Ka riƙe tushen CA na VPN ɗinka a wajen layi kuma har yanzu ka ba da takaddun shaida

VPN ɗinka yana amsa haɗin kai da ƙarfe 3 na dare yayin da injin da ke sa hannu kan takaddun shaidarsa yana kashe a cikin aljihu. Abokin ciniki da ke tabbatar da takardar shaidar uwar garke ba ya taɓa tuntuɓar CA ɗinka, don haka CA ba ya buƙatar kasancewa mai isa ga kowane haɗi. Sassan da ke buƙatar tsari shi ne ranar da dole ne a bayar, a sabunta ko a soke takardar shaida yayin da maɓallin tushe ya kasance a kulle.

Abin da haɗi ke tabbatarwa a zahiri

Lokacin da abokin ciniki na OpenVPN ya haɗa, yana bin sarkar sa hannu daga takardar ganyen uwar garke zuwa takardar CA da ya riga ya amince da ita, yana duba taga ingancin, kuma idan bayanin ya faɗi haka, yana duba jerin sokewa. Ba ya taɓa neman tushen CA ɗinka. Uwar garke tana yin kwatancen madubi ga takaddun abokin ciniki. A lokacin haɗi kawai ganye, na tsakiya da kunshin amincewa da ka rarraba a baya ne suke nan.

Abin da ke gazawa a zahiri ɗaya ne daga cikin abubuwa uku: maɓallin sa hannu ba ya samuwa a lokacin bayarwa, jerin sokewa ya tsufa, ko kunshin amincewar abokin ciniki ya fi tsofaffin sarkar da uwar garke ke gabatarwa. Na farko matsalar tsari ce; sauran biyun matsalolin rarrabawa ne. Babu ɗayansu da ke buƙatar maɓallin tushe ya kasance a kan layi, kuma sabis ɗin VPN da aka sarrafa wanda ke buƙatar takardar shaida mai zaman kansa don tabbatar da rami yana mayar da ikon sa hannu ga mai bayarwa kawai. Azure aya-zuwa-wuri yana aiki akasin haka: za ka loda takardar shaidar tushe kuma ana amince da takaddun da aka sa hannu a ƙarƙashinta, don haka ka tambaya wanene ke sa hannu, wanene ke tabbatarwa, da yadda ake janye takardar shaida da wuri.

Ka gina tushen a kan mai masaukin da ba ya taɓa samun adireshi

Ba a yawan amfani da tushen da ba ya kan layi: don sa hannu kan takardar CA ta tsakiya, daga baya kuma don sabunta ko soke ta. Duk sauran suna faruwa mataki ɗaya ƙasa. Yi aikin tushe a kan injin da aka ajiye daga hanyar sadarwa, idan zai yiwu daga tsarin da ke aiki, kuma rubuta wanda ya kasance a ɗakin. Umarnin suna ɗaukan OpenSSL 1.1.1 ko sabo, saboda -addext ba ya cikin tsofaffin ginawa.

openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-256 -out root.key
openssl req -x509 -new -key root.key -sha256 -days 7300 \
  -subj "/CN=Example VPN Root CA" -out root.crt \
  -addext "basicConstraints=critical,CA:TRUE" \
  -addext "keyUsage=critical,keyCertSign,cRLSign"

Ƙirƙiri na tsakiya a kan mai masaukin sa hannu ka kai buƙatarsa kaɗai zuwa injin da ba ya kan layi. Tushen yana sa hannu kan wannan buƙatar da tsawon hanya sifili, don haka CA na tsakiya na iya sa hannu kan takaddun ƙarshe amma ba zai iya ƙirƙirar wata CA a ƙarƙashinsa ba. Wannan faɗaɗawa ɗaya yana hana mai masaukin sa hannu da aka lalata ƙirƙirar ikon daidai da tushe. Yi amfani da ECDSA kawai idan kowane abokin ciniki yana gudanar da OpenVPN 2.4 ko sabo; in ba haka ba ƙirƙiri maɓallan RSA ka kiyaye tsarin daidai.

openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-256 -out intermediate.key
openssl req -new -key intermediate.key -subj "/CN=Example VPN Intermediate CA" -out intermediate.csr
openssl x509 -req -in intermediate.csr -CA root.crt -CAkey root.key \
  -CAcreateserial -days 3650 -sha256 -extfile intermediate.ext -out intermediate.crt

intermediate.ext yana ɗauke da basicConstraints=critical,CA:TRUE,pathlen:0, keyUsage=critical,keyCertSign,cRLSign da authorityKeyIdentifier=keyid:always. Mayar da maɓallin tushe cikin akwatinsa kafin a sake haɗa mai masaukin sa hannu. Idan tushen dole ya iya soke na tsakiya, sa hannu da shi ta openssl ca -config root.cnf -extensions intermediate_ca a kan index.txt na matakin tushe maimakon openssl x509 -req, domin a rubuta lambar jerin; sa'an nan ka aika jerin tushen da aka samu cikin bayanin abokin ciniki, inda crl-verify mai tushen fayil ke karanta shi a lokacin farawa. Aika wa abokan ciniki kunshin da takaddun CA biyu; ganye shi kaɗai ba zai tabbatar da tushen ba.

Ba da ganye daga na tsakiya, tare da bayanan bayanai

Sa hannu da openssl x509 -req yana aiki har sai kana buƙatar sokewa, domin babu abin da ke rubuta lambar jerin. Yi amfani da openssl ca tun daga takardar farko domin lambar jerin, ƙarewa da yanayin sokewa su rayu cikin bayanan bayanai ɗaya. Ƙirƙiri fayilolin bayanan sau ɗaya, sannan ka nuna tsarin zuwa gare su:

mkdir -p /etc/vpn-ca/intermediate/newcerts
touch /etc/vpn-ca/intermediate/index.txt
echo 1000 > /etc/vpn-ca/intermediate/serial
echo 1000 > /etc/vpn-ca/intermediate/crlnumber

[ ca ]
default_ca = CA_default
[ CA_default ]
dir = /etc/vpn-ca/intermediate
database = $dir/index.txt
new_certs_dir = $dir/newcerts
serial = $dir/serial
crlnumber = $dir/crlnumber
certificate = $dir/intermediate.crt
private_key = $dir/intermediate.key
default_md = sha256
default_days = 365
default_crl_days = 30
unique_subject = no
policy = policy_any
[ policy_any ]
commonName = supplied
[ server_cert ]
basicConstraints = CA:FALSE
keyUsage = critical, digitalSignature
extendedKeyUsage = serverAuth
subjectAltName = @server_names
[ client_cert ]
basicConstraints = CA:FALSE
keyUsage = critical, digitalSignature
extendedKeyUsage = clientAuth
[ server_names ]
DNS.1 = vpn.example.com

Layin amfani da maɓalli yana ɗauka maɓallin ECDSA; ƙara keyEncipherment don RSA. Ba kowane abokin ciniki sunansa na gama gari, domin OpenVPN yana gane haɗi ta wannan filin, kuma kwamfutoci biyu masu ɗauke da CN=vpn-client ba za a iya bambanta su a cikin rajistan ayyuka, a cikin ka'idojin client-config-dir ko a kowane turawa na kowane mai amfani ba, kuma za ka rasa alaƙar da ke sa shawarar sokewa ta zama mai iya karewa. Ba da ganye kuma tabbatar da shi haka:

openssl req -new -key alice.key -subj "/CN=alice-laptop" -out alice.csr
openssl ca -config intermediate.cnf -extensions client_cert -in alice.csr -out alice.crt -batch
openssl verify -CAfile ca-bundle.crt -untrusted intermediate.crt alice.crt

Riƙe maɓallin sa hannu bayan iyakar manufa maimakon kwafa shi zuwa mai masaukin VPN: ƙaramin sabis da ke tabbatar da buƙatar, duba sunan gama gari a kan jerin da aka yarda da shi kuma ya mayar da takardar kaɗai. Rubuta kowace lambar jerin; rajistan shi ne kaɗai haɗin tsakanin takardar shaida da mutumin da ya nemi ta.

Wallafa sokewa ba tare da tada tushen ba

Na tsakiya ne ke soke takaddun abokan ciniki, ba tushen ba. Jerin tushe yana da mahimmanci kawai lokacin da aka ƙone wani na tsakiya. Nuna uwar garke ga jerin na tsakiya da crl-verify. Ana loda CRL mai tushen fayil a farkon sabis, don haka sake loda shi bayan kowace sake ƙirƙira; siffar jagora tana karanta yanayi a lokacin haɗi kuma tana kashe fayil ɗaya ga kowace lambar jerin.

Soke kuma sake ƙirƙira da umarni biyu daga bayanan bayanai ɗaya:

openssl ca -config intermediate.cnf -revoke /etc/vpn-ca/intermediate/newcerts/1001.pem
openssl ca -config intermediate.cnf -gencrl -out /etc/openvpn/crl.pem

Sannan ka kula da agogo. CRL yana ɗauke da filin sabunta na gaba, kuma da zarar wannan ranar ta wuce, abokin da ke tabbatarwa ya ƙi jerin maimakon yin watsi da shi. Sake ƙirƙira kowane wata da default_crl_days = 30 yana barin sarari; na shekara-shekara ba ya barin. Gajerun rayuwar ganye sune mafi amincin sarrafawa, domin sokewa tana aiki ne kawai a inda ake duba jerin.

Gwada sarkar, sannan ka rubuta bikin

Sake haifar da gazawa huɗu kafin ka amince da ƙirar. Tabbatar da sarkar da openssl verify -CAfile ca-bundle.crt -untrusted intermediate.crt server.crt. Haɗa da takardar abokin ciniki da ta ƙare ka tabbatar uwar garke ta ƙi ta. Soke abokin ciniki na gwaji, sake loda ka tabbatar jerin ya fara aiki. Ciyar da agogon mai masauki kwana ɗaya gaba, domin agogo mara kyau na iya bayarwa da ƙin takaddun da suke kama da inganci a wani wuri.

Tushen da ba ya kan layi sarrafawa ne kawai idan takardun sun wanzu: mutane biyu da aka ambata don bikin, rikodin kowace lambar jerin da aka sa hannu, ajiyar sirri da aka ɓoye da aka adana dabam da injin, da gwajin dawo da shi a kan mai masauki dabam. Sa hannu kan wani na tsakiya na ajiya a lokacin wannan bikin domin mataccen mai masaukin sa hannu kada ya tilasta maka buɗe tushen da tsakar dare.

Kafin ka kira shi an gama, tabbatar da abubuwa biyar: maɓallin tushe ba ya kan mai masaukin da ke cikin hanyar sadarwa, maɓallin na tsakiya yana rayuwa ne kawai a kan mai masaukin sa hannu, kunshin abokin ciniki yana ɗauke da takaddun CA biyu, CRL yana da sabunta na gaba a nan gaba, kuma wani yana da shigarwar kalanda don kowace ƙarewa a cikin sarkar. Idan ɗaya ya ɓace, saitin da yake kama da ba ya kan layi ba a rubuta shi ba ne kawai.