Iphutha lokuthemba le-Android IKEv2: thumela i-CA ephakathi, hhayi impande
Ucingo lwenqaba i-gateway ngoba uchungechunge olutholile luphela ngokushesha. Nquma: thumela ephakathi, lungisa ubunikazi, noma shintsha uhlobo lokhiye.
Ucingo lwenqaba ukuxhuma futhi luphrinta No trusted RSA public key found for vpn.example.net, kuyilapho isitifiketi se-gateway esifanayo sisebenza kusukela kukhompuyutha ephathwayo kwinethiwekhi efanayo. Isinyathelo esihehayo ukukhipha kabusha isitifiketi. Ngaphambi kokwenza lokho, thola ukuthi iyiphi iphutha kumathathu onalo, ngoba linye kuphela lawo eliphathelene nokuqukethwe kwesitifiketi. Umlayezo uhlanganisa uchungechunge olungaphelele, ukungafani kobunikazi, nokhiye noma isiginesha engasekelwe, futhi ngayinye inokulungiswa okuhlukile.
Amaphutha amathathu ngemuva komlayezo owodwa
I-Android yakha uchungechunge kusukela kusitifiketi se-gateway kuya ku-CA ekhethiwe kuphrofayela ye-VPN, bese iqhathanisa igama leseva nephrofayela. Isaziso sibika umphumela, hhayi isigaba. Iphutha lokuthemba lisho ukuthi uchungechunge alukwazanga ukuqedwa ngezitifiketi ezinikezwe ekushintshaneni; iphutha lobunikazi lisho ukuthi uchungechunge luqinisekisiwe kodwa igama alifananga; iphutha le-algorithm lisho ukuthi idivayisi noma iphrofayela ayamukeli uhlobo lokhiye noma isiginesha.
| What you see | What it points to | First move |
|---|---|---|
| Chain stops after the leaf in the daemon log | intermediate not loaded or not sent | load the intermediate as CA material |
| Chain validates, name differs from the profile | identity mismatch | fix the profile name or the certificate SAN |
| Chain validates, handshake still fails | key or signature not accepted | compare key type against the device |
Nquma ngobufakazi esikhundleni sokuzama ukulungiswa ngokulandelana. Umzamo owodwa ezingeni lelogi 2 ngokumelene ne-daemon ukutshela ukuthi ukuliphi umugqa, futhi kubiza kancane kunokukhipha kabusha isitifiketi ebbinge singakaze sibe nephutha.
Nquma kuqala: ingabe uchungechunge lonke lufikile?
I-strongSwan ithumela isitifiketi esilungiselelwe lowo mxhumi, futhi izitifiketi eziphakathi ziyizifakaziso ezihlukile. Kumele zilayishwe njengezitifiketi ze-CA ngaphambi kokuba i-daemon izibeke kumthwalo, ngakho isakhiwo lapho isitifiketi seseva sisayinwa khona yisiphakathi, impande iyinsika yokuthemba, futhi isiphakathi sitholakala kuphela kukhombisa yokwakha ye-CA sikhiqiza kahle leli phutha: iqabunga lodwa ocingweni, uchungechunge luphela ngokushesha ocingweni.
Hlola ukuthi i-daemon inani usebenzisa swanctl --list-certs ekufakweni kwe-swanctl, noma ipsec listcerts nge-starter endala. Isiphakathi kufanele sivele njengesitifiketi se-CA esinempande phezulu kwaso. Uma singekho, akukho ukukhetha komxhumi okuzosiza; uma sikhona, dlulela embuzweni olandelayo.
Bese uhlola ukuthi sizothunyelwa yini. Isithenjwa se-swanctl.conf sichaza send_cert, okungukuthi okuzenzakalelayo kwaso ifasked kuthumela izitifiketi kuphela lapho umlingani ecelile; always kuthumela ngaso sonke isikhathi. Okulingana kwakudala i-leftsendcert=always ku-ipsec.conf. Leso silungiselelo silawula ukuthumela, hhayi ukutholakala, ngakho asikwazi ukunxephezela isiphakathi i-daemon engakaze isilayishe.
Uma uchungechunge lufushane, layisha isiphakathi lapho i-daemon ibheka khona
Beka isiphakathi kukhombisa ye-CA hhayi eceleni kweqabunga: /etc/ipsec.d/cacerts kusilungiselelo se-ipsec.conf, /etc/swanctl/x509ca se-swanctl, noma indlela eshintshwa iphakethe lakho. Layisha kabusha ukulungiselela futhi uhlu izitifiketi futhi. Amanye amavolumu athumela futhi inqwaba equkethe uchungechunge ngaphakathi kwefayela leqabunga, kodwa ikhombisa ye-CA iyindlela ehambayo kuwo wonke amavolumu namaphakethe.
Qinisekisa futhi kusukela ohlangothini lomxhumi. Ucingo lubona kuphela okulethelwe ukushintshana, ngakho ilogi ye-daemon ezingeni 2 kufanele ibonise isiphakathi phakathi kwezitifiketi ezithunyelwe. Uma ilogi isibonisa futhi ucingo lusahluleka, ukumugqa ohlukile wetafula, futhi ukuqhubeka nokulungisa amafayela e-CA ngeke kushintshe umphumela.
Uma uchungechunge luphelele, yeka ukuhlela izitifiketi
Iphutha lobunikazi ukungafani phakathi kwegama kuphrofayela ye-VPN negama esitifiketini. I-Android iqhathanisa ubunikazi beseva obusilungiselele nesitifiketi esikusiqinisekisile, ngakho iphrofayela ekhomba ikheli ngenkathi isitifiketi sisho igama lomsingathi, noma iphrofayela esho igama lomsingathi isitifiketi esingasihlanganisi, ihluleka ngemuva kokuqinisekiswa kochungechunge okuphumelelayo. Lungisa uhlangothi olungalungile, futhi gcina iphrofayela nesitifiketi kuhambisana lapho noma yikuphi kushintsha.
Iphutha le-algorithm livela ngouchungechunge oluvumelekile negama elihambisanayo. Izinguqulo ze-Android ziyahluka ngezinhlobo zokhiye namasu esiginesha ezizamukelayo, futhi uhlobo lwephrofayela ngokwalo lukhawulela ukukhetha. Uma i-gateway isebenzisa inhlanganisela endala noma engajwayelekile, qhathanisa nalokho idivayisi ekusekelayo ngaphambi kokucabanga ukuthi isitifiketi sonakele. Ilogi ye-daemon izobonisa ukuthi ukuxhawulana kwandiza kude kunasekimweni lokuthemba, futhi lokho kuwuphawu lokuthi uchungechunge akuseyona inkinga.
Ungafaki isiphakathi njengempande yomsebenzisi ocingweni
Ukufaka isiphakathi esingekho njengesitifiketi somsebenzisi ocingweni kwenza isixwayiso sinyamalale futhi kushintshe imodeli yokuthemba yocingo kuyo yonke inhlelo ezamukela izimpande ezifakwe umsebenzisi. Kubuye kufihle iphutha lokulethwa elizoshaya umxhumi olandelayo, futhi kushiye i-gateway ithumela uchungechunge olungaphelele kuyo yonke idivayisi yesikhathi esizayo. Ukulungiswa okuhlala njalo kusesiveni, kanye, kubo bonke abaxhumi.
Gcina izinqumo ezintathu zihlukile kurekhodi loshintsho: yiziphi izitifiketi ezithunyelwe, ubuphi ubunikazi obuqhathanisiwe, futhi iyiphi i-algorithm okwavunyelwana ngayo. I-gateway ehlala ithumela uchungechunge lwayo olugcwele, iphrofayela ebiza isitifiketi ngendlela efanele, nohlobo lokhiye olusekelwa yimpi kuyizinto ezintathu ezincane, futhi ziyilokho konke lokhu kuhluleka.