/cm\/wp-json\/wp\/v2\/tags?post=439"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}