Iphutha lesitifiketi sewebhu ku-Access Server: iphakethe le-CA elingenalutho

Inani elingenalutho le-ca_bundle noma i-PEM eyonakele kumisa isixhumanisi sokulawula. Qinisekisa isitifiketi, ukhiye kanye nochunge lwazo njengeqoqo elilodwa ngaphambi kokuqala kabusha, futhi ungalithinti i-PKI ye-VPN.

Ikhasi lokungena lewebhu elingalayishi ngenkathi i-DNS ixazululwa kahle ngokuvamile akulona inkinga ye-DNS. Uma ilogi yensizakalo isho indlela engenalutho yephakethe lesitifiketi noma ukwehluleka kokuhlaziya i-PEM kwesitifiketi sewebhu nokhiye oyimfihlo, isilaleli se-HTTPS asinampahla esebenzisekayo futhi ukuxazululwa kwamagama ngeke kusize. Ukulungiswa kusekhona kumakhiye amathathu wokucwangisa futhi akudingi ukuthi noma yisiphi isitifiketi sekhasimende le-VPN sikhishwe kabusha.

Ukhiye abathathu bakhomba ini ngempela

Isethi yesitifiketi sewebhu eyenziwe ngokwezifiso ichazwa ngu-cs.cert, cs.priv_key kanye no-cs.ca_bundle. Ngayinye igcina indlela yefayela, futhi insizakalo yewebhu isebenzisa zontathu ndawonye. Isitifiketi esinokhiye ongafanele, noma ifayela lochunge oluyisitifiketi seqabunga ngempela, sehluleka njengenani elingenalutho.

Laba khiye bangabe-Admin kanye nesixhumanisi sewebhu se-Client. Bahlukene ne-PKI ekhipha izitifiketi kubakhasimende e-VPN ngakho ukushintsha akudingi ukuthinta amaphrofayela, ukhiye wesiphakeli noma isiphathimandla sezitifiketi. Ukwakha kabusha i-PKI yonke yiphutha elibiza kakhulu lapha.

Umehluko owodwa wonga isikhathi: inani elenziwe ngokwezifiso elingenalutho ngokusobala alisona isimo esifanayo nokungabikho kokubhala phezu. Eyokuqala inikeza umhlaziyi indlela engenalutho, yilokho okushiwo umugqa welogi. Eyesibili ishiya i-Access Server empahleni yayo.

Kungani ifayela elikhona lingakahlaziywa

Umhlaziyi ufunda amabhulokhi anelebula ngaphakathi kwefayela, hhayi igama lefayela. I-.crt equkethe ukhiye oyimfihlo, uchunge olubhalwe njengebhulokhi elilodwa, noma ifayela eligcinwe ngomugqa wokugcina onqunyiwe kuyanqatshwa. I-RFC 7468 ichaza lawomalebula afundekayo ngoba yiwo kuphela akhombayo ukuthi yiluphi uhlobo lwento olulandelayo.

Hlola izinto, hhayi izandiso. Ku-Linux, i-openssl x509 -noout -subject -issuer -in server.pem ne-openssl pkey -noout -check -in key.pem ziphendula imibuzo emibili ebalulekile, futhi ukuqhathanisa i-modulus noma ukhiye womphakathi wakho kokubili kufakazela ukuthi zihambisana. Gcina umphumela wokhiye oyimfihlo kude namathikithi namalogi ezingxoxo.

Indlela engenalutho ifanelwe ukusolwa okufanayo nefayela elonakele, ngoba zombili zinikeza amaphutha angaqondakali kamuva. Uma ilogi ithi indlela yephakethe ayinalutho, funda inani eligciniwe ngaphambi kokulungisa ifayela.

Buyela esipele ngamabomu

I-CLI ye-Access Server inokuhlola okuthatha izindlela ezintathu njengezimpikiswano futhi kubike ukuthi isethi iyasebenza yini. Izindlela ezingezansi ziyizibonelo; zishintshe ngezindawo ezivikelwe kusiphakeli.

sacli --ca_bundle=/secure/webcerts/chain.pem \
      --cert=/secure/webcerts/server.pem \
      --priv_key=/secure/webcerts/key.pem TestWebCerts

Funda umphumela ngaphambi kokuthinta insizakalo esebenzayo, bese ungenisa amanani futhi uwasebenzise ngomsebenzi obhaliwe wenguqulo efakiwe. I-isifundo se-CLI esisemthethweni sihlanganisa ukuhlola, ukungenisa kanye nesinyathelo sokusebenzisa, futhi inguqulo yayo ibaluleke kunanoma yisiphi isifinyezo.

Qinisekisa igama abasebenzisi abalibhalayo

Uma impahla eyenziwe ngokwezifiso yephukile futhi isipele esisemthethweni esakhelwe ngaphakathi sisekhona, ukubuyiselwa okubhaliwe ukususa ukubhala phezu kokuthathu nokuvumela i-Access Server ukuthi isebenzise leso sipele. Hlela ukufinyelela kwe-console kanye nekhophi yokucwangisa kwamanje kuqala.

sacli ConfigDel --key "cs.cert"
sacli ConfigDel --key "cs.priv_key"
sacli ConfigDel --key "cs.ca_bundle"
# then the supported apply/restart step for this version

Ukususa sonke isisekelo sedatha yokucwangisa akulona ukulungiswa kwesitifiketi. Khomba kulelo khiye elithathu, sebenzisa futhi uqinisekise ukuthi isixhumanisi sewebhu siyaphendula. Amafayela azisayinele kuweb-ssl ayinsiza yesipele, akuyona indawo yokusebenza.

Linde ukuthi isiphequluli sikhombise esinye isitifiketi ngemuva kokuthi isipele sisebenze. Lowo umphumela ofanele; uqinisekise ngohlelo lwakho lokuphatha olwethenjwayo.

Ukubuyiselwa kuphela ngemuva kokungena okuphumelelayo

Ukubuyiselwa akukapheli lapho kuvela isilaleli se-TCP. Qinisekisa igama le-DNS, ubunikazi besitifiketi kanye nochunge lwalelo gama, bese ulayisha izixhumanisi ze-Admin ne-Client futhi uqedele ukungena. Ukuhlolwa kwembobo akufakazeli lutho kwalokho.

I-Access Server 3.1 nangaphezulu ingase inikeze izitifiketi zewebhu ezihlukene ngegama ngalinye lomsingathi we-SNI. Uma lokho kucwangisiwe, okhiye abazenzakalelayo kanye nokufakwa okuqondene negama kungamasethi ahlukene, futhi ukuhlola ngekheli le-IP kungakhombisa kalula isitifiketi esihlukile kuleso abasebenzisi abasitholayo. Lungisa futhi uqinisekise isethi yegama elihlulekile, bese uphinda ukuhlolwa kokungena ngaphambi kokuvala isigameko.

Izihloko ezihlobene