Mac IKEv2 ECDSA: nooca shahaadada kee baa ka tirsan macmiilka?
Mac, ECDSA256 ee dejinta IKEv2 waxay qeexdaa shahaadada aqoonsiga maxalliga, ma aha irridda ama saxeexa soo saaraha. Akhri door kasta ka hor intaadan dooran.
macOS, doorashada ECDSA ee dejinta macmiilka IKEv2 waxay ka jawaabtaa su'aal cidhiidhi ah: shahaadadee baa caddaynaysa aqoonsiga Mac. Ma qeexdo shahaadada irridda, saxeexa soo saaray shahaadada macmiilka, ama soo jeedinta sirta tunnellada. U qaadashada afarta doorasood hal su'aal oo iswaafajin ah waa sababta dejinta maxalli ah ee saxda ah lagu eedeeyo ismaandhaafka dhinaca serverka. Go'aanku wuu yar yahay, laakiin caddaynta loo isticmaalo inuu qaato waa inay saxnaataa.
Goobtanu waxay magacawdaa hal shahaado: aqoonsiga maxalliga
Network Extension API ee Apple waxay soo bandhigtaa nooc shahaado ah oo loogu talagalay aqoonsiga macmiilka, oo ay ku jirto NEVPNIKEv2CertificateType.ECDSA256, oo loo diiwaangeliyay nooca shahaadada ECDSA p-256. Hantida waxay khuseysaa shahaadada lagu bixiyay identityReference ama identityData.
Taasi waxay ka dhigan tahay go'aanku wuxuu ku saabsan yahay shahaadada Mac soo bandhigo, iyo furaha gaarka ah ee la socda. Dooro nooca ku habboon furaha guud ee shahaadada caleentaas oo soo bandhig aqoonsiga habka la taageeray. Haddii Mac uusan lahayn fure gaar ah oo isticmaal leh aqoonsiga, doorashada noocu ma badbaadin karto xiriirka.
Borofayllada la maareeyay waxay isla go'aankaas qaataan iyagoo isticmaalaya CertificateType ee xamuulka IKEv2, oo lala socodsiiyay tixraac shahaado sida PayloadCertificateUUID. Goobahani waxay leeyihiin shuruudo iyo nidaam loogu talagalay nooca OS ee bartilmaameedka; qiimaha nooca qaawan ee borofayl lagu nuqulay lama rakibi karo, iyo daaqadda dejintu waxaa laga yaabaa inaysan tusin ikhtiyaar kasta oo API ah. Hubi shuruudaha xamuulka ee noocaas ka hor geynta.
Ku go'aan qaado doorka, ma aha calaamadda shahaadada
Akhri goobta aad beddelayo oo weydii shahaadadee ay tilmaamayso. Calaamadaha ku jira bandhigga shahaadada waxay isku daraan maadooyinka, soo saaraha iyo algorithmka saxeexa, midkoodna kaliya ayaa ka tirsan doorashada aqoonsiga macmiilka.
| What you inspected | What it controls | Does it choose the Mac certificate type? |
|---|---|---|
| Client leaf public key | The identity the Mac presents | Yes, this is the field's subject |
| Issuer signature algorithm | How the client certificate was signed | No |
| Gateway certificate | What the Mac validates as the peer | No, check it separately |
| IKE and ESP proposals | Algorithms for the tunnel | No, separate proposal settings |
Haddii bandhigga shahaadadu muujiyo saxeex ECDSA oo ka socda CA, taasi waxay qeexdaa furaha saxeexa ee soo saaraha. Furaha macmiilka laftiisu weli wuxuu noqon karaa RSA, goobta noocuna waa inay raacdo furaha macmiilka ee ma aha safka saxeexa. Jahwareerkan keliya ayaa sharaxa warbixinno badan oo ah "ECDSA waa la dejiyay laakiin xiriirku wuu guuldareystaa". Isbarbar dhig nooca furaha ee caleenta iyo nooca borofaylka lagu doortay ka hor intaadan wax beddelin.
Go'aanku wuu fududaadaa marka caleenta la garto: ECDSA256 loogu talagalay furaha macmiilka p-256, nooc kale oo la taageeray oo loogu talagalay fure kale. Haddii shahaadada macmiilka iyo furaheeda aysan iswaafajin, hagaaji lammaanahaas ka hor intaadan beddelin borofaylka VPN.
Shahaadada irriddu waa go'aan gaar ah
Irriddu waxay soo bandhigtaa shahaadadeeda u gaar ah, Macna wuxuu ku xaqiijiyaa barroosinka kalsoonida iyo magaca la filayay. Haddii shahaadadaasi isticmaasho ECDSA, RSA ama nooc fure kale, waa sifo serverka, ma aha dejinta aqoonsiga macmiilka.
Taageerada maxalliga ee shahaadada macmiilka ECDSA ma caddaynayso in shahaadada irrid kasta, qallooc ama dejinta xaqiijinta serverka ay wada shaqeyn doonaan. Hubi aqoonsiga serverka, silsiladdiisa iyo habka xaqiijinta IKE oo ah gelisyo gaar ah, oo ku tijaabi borofaylka dhab ahaan la geyn doono.
Haddii shahaadada irriddu tahay dhibaatada, calaamaddu waxay inta badan soo baxdaa inta lagu jiro xaqiijinta lammaanaha, ma aha xilliga doorashada aqoonsiga. Akhri marxaladda guuldareysta ka hor intaadan beddelin nooca macmiilka, sababtoo ah guuldareysta kalsoonida iyo ismaandhaafka furaha macmiilka ma wadaagaan hal xal.
Saxeexa soo saaraha iyo kooxda heshiiska furaha ma aha nooca macmiilka
X.509 waxay hayaan furaha guud ee maadada iyo saxeexa soo saaraha goobo kala duwan. Macluumaadka furaha guud ee maadadu wuxuu qeexaa furaha shahaadada ku jira; algorithmka saxeexu wuxuu qeexaa furaha CA iyo hawsha saxeexa. Kaliya kan ugu horreeya ayaa u dhigma dejinta nooca shahaadada.
Soo jeedinta IKE iyo Child SA waa dhidib kale. Nooca shahaadada ECDSA ma aha doorashada sirta ESP, beddelka kooxda heshiiska furahuna ma dooranayo nooc shahaado. Borofaylku wuxuu yeelan karaa soo jeedinno ansax ah iyo nooc aqoonsi khaldan, ama nooc aqoonsi sax ah iyo soo jeedin lammaanuhu diido.
Saddexda sadar goobo kala duwan ku hay diiwaanka isbeddelka: shahaadada aqoonsiga iyo furaha, gelisyada kalsoonida irridda, iyo algorithms-ka soo jeedinnada. Mid keliya oo lagu daro "dejinta crypto" wuxuu ka dhigaa guuldareysta xigta mid aan la awoodin in lagu nisbeeyo.
Ku xaqiiji go'aanka goobaha aad dejisay
Hubi aqoonsiga borofaylku dhab ahaan tixraacayo, ka dibna xaqiiji in shahaadada tixraacaas ay leedahay furaha guud la filayay iyo fure gaar ah oo isticmaal leh. Nooca UI-ga lagu muujiyay, shahaadada la tixraacay iyo furaha qalabka waa inay iswaafajiyaan.
Marka xigta xaqiiji gelisyada irridda: magaca serverka la filayay, barroosinka kalsoonida iyo habka xaqiijinta IKE. Ugu dambayn isku xir oo akhri halka gacan-qabsigu istaago. Guuldareysta ka hor is-weydaarsiga aqoonsiga waxay tilmaamaysaa meel ka fog dejintan; guuldareysta xaqiijinta lammaanaha waxay tilmaamaysaa dhinaca irridda.
Diiwaangeli nooca la doortay, tixraaca aqoonsiga iyo maadada shahaadada irridda qoraallada geynta. Cusboonaysiinta borofaylka xigta waxay beddeli kartaa mid kasta oo iyaga ka mid ah, saddex qiime oo magac lehna way ka dhaqso badan tahay in la isbarbardhigo sawirka shaashadda ee guddiga dejinta.