Kuskuren amincewa na IKEv2 a Android: aika CA na tsakiya, ba tushe ba
Wayar ta ƙi ƙofar saboda sarkar da ta samu ta tsaya da wuri. Yanke shawara: aika na tsakiya, gyara asali ko canza nau’in maɓalli.
Wayar ta ƙi haɗawa kuma tana buga No trusted RSA public key found for vpn.example.net, yayin da wannan takardar shaidar ƙofar ke aiki daga kwamfutar tafi-da-gidanka a cikin wannan hanyar sadarwa. Matakin da ya fi jan hankali shi ne sake fitar da takardar. Kafin haka, gano wanne daga cikin kuskure uku kake da shi, domin ɗaya ne kawai ke magana kan abin da ke cikin takardar.
Kuskure uku a bayan saƙo ɗaya
Android na gina sarka daga takardar shaidar ƙofar zuwa CA da aka zaɓa a bayanan VPN, sannan ya kwatanta sunan uwar garke da bayanan. Sanarwar tana ba da sakamakon, ba matakin ba. Kuskuren amincewa yana nufin ba a iya kammala sarkar da takardun da aka bayar a musayar ba; kuskuren asali yana nufin sarka tana da inganci amma sunan bai dace ba; kuskuren lissafi yana nufin na’urar ko bayanan ba su karɓi nau’in maɓalli ko sa hannu ba.
| What you see | What it points to | First move |
|---|---|---|
| Chain stops after the leaf in the daemon log | intermediate not loaded or not sent | load the intermediate as CA material |
| Chain validates, name differs from the profile | identity mismatch | fix the profile name or the certificate SAN |
| Chain validates, handshake still fails | key or signature not accepted | compare key type against the device |
Yanke shawara da hujja maimakon gwada gyare-gyare a jere. Ƙoƙari ɗaya a matakin log na 2 a kan daemon yana gaya maka wane layi kake, kuma ya fi sauƙi fiye da sake fitar da takardar da ba ta taɓa kuskure ba.
Da farko yanke shawara: dukan sarkar ta iso?
strongSwan na aika takardar da aka saita don wannan haɗin, kuma takardun tsakiya shaida ne daban. Dole a loda su a matsayin takardun CA kafin daemon ya iya saka su cikin kaya, don haka tsarin da takardar uwar garke ta sami sa hannu daga na tsakiya, tushen shine anka na amincewa kuma na tsakiya yana zama kawai a cikin babban fayil na ginin CA yana haifar da wannan kuskure: ganye kawai a kan waya kuma sarkar ta ƙare da wuri a wayar.
Duba abin da daemon ke riƙe da swanctl --list-certs a tsarin swanctl, ko ipsec listcerts tare da tsohon starter. Ya kamata na tsakiya ya bayyana a matsayin takardar CA tare da tushe a sama. Idan babu, babu wani zaɓi na abokin ciniki da zai taimaka; idan akwai, ci gaba zuwa tambaya ta gaba.
Sannan duba ko za a aika shi. bayanin swanctl.conf yana bayanin send_cert, wanda tsohonsa ifasked ke aika takardu kawai lokacin da abokin tarayya ya nemi; always na aika koyaushe. Tsohon daidai shine leftsendcert=always a cikin ipsec.conf. Wannan saitin yana sarrafa aikawa, ba samuwa ba, don haka ba zai iya rama na tsakiya da daemon bai taɓa lodawa ba.
Idan sarkar gajere ce, loda na tsakiya inda daemon ke nema
Saka na tsakiya a cikin babban fayil na CA, ba gefen ganye ba: /etc/ipsec.d/cacerts don tsari da ipsec.conf, /etc/swanctl/x509ca don swanctl, ko hanyar da fakitin ka ke maye gurbinsa. Sake loda saitin kuma sake lissafin takardun. Wasu nau’ikan suna kuma aika ƙuntata mai ɗauke da sarkar a cikin fayil ɗin ganye, amma babban fayil na CA shine tsarin da ake iya ɗauka tsakanin nau’ika da fakiti.
Duba kuma daga gefen abokin ciniki. Wayar tana ganin abin da musayar ta ɗauka kawai, don haka log ɗin daemon a matakin 2 ya kamata ya nuna na tsakiya cikin takardun da aka aika. Idan log ɗin ya nuna shi kuma wayar har yanzu ta kasa, kana cikin wani layi na tebur, kuma gyara fayilolin CA ba zai canza sakamakon ba.
Idan sarkar cikakke ce, daina gyara takardu
Kuskuren asali shine rashin daidaituwa tsakanin sunan a cikin bayanan VPN da sunan a cikin takardar. Android na kwatanta asalin uwar garke da ka saita da takardar da ya tabbatar, don haka bayanan da ke nuna adireshi yayin da takardar ke ambaton sunan mai masauki, ko bayanan da ke ambaton sunan mai masauki wanda takardar ba ta rufe ba, yana kasa bayan ingantaccen tabbatarwar sarka. Gyara ɓangaren da ba daidai ba kuma ka riƙe bayanan da takardar daidai.
Kuskuren lissafi yana bayyana da ingantacciyar sarka da suna mai dacewa. Sifofin Android sun bambanta a cikin nau’ikan maɓalli da tsarin sa hannu da suke karɓa, kuma nau’in bayanan da kansa yana iyakance zaɓuɓɓukan. Idan ƙofar tana amfani da tsohuwar ko sabon haɗin da ba a saba ba, kwatanta shi da abin da na’urar ke goyon baya kafin ka ɗauka takardar ta lalace. Log ɗin zai nuna cewa musafaha yana ci gaba fiye da yanayin amincewa, wanda shine alamar sarkar ba ita ce matsala ba yanzu.
Kada ka saka na tsakiya a matsayin tushen mai amfani a wayar
Saka na tsakiya da ya ɓace a matsayin takardar mai amfani a wayar yana sa gargaɗin ya ɓace kuma yana canza tsarin amincewar wayar ga kowace manhaja da ke karɓar tushen da mai amfani ya saka. Hakanan yana ɓoye kuskuren isarwa wanda zai shafi abokin ciniki na gaba, kuma yana barin ƙofar ta aika sarkar da ba ta cika ba ga kowace na’ura mai zuwa. Maganin dindindin yana kan uwar garke, sau ɗaya, ga dukan abokan ciniki.
Riƙe shawarwari uku daban a cikin rikodin canji: waɗanne takardu aka aika, wace asali aka kwatanta da wane lissafi aka tattauna. Ƙofar da ke aika cikakkiyar sarkarta koyaushe, bayanan da ke ambaton takardar daidai da nau’in maɓalli da rundunar ke goyon baya abubuwa uku ne ƙanana, kuma su ne dukan wannan kuskure.