{"id":128,"date":"2009-01-05T16:01:10","date_gmt":"2009-01-05T15:01:10","guid":{"rendered":"http:\/\/blog.guiguiabloc.fr\/?p=128"},"modified":"2009-01-05T16:01:10","modified_gmt":"2009-01-05T15:01:10","slug":"gestion-dune-pki-installation-dun-repondeur-ocsp","status":"publish","type":"post","link":"https:\/\/blog.guiguiabloc.fr\/index.php\/2009\/01\/05\/gestion-dune-pki-installation-dun-repondeur-ocsp\/","title":{"rendered":"Gestion d’une PKI : Installation d’un r\u00e9pondeur OCSP"},"content":{"rendered":"

D\u00e9j\u00e0 avant tout, Excellente Ann\u00e9e 2009 \u00e0 vous tous \ud83d\ude00<\/p>\n

La gestion des certificats SSL et\/ou X509 est une tr\u00e8s bonne chose pour le contr\u00f4le et la s\u00e9curit\u00e9 de l’acc\u00e8s \u00e0 vos syst\u00e8mes d’informations.<\/p>\n

Je ne parlerais pas de la fa\u00e7on de monter une PKI<\/a> chez soi, j’avais \u00e9cris un pr\u00e9c\u00e9dent billet ICI<\/a> sur lequel vous pouvez vous baser.<\/p>\n

OSCP ??? C’est quoi ce truc encore ….<\/p>\n

OCSP signifie Online Certificate Status Protocol. C’est un protocole d\u00e9finit dans la RFC 2560<\/a> qui permet de valider un Certificat num\u00e9rique X509.<\/p>\n

En clair, cela vous permet d’offrir \u00e0 vos \u00ab\u00a0clients, amis, potes….\u00a0\u00bb une fonction de v\u00e9rification en ligne de la validit\u00e9 d’une certificat.<\/p>\n

Petit exemple (source Wikip\u00e9dia) :<\/p>\n

    \n
  1. Alice et Bob<\/a> sont des clients d’Ivan, l’autorit\u00e9 de certification<\/a> (AC<\/a>). Ils poss\u00e8dent le certificat de cl\u00e9 publique d’Ivan.<\/li>\n
  2. Alice et Bob<\/a> poss\u00e8dent chacun un certificat de cl\u00e9 publique \u00e9mis par Ivan.<\/li>\n
  3. Alice veut effectuer une transaction avec Bob. Elle lui envoie donc son certificat contenant sa cl\u00e9 publique<\/a>.<\/li>\n
  4. Bob veut s’assurer que le certificat d’Alice n’a pas \u00e9t\u00e9 r\u00e9voqu\u00e9. Il cr\u00e9e une requ\u00eate OCSP<\/em> contenant l’empreinte<\/a> du certificat d’Alice et l’envoi \u00e0 Ivan.<\/li>\n
  5. Le r\u00e9pondeur OCSP d’Ivan v\u00e9rifie le statut du certificat d’Alice dans la base de donn\u00e9es de la CA.<\/li>\n
  6. Le r\u00e9pondeur OCSP confirme la validit\u00e9 du certificat d’Alice en envoyant une r\u00e9ponse OCSP<\/em> positive sign\u00e9e<\/a> \u00e0 Bob.<\/li>\n
  7. Bob v\u00e9rifie la signature cryptographique de la r\u00e9ponse.<\/li>\n
  8. Bob effectue sa transaction avec Alice.<\/li>\n<\/ol>\n

    Je vous invite donc fortement, avant de continuer, \u00e0 lire cet article explicatif<\/a>.<\/p>\n

    Il existe un projet libre de r\u00e9pondeur OCSP , qui est inclus dans l’excellentissime projet OpenCA :<\/p>\n

    http:\/\/www.openca.org\/projects\/ocspd\/<\/a><\/p>\n

    Commencons donc par t\u00e9l\u00e9charger les sources ICI<\/a> (derni\u00e8re version disponible, la 1.5.1-rc1).<\/p>\n

    L’installation est des plus basiques (a vous de voir pour le prefix) :<\/p>\n

    $ .\/configure --prefix=\/opt\/ocspd\r\n$ make\r\n$ su\r\n# make install<\/pre>\n
    On cr\u00e9er un groupe et un user d\u00e9di\u00e9 et on affecte les droits :<\/p>\n
    pki:\/opt\/ocspd# groupadd ocspd\r\npki:\/opt\/ocspd# useradd -d \/opt\/ocspd -g ocspd -s \/bin\/false ocspd\r\npki:\/opt\/ocspd# chown -R ocspd:ocspd \/opt\/ocspd<\/pre>\n
    Avec votre syst\u00e8me de PKI pr\u00e9f\u00e9r\u00e9e, g\u00e9n\u00e9rer un certificat publique et un certificat priv\u00e9 pour votre serveur OCSP. (attention au hostname, dans mon cas, ocsp.guiguiabloc.fr)<\/p>\n
    Copier les, ainsi que votre certificat CA, dans \/opt\/ocspd\/etc\/ocspd\/certs<\/p>\n
    Il ne reste qu’a configurer votre r\u00e9pondeur :<\/p>\n
    cat \/opt\/ocspd\/etc\/ocspd\/ocspd.conf\r\n\r\n[ ocspd ]\r\ndefault_ocspd   = OCSPD_default         # The default ocspd section\r\n\r\n####################################################################\r\n[ OCSPD_default ]\r\n\r\ndir              = \/opt\/ocspd\/etc\/ocspd         # Where everything is kept\r\ndb               = $dir\/index.txt               # database index file.\r\nmd               = sha1\r\n\r\nca_certificate    = $dir\/certs\/CA_Guiguiabloc-cert.pem      # The CA certificate\r\nocspd_certificate = $dir\/certs\/ocsp-cert.crt    # The OCSP server cert\r\nocspd_key         = $dir\/certs\/ocsp-key.pem   # The OCSP server key\r\npidfile           = $dir\/ocspd.pid              # Main process pid\r\n\r\nuser                    = ocspd\r\ngroup                   = ocspd\r\n\r\nbind                    = 192.168.1.1 (l'ip sur laquelle \u00e9couter ou * pour toutes les interfaces)\r\nport                    = 2560\r\ncrl_auto_reload = 3600\r\ncrl_reload_expired = yes\r\nresponse        = ocsp_response\r\n\r\n....\r\n\r\n[ ocsp_response ]\r\ndir                     = \/opt\/ocspd\/etc\/ocspd\r\nocsp_add_response_keyid = yes\r\n\r\n...\r\n\r\n[ first_ca ]\r\n\r\ncrl_url = file:\/\/\/\/opt\/ocspd\/etc\/ocspd\/crls\/crl-Guiguiabloc.pem (la liste de r\u00e9vocation de certificat)\r\nca_url  = file:\/\/\/\/opt\/ocspd\/etc\/ocspd\/certs\/CA_Guiguiabloc-cert.pem<\/pre>\n
    Je vous laisse consulter le fichier conf en entier pour en comprendre le contenu et le modifier suivant vos besoins, mais la configuration ci-dessous, tr\u00e8s simple, fonctionne pour un premier test.<\/p>\n
    Ne reste qu’a lancer le d\u00e9mon et verifier le syslog :<\/p>\n
    pki:#\/opt\/ocspd\/sbin\/ocspd -c \/opt\/ocspd\/etc\/ocspd\/ocspd.conf -v &\r\n\r\nJan  5 14:56:15 pki ocspd[22154]: OpenCA OCSPD v1.5.1 - starting.\r\nJan  5 14:56:15 pki ocspd[22154]: reading certificate file (\/opt\/ocspd\/etc\/ocspd\/certs\/ocsp-cer\r\nt.crt).\r\nJan  5 14:56:15 pki ocspd[22154]: Reading Private Key file \/opt\/ocspd\/etc\/ocspd\/private\/ocsp-ke\r\ny.pem\r\nJan  5 14:56:15 pki ocspd[22154]: reading CA certificate file.\r\nJan  5 14:56:15 pki ocspd[22154]: OCSP Daemon setup completed\r\nJan  5 14:56:15 pki ocspd[22154]: variable lookup failed for OCSPD_default::chroot_dir\r\nJan  5 14:56:15 pki ocspd[22154]: Auto CRL reload every 3600 secs\r\nJan  5 14:56:15 pki ocspd[22154]: Reload on expired CRLs enabled\r\nJan  5 14:56:15 pki ocspd[22154]: Number of CAs in configuration is 1\r\nJan  5 14:56:15 pki ocspd[22154]: INFO::FORMAT::CA Cert [\/\/opt\/ocspd\/etc\/ocspd\/certs\/CA_Guiguiabloc-cert.pem] is PEM formatted\r\nJan  5 14:56:15 pki ocspd[22154]: CA CERT for first_ca loaded successfully.\r\nJan  5 14:56:15 pki ocspd[22154]: CA List Entry added (CA list num 0)\r\nJan  5 14:56:15 pki ocspd[22154]: INFO::CRL RELOAD::File Protocol\r\nJan  5 14:56:15 pki ocspd[22154]: INFO::FILE::CRL is in PEM format\r\nJan  5 14:56:15 pki ocspd[22154]: CRL loaded [ first_ca ]\r\nJan  5 14:56:15 pki ocspd[22154]: CRL and CA cert [0:1] check ok\r\nJan  5 14:56:15 pki ocspd[22154]: CRL matching CA cert ok [ 1 ]\r\nJan  5 14:56:15 pki ocspd[22154]: INFO::CRL::Verify 1 [OK=1]\r\nJan  5 14:56:15 pki ocspd[22154]: INFO::CRL is Valid\r\nJan  5 14:56:15 pki ocspd[22154]: INFO::CRL::16 Entries [ first_ca ]\r\nJan  5 14:56:15 pki ocspd[22154]: CRL loaded successfully [first_ca]\r\nJan  5 14:56:15 pki ocspd[22154]: variable lookup failed for ocsp_response::ocsp_add_response_c\r\nerts\r\nJan  5 14:56:15 pki ocspd[22154]: variable lookup failed for OCSPD_default::crl_check_validity\r\nJan  5 14:56:15 pki ocspd[22154]: Configuration loaded and parsed\r\nJan  5 14:56:15 pki ocspd[22154]: INFO::Local Address 192.168.1.1 [2560]\r\nJan  5 14:56:15 pki ocspd[22154]: INFO::OPENCA_SRV_INFO_TREAD::new thread created<\/pre>\n
    Bien \u00e9videmment, vous fournissez au r\u00e9pondeur OCSP, la Liste de r\u00e9vocation des certificats (fichier CRL) et la database (index.txt).
    \nSi vous utilisez easyCA, ils sont g\u00e9n\u00e9r\u00e9s sous $DIR et $DIR\/crl par d\u00e9faut (voir votre fichier openssl.cnf).<\/p>\n
    Et maintenant, interrogeons le serveur OCSP pour savoir si mon Certificat (ici webmail.guiguiabloc.fr) est encore valable :<\/p>\n
    pki:# openssl ocsp -issuer CA_Guiguiabloc-cert.pem -CAfile CA_Guiguiabloc-cert.pem -cert webmail.guiguiabloc.fr.crt -url http:\/\/192.168.1.1:2560 -text\r\nOCSP Request Data:\r\n    Version: 1 (0x0)\r\n    Requestor List:\r\n        Certificate ID:\r\n          Hash Algorithm: sha1\r\n          Issuer Name Hash: 4A694097441CA470D697E82AF367D1F196B59680\r\n          Issuer Key Hash: 6490C296FF639D9B75A899E2DB29DC7DA42EE38D\r\n          Serial Number: 13\r\n    Request Extensions:\r\n        OCSP Nonce:\r\n            0410DDDA8DFEF460BA0C13ACCEBE7CDFDCB9\r\nOCSP Response Data:\r\n    OCSP Response Status: successful (0x0)\r\n    Response Type: Basic OCSP Response\r\n    Version: 1 (0x0)\r\n    Responder Id: C = FR, ST = Bretagne, O = Guiguiabloc, OU = Guiguiabloc, CN = ocsp.guiguiabloc.fr, emailAddress = pki@guiguiabloc.fr\r\n    Produced At: Jan  5 14:21:40 2009 GMT\r\n    Responses:\r\n    Certificate ID:\r\n      Hash Algorithm: sha1\r\n      Issuer Name Hash: 4A694097441CA470D697E82AF367D1F196B59680\r\n      Issuer Key Hash: 6490C296FF639D9B75A899E2DB29DC7DA42EE38D\r\n      Serial Number: 13\r\n    Cert Status: good\r\n    This Update: Jan  5 14:16:51 2009 GMT\r\n    Next Update: Jan  5 14:26:40 2009 GMT\r\n\r\n    Response Extensions:\r\n        OCSP Nonce:\r\n            0410DDDA8DFEF460BA0C13ACCEBE7CDFDCB9\r\nCertificate:\r\n    Data:\r\n        Version: 3 (0x2)\r\n        Serial Number: 16 (0x10)\r\n        Signature Algorithm: md5WithRSAEncryption\r\n        Issuer: C=FR, ST=Bretagne, L=Brest, O=Guiguiabloc, OU=Guiguiabloc, CN=Guiguiabloc CA Authority\/emailAddress=pki@guiguiabloc.fr\r\n        Validity\r\n            Not Before: Jul 18 08:08:25 2008 GMT\r\n            Not After : Jul 17 08:08:25 2013 GMT\r\n        Subject: C=FR, ST=Bretagne, O=Guiguiabloc, OU=Guiguiabloc, CN=ocsp.guiguiabloc.fr\/emailAddress=pki@guiguiabloc.fr\r\n        Subject Public Key Info:\r\n            Public Key Algorithm: rsaEncryption\r\n            RSA Public Key: (1024 bit)\r\n                Modulus (1024 bit):\r\n                    00:bb:c8:c3:c0:78:26:88:8c:45:6c:2a:1b:88:fd:\r\n                    71:57:c0:bb:23:e1:1e:40:86:d2:94:af:fc:e7:74:\r\n                    41:3d:41:39:ac:a6:51:dc:4d:e8:80:53:a3:73:5d:\r\n                    74:0e:1f:04:b1:78:dc:ad:45:65:5b:4f:0e:b2:92:\r\n                    3c:bc:64:bb:3e:70:2c:ca:b8:ea:dc:fc:33:31:01:\r\n                    d2:05:b2:e2:60:0c:d2:a6:c1:e9:83:b0:ca:d9:42:\r\n                    98:44:8b:c3:df:63:dc:17:02:51:b6:f2:da:0e:c6:\r\n                    81:fa:78:1c:d2:ca:56:52:f3\r\n                Exponent: 65537 (0x10001)\r\n        X509v3 extensions:\r\n            X509v3 Basic Constraints:\r\n                CA:FALSE\r\n            X509v3 Key Usage:\r\n                Digital Signature\r\n            X509v3 Extended Key Usage:\r\n                OCSP Signing\r\n            X509v3 Issuer Alternative Name:\r\n\r\n            X509v3 Subject Key Identifier:\r\n                1A:18:4A:7A:BC:DB:3E:CD:60:87:0B:A3:11:4D:4F:E6:CE:19:17:27\r\n            X509v3 Authority Key Identifier:\r\n                keyid:64:90:C2:96:FF:63:9D:9B:75:A8:99:E2:DB:29:DC:7D:A4:2E:E3:8D\r\n                DirName:\/C=FR\/ST=Bretagne\/L=Brest\/O=GuiGuiabloc\/OU=Guiguiabloc\/CN=Guiguiabloc CA Authority\/emailAddress=pki@guiguiabloc.fr\r\n                serial:B9:0E:D5:3E:0F:DA:79:FF\r\n\r\n            Authority Information Access:\r\n                OCSP - URI:http:\/\/ocsp.guiguiabloc.fr\/\r\n\r\n    Signature Algorithm: md5WithRSAEncryption\r\n        0c:3a:3f:79:7e:e4:21:be:1b:d1:d4:ef:8f:1d:33:af:f2:88:\r\n        eb:0f:40:cb:24:50:9b:47:cc:61:e2:a9:a3:6e:c5:4f:2a:7c:\r\n        b5:03:f1:a1:b8:b7:23:c7:e1:00:61:3a:c0:7c:8f:c6:2f:c7:\r\n        6a:c9:98:ad:af:ff:28:db:c6:1f:17:d3:54:f3:d7:1a:96:51:\r\n        19:04:6c:f8:92:74:70:de:54:c1:55:d3:9d:27:99:8b:09:be:\r\n        98:27:e6:5b:1e:14:a2:a9:d2:cb:a2:d7:52:8a:e1:ac:9b:a7:\r\n        52:a2:5b:90:dc:cc:8f:33:4b:7a:99:60:4d:5e:b9:e6:71:ed:\r\n        be:92\r\n-----BEGIN CERTIFICATE-----\r\nMIID\/DCCA2WgAwIBAgIBEDANBgkqhkiG9w0BAQQFADCBnDELMAkGA1UEBhMCRlIx\r\nETAPBgNVBAgTCEJyZXRhZ25lMQ4wDAYDVQQHEwVCcmVzdDEVMBMGA1UEChMMU3R5\r\neCBOZXR3b3JrMRAwDgYDVQQLEwdTdHl4bmV0MSIwIAYDVQQDExlTdHl4IE5ldHdv\r\ncmsgQ0EgQXV0aG9yaXR5MR0wGwYJKoZIhvcNAQkBFg5wa2lAc3R5eG5ldC5mcjAe\r\nFw0wODA3MTgwODA4MjVaFw0xMzA3MTcwODA4MjVaMIGCMQswCQYDVQQGEwJGUjER\r\nMA8GA1UECBMIQnJldGFnbmUxFTATBgNVBAoTDFN0eXggTmV0d29yazEQMA4GA1UE\r\nCxMHU3R5eG5ldDEYMBYGA1UEAxMPb2NzcC5zdHl4bmV0LmZyMR0wGwYJKoZIhvcN\r\nAQkBFg5wa2lAc3R5eG5ldC5mcjCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA\r\npsHpg7DK2UKYRIvD32PcFwJRtvLaDsaB+ngc0spWUvMCAwEAAaOCAWQwggFgMAkG\r\nA1UdEwQCMAAwCwYDVR0PBAQDAgeAMBMGA1UdJQQMMAoGCCsGAQUFBwMJMAkGA1Ud\r\nEgQCMAAwHQYDVR0OBBYEFBoYSnq82z7NYIcLoxFNT+bOGRcnMIHRBgNVHSMEgckw\r\ngcaAFGSQwpb\/Y52bdaiZ4tsp3H2kLuONoYGipIGfMIGcMQswCQYDVQQGEwJGUjER\r\nMA8GA1UECBMIQnJldGFnbmUxDjAMBgNVBAcTBUJyZXN0MRUwEwYDVQQKEwxTdHl4\r\nIE5ldHdvcmsxEDAOBgNVBAsTB1N0eXhuZXQxIjAgBgNVBAMTGVN0eXggTmV0d29y\r\nayBDQSBBdXRob3JpdHkxHTAbBgkqhkiG9w0BCQEWDnBraUBzdHl4bmV0LmZyggkA\r\nuQ7VPg\/aef8wMwYIKwYBBQUHAQEEJzAlMCMGCCsGAQUFBzABhhdodHRwOi8vb2Nz\r\ncC5zdHl4bmV0LmZyLzANBgkqhkiG9w0BAQQFAAOBgQAMOj95fuQhvhvR1O+PHTOv\r\n8ojrD0DLJFCbR8xh4qmjbsVPKny1A\/GhuLcjx+EAYTrAfI\/GL8dqyZitr\/8o28Yf\r\nF9NU89callEZBGz4knRw3lTBVdOdJ5mLCb6YJ+ZbHhSiqdLLotdSiuGsm6dSoluQ\r\n3MyPM0t6mWBNXrnmce2+kg==\r\n-----END CERTIFICATE-----\r\nResponse verify OK\r\nwebmail.guiguiabloc.fr.crt: good<\/pre>\n
    R\u00e9ponse : GOOD tout va bien \ud83d\ude42<\/p>\n
    La r\u00e9ponse peut \u00eatre: GOOD – REVOKED – UNKNOWN<\/p>\n
    Vous pouvez inclure directement dans votre certificat l’adresse de votre r\u00e9pondeur OCSP en ajoutant des extensions \u00e0 votre openssl.cnf :<\/p>\n
    [OCSP]\r\n\r\nbasicConstraints        = CA:FALSE\r\nkeyUsage                = digitalSignature\r\nextendedKeyUsage        = OCSPSigning\r\nissuerAltName           = issuer:copy\r\nsubjectKeyIdentifier    = hash\r\nauthorityKeyIdentifier  = keyid:always,issuer:always\r\nauthorityInfoAccess     = OCSP;URI:http:\/\/ocsp.guiguiabloc.fr\/\r\n\r\n[SERVEUR_OCSP]\r\nnsComment                       = \"Guiguiabloc Certificate\"\r\nsubjectKeyIdentifier            = hash\r\nauthorityKeyIdentifier          = keyid,issuer:always\r\nissuerAltName                   = issuer:copy\r\nbasicConstraints                = critical,CA:FALSE\r\nkeyUsage                        = digitalSignature, nonRepudiation, keyEncipherment\r\nnsCertType                      = server\r\nextendedKeyUsage                = serverAuth\r\nauthorityInfoAccess             = OCSP;URI:http:\/\/ocsp.guiguiabloc.fr\/\r\n\r\n[CLIENT_OCSP]\r\nnsComment                       = \"Certificat Client SSL\"\r\nsubjectKeyIdentifier            = hash\r\nauthorityKeyIdentifier          = keyid,issuer:always\r\nissuerAltName                   = issuer:copy\r\nbasicConstraints                = critical,CA:FALSE\r\nkeyUsage                        = digitalSignature, nonRepudiation\r\nnsCertType                      = client\r\nextendedKeyUsage                = clientAuth\r\nauthorityInfoAccess             = OCSP;URI:http:\/\/ocsp.guiguiabloc.fr\/<\/pre>\n
    Puis d’invoquer l’extension lors de la cr\u00e9ation du certificat avec openssl (-extensions CLIENT_OCSP (par exemple).<\/p>\n
    Dans Firefox, pour configurer l’interrogation automatique du r\u00e9pondeur OCSP, allez dans Outils\/Options\/Avance\/Chiffrement et cliquez sur \u00ab\u00a0V\u00e9rification\u00a0\u00bb.<\/p>\n
    \"\"<\/a><\/p>\n
    G\u00e9nial non ? \ud83d\ude00<\/p>\n
    Petit bonus, sur votre Cisco pr\u00e9f\u00e9r\u00e9, on peut aussi faire de l’OCSP \ud83d\ude42  \ud83d\ude42<\/p>\n
    rt-2611>en\r\nPassword:\r\nrt-2611#conf t\r\nEnter configuration commands, one per line.  End with CNTL\/Z.\r\nrt-2611(config)#crypto pki trustpoint guiguiabloc\r\nrt-2611(ca-trustpoint)#ocsp url http:\/\/ocsp.guiguiabloc.fr:2560\r\nrt-2611(ca-trustpoint)#revocation-check ocsp none<\/pre>\n
    La derni\u00e8re ligne est la m\u00e9thode de v\u00e9rification, l’option none sp\u00e9cifie que le routeur passera la v\u00e9rification OSCP si le r\u00e9pondeur ne r\u00e9pond pas.
    \nPour les IOS 12.3 et sup\u00e9rieure (la page chez Cisco     LA<\/a> )<\/p>\n
    Amusez vous bien \ud83d\ude42<\/p>\n","protected":false},"excerpt":{"rendered":"
    D\u00e9j\u00e0 avant tout, Excellente Ann\u00e9e 2009 \u00e0 vous tous \ud83d\ude00 La gestion des certificats SSL et\/ou X509 est une tr\u00e8s bonne chose pour le contr\u00f4le et la s\u00e9curit\u00e9 de l’acc\u00e8s \u00e0 vos syst\u00e8mes d’informations. Je ne parlerais pas de la … Read More →<\/span><\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[6,7,8],"tags":[91,92,85],"_links":{"self":[{"href":"https:\/\/blog.guiguiabloc.fr\/index.php\/wp-json\/wp\/v2\/posts\/128"}],"collection":[{"href":"https:\/\/blog.guiguiabloc.fr\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.guiguiabloc.fr\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.guiguiabloc.fr\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.guiguiabloc.fr\/index.php\/wp-json\/wp\/v2\/comments?post=128"}],"version-history":[{"count":4,"href":"https:\/\/blog.guiguiabloc.fr\/index.php\/wp-json\/wp\/v2\/posts\/128\/revisions"}],"predecessor-version":[{"id":283,"href":"https:\/\/blog.guiguiabloc.fr\/index.php\/wp-json\/wp\/v2\/posts\/128\/revisions\/283"}],"wp:attachment":[{"href":"https:\/\/blog.guiguiabloc.fr\/index.php\/wp-json\/wp\/v2\/media?parent=128"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.guiguiabloc.fr\/index.php\/wp-json\/wp\/v2\/categories?post=128"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.guiguiabloc.fr\/index.php\/wp-json\/wp\/v2\/tags?post=128"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}