Yadda ake Yi HTTPS Buƙatar Farko Ta hanyar VPN

Mai binciken da ke farawa da farko kuma ya sauka bayan turawa ya riga ya aika da buƙatu ɗaya a sarari, kuma VPN baya canza hakan. Ramin yana kare kafa daga abokin ciniki zuwa kullin fita; ba ya ɓoye wani abu a sama da layin jigilar kayayyaki, don haka mai kallo tsakanin fitowar da asalin har yanzu yana ganin zaren rubutu. Yin HTTPS buƙatun farko shine canjin gefen abokin ciniki tare da sassa uku: ainihin adireshin HTTPS, yanayin haɓaka mai binciken, da manufofin shafin. Matakan da ke ƙasa sune odar da nake amfani da su, kowanne tare da cak ɗin da ke gaya muku ko ya ɗauka.

Mataki 1: tabbatar da menene ainihin buƙatun farko

Kafin canza wani abu, duba abin da mai lilo ya aika. Bude cibiyar sadarwar da aka sake loda shafin daga cache mai sanyi kuma karanta jere na farko: idan makircin shine http kuma matsayi shine 301 ko 308, duk abin da ke bayan wannan layin shine buƙatu na biyu. curl -sS -o /dev/null -w '%{http_code} %{url_effective}\n' http://example.com yana sake fitar da jeri iri ɗaya a wajen mai binciken kuma yana buga URL ɗin da kuka gama dashi.

Sakamakon biyu yana yiwuwa kuma suna buƙatar gyara daban-daban. Idan rukunin yanar gizon yana hidimar HTTPS akan mai masaukin baki ɗaya, gyara shine a daina buga fom ɗin HTTP: sabunta alamar, hanyar haɗin wiki, gajeriyar hanyar tebur da samfurin imel ɗin mutane suna danna. Idan rukunin yanar gizon ba ya amfani da HTTPS kwata-kwata, babu saitin burauzar da zai haifar da shi, kuma amsar gaskiya ita ce matsalar. Kar a rubuta akan shari'a ta biyu tare da keɓancewa, saboda keɓan satifiket akan shafin asusu yana canza matsalar sufuri zuwa matsalar tantancewa. Rubuta ko wane hali kuke ciki kafin ku taɓa saiti.

Mataki 2: kunna yanayin HTTPS-kawai mai burauza

Yanayin haɓakawa shine sashi na biyu, kuma hanyoyin ba su canzawa. Bincika abin da naku ke yi kafin kunna shi: haɓakawa shiru, haɓakawa tare da faɗakarwa, ko ƙi ɗauka.

A cikin Firefox masu sarrafawa suna rayuwa a bayaabout:configkuma a cikin shafin saitin sirri, tare dadom.security.https_only_modekamar yadda sauyawa da keɓanta kowane rukunin yanar gizo ke gudanarwa daga menu na makullin. A cikin Chrome da Edge ra'ayin iri ɗaya yana zaune a ƙarƙashin Saituna, Sirri da tsaro, Tsaro, mai lakabin Yi amfani da amintattun haɗi koyaushe. Ko menene alamar, tabbatar da halin da ake ciki a kan mai watsa shiri wanda kawai ke amsawa akan tashar jiragen ruwa 80, saboda yanayin da ke haɓakawa sannan kuma ya faɗi baya cikin shiru ba shine kariyar da kuke tunanin kun kunna ba. The Takaddun HTTPS kawai Firefox yana fitar da haɓakawa, faɗakarwa da kuma keɓanta hali na mai binciken.

Mataki na 3: gyara albarkatun, ba kawai sandar adireshin ba

Lokacin da haɓakawa ya gaza, karanta ainihin kuskuren maimakon mashigin adireshi. Mai watsa shiri ba tare da mai sauraron HTTPS ba, sunan mai masaukin da bai dace da takardar shaidar ba da sarkar da ta ƙare suna samar da saƙon daban-daban kuma na masu mallakar daban-daban. Na farko kawai shine rata ta gefen uwar garken; na biyu yawanci alamar shafi ne wanda ba a taɓa sabunta shi ba; na uku shine matsalar sabuntawa wanda haɗin VPN ba shi da mahimmanci.

Kar a ƙara keɓanta takaddun shaida zuwa rukunin asusun saboda VPN yana kunne. Banda ya hana cak ɗin da zai kama daidai tsangwama da VPN ake nufi don hanawa.

Kashi na uku yana cikin shafin, kuma shine wanda mutane suka rasa. Shafin da ke lodi akan HTTPS yana iya ciro hotuna, rubutu ko rubutu daga URL ɗin http, kuma mai binciken zai toshe su ko rage alamar tsaro ga duka shafin. Bincika buƙatun da suka gaza a cikin rukunin cibiyar sadarwa kuma gyara nassoshi na albarkatu a wurin mai su maimakon ɗaukan adireshin adireshin ya bayyana kowace buƙata. A kan rukunin yanar gizon da kuke gudana, wannan yana nufin gyara URLs da aka adana a cikin CMS ko samfuri maimakon sake rubuta su a cikin burauzar. Idan ba za ku iya canza tushen ba, yi rikodin abin da aka gauraye a matsayin sanannen gibi, saboda kulle-kulle a kan shafin da ke jan albarkatun rubutu siginar ƙarya ce.

Mataki na 4: abin da HSTS ke ƙarawa, da abin da ba ya yi

HSTS manufa ce ta rukunin yanar gizo maimakon fifikon burauza, kuma ita ce hanya ɗaya tilo a nan da ke tsira daga buga akan sabon bayanin martaba. Da zarar mai bincike ya ga taken Strict-Transport-Security na mai watsa shiri, sai ya sake rubuta buƙatun zuwa https kafin aika su, wanda shine ainihin kayan da kuke so. Ba ya yin kome ga rundunar mai binciken bai taɓa ziyarta ba, kuma ba komai don wani sunan mai masaukin baki da ke aiki iri ɗaya.

Duba abin da asalin ke aikawa da curl -sSI https://example.com | grep -i strict-transport-security. Babban kan da ya ɓace shine canjin uwar garken kuma ba wani abu da abokin ciniki zai iya sakawa ba. Idan akwai, karanta max-age kuma ko an saita includeSubDomains, saboda gajeriyar max-age yana ƙarewa tsakanin ziyara da ɓacewa includeSubDomains yana barin kowane yanki mara tsaro. RFC 6797 yana bayyana yadda wakilin mai amfani ke aiwatar da manufofin da abin da zai yi watsi da shi. Preload alkawari ne daban, don haka duba matsayi ta hstspreload.org API kafin yin alƙawarin kowa cewa yanki yana cikin jerin.

Tabbatarwa da juyawa

Juyawa baya yana da arha ga saitunan abokin ciniki kuma yana da tsada ga HSTS. Kashe yanayin HTTPS-kawai yana dawo da halin da ya gabata nan da nan; dogon max-age baya, kuma baƙi waɗanda suka rigaya suka karɓa suna ci gaba da haɓakawa har sai ya ƙare.

Don haka tabbatar da tsari kafin kiran an yi. Sake saukewa daga cache mai sanyi kuma tabbatar da buƙatun farko a cikin rukunin cibiyar sadarwa shine https ba tare da turawa ta gaba ba. Sannan duba wani yanki, saboda includeSubDomains shine inda waɗannan manufofin sukan zama kunkuntar fiye da yadda ake zato. Sannan duba shafi ɗaya wanda ke jan kadarorin ɓangare na uku, tunda gauraye abun ciki shine gazawar da ta tsira daga kowane gyara.

Idan har yanzu buƙatar farko ta kasance http bayan duk wannan, abokin ciniki ba shine mai canzawa ba: hanyar haɗin da mutane ke danna ita ce. Bincika wuraren da kuke sarrafawa don nau'in http na sunan mai masauki, sabunta su, kuma sake gwadawa tare da sake kunna cache iri ɗaya. Tsare tambayar VPN daban a ko'ina, saboda rami ya canza wanda zai iya ganin bukatar kuma baya canzawa ko an rufaffen buƙatun. Layin da za a saka a cikin tikitin shine buƙatar farko ita ce ta fi dacewa, kuma turawa rasidi ne kawai don buƙatar da aka aiko.