Shahaadda VPN weli ma ansaxna: saddex sababood, hal nidaam oo hubin
Weli ma ansaxna waxay ka dhigan tahay in saacadda qalabka ay dib u dhacday, daaqaddu runtii ka bilaabato goor dambe, ama shahaad dhexe aan weli furmin. Ku hubi sidaas.
Waxaad furtaa macmiilka, waxaad doorataa profile-ka aad bilooyin isticmaalayay, wuuna istaagaa "certificate is not yet valid". Waxba kama beddelmin gelitaankaaga, kaydka kalsoonaanta ayaa u badan tahay inuu fiican yahay: shahaadda lagu soo bandhigay gacan-qabsiga waxay qaadaysaa daaqad ansax ah oo bilaabata waqti ka dambeeya kan hubiyuhu isticmaalayo. Saddex xaaladood oo kala duwan ayaa soo saara fariintaas saxda ah, waxayna u baahan yihiin tillaabooyin kala duwan. Nidaamka hoose wuxuu kuu sheegayaa midka aad haysato ka hor inta aadan taaban saacad ama fayl shahaadeed.
Saddexda sababood kee baad arkaysaa
Sababta koowaad waa maxalli ah: qalabka hubinta sameeya wuxuu leeyahay saacad ka horraysa taariikhda bilaabashada shahaadda. Waxaad ku aragtaa qalab leh batteriga CMOS dhintay, mishiinnada farsamada ah ee laga soo celiyay sawir hore, qalabka muddo dheer damisnaa oo waqti lumiyay, iyo shabakadaha NTP-ga baxa la xannibay oo aan cidina arag. Shahaaddu si buuxda ayay u ansaxmi kartaa oo haddana sidan ayay u guuldareysan kartaa.
Sababta labaad waxaa iska leh soo-saare, sababtoo ah shahaaddu runtii waxay bilaabataa mustaqbalka: goor hore la soo saaray, waqti bilaash ah oo cad lala sameeyay, ama loo saxeexay qayb ka mid ah tallaabo firfircoonayn aan weli dhicin. Sababta saddexaad waxay lumisaa waqtiga ugu badan, sababtoo ah caleentu waa mid hadda jirta halka shahaad kale oo silsiladda la soo bandhigay aanay ahayn, marka khaladku wuxuu magacaabaa shay aadan waligaa rakibin.
Hal su'aal ayaa kala sooca. Guuldarradu ma raacdaa qalabka mise adeegga? Laba mishiin oo isku shabakad ah oo si kala duwan u dhaqma waxay tilmaamayaan saacadaha. Haddii macmiil kastaa si isku mid ah u guuldareysto, waxay tilmaamaysaa daaqadda shahaadda iyo silsiladda ka dambeysa.
Daaqadda ka akhri shahaadda dhab ahaan la soo bandhigay
Ha baarin fayl PEM ka hadhay dhaqan-gelin hore; weydii adeegga silsiladda uu hadda dirayo. openssl s_client -connect vpn.example.com:443 -servername vpn.example.com -showcerts wuxuu daabacaa shahaad kasta oo silsiladda ku jirta. Kaydi qaybta aad u baahan tahay oo socodsii openssl x509 -noout -subject -issuer -dates; tan ugu dambeysa waxay daabacdaa notBefore iyo notAfter, labadaas qiime ayaa go'aansada. Windows, wada-hadalka shahaadda isku xirka iyo certutil -dump fayl la dhoofiyay waxay muujinayaan isla beerahaas.
Akhri labada daraf ee daaqadda, ma aha oo kaliya bilowga. Shahaad furmata laba saacadood ka dib iyo mid xirma laba saacadood ka dib waxay ku guuldareystaan fariimo kala duwan waxayna ku lug leeyihiin kooxo kala duwan. Ogaal sheeg shahaadda khaladku magacaabo — caleen, dhexe ama xidid — sababtoo ah taas ayaa go'aamisa haddii wax macmiilka dhinaciisa laga hagaajin karo.
Waxaad sidoo kale tijaabin kartaa daaqadda adigoon sugayn. Hubintu waxay aqbashaa waqti cad: openssl verify -attime 1793600000 -CAfile ca.pem -untrusted intermediate.pem leaf.pem wuxuu qiimeeyaa silsiladda waqtigaas. Ku socodsii waqtiga hadda si aad u soo saarto guuldarrada, ka dibna waqtiga bilaabashada shahaadda si aad u xaqiijiso in isla silsiladdaas ay gudubto marka daaqaddu furmo. RFC 5280 wuxuu qeexayaa goobta ansaxnimada iyo qaanuunka ah in shahaadda aan laga isticmaalin meel ka baxsan, waana isla qaanuunkaas uu macmiilkaagu hadda dhaqan geliyay.
Saacaddaada, ama tan iyaga
Isbarbar dhig saacadda qalabka iyo bilowga shahaadda UTC, laga bilaabo il aad aaminto. date -u wuxuu bixiyaa daqiiqadda, systemd host-na timedatectl status wuxuu sidoo kale soo sheegaa haddii saacaddu isku dhafan tahay. Windows, w32tm /query /status wuxuu muujinayaa isha hadda iyo isku-dhafka ugu dambeeyay ee guulaystay. Aagga waqtiga ee tray-ga lagu muujiyay waa doorasho bandhig, ma aha saacad khaldan; hubiyuhu wuxuu isbarbar dhigaa daqiiqadaha UTC.
| What you see | Most likely reading | Next step |
|---|---|---|
| Clock behind, one device affected | Local time fault | Resync time, keep validation on, retest |
| Clock correct, window opens soon | Certificate staged early | Wait for the window or follow the cutover plan |
| Clock correct, intermediate not yet valid | Chain material mismatch | Operator replaces the intermediate |
| Some peers pass, others do not | Inconsistent nodes | Record each peer's chain before changing anything |
Haddii saacaddu dib u dhacday, dib u isku-dhaf oo dib u tijaabi ka hor inta aadan beddelin wax shahaadeed. Qalab dhowr daqiiqo ama saacadood khaldan wuxuu diidayaa shahaad kasta oo dhawaan la soo saaray oo uu la kulmo, ma aha hal adeeg oo kaliya, marka sharraxaad hal-adeeg ah ayaa badanaa khaldan. Haddii saacaddu sax tahay oo isku dhafan tahay, jooji fiirinta qalabka: daaqaddu waxaa iska leh soo-saare, mana jiro dejinta maxalli ah oo la beddelo si ay u gudubto.
Shaxdaas waa go'aanka oo dhan. Saacadda u raridda waxa shahaaddu filanayso ma aha dayactir, daminta hubinta waqtigana ma aha, sababtoo ah labaduba waxay qariyaan xaaladdii khaladka keentay.
Sababta silsiladdu u guuldareysato iyadoo caleentu fiican tahay
Caleemaha la cusboonaysiiyay iyo shahaadaha dhexe ee beddelka ayaa badanaa wada la diraa, mar walbana isku daqiiqad ma yimaadaan. Adeeggu wuxuu diri karaa caleen cusub oo uu saxeexay dhexe oo daaqaddiisu goor dambe bilaabato, ama wuxuu sii wadi karaa adeeginta dhexe duug ah oo hoos yimaada caleen cusub. Labada xaaladba silsiladdu way guuldareysataa iyadoo taariikhaha caleenta lafteeda macquul u eg yihiin.
Barta-dhammaadka culeyska dheellitiran waxay tan ka beddelaan jaban mid aan is waafaqsanayn. Haddii isku daygii dambe guulaysto, ama hal shabakad shaqayso mid kalena shaqayn, qor yaa ka jawaabay iyo silsiladdee uu diray ka hor inta aadan beddelin dejinta. openssl s_client wuxuu daabacaa ciwaanka isku xiran, marka isku dayo dhowr ah waxay muujinayaan haddii nood kastaa u adeego isla silsiladda.
Wadooyinka dayactirka ee hubinta ilaalinaya
Dhibaatada saacadda waxaa lagu hagaajiyaa qalabka iyadoo hubintu furan tahay. Dhibaatada shahaadda waxaa hagaajiya hawlwadeenka iyadoo la adeegsanayo shay loo soo saaray daaqad hore ugu jirta hadda. Ma jiro dejin macmiil oo shahaad aan weli ansax ah ka dhigta mid ansax ah; calaamadaha dhaafa hubinta waqtiga waxay u jiraan xaqiijinta ogaanshaha cudurka, ma aha in la geeyo wax soo saar.
Marka shahaadda loo diyaariyay firfircoonayn la qorsheeyay, raac qorshaha gudubka. Rakib marka daaqaddiisu furmo, ama isticmaal habka is-dhaafka ee soo-saaruhu dokumenteeyay, halkii aad hore u rakibi lahayd oo bartamaha isticmaalayaasha inay riixaan digniinaha. Digniinaha dadku bartaan inay iska indhatiraan waxay ka qaalisan yihiin dib u dhac gaaban.
Ugu dambayn, dib u tijaabi sida guuldarradu u dhacday: kulan cusub, isla macmiilka, kheyraadka aad runtii u baahan tahay. Maktabadaha TLS waxay kaydin karaan silsilad la hubiyay inta uu isku xirku noolaanayo, kulanka dib loo bilaabayna maahan inuu mar kale hubiyo, marka kulan duug ah wuxuu sii wadi karaa guuldarrada dayactirka ka dib ama sii wadi karaa shaqada dib u noqosho ka dib. Faylka daaqadda lagu furo waxay caddaynaysaa oo kaliya in faylku la akhriyi karo; gacan-qabis dhammaaday waxay caddaynaysaa in silsiladdu ansax tahay.
Ka hor inta aadan xirfin tikitka, xaqiiji afar shay: waqtiga UTC iyo xaaladda isku-dhafka qalabka guuldareystay, notBefore iyo notAfter ee shahaad kasta oo silsiladda la soo bandhigay ku jira, isla silsiladdaas oo ka timid macmiil labaad, iyo magaca uu khaladku shahaadda siiyo. Haddii saacaddu sax tahay oo daaqaddu aanay furmin, inta kale waa shaqada hawlwadeenka, talaabada saxda ah ee dhinacaaga waa inaad sugto daaqadda halkii aad daciifin lahayd hubinta.