Proxy na HTTPS yana nufin haɗin TLS biyu, ba ɗaya ba
Tsallakewar proxy da gidan yanar gizo dangantakar TLS daban-daban ne da amincewa daban. Karanta wace ƙarshen ya kasa kafin ka canza kowane saitin takardar shaida.
Alamar proxy na HTTPS tana bayanin jigilar tsakanin abokin ciniki da proxy kawai, ba wani abu ba. Ba ta faɗin cewa gidan yanar gizon da ke bayansa an ɓoye shi da wannan haɗin, kuma ba ta faɗin cewa proxy na iya karanta shafin. Da zarar ka raba haɗin biyu, kurakuran takardar shaida sun daina zama abin asiri kuma kwatancen da VPN ya zama tabbatacce.
Ma'auratan ƙarshe biyu, tabbaci biyu
A al'adar yanayin rami akwai dangantakar TLS biyu. Na farko yana tafiya daga abokin cinikinka zuwa proxy kuma yana tabbatar da proxy. Na biyu yana tafiya daga abokin cinikinka zuwa gidan yanar gizon da ke cikin ramin, kuma yana tabbatar da gidan yanar gizon. Suna kasawa dabam kuma ana daidaita su dabam.
Suna da shawarwarin amincewa dabam, sarƙoƙin takardar shaida dabam da saƙonnin kasa dabam. Proxy da ke amfani da CA na ƙungiya da gidan yanar gizo na jama'a da ke amfani da sarka ta jama'a na iya buƙatar daidaitaccen tabbaci daban bisa doka, kuma wannan ba kuskuren daidaitawa ba ne.
Ka ɗauke su a matsayin haɗin biyu da suka yi tarayya da socket ɗaya, domin haka suke.
Abin da CONNECT ke rami a zahiri
Abokin ciniki yana aika buƙatar CONNECT yana ambaton mai masauki da tashar, kuma proxy yana buɗe haɗin TCP zuwa wannan manufa. Bayan proxy ya amsa, bayanan da suka biyo ana isar da su ba tare da fassarori ba, shi ya sa musayar hannu ta TLS na gidan yanar gizo ke wucewa ta proxy ba ta canzawa. Don haka proxy yana sanin sunan manufa da bayanan haɗin, kuma ba ya karɓar shafukan da aka buɗe daga wannan tsarin.
Wannan bambanci shi ne dukan hujjar tsaro ta yanayin rami, kuma ita ce iyakarsa.
Proxy na HTTP ba tare da TLS a tsallakewar proxy ba har yanzu yana ɗaukar gidan yanar gizo na HTTPS ta CONNECT. Musayar abokin ciniki-da-proxy a bayyane take yayin da haɗin gidan yanar gizon ba haka yake ba, kuma kiran dukan abu proxy na HTTPS yana ɓoye wannan bambancin.
Wace takardar shaida ta kasa
Lokacin da tabbaci ya kasa, karanta ƙarshen da aka ambata a cikin kuskure kafin ka canza kowane saitin amincewa. Kuskuren biyu suna kama da juna a tashar, kuma suna nuni ga gyare-gyare daban-daban, saboda haka tambayar farko koyaushe ita ce wace haɗi ta ƙi.
curl yana raba zaɓuɓɓukan saboda wannan dalili. Fayil ɗin CA na proxy yana daidaita tabbacin proxy, yayin da fayil ɗin CA ke daidaita tabbacin uwar garke, kuma halin ajiyar amincewa da ya dace shi ma ya dogara da yadda aka gina curl.
curl -v --proxy https://proxy.example.net:443 \
--proxy-cacert org-ca.pem --cacert public-ca.pem https://www.example.com/Danne tabbaci ba gyara ba ne. Ba ya tabbatar da komai game da kowane ɗaya daga cikin ƙarshen biyu.
Bincike wani tsari ne daban
Binciken TLS ba rami ba ne. Mai shiga tsakani mai bincike yana ƙare dangantakar amincewa da gidan yanar gizo kuma yana gabatar da takardarsa ta shaida ga abokin ciniki, don haka abokin ciniki yana tabbatar da mai shiga tsakani maimakon rukunin. Wannan na iya zama halal a ƙarƙashin tsarin da aka amince da shi, kuma da'awa ce ta daban sosai daga isar da bayanai byte da byte. Kada ka ɗauka kowane proxy yana bincike, kuma kada ka ɗauka cewa tsallakewar proxy da aka ɓoye yana hana hakan.
CA na ƙungiya a cikin ajiyar amincewarka alama ce ta wace tsari kake ciki, ba hujja ba. Tambayi tsarin maimakon cire shi daga sarkar takardar shaida.
Waɗannan tsare-tsare biyu suna ba da amsoshi daban-daban ga tambayar wanene zai iya karanta shafin.
Kwatanta proxy da VPN a kan layuka huɗu ɗaya
Kwatancen yana da amfani ne kawai lokacin da aka kwatanta duka biyun a hanya ɗaya.
| Line | What to state |
|---|---|
| Protected segments | Which hops are encrypted, and between which endpoints |
| Verified identities | What each end proves, and against which trust anchor |
| Trusted intermediaries | Who can read or alter traffic by design |
| Traffic included | Which processes and destinations the policy actually covers |
Proxy da aka daidaita don buƙata ɗaya yana rufe wannan buƙatar. Ba ya tura kowane tsari a na'urar ta cikinsa, kuma umarnin misali daidai yake da ƙunci haka. Rufe VPN ya dogara da hanyarsa da manufofin aikace-aikacensa, waɗanda kuma dole ne a bincika maimakon ɗauka. Babu ɗayan zaɓin da ke rufe komai kawai saboda an shigar da shi.
Rubuta layuka huɗu ga kowane zaɓi kuma gardama takan warware kanta. Kwatancen da ke da amfani ba shine wace alama ta fi jin ɓoye ba. Shi ne waɗanne sassa suke da kariya, wanene ake tabbatarwa a ƙarshensu, waɗanne masu shiga tsakani kuka amince da su, da wace hanya kuke da ita a zahiri.