AWS Client VPN: shahaadada serverka iyo doorka shahaadada macmiilka
Shahaadada serverka ee endpoint-ka waxay caddaynaysaa adeegga. Aqoonsiga labada dhinac wuxuu ku darayaa aqoonsiyo macmiil kasta iyo kalsooni CA iyada oo aan la wadaagin furaha serverka.
Endpoint-ka Client VPN wuxuu had iyo jeer u baahan yahay shahaadada TLS ee serverka. Taasi waa aqoonsiga endpoint-ka la maareeyo soo bandhigo marka macmiilku xirmo. Waa shay ka duwan shahaadaha macmiillada gaarka ah soo bandhigaan marka aqoonsiga labada dhinac la isticmaalayo. Labadan isku qaldiddu waa sababta ugu badan ee ay dejinta ACM si kale sax ah ugu guuldareysato xiriirka koowaad.
Waa kan socodka laga bilaabo console-ka ilaa bannaanka, sida ay xiriirku dhab ahaan u socoto.
Laba door, hal endpoint
Endpoint-ku wuxuu leeyahay aqoonsi server iyo, ikhtiyaar ahaan, hab lagu xaqiijiyo aqoonsiyada macmiillada. Kuwaas si gooni ah ayaa loo habeeyaa. Mid wuxuu go'aamiyaa in macmiilku kalsooni ku qaadan karo adeegga; kan kalena wuxuu go'aamiyaa in adeeggu aqbalo macmiilka.
| Material | Purpose | Where it lives |
|---|---|---|
| Server certificate and private key | The managed endpoint proves its TLS identity | ACM, in the endpoint's Region |
| Client certificate and matching key | An individual client proves its identity | On the device |
| CA trust material | The verifier checks the issuer chain | Selected for the client role |
Shaxda u akhri saddex shuruudood oo madax banaan halkii aad ka akhrin lahayd hal shahaado. Shahaadada serverka iyo furaheeda gaarka ah waxay la joogaan adeegga. Shahaadada macmiilka iyo furaha gaarka ah ee u dhigma waxay ku nool yihiin qalabka. Maaddada CA waa waxa xaqiijiyuhu isticmaalo si uu u hubiyo silsiladda. Kaliya safka dhexe ayaa waligiis ku habboon laptop.
Maxay samaysaa shahaadada serverka ACM
Marka aad abuurto endpoint-ka, shahaadada serverku waa inay ku heli kartaa ACM isla gobolka endpoint-ka. Console-ku wuxuu weyddiistaa ARN, ARN-na waa inuu halkaas ku xallimaa. ACM waxay hayn kartaa shahaado aad ku bixisay xaqiijinta domain-ka, ama mid aad soo dejisatay iyada oo la socota furaheeda iyo silsiladdeeda. Labaduba way ku shaqeeyaan doorkan; way ku kala duwan yihiin cusboonaysiinta iyo cidda haysta furaha gaarka ah.
Dooro dariiqa bixinta ee u dhigma cidda cusboonaysiin karta shahaadada, ma aha tii si shil ah u soo saartay fayl u eg mid sax ah.
Maxay ku daraysaa aqoonsiga labada dhinac
Doorashada aqoonsiga macmiilka ee ku saleysan shahaadada waxay ku daraysaa su'aal labaad: macmiillada kee ayaa xirmi kara. Macmiil kastaa wuxuu soo bandhigaa shahaadadiisa oo wuxuu caddeeyaa inuu haysto furaha gaarka ah ee u dhigma. Aqoonsiyo gooni ah ayaa suurtageliya burrinta xulashada mar dambe. Koobi furaha macmiil keliya qalab kasta wuxuu si aamusnaan ah u tuurayaa hantidaas, xitaa marka shahaadada serverka si fiican loo helay.
Habka aqoonsiga endpoint-ku waa doorasho, ma aha shuruud guud.
Active Directory iyo aqoonsiga federaalku waxay su'aasha isku mid ah uga jawaabaan siyaabo kale. Cunto karinta shahaadada labada dhinac si otomaatig ah uma noqoto naqshadda gelitaanka ee hirgelintaas, xaqiijinta TLS ee serverkana way sii socotaa iyada oo aan loo eegin sida isticmaalaha loo ogolaaday.
Sababta ARN CA isku mid ah aanay ahayn wadaagista furaha
AWS waxay diiwaangelisay in marka shahaadada serverka iyo macmiilka ay soo saarto isla CA, ARN-ka shahaadada serverka sidoo kale loo isticmaali karo doorashada shahaadada macmiilka. Jumladaas waxay ku saabsan tahay silsiladda endpoint-ku ku kalsoonaado xaqiijinta. Ma sheegayso macmiillada inay isticmaalaan furaha gaarka ah ee serverka. Laptop weli wuxuu u baahan yahay shahaadadiisa macmiil iyo furahiisa u dhigma.
Marka CA-da macmiilku tahay soo-saare kale, dariiqa la diiwaangeliyay waa in CA-daas lagu soo dejiyo ACM oo loo doorto doorka macmiilka.
Guuldarada dib ugu celi marxalad
Go'aami marxaladda shilka leh ka hor inta aadan wax beddelin. Haddii macmiilku diido endpoint-ka, ARN-ka serverka ama silsiladdiisu waa tuhmanaha. Haddii endpoint-ku diido macmiilka, eeg shahaadada macmiilka, soo-saarahaheeda iyo habka aqoonsiga la doortay. Haddii tunnel-ku soo baxo oo taraafikadu weli guuldareysato, waxaad ka gudubtay shahaadooyinka.
Hal shay mar beddel, sababtoo ah labada daraf isku mar beddeliddu waxay soo saartaa mugdiga aad ku bilowday.
Sidoo kale hubi algorithms-ka furaha ee adeeggu taageero iyo fidinta loo baahan yahay doorka gaarka ah. Shahaado qancisa website dadweyne ma aha caddayn in dhammaan shuruudaha aqoonsiga Client VPN la buuxiyay.
Qor ARN-ka ay hayso goob kasta, CA-da soo saartay shahaadada macmiilka iyo habka aqoonsiga ee endpoint-ku dhab ahaan isticmaalo. Saddex sadar oo diiwaan ah ayaa cusboonaysiinta xigta u beddela hawl halkii baaritaan.