Diiwaanka shahaadaha VPN: waxa diiwaanka CA caddayn karo
Fayl ku yaal serverka, diiwaan CA, liis tirtirid iyo shaxda fadhiyada waxay ka jawaabaan su'aalo kala duwan. Kala hayso marka aad diiwaan gelinayso aqoonsiyada VPN.
Albaabkaagu waxa uu aqbalaa shahaadada macmiilka oo uusan waligiis arag, sababtoo ah waxa loo habeeyay waa soo-saare la aamino, shahaadaduna waxay timaaddaa inta lagu jiro is-gacan-qaadka. Sidaas ayaa borotiinku ahayd inuu shaqeeyo, taasna waa sababta liiska galka ee serverka uu yahay diiwaan liita. Soo-saaraha waa ogyahay waxa uu abuuray, serverka waa ogyahay waxa isku xidhay, xaaladda tirtiridna waa og waxa la soo celiyay. Diiwaanka isku daraya saddexdan diiwaan wuxuu ugu dambayn sheeganayaa wax aan midkoodna odhan.
Albaabka waxa uu aaminaa soo-saare, ma aha liis faylal
Xaqiijintu waxay isbarbardhigtaa shahaadada la soo bandhigay iyo barroosinka kalsoonida, sidaas darteed aqoonsi soo-saare isku mid ah shalay abuuray waxa uu isku xidhaa isagoo aan waligiis ka jirin saxanka serverka. Taas ma dhacdo wax la koobiyeeyay, qofna ma aha inuu gacanta ku ansixiyo. Sidaas darteed diiwaannada serverka laftiisu waxay sharraxaan imaatin, ma aha tirada aqoonsiyada iman kara.
Farqiga kale ee ka soo horjeeda ayaa isna si la mid ah u xun. Gal waxa uu ka koobnaan karaa shahaadooyin dhacay, kuwa la tirtiray iyo aqoonsiyo loo soo saaray aaladaha aan waligood la deploy-gelin. Tirinta faylasha waxay ka jawaabtaa inta fayl ay jiraan, taas oo ah su'aal aan cidna weydiin. Beddelkeeda ka bilow diiwaannada macne leh.
Afar su'aalood, afar diiwaan oo kala duwan
Nooc kasta oo diiwaan ah waxa uu si wanaagsan uga jawaabaa hal su'aal oo si xun uga jawaabaa kuwa kale, sidaas darteed warbixinta isku daraysa waxay u muuqataa mid dhammaystiran iyadoo si gaar ah u khaldan. Shaxda hoose waxay u kala hormariaysaa su'aasha ay xalliyaan, ma aha nidaamka soo saara.
| Question you are answering | Where the answer lives | How quickly it changes | What it will never show |
|---|---|---|---|
| Was this identity ever created? | The issuer's issuance database | Only when something is issued | Whether the device still exists |
| Is a copy sitting on this host? | The paths you actually inspected | Whenever anyone copies files | Certificates that were never copied here |
| Has the issuer withdrawn it? | Published revocation state | When the issuer next publishes | Withdrawals that are not published yet |
| Is it connected right now? | The live session table | Continuously | Anything about past or future sessions |
Kaydka shahaadooyinka dadweynaha ma aha sir, maadaama uusan ku jirin furayaal gaar ah, laakiin sidoo kale lama wadaagi karo. Mawduucyada iyo magacyada aaladaha waxay daaha ka qaadaan faahfaahinta hawlgalka, warbixintuna waa inay la joogto dhagaystayaasha u baahan. Furayaasha gaarka ah gabi ahaanba waxay ka baxsan yihiin diiwaanka, sababtoo ah diiwaanku waxa uu u baahan yahay metadata, ma aha aqoonsi.
Soo-saare iyo lambarka taxanaha ayaa ah furaha kaliya ee deggan
Mawduucyada waa dib loo isticmaalaa magacyada faylashuna dib ayaa loo isticmaalaa, sidaas darteed magac sannadkii hore tilmaamayay hal aalad ayaa hadda tilmaami kara mid kale. Midkoodna ma aha fure, warbixin ku dhisan midkoodna ugu dambayn waxay isku dari doontaa laba aqoonsi hal sadar.
Lammaanaha soo-saare iyo lambarka taxanaha waxay si gaar ah u aqoonsadaan shahaadada, labada gooboodna waxay ka yimaadaan shahaadada lafteeda. Ku qor iyaga oo la socda mawduuca, taariikhaha ansaxnimada, isha uu koobigu ka yimid, iyo qofka ama aaladda mas'uulka ah. Ku dar xaaladda tirtirid iyo deploy-ka oo ah goobo gaar ah oo leh waqtiyadooda indho-indhayn, sababtoo ah shahaadada ku jirta daaqadda ansaxnimadeeda si otomaatig ah looma ogola. Labadan xaqiiqo waxay ku nool yihiin nidaamyo kala duwan, isku darkooduna waxa uu qariyaa kiiska aqoonsi la soo celiyay iyadoo faylkiisu weli u muuqdo mid cusub.
Akhri hal shahaadad mar kasta
Astaanta duurjoogta ah ee ku fidsan gal ma aha is-dhexgal dufcad ah, waxayna qarinaysaa faylka keenay soo-saarka. Akhri metadata shahaadad kasta, oo akhri dhinaca tirtiridda artefaktkeeda u gaar ah. Tixraaca OpenSSL x509 waxa uu taxaa goobaha ay doorashooyinkaas daabacaan.
openssl x509 -in <cert>.pem -noout -issuer -serial -subject -dates -fingerprint -sha256
openssl crl -in <issuer>.crl -noout -text | head -n 40PKI Easy-RSA oo la maamulo, waxa aad ka weyddiisaa keydka xogta soo-saarista iyada oo loo marayo socodka shaqada ay qalabku taageerto halkii aad ka fikiri lahayd qaabaynta galka, oo asalka ku hay akhris-kaliya inta diiwaanka la ururinayo. Qaabka diiwaanku waa mid joogto ah oo ku filan in lagu tiriyo gelitaanka ansax ah oo lagu taxo kuwii la soo celiyay iyada oo aan keydka gacanta lagu furin.
grep -c '^V' pki/index.txt
grep '^R' pki/index.txt | cut -f4,5Diiwaan ka gudba soo-saarista xigta
Dumping hal mar oo gal ah waxa uu duugoobaa isla marka shahaadada xigta la soo saaro, sidaas darteed warbixinta ka dhis socodka shaqada soo-saarista oo u oggolow inay cusboonaysiiso iyada oo qayb ka ah hawlgalka caadiga ah. Tani waxay warbixinta ka dhigaysaa mid dib loo soo saari karo, taas oo muhiim ah marka laba qof ay isku raacsanayn waxa la soo saaray.
Isticmaal natiijada go'aamada cusboonaysiinta iyo ka-faa'iidaysiga, ma aha layli xaashi-celin ah. Tirtiridda koobi maxalli ah ma burinayso koobiyada fog ee hore u jiray. Ku soo celi aqoonsiga iyada oo loo marayo socodka shaqada tirtiridda iyo oggolaanshaha ee la habeeyay, ka dibna diiwaan geli soo-celinta taariikhdeeda. Aqoonsiga ka lumay serverka laakiin soo-saaruhu weli aamino ma aha mid laga faa'iidaystay, farqigaasna waa kan kala sooca diiwaan sax ah iyo mid kaliya xasillooni siinaya.