An soke takardar shaidar VPN da ba daidai ba? Hanyoyin dawo da iyaka

Wani ya soke takardar shaida a cikin konsol ɗin CA kuma yanzu mai amfani ba zai iya haɗawa ba. Tunani na farko shi ne neman sokewa, kuma a yawancin PKI babu ta: sokewa magana ce da aka bayyana game da lambar serial, kuma hanyar dawo da aka tallafa sabuwar takardar shaida ce, ba bayanan da aka juya ba. Bi gwaje-gwajen da ke ƙasa cikin tsari, domin wane gyara aka ba ka izinin amfani da shi ya dogara da lambar dalili da kuma ko an taɓa fallasa maɓallin.

Gano takardar shaida, ba mutum ba

Sunaye na gama-gari suna maimaitawa. Mai amfani da ya sake yin rajista a kwata ta gabata yana iya riƙe takardun shaida biyu da CN ɗaya da lambobin serial daban-daban, kuma soke ɗaya yana barin ɗayan yana aiki. Fara tabbatar da ainihin abin:

openssl x509 -in client.crt -noout -serial -issuer -subject -dates
openssl crl -in ca.crl -noout -text | head -40

Rubuta lambar serial, mai bayarwa, ranar sokewa da dalilin da aka rubuta a cikin CRL. Sa'an nan tabbatar da waɗɗe na'urori ke gabatar da wannan lambar serial, domin takardar shaidar da aka soke tana iya kasancewa har yanzu a shigar a kwamfutar tafi-da-gidanka, waya da na'urar router ta ajiya, kuma maye gurbin da ya isa ɗaya kawai yana haifar da wata al'amari ta biyu.

Bincike na ɗabi'a mai sauri yana tabbatar da yanayin ba tare da canza komai ba:

openssl verify -crl_check -CAfile ca.crt -CRLfile ca.crl client.crt

Idan ya ba da rahoton an soke takardar, CRL da abokin ciniki sun yarda; idan an tabbatar da shi a tsaftace, abokin cinikin da ke hannunka ba shine wanda aka soke ba, kuma binciken yana ci gaba.

Duba ko CA ya yi amfani da riƙewa ko sokewar dindindin

RFC 5280 ya bayyana certificateHold a matsayin yanayi na wucin gadi, kuma removeFromCRL a matsayin siginar da ke sake shi. Wannan yanayin rayuwa na gaske ne, amma ba maɓallin sokewa na gama-gari ba ne. Karanta lambar dalili yana gaya maka ko mai bayarwa ya taɓa yin niyyar tallafa wa sakin.

Tarkon shi ne ɗauka cewa niyyar wucin gadi tana nufin rikodin wucin gadi. Idan rikodin CA yana ɗauke da keyCompromise ko cessationOfOperation, an soke takardar shaidar har abada ko da menene mutumin da ya danna maɓallin ya yi niyya. Akasin haka, rikodin da aka yiwa alama certificateHold akan CA da ba ya aiwatar da sakin riƙewa yana dawwama a aikace, domin babu abin da zai taɓa wallafa sakin.

CA da suka dogara da OpenSSL suna nuna iyakar. Umarnin ca yana karɓar ƙimar -crl_reason, ciki har da certificateHold da removeFromCRL, amma ba ya samar da CRL na delta — takardun OpenSSL CA sun ambaci wannan iyaka ga fitarwar CRL ɗinsa. Cikakken CRL da kawai ya bar lambar serial ya bambanta tsarin wallafawa da delta da ke cewa "an saki wannan rikodin", don haka liƙa removeFromCRL a cikin CA VPN da ta dogara da OpenSSL ba ya samar da sakin da ka'idoji suka bayyana.

Idan ana iya fallasa maɓallin, maye gurbinsa

Takardar shaidar da aka soke bayani ne cewa wannan maɓalli na iya zama ba za a amince da shi ba kuma. Idan sokewar ta kasance daidai a zahiri — an rasa kwamfutar tafi-da-gidanka, an kwafi maɓalli a faifai da aka raba, an liƙa maɓalli na sirri a tikit — mayar da wannan takardar shaidar tana juya shawarar tsaro da ke aiki yadda ya kamata.

Bayar da sabon maɓallin biyu ta hanyar tsarin yin rajista, rarraba sabon bayanin martaba, kuma bar tsohon lambar serial a soke har tsawon rayuwarsa. Sabunta duk abin da ke ɗora ainihi ta lambar serial ko sawun yatsa, ciki har da jerin shiga, lissafin na'urori da sa ido da ke tsammanin takamaiman takardar shaida.

Hujjar jin daɗin mayar da tsohon gaskiya ce, amma ya kamata a amsa ta a bayyane ba a shiru ba. "Mai amfani yana bukatar shiga yau" dalili ne na hanzarta bayarwa, ba dalilin soke sokewar maɓallin da ba za ka iya ba da lissafi a kansa ba.

Idan kuskuren gudanarwa ne, maye gurbinsa cikin kulawa

Lokacin da sokewar ta kasance kawai kuskure kuma ba a taɓa fallasa maɓallin ba, gyaran har yanzu maye gurbi ne da aka sarrafa ba gyara ba. Yi amfani da tsarin da mai bayarwa ya tallafa, riƙe lambar serial da tarihin bayarwa cikakke, kuma guje wa gajerun hanyoyi biyu masu jaraba: juya alamar matsayi a cikin index.txt daga R zuwa V, da share layin bayarwa don sabuwar takardar shaida ta sake amfani da lambar serial.

A kan CA OpenSSL bayanan suna rabu da tab kuma ana iya karanta su kuskure cikin sauƙi, wanda ke sa gyaran hannu ya zama abin sha'awa:

awk -F'\t' '$1=="R" {print $4, $3, $6}' index.txt

Karanta shi, kada ka rubuta shi. Gyara fayil ɗin yana canza CRL na gaba ba tare da wata alamar dubawa ba, kuma duk wani misali na biyu na CA ko ajiyar da har yanzu ke riƙe layin asali zai saba da shi daga baya.

Bayan bayar da maye gurbin, wallafa sabon CRL ta hanyar da aka saba kuma bar abokan ciniki su ɗauke shi. Cire CRL, rage rayuwarsa zuwa babu, ko kashe binciken sokewa a cikin bayanin abokin ciniki yana gyara mai amfani ɗaya ta hanyar raunana duk wata sokewar da CA ya taɓa wallafawa.

Tabbatar da sabuwar shiga kuma riƙe rikodin

Gwada da sabuwar haɗi, ba da zaman da ya riga ya buɗe ba. Ramin rai mai rai yana iya sake gudanar da gwaje-gwajen shiga da sabon musayar hannu ke yi, kuma ajiyar CRL yana nufin abokin ciniki na iya ci gaba da haɗawa har sai ya wartsake. Katse, sake haɗawa, kuma tabbatar a cikin log ɗin uwar garken wace lambar serial aka karɓa.

Yi rikodin abin da ya faru yayin da yake sabo: wace lambar serial aka soke, da wa, da wane dalili, wane maye gurbi aka bayar, da kuma lokacin da aka sake wallafa CRL. Wannan rikodin shine ke sa bitar sokewar ta gaba ta yiwu, kuma shine shaidar cewa an magance kuskuren ba a ɓoye shi ba.

Don gajerun dakatarwa a nan gaba, yi amfani da tsarin dakatar da shiga idan ɗaurawar tana da shi — asusu da aka kashe a matakin ainihi, an cire memba na rukuni, an riƙe bayanin abokin ciniki. Wannan yana raba shawarar manufa ta wucin gadi daga tambayar ko takardar shaidar da aka bayar har yanzu abin dogaro ce, kuma daidai wannan bambancin ne aka rasa a farkon lokaci.