Wace fayil ɗin CA ke shiga bayanin OpenVPN mai kalmar sirri kawai?

Bi tambayoyi huɗu a jere kuma tattaunawar CA ba za ta zama mai ruɗani ba. Wane kayan ne mai gudanarwa ya bayar da gaske, me bayanin ya riga ya ƙunsa, wane fili ne ke tambaya, kuma me ke faruwa bayan an loda fayil ɗin? Tsaya a tambayar farko da ba za ka iya amsawa daga umarnin mai gudanarwa ba, domin yin hasashe fiye da ita ita ce hanyar da takardar shaidar CA ta jama'a ke haɗewa da maɓallin sirri wanda bai kamata ya taɓa barin uwar garken ba.

Jeri yana da muhimmanci: tambayoyi biyu na ƙarshe suna da ma'ana ne kawai da zarar ka san wane kayan ya kamata ya kasance.

Fara da abin da bayanin ya riga ya ƙunsa

Buɗe bayanin a editan rubutu ka nemo toshe ca kafin ka nemi fayil. Toshe ca na ciki da ke ɗauke da CA na jama'a na mai gudanarwa yana nufin bayanin ya dogara da kansa, kuma abokin ciniki da har yanzu ke neman fayil ɗin CA yana iya karanta wani bayani ko shigowa marar cikawa. Idan bayanin yana da layin ca da ke nuna hanya, wannan hanyar dangi ce ga kundin aikin abokin ciniki a wasu haɗin kai kuma cikakkiya a wasu. Rubuta wane siffa kake da ita kafin ka canza wani abu.

ca /absolute/path/operator-ca.crt
auth-user-pass
remote-cert-tls server

Duba kunshin da aka kawo don fayilolin da bayanin ya ambata: takardar shaidar CA, wani lokaci takardar shaidar abokin ciniki da maɓalli daban, kuma wataƙila fayil ɗin tls-auth ko tls-crypt. Bayanin da ya ambaci fayiloli huɗu amma ya zo da biyu bai cika ba, kuma babu adadin nuna filaye da zai gyara hakan. Nemi ɓangaren da ya ɓace daga mai gudanarwa maimakon maye gurbinsa da takardar shaidar da ka samu kwatsam.

Raba nau'ikan kayan guda huɗu

Takardar shaidar CA kayan jama'a ne da ake amfani da shi don tabbatar da asalin uwar garken. Takardar shaidar abokin ciniki tana nuna mai amfani ko na'urar ga uwar garken. Maɓallin sirri shi ne rabin sirri na wannan takardar shaidar abokin ciniki, kuma bai kamata ya zama maɓallin sa hannu na CA ko maɓallin uwar garken ba. Kayan tls-auth ko tls-crypt wani sirri ne na daban da aka raba wanda ke kare tashar sarrafawa. Waɗannan huɗu ba sa musanya, kuma nuna filin CA ga takardar shaidar abokin ciniki yana haifar da gazawar tabbatarwa da ke kama da matsalar amincewa.

Tabbatarwa da kalmar sirri kawai yana canza wanne daga cikin huɗun kake buƙata, ba ma'anarsu ba. Tare da auth-user-pass da remote-cert-tls server abokin ciniki har yanzu yana tabbatar da uwar garken da CA, shi ya sa filin CA ke bayyana ko da babu takardar shaidar abokin ciniki. Manufar mai gudanarwa ce ke yanke shawarar ko ana buƙatar takardar shaidar abokin ciniki kuma babu wata tattaunawa da za ta gaya maka hakan.

Nuna abokin ciniki ga fayil ɗin amincewa

Zaɓi fayil ɗin takardar shaidar CA kansa, ba babban fayil ɗin da ke ɗauke da shi ba kuma ba kunshin .p12 da ke ɗauke da asalin abokin ciniki ba. A Windows tsarin hanyar da mai zaɓen fayil suna yin daban da misalan Linux a yawancin jagorori, don haka yi amfani da abin da abokin ciniki da aka shigar ya karɓa kuma tabbatar cewa asusun da ke tafiyar da shi zai iya karanta fayil ɗin. Matsalar izini da fayil ɗin da ya ɓace suna kama a tattaunawa amma suna samar da layukan log daban. Bayan zaɓi, sake buɗe saitunan bayanin don tabbatar abokin ciniki ya riƙe zaɓin.

<ca>
-----BEGIN CERTIFICATE-----
...operator-provided public CA...
-----END CERTIFICATE-----
</ca>

Idan abokin ciniki yana goyon bayan toshewar ciki, fifita bayanin ciki na mai gudanarwa maimakon wanda aka haɗa da hannu. Kayan ciki na tafiya da bayanin kuma yana tsira daga sake shigowa, yayin da cikakkiyar hanya ke karyewa a daidai lokacin da aka matsar da bayanin zuwa wata na'ura.

Karanta kuskure na gaba, ba wannan ba

Manufar bayar da daidai CA ita ce a canza kuskuren, ba a sa ya ɓace ba. Gazawar asalin uwar garken bayan an loda CA tana nufin takardar shaidar ba ta dace da sunan da ake tsammani ko tsammanin remote-cert-tls ba, wanda gyara ne daban da ƙin kalmar sirri. Ƙin kalmar sirri yana nufin matakin TLS ya yi nasara kuma takardar shaidar aiki ba daidai ba ce. Riƙe saƙo na farko sabo; shi ne mai amfani.

Abokin ciniki da ke haɗawa amma bai isa ko'ina ba ya wuce amincewa gaba ɗaya kuma yanzu yana fuskantar tambayar hanya ko DNS.

Kada ka taɓa kashe tabbatarwa don wuce wannan tattaunawa. Abokin ciniki da ke karɓar kowace takardar shaidar ba shi da dalilin neman CA, kuma ramin da yake gina ba shine wanda mai gudanarwa ya nufa ba.