Takardar shaidar ganye tana aiki, sarkar ta ƙare: karanta zurfin

Kuna duba takardar shaidar uwar garke, kuna ganin sauran watanni a agogo, kuma abokin ciniki har yanzu ya ƙi haɗin tare da saƙon ƙarewa. Ranar da kuka karanta ta ganye ce, kuma ƙarar na iya kasancewa game da wani abu mai zurfi a cikin hanyar. Tabbatarwa tana tafiya sarkar, kuma kowace takardar shaidar da wannan tafiyar ta zaɓa na iya gazawa a cikin nata taga ingancin. Karanta wacece ta gaza kafin sabunta wani abu.

Zurfin yana ambaton takardar shaidar da ta gaza

A cikin binciken OpenSSL, zurfi 0 ita ce takardar shaidar manufa kuma zurfi 1 shine mai bayarwa wanda ya sanya hannu a kanta, tare da manyan lambobi suna ci gaba zuwa ankwarsa amincewa. Ƙarewar da aka ruwaito a zurfi 1 baya cin karo da notAfter na yanzu a kan ganye, don haka sake duba takardar shaidar da ake gani ba zai taɓa bayyana kuskuren ba.

Yi rikodin sawun yatsan takardar shaidar da ta gaza tare da batunta, domin takardu daban-daban na iya ɗaukar sunan CA ɗaya. Sa hannu na giciye yana haifar da daidai wannan yanayi: hukuma ɗaya tana bayyana fiye da sau ɗaya, da kwanakin inganci daban-daban, kuma mai tabbatarwa ya zaɓi wanda ba ku tsammani ba. Alama da aka sani ba ita ce mai ganowa ba, kuma sawun yatsa shine abin da ke bambanta abubuwa biyu da suke da suna ɗaya.

Kuma kula da kayayyakin da ke da fiye da rawar takardar shaidar guda ɗaya. A OpenVPN Access Server, takardun shaidar da ke kare mu'amalar yanar gizo sun bambanta da waɗanda ake amfani da su don haɗin VPN, don haka burauza da ke buɗe shafin gudanarwa ba ta tabbatar da komai game da hanyar ramin ba.

Shigarwar amincewa ba ɗaya ce da 'yan takarar sarkar ba

Ba wa mai tabbatarwa shigarwar biyu daban kuma a bayyane. Fayil ɗin amincewa yana riƙe da ankwarsa da kuke karɓa; tarin da ba a amince da shi ba yana riƙe da takardun shaidar tsakiya da ake bayarwa don gina hanyar. Haɗa su shine yadda mutane ke ɗaga takardar shaidar tsakiya zuwa tushe bisa kuskure sannan su yi mamakin dalilin da yasa irin wannan kuskuren ke binsu tsakanin injuna.

$ openssl verify -verbose -show_chain -purpose sslserver \
    -CAfile trusted-roots.pem -no-CApath -no-CAstore \
    -untrusted intermediates.pem server.pem

Kashe hanyar da ma'ajiyar tsohuwar da -no-CApath -no-CAstore yana riƙe gwajin da gaskiya: sakamakon yana dogara ne akan fayilolin da kuka ambata, ba akan abin da tashar aiki ta amince da shi ba bisa kwatsam. Bayanin tabbatarwa na OpenSSL yana rubuta waɗannan zaɓuɓɓuka da binciken da suke haifarwa.

-show_chain yana buga sarkar da aka gina lokacin da tabbatarwa ta yi nasara, wanda ke da amfani don tabbatar da cewa hanyar ita ce da kuka yi niyya. Lokacin da ta gaza, riƙe zurfin da batun da aka ruwaito; waɗannan filaye biyu suna gaya wa mai karatu na gaba wace takardar shaidar ya duba.

Abin da wannan ba ya yi shine sake haifar da manufofin kowane abokin ciniki. Fil, takurawar manufa ko duba ainihi ta musamman na abokin ciniki suna rayuwa a cikin abokin ciniki, ba a cikin wannan umarnin ba. Waɗannan sune saitunan da za a duba lokacin da tabbatarwa ta wuce akan uwar garke kuma haɗin har yanzu ya gaza. Raba binciken biyu, in ba haka ba za ku sabunta takardar shaidar lafiya kuna bin kuskuren pinning.

Abin da binciken ke tabbatarwa da abin da ya bar waje

Wannan binciken hanya ne da manufa akan fayil ɗin amincewa da kuka bayar. Don duba sunan HTTPS, ƙara sunan mai masaukin da ake tsammani ta hanyar zaɓin da ya dace; don haɗin VPN, riƙe duban ainihi da aka saita na abokin ciniki kuma yi amfani da kayan amincewa da abokin cinikin da kansa yake karantawa.

Abin da uwar garke ke aikawa saitin 'yan takara ne, ba hanyar da abokin cinikinku zai gina a ƙarshe ba. Amincewar gida da ka'idojin ginin ɗakin karatu duka suna siffanta sakamakon, shi yasa amsa ɗaya na iya tabbatarwa a kan inji ɗaya kuma ta gaza a wata. Kwatanta ma'ajiyar amincewa da ake kula da ita da aiwatar da TLS na abokin cinikin da ya gaza da na abokin cinikin da ke aiki kafin ɗaukan kimantawa iri ɗaya. Bambanci a can yana bayyana yawancin rahotannin „wannan kwamfutar tafi-da-gidanka ce kawai ke gaza“.

Don ganin taga kowace takardar shaidar maimakon ɗaya bayan ɗaya, buga su a matsayin saiti:

$ openssl x509 -in server.pem -noout -subject -dates
$ openssl crl2pkcs7 -nocrl -certfile intermediates.pem \
    | openssl pkcs7 -print_certs -noout

Wannan umarni na biyu yana lissafa batutuwa da masu bayarwa ba tare da yin kwaskwarimar kowane fayil da hannu ba, haka zaka gano takardar shaidar tsakiya wadda ranarta ta wuce yayin da ganyen har yanzu yana kama da lafiya.

Gyara hanyar ba tare da raunana tabbatarwa ba

Lokacin da aka bayar da takardar shaidar tsakiya da ta ƙare ko kuma takardar shaidar giciye da ta tsufa, sami sarkar da mai bayarwa ke tallafawa a yanzu kuma tura ta ta hanyar aikin takardar shaidar da aka rubuta na sabis ɗin. Lokacin da abokin ciniki ba shi da ankwarsa da ake kula da ita da ake nufi, sabunta tsarin amincewar da ake sarrafawa ko software na abokin ciniki. Yi tsayayya da gajeriyar hanyar yi wa kowace takardar shaidar a cikin tarin alama a matsayin tushe don yin shiru da saƙon kawai.

Maganar tushe ta cancanci bayanin kula, domin taƙaitawa sukan wuce gona da iri. RFC 5280 yana ɗaukar ankwarsa a matsayin shigarwar da ke waje da hanyar da ake sa ran, yayin da OpenSSL ke rubuta duba ingancin da ya haɗa da takardar shaidar CA ta tushe. Duk maganganun biyu gaskiya ne ga tsarin nasu; daidaita halin ƙarewar tushe na ɗakin karatu ɗaya zuwa kowane abokin ciniki yana haifar da amsoshi marasa gaskiya cikin tabbaci.

Bayan canjin, tilasta sabon tabbacin ainihi akan abokin cinikin da abin ya shafa kuma tabbatar da cewa takamaiman saƙon ƙarewar ya tafi. Sabunta ganyen ne kawai idan ganyen da kansa bai dace ba. Kashe duba lokaci ko maido da takardar shaidar giciye ta tarihi ba ya haifar da ingantacciyar hanyar yanzu; yana jinkirta gazawar gaba kawai.