An rasa takardar shedar abokin ciniki? Soke ta da lambar serial, ba da suna ba

Fayil ɗin shaidar abokin cinikinka ya ɓace, kuma hanzari shi ne a soke sunan sannan a fitar da sabuwa. Wannan hanzarin yana barin ainihin shaidar da inganci, domin sokewa tana aiki ne bisa lambar serial ba kan lakabi ba. CA kusan tabbas tana riƙe da kwafin abin da ta fitar, kuma nemo wannan kwafin shi ne dukan aikin.

Rasa fayil ba rasa rikodin CA ba ne

Easy-RSA PKI tana adana shaidun jama'a da ta fitar, kuma sabbin bugu suna ajiye kwafin bisa serial a cikin babban fayil ɗin certs_by_serial na PKI. Ba a buƙatar maɓallin sirri don soke komai. Abu mafi muhimmanci shi ne ainihin shaidar da CA ta sanya hannu, wadda CA ke da ita tuni.

Yi aiki a kan kwafin ajiya na PKI daidai, tare da mai kula da ke da shi. Sokewa aiki ne da za a iya bincikewa, ba gyara a kan bayanan samarwa da tsakar dare ba.

Kwafin shaidar jama'a ta ciki ta abokin ciniki ma tana aiki, idan tsarin ya adana ɗaya.

Fara karanta mai fitarwa da lambar serial

Bincika PEM da aka dawo da shi sannan ka rubuta mai fitarwa, lambar serial, batun da lokacin inganci. Lambar serial ta keɓanta a cikin iyakar mai fitarwa ɗaya, ba a dukan CA a yankinka ba, saboda haka mai fitarwa wani ɓangare ne na asalin. Idan shaidu da yawa suna da batu ɗaya, waɗannan lambobin serial ne ke bambanta su.

Daidaita ƙimar da rikodin CA da na'urar ko mutumin da kake tunanin yana riƙe da shaidar.

Ana iya sake amfani da suna na gama gari, kuma yawanci haka ake yi. Kada ka yanke shawarar wace shaidu za a janye har sai an rubuta lambobin serial.

Me ya sa soke sabuwar shaidar ba ya yin komai

Fitar da maye gurbi da sunan gama gari ɗaya yana haifar da shaida ta biyu mai lambar serial daban. Soke maye gurbin yana janye sabuwar kuma yana barin ta asali da inganci har sai ta ƙare. A ganin CA waɗannan abubuwa biyu ne masu zaman kansu, kuma CRL tana lissafin lambobin serial ba sunaye ba. Index ɗin CA yana riƙe layi ɗaya ga kowace shaidar da aka fitar saboda wannan dalili.

Wannan rikicewar tana haifar da kuskuren akasin haka: share fayil ɗin abokin ciniki da ɗauka cewa CA ta manta da shi. Sharewa a wajen abokin ciniki ba taron sokewa ba ne, kuma shaidar tana ci gaba da aiki ga duk wanda ke da kwafi.

Dukan kuskuren biyu suna zuwa ne daga ɗaukar suna a matsayin asali.

Soke shaidar da lambar serial ta ambata

Gano abin kafin ka taɓa CA: openssl x509 -in recovered-client.pem -noout -issuer -serial -subject -dates yana buga ƙimomin huɗu a bugu ɗaya, kuma serial ita ce abin da kake daidaitawa da ajiyar CA. Easy-RSA tana ajiye wannan ajiya a ƙarƙashin pki/certs_by_serial, da fayil ɗaya da sunan kowace serial. Umarnin sokewa yana karɓar suna na gama gari ba serial ba, don haka kwafi fayil ɗin ajiyar zuwa pki/issued/<common-name>.crt kuma bar sunan ya nuna abin da ka gano. Gudanar da easyrsa revoke <common-name> daga babban fayil ɗin PKI, sannan duba cewa layin da ya dace a cikin index.txt ya koma R. Serial ita ce hanyar da kake zaɓar abin, ba hujjar da umarnin ke karɓa ba.

openssl x509 -in recovered-client.pem -noout -issuer -serial -subject -dates
cp pki/certs_by_serial/A1B2C3D4.pem pki/issued/client-01.crt
./easyrsa revoke client-01
grep -n client-01 pki/index.txt
./easyrsa gen-crl

Idan index.txt bai nuna R ba, tsaya ka karanta kuskuren kafin ka ƙirƙiri CRL, domin CRL da aka gina daga rikodin da har yanzu inganci ba ya janye komai. Sai bayan layin ya juya za ka gudanar da easyrsa gen-crl sannan ka ci gaba da rarraba fayil ɗin.

Wallafa CRL a inda ake aiwatar da shi da gaske

Ƙirƙiri sabon CRL ta hanyar aikin PKI da aka goyi baya, sannan wallafa shi ga kowane mai tabbatarwa da ke aiwatar da sokewar wannan mai fitarwa.

Fayil ɗin da aka sabunta da ke kwance a kan CA ba ya canza komai, domin VPN tana ƙarasa shawarar a wajen nata mai tabbatarwa. Duba mai fitarwa na CRL, lokacin ingancinsa da lambobin serial da aka soke, kuma tabbatar da cewa sabis ɗin yana sake loda fayil ɗin maimakon adana na baya a ajiya. Mallaka da hanya suna da muhimmanci kamar abun ciki: CRL da daemon ba zai iya karantawa ba ya yi daidai da rashin CRL kwata-kwata. Zaɓin crl-verify na OpenVPN yana ambaton fayil ɗin da daemon ke karantawa, don haka duba wannan hanya da mallakar fayil ɗin a cikin tsarin uwar garken.

Tabbatar da yunƙurin haɗi na gaske, ba da tambarin lokacin fayil ɗin ba.

San lokacin da CRL ba kayan aiki daidai ba ne

Idan ba a amince da maɓallin sirri na mai fitarwa ba kuma, janye sanannun serial ba zai hana wanda ba shi da izini sanya hannu kan sabbin shaidu ba. Wannan sauyin amincewar mai fitarwa ne, wato sabuwar CA da shirin rarrabawa, ba wani shigarwa a cikin CRL ba. Kasancewar tsohon mai kula da ya sami dama ba shi kadai ba shaida ce cewa an yi amfani da maɓallin ba daidai ba, don haka sami gaskiyar kafin sake gina amincewa.

Gyaran bayanan fitarwa da hannu don juya harafin matsayi ba ya maye gurbin soke da aka sanya hannu, kuma yana barin CRL cikin rashin daidaituwa da rikodin.

Riƙe serial, CRL da matakin rarrabawa a cikin rubutu ɗaya, kuma bita ta gaba za ta zama karatu kawai. Aikin Easy-RSA yana rubuta umarnin da aka goyi baya don bugun da ka shigar, kuma wannan ita ce kawai hanyar da ta cancanci bi.