strongSwan send_cert: marka shahaadada IKE la diro

Iridaha waxay diiwaangeliyaan guul-darrooyinka aqoonsiga ee la xiriira shahaadooyinka, fikradda koowaadna waa in qaataha lagu daro CA kale. Taasi waxay u qaadataa in shahaadadu timid oo la diiday. Suurtagalnimada kale waa in aan weligeed la dirin, taasna waxaa go'aamiya siyaasadda xidhiidhka diraha. Go'aami midka labada ka mid ah uu dhacay ka hor intaadan beddelin kalsoonida.

Waxa send_cert dhab ahaan maamulo

Aqoonsiga shahaadadu wuxuu u baahan yahay in shahaadda hay'adda ugu dambaysa ee peer ay gaarto dhinaca kale iyada oo loo marayo isdhaafsiga IKE ama diyaarin hore. Gudaha swanctl, dejinta xidhiidhka send_cert waxay go'aamisaa haddii bartaas dambe ay ku darto culayska shahaadadeeda: weligeed, had iyo jeer ama ifasked. Qiimaha caadiga ah ifasked wuxuu u diraa jawaab u ah codsiga shahaadada ee peer-ka. Shahaado codsashadu waa dejin gooni ah, sababtoo ah in dhinaca kale laga codsado shahaadadeeda ma aha isku mid la bixinta tanada.

Habaynta hore ee ipsec.conf waxay isticmaali jirtay leftsendcert iyo rightsendcert, magacyadaasna waxay u dhigmaan doorarka gudaha iyo fog, ee ma aha si toos ah swanctl.

Akhri hal isku day ka hor intaadan beddelin xidhiidhka

Cilad-baadhistu ha ka timaaddo hal isku day la kontoroolay, ee ha ka timaaddo aragtida guud ee ah in shahaadooyin ku lug leh. Siyaasadda iyo ururka firfircoon labadaba waa la baari karaa.

swanctl --list-conns
swanctl --list-sas
journalctl -u strongswan --since "10 min ago" | grep -iE "cert|CERT"

Liiska xidhiidhada wuxuu muujinayaa qiimaha la habboon send_cert, liiska SA-na wuxuu muujinayaa xidhiidhada dhab ahaan soo baxay. Diiwaanku wuxuu ku darayaa faahfaahinta wada-hadalka: haddii codsi shahaado la helay iyo haddii culays shahaado baxay. Guul-darro guud oo aqoonsigu ma tilmaamto dhibaato gaarsiin, sidaas darteed raadi isdhaafsiga gaarka ah ka hor intaadan wax soo gabagabayn. Qor shaabadda waqtiga isku dayga si daaqadda diiwaanku u daboolo gacan-qabsiga oo dhan.

Kalsoonida qaataha waa go'aan gooni ah

Gaarsiinta iyo kalsoonidu waa sifooyin kala duwan, mid ka mid ah hagaajintana ma hagaajiso tan kale. Qaataha waa inuu haystaa barkada kalsoonida loogu talagalay, helo silsilad la isticmaali karo oo u dhigma aqoonsiga peer-ka la filayo. Shahaadda hay'adda ugu dambaysa ee timaadda iyada oo aan lahayn shahaadadeeda dhexe weli way ku guuldaraysataa hubin adag oo silsilad. Taas lidkeeda, rakibidda CA sinaba uma qasabto peer inuu dirao shahaadadiisa.

openssl x509 -in peer-chain.pem -noout -subject -issuer -dates

Baaristu waxay muujinaysaa soo-saaree waxa uu saxeexay shahaadda iyo goorta ay dhamaato, barkada qaatahana waa inay taasi u dhiganto. Aamin soo-saaraha CA ee ay leedahay habaynta, ee ha aaminin shahaado kasta oo dhexe oo silsiladda ku jirta, sababtoo ah kor-u-qaadista shahaado kasta oo dhexe ilaa xidid waxay ballaadhisaa kalsoonida meel aad uga fog hal peer. Hayso hubinta aqoonsiga oo firfircoon, sababtoo ah xidhiidhka kaliya ku guulaysta marka hubintu damiisan tahay ma aha hagaajin. Halka silsiladdu aanay dhamaystirnayn, hagaaji diyaarinta ee ha hagaajin siyaasadda diraha.

Beddel diraha kaliya markaad haysato caddayn

Marka diiwaanku muujiyo in shahaadda aan weligeed la dirin oo qaatahu dhab ahaan codsaday, dejinta send_cert on always waa isbeddel xaq leh xidhiidhkaas. Ku dabaq qaabeynta swanctl, dib u soo shub xidhiidhada oo samee kalfadhi cusub halkii aad dib u isticmaali lahayd SA-da jirta. Xaqiiji in culayska shahaadadu hadda soo muuqdo iyo in qaatahu ku aqbalo barkada loogu talagalay. Haddii wax aan isbeddelin, khaladku wuxuu ahaa dhinaca kalsoonida oo dejinta diraha ma ahayn sababta.

Qor isdhaafsiga la arkay, barkada iyo hubinta ka dhalata diiwaanka isbeddellada. Hagaajin shahaado aan lagu sharaxi karin ereyadaas waa shil.