PKCS12, PEM ko DER: abin da abokin ciniki na VPN ke buƙata da gaske

A cikin tattaunawar takaddun shaida akwai iƙirari biyu da suke yawo. Na farko shi ne cewa .p12 shine zaɓi mai ƙarfi kuma .pem shine sako-sako; na biyu kuma cewa fayil ɗin rubutu dole ya kasance amintacce don aikawa saboda kana iya karanta shi. Babu ɗayansu da zai tsira minti ɗaya na bincike.

PKCS12, PEM da DER suna bayyana yadda ake tattara abubuwan takardar shaida da kuma lissafta su. Ba su yanke shawara kan wanda ke wancan gefen ba, ko ana amincewa da mai bayarwa, ko fayil ɗin na buƙatar kalmar sirri.

Abin da abokin ciniki ke karɓa tambaya ce ta jituwa. Abin da fayil ɗin ke ɗauke da shi tambaya ce ta ainihi. Raba su biyu kuma yawancin kurakuran shigo da fayil za su daina zama abin asiri.

Kwano uku, tsarin abu ɗaya

Fara da abin da kake da shi da gaske. Takardar shaida sanarwa ce da aka sanya wa hannu game da maɓallin jama'a. Maɓallin sirri wani abu ne daban wanda ke tabbatar da cewa kana sarrafa wannan maɓallin. Sarka ita ce tarin masu bayarwa waɗanda ke haɗa takardar shaidarka da tushen da abokin ciniki ya amince da shi. Duk ukun suna wanzu ba tare da la'akari da tattarawa ba.

Fayil ɗin PKCS12, yawanci .p12 ko .pfx, kwano ne da aka bayyana a cikin RFC 7292 wanda zai iya ɗauke da maɓallin sirri, takarda shaida ɗaya ko fiye da sarka a cikin wani ɗanɗano guda ɗaya da kalmar sirri ta kare, tare da laƙabi da ke suna ainihi. Fayil ɗin PEM wani tsari ne na rubutu da aka bayyana a cikin RFC 7468: jikin base64 tsakanin layukan BEGIN da END, kuma fayil ɗaya zai iya ɗauke da ɗanɗano da yawa a jere. DER shine lissafin binary na tsarin ASN.1 iri ɗaya, kuma jikin PEM a zahiri DER ne da aka naɗe da base64.

Wannan jimlar ta ƙarshe ita ce ta cancanci a tuna. Mayar da PEM zuwa DER yana sake rubuta tsarin, ba abin da ke ciki ba, kuma mayar da shi yana dawo da ainihin byte ɗin.

Lissafi ba rufewa ba ne

base64 haruffan jigilar kaya ne. Ba ya ɓoye komai, kuma kowa zai iya buɗe ɗanɗanon PEM a cikin shell. Fayil ɗin DER binary ne kuma a bayyane yake daidai. Babu ɗaya daga cikin waɗannan halaye da yake kariya, kuma babu ɗaya da ke nuna akwai kalmar sirri.

Ainihin kariya tana cikin kayan maɓalli. Kunshin PKCS12 na iya ɓoye abin da ke ciki da maɓallin da aka samu daga kalmar sirri. Ana iya ɓoye maɓallin PEM na sirri da tsohon ɗanɗanon kanun kai ko a ajiye shi a cikin PKCS#8 EncryptedPrivateKeyInfo. Takardar shaida ita kaɗai ba ta ɗauke da wani abu na asiri, saboda haka fitarwa da ta samar da takardar shaida kawai tana barin abokin ciniki ya kasa tabbatar da kansa, ko da wane tsari ka naɗe ta.

Ƙarin bayani ne, ba yarjejeniya ba. Fayilolin da suka ƙare da .cer da .crt suna bayyana a cikin duka lissafai, kuma na'urori suna fitar da takaddun shaida na DER a ƙarƙashin sunayen .pem da yawa har yin hasashe daga ƙarshen suna yana ɓata rana. Karanta byte ɗin farko maimakon: fayil ɗin PEM yana buɗewa da layin BEGIN, yayin da DER ke farawa da 0x30 saboda tsarin waje SEQUENCE ne.

Me ya sa shigo da fayil yake gazawa da gaske

Saƙonnin kuskure na abokin ciniki suna matse matsaloli daban-daban a cikin jumla ɗaya game da takardar shaida mara inganci, don haka raba su bisa dalili. Wanda ya fi yawa shine rashin daidaituwar lissafi: abokin ciniki da ke nazarin PEM yana mayar da kuskuren nazari a kan fayil ɗin DER, kuma gyaran shine juyawa ba sabuwar takarda shaida ba. Na biyu shine maɓallin da ya ɓace, inda takardar shaidar take daidai kuma ba za a iya tabbatar da ainihi ba. Na uku sarka ce, inda kunshin da ba shi da takardar shaida ta tsakiya yake kama da daidai a cikin taga shigo da fayil sannan ya gaza yayin musayar hannu.

Sigar ɓoyewa suna haifar da na huɗu, kuma yana kama da kalmar sirri mara kyau daidai. Tsofaffin na'urori sun fitar da fayilolin PKCS12 da RC2-40 da 3DES, waɗanda OpenSSL 3 ke ƙi sai an loda mai bayarwa na legacy. Sake fitarwa daga na'urar da AES-256-CBC da PBKDF2 shine magani mai ɗorewa. Barin tsofaffin sirri a kunne har abada a na'urar abokin ciniki don fayil ɗaya ciniki ne mara kyau.

Na biyar shine rashin tabbas. Kwano da ke ɗauke da maɓallai biyu da takaddun shaida biyu, ko fayil ɗin PEM da ɗanɗanon CERTIFICATE uku, yana tilasta abokin ciniki ya zaɓa, kuma zaɓinsa yawanci shine abu na farko kawai. Lokacin da tunnel ya tashi da ainihin da ba daidai ba, yawanci wannan ne dalilin.

Bincika kafin ka juyar

Karanta tsarin ba tare da buga asirai ba. openssl pkcs12 -in bundle.p12 -info -noout yana bayar da rahoton algorithms ɗin ɓoyewa da laƙabai yayin da yake danne fitar da maɓalli da takardar shaida, kuma littafin openssl-pkcs12 yana rubuta tutoci. Cire -noout da ƙara -nodes don samar da fayilolin da kake niyyar ajiyewa ne, ba don kallon gaggawa ba, domin yana rubuta maɓallin sirri a fili.

Don takardar shaida, openssl x509 -in cert.pem -noout -subject -issuer -dates yana amsa abin da taga shigo da fayil ba zai amsa ba, kuma ƙara -ext subjectAltName yana nuna sunayen da takardar shaidar take da inganci a kansu da gaske. Idan fayil ɗin DER ne, ƙara -inform DER; wannan tuta ɗaya tana warware yawancin kurakuran unable-to-load.

Daidaita maɓalli da takardar shaida aikin inji ne, kuma ya cancanci yi kafin kowace shigo da fayil:

openssl x509 -in cert.pem -noout -pubkey | openssl sha256
openssl pkey -in key.pem -pubout | openssl sha256

Daidaitattun digest suna nufin ma'auratan suna tare. Bambance-bambancen digest suna nufin kana da maɓallin da ba daidai ba, kuma babu wani juyin tsari da zai canza hakan.

Abin da tsarin ba ya canzawa har abada

Shawarwarin amincewa suna faruwa a sama da kwano. Abokin ciniki yana tafiya sarkar zuwa tushe a cikin ajiyarsa, yana duba taga inganci, yana duba amfanin maɓalli mai zurfi don tabbatar da abokin ciniki, kuma a gefen uwar garke yana duba cewa sunan da ya buga yana cikin takardar shaida. Babu ɗaya daga cikin waɗannan matakan da ke karanta ƙarin fayil.

Shi ya sa sake sunan fayil har sai kuskure ya ɓace hanya ce mai aminci ta ɓata lokaci. Shigo da fayil yana yin nasara, ainihin har yanzu ba daidai ba ne, kuma gazawar tana sake bayyana yayin musayar hannu inda saƙon ba shi da taimako sosai. Shi ya kuma sa kunshin da aka fitar shekaru biyu da suka wuce ana shigo da shi cikin tsafta kuma har yanzu ana ƙi shi: ranar ƙarewa ta yi tafiya cikin takardar shaida, ba a cikin sunan fayil ba.

Tsari da ke guje wa sake aiki

Tambayi takardun abokin ciniki waɗanne lissafai yake karɓa da wane kwano yake tsammani don ainihin abokin ciniki, sannan ka duba abin da aka ba ka. Idan abokin ciniki yana son ainihi ɗaya da za a shigo da ita kuma kana da fayilolin PEM a kwance, gina kunshin sau ɗaya da kalmar sirri da kake sarrafawa ka ajiye tushen. Idan yana son PEM, ciro maɓalli da sarka, sannan ka cire fayilolin tsakiya ta hanyar tsarin sarrafa takardun shaidar da ƙungiyarka ke amfani da ita tuni.

Bayan shigo da fayil, tabbatar da ainihi maimakon taga: batu, mai bayarwa, ƙarewa da sunan da abokin ciniki zai gabatar. Suna mai daɗi a cikin jeri alama ce, ba ainihin da aka tabbatar ba. Idan tunnel ɗin ya gaza bayan haka, kana gyara tabbatarwa ko turawa maimakon tattarawa, wanda ya fi guntu sosai.