Sunan fayil ɗaya ca.crt, takardar shaidar daban: me za a kwatanta

Furofayiloli biyu duk suna ɗaukar fayil mai suna ca.crt, rami ɗaya yana tashi ɗaya kuma yana kasawa da kuskuren sarkar. Buɗe fayilolin biyu gefe da gefe ba safai yake warware wannan ba, kuma kashe tabbatarwa yana warware shi a hanya marar kyau. Tambayar da kuskuren ke yi a zahiri ta fi ƙunci: wace takardar shaidar kowane tsari ke lodawa a matsayin gindin amanarsa, kuma su biyun abu ɗaya ne? Amsa wannan da farko sannan sauran binciken zai sami alkibla. Sunan fayil alamar marufi ne, kuma hanyar da aka rubuta a furofayil ita ma ba ta da iko, don haka komai ya dogara da abin da tsarin ke karantawa a zahiri.

Nemo takardar shaidar da abokin ciniki ke lodawa a zahiri

OpenVPN yana karɓar hukuma a siffofi biyu, kuma siffar ita ce ke yanke shawarar wace baiti ke da muhimmanci. Furofayil na iya nuna fayil na waje da ca, ko saka takardar shaidar cikin toshe <ca> a cikin furofayil ɗin kansa. Idan duka biyu sun kasance, toshe da aka saka yana yin nasara kuma fayil ɗin da ke gefen furofayil ba a taɓa buɗewa.

Karanta furofayil ɗin da ke kasawa kuma gano wace siffa yake amfani kafin kwatanta komai. Kwafi da aka ɗauka daga wani babban fayil na kusa, ko daga fakitin da ɗayan furofayil ya fito, ba ya gaya maka komai game da abin da wannan tsari ke amincewa. Haka ma hanyar da ke cikin saitin: ana warware ta ne dangane da inda aka fara abokin ciniki, wanda ba koyaushe ne babban fayil ɗin da kake kallo ba. Karanta furofayil ɗin, ba babban fayil ɗin ba.

Ana gane takardun shaida ta abin da suke ciki: maɓallin jama'a, jigo da mai bayarwa, taga inganci da sa hannu a kan duk wannan. Fayiloli biyu da baiti iri ɗaya su ne takardar shaidar ɗaya duk sunan da ake kira su, kuma fayiloli biyu da suna ɗaya na iya zama hukumomi marasa alaƙa. Sunan alamar marufi ne, ba ainihi ba.

Yi hoton yatsa na kwafin biyu da openssl

Hoton yatsa hash ne a kan DER encoding na takardar shaidar, siffar da sa hannu ke rufewa, don haka ƙarshen layi da rubutun kai ba za su iya shafar sa ba. Lissafta shi ga kowane fayil kuma kana da igiyoyin hex guda biyu da aka raba da colon waɗanda ko dai sun yi daidai ko a'a. Babu wani abu a cikin takardar shaidar da za a karanta don amsa tambayar kwatancen.

openssl x509 -in /etc/openvpn/office/ca.crt -noout -fingerprint -sha256
openssl x509 -in ~/profiles/lab-ca.pem -noout -fingerprint -sha256

Yana da ban sha'awa ka nuna openssl ga furofayil ɗin kansa, amma yana karanta duk toshe takardar shaidar da ta bayyana farko a cikin fayil ɗin, kuma furofayil yawanci yana ɗaukar <cert> kafin <ca>. Ciro toshewar hukuma, sannan yi hoton yatsa na fayil ɗin da aka ciro, domin wannan ita ce kwafin da abokin ciniki zai yi amfani da shi a zahiri.

sed -n '/^<ca>$/,/^<\/ca>$/p' office.ovpn | sed '1d;$d' > /tmp/office-ca.pem
openssl x509 -in /tmp/office-ca.pem -noout -fingerprint -sha256

Hoton yatsa iri ɗaya na nufin kayan amanar ɗaya ne kuma kuskuren sarkar yana da wani dalili dabam, wanda wani bincike ne dabam. Hoton yatsa daban na nufin takardun shaida daban, kuma a nan ne sashe na gaba ya fara.

Karanta rashin daidaituwa kafin ka yi zaton hari

Hoton yatsa daban na nufin takardun shaida daban kuma babu wani abu fiye da haka. Sake bayarwa, jujjuyawa, hukuma da aka sake wa suna, ko fakitin da ya tsufa duk suna samar da fayiloli daban da tarihin da ya dace gaba ɗaya. Wanne ne na turawa tambaya ce ga mai aiki ko rihistoryin turawa, ba ga lokacin gyaran fayil ɗin ba. Rijiyoyi suna kwafin tambarin lokaci, don haka sabon fayil ba ya zama gindin da ya dace kai tsaye.

Tushen da ke sa hannu da kansa al'ada ce, don haka samun ɗaya ba hujja ba ce ta matsala. Aikin mai tabbatarwa shi ne gina hanya daga takardar shaidar uwar garke zuwa gindin da aka ba shi, kuma kuskuren sarkar yawanci yana nufin ba a iya kammala wannan hanya ba.

Duba ko gindin furofayil ɗin da ke kasawa hukuma ce da turawa ke bayarwa daga gare ta har yanzu. Idan hoton yatsa bai dace da kome a cikin rihistoryin turawa ba, furofayil ɗin ya tsufa kawai, kuma babu wani daidaitawa a gefen abokin ciniki da zai gyara hakan.

Gyara amana ba tare da kashe tabbatarwa ba

Maganin ɗan gajeren lokaci shi ne kashe tabbatarwa ko ƙara kowace takardar shaidar da ke cikin sarkar a matsayin gindi. Duka biyu suna sa saƙon ya ɓace, kuma duka biyu suna canza waɗanne sabar abokin ciniki zai karɓa daga nan gaba. Sake kunna tabbatarwa, shigar da gindin da ake nufi, sannan sake gwadawa.

Idan sarkar yanzu ta ginu amma wani kuskure dabam ya bayyana, wannan ci gaba ne: tabbatar da suna, kwanakin inganci da sokewa gwaje-gwaje ne dabam da saƙonni dabam. Riƙe biyun hoton yatsa da ainihin rubutun kuskuren tare a cikin tikitin, domin na gaba ya ga wane gindi aka lodawa da wane aka yi tsammani. Biyun hoton yatsa ya isa a liƙa a cikin bayanin miƙa mulki, kuma abin da zai faru na gaba zai ɗauki minti biyar maimakon wata rana.

Samu hukumar da ta dace ta hanyar tashar tabbatarwa ɗaya da ta isar da furofayil ɗin. Ciro takardar shaidar daga uwar garke domin jigon ta ya yi kama da sananne aiki ne dabam, kuma yana faɗaɗa abin da abokin ciniki zai amince da shi a hankali.