Fitar da takardun shaida daga P12 ba tare da maɓallin sirri ba

Tikit ɗin tallafi yana tambaya wace takardar shaida take cikin ƙungiyar VPN, kuma tunanin farko shi ne a fitar da komai a haɗa shi. Fayil ɗin P12 yana tattara takardun shaida da kayan maɓallin sirri a cikin kwano ɗaya, don haka fitar da komai shi ne ainihin abin da bai kamata ka aika ba. Umarnin da ke amsa tambayar matsala ce ta zaɓi, ba matsala ta juyawa ba. Tutoci huɗu ne ke ƙayyade wane rabin kwano za ka samu, kuma biyu daga cikinsu suna jin lafiya fiye da yadda suke.

Fara da karanta kwanon maimakon ɓata shi.

Abin da fayil ɗin PKCS12 ke ɗauka a zahiri

Kwanon PKCS12 yana ɗauke da takardar shaida ɗaya ko fiye, wataƙila maɓallin sirri da message authentication code a kan abin da ke ciki. Takardun shaidar na iya haɗa da takardar ganyen asalin abokin ciniki da matsakaicin da ke haɗa shi da CA. Maɓallin, idan akwai, shi ne abin da ke mai da fayil ɗin sirri maimakon takarda.

Wannan bambanci shi ne dalilin da -nokeys yake wanzuwa da kuma dalilin da yasa shi ne tutar da wannan aiki yake buƙata.

Karanta ƙungiyar ba tare da rubuta maɓallin ba

Sigar dubawa tana buga tsari da bayanan algorithm kuma ba ta rubuta komai: openssl pkcs12 -in client.p12 -info -noout. Tana neman kalmar sirrin shigo da kaya, wanda shi ne wurin da ya dace ga wannan ƙimar, kuma tana gaya maka ko fayil ɗin yana ɗauke da maɓalli kwata-kwata. Yi amfani da -passin env:PKCS12_PASS lokacin da ba za a iya buga kalmar sirri ba, domin kalmar sirri a cikin umarnin shell kalmar sirri ce a cikin jerin matakai. Wannan matakin baya fitar da komai, kuma wannan shi ne dukan ma'anar.

Karanta fitarwar don abubuwa uku: takardun shaida nawa, ko maɓalli yana nan, da waɗanne algorithms suke kare shi.

Yi amfani da -nokeys, kuma kada ka ruɗe shi da -nocerts

-nokeys yana cire maɓallan sirri ya bar takardun shaida. -clcerts yana taƙaita hakan ga takardun shaidar abokin ciniki, -cacerts yana taƙaita ga takardun shaidar CA, kuma waɗannan biyun matattara ne ba zaɓi ba. -nocerts ana karanta shi kamar amintaccen rubutun wannan ra'ayi kuma yana nufin akasin haka: babu takardun shaida, wanda ke barin maɓallai kawai. Haɗa shi cikin fitar da takardun shaida shi ne yadda maɓallin sirri ke ƙarewa a faifai.

Sigar layi biyu da ke samar da fayil ɗin takardun shaida da fayil ɗin CA, kuma ba wani abu ba, ita ce:

openssl pkcs12 -in client.p12 -nokeys -clcerts -out client-certificates.pem
openssl pkcs12 -in client.p12 -nokeys -cacerts -out ca-certificates.pem

Tsofaffin ƙungiyoyi suna buƙatar -legacy a OpenSSL 3 don karanta tsohon ɓoyensu, kuma wannan tutar tana canza abin da parser ke karɓa, ba abin da yake fitarwa ba. Idan bincike ya kasa da kuskure game da algorithm da ba a tallafa masa, ƙara -legacy shine matakin farko da ya dace kuma tsallake binciken MAC ba haka ba ne.

Duba fitarwar, ba lambar fita ba

Matsayin fita na sifili yana cewa umarnin ya gudana, ba cewa fayil ɗin yana ɗauke da abin da kake tsammani ba. Ƙidaya takardun shaida a cikin fitarwar kuma karanta subject da kwanaki: openssl x509 -in client-certificates.pem -noout -subject -dates -fingerprint. Kwatanta sawun yatsa da abin da ƙungiyar tallafi ke tsammani, domin ƙungiya mai takardun shaidar abokin ciniki biyu tana samar da fayil mai tubalan biyu kuma yawancin kayan aiki suna karanta na farko kawai. Manufa, amana da daidaiton maɓalli kuma gwaje-gwaje daban ne.

Takardar shaida da za a iya bincikawa takardar shaida ce da za a iya bincikawa. Ba takardar shaida ba ce da VPN ke karɓa.

Yanke shawara ko kana buƙatar fayiloli kwata-kwata

Idan abokin cinikin da ke karɓa yana shigo da PKCS12 kai tsaye, aika ainihin ƙungiyar ta hanyar da aka amince da ita tare da ajiye kalmar sirri daban ya fi sauƙi kuma yana kiyaye kariya. Ciro yana don dubawa, don abokin ciniki da ke buƙatar PEM, ko don shari'ar tallafi da ta nemi takamaiman kayan aiki. Kowane ciro yana cire wani Layer kuma ya kamata ya sami dalili.

Takardun shaida na jama'a ba su ɗauke da maɓallin sirri ba, amma suna ɗauke da sunaye da bayanan ƙungiya. Raba filayen da tikit ɗin ya nema maimakon fayil ɗin, sai dai idan fayil ɗin ne aka nema.