I-AWS Client VPN: isitifiketi seseva nesikhundla sesitifiketi sekhasimende
Isitifiketi seseva sendawo yokugcina sibonisa insizakalo. Ukuqinisekisa kwangaphambili kunezela ubunikazi bomuntu ngamunye kanye nokwethemba kwe-CA ngaphandle kokwabelana ngokhiye weseseva.
Indawo yokugcina ye-Client VPN ihlala idinga isitifiketi se-TLS seseva. Lokho ubunikazi indawo yokugcina ephethwe okuyiveza lapho ikhasimende lixhuma. Kuyinto ehlukile kuzitifiketi ezivezwa amakhasimende ngamanye lapho kusetshenziswa ukuqinisekisa kwangaphambili. Ukuhlanganisa lezi zimbili yisizathu esivame kakhulu sokuthi ukusethwa kwe-ACM okulungile ngenye indlela kwehluleke okokuqala.
Nansi indlela esuka kukhonsoli iye ngaphandle, ngokulandelana okuhamba ngakho ukuxhumana ngempela.
Izindima ezimbili, indawo yokugcina eyodwa
Indawo yokugcina inobunikazi baseseva futhi, ngokuzikhethela, indlela yokuqinisekisa ubunikazi bamakhasimende. Lokhu kuhlelwa ngokuhlukene. Okunye kunquma ukuthi ikhasimende lingayethemba yini insizakalo; okunye kunquma ukuthi insizakalo iyalemukela yini ikhasimende.
| Material | Purpose | Where it lives |
|---|---|---|
| Server certificate and private key | The managed endpoint proves its TLS identity | ACM, in the endpoint's Region |
| Client certificate and matching key | An individual client proves its identity | On the device |
| CA trust material | The verifier checks the issuer chain | Selected for the client role |
Funda ithebula njengezimfuneko ezintathu ezizimele hhayi njengesitifiketi esisodwa. Isitifiketi seseva nokhiye waso wangasese kuhlala kukhona insizakalo. Isitifiketi sekhasimende nokhiye wangasese ohambisanayo kuhlala kudivayisi. Impahla ye-CA yiyo esetshenziswa umqinisekisi ukuhlola uchungechunge. Umugqa ophakathi kuphela oke ube ngowekhompyutha ephathekayo.
Isitifiketi seseva se-ACM senzani
Uma wenza indawo yokugcina, isitifiketi seseva kufanele sitholakale ku-ACM esifundeni esifanayo nendawo yokugcina. Ikonsoli icela i-ARN, futhi leyo ARN kufanele ixazululwe lapho. I-ACM ingagcina isitifiketi osihlinzeke ngokuqinisekiswa kwesizinda, noma leso osingenise kanye nokhiye waso nochungechunge. Zombili ziyasebenza kule ndima; ziyahluka ekuvuseleleni nasekutheni ubani ophethe ukhiye wangasese.
Khetha indlela yokuhlinzeka ehambisana nalowo ongavuselela isitifiketi, hhayi leyo eyavele yakhiqiza ifayela elibonakala livumelekile.
Ukuqinisekisa kwangaphambili kunezela ini
Ukukhetha ukuqinisekisa kwekhasimende okusekelwe esitifiketini kunezela umbuzo wesibili: amaphi amakhasimende avunyelwe ukuxhuma ngokuphelele. Ikhasimende ngalinye liveza isitifiketi salo futhi libonisa ukuthi liphethe ukhiye wangasese ohambisanayo. Ubunikazi obuhlukene yibo obwenza ukuhoxiswa okukhethiwe kwenzeke kamuva. Ukukopisha ukhiye wekhasimende elilodwa kudivayisi ngayinye kulahla leyo mpawu ngokuthula, ngisho noma isitifiketi seseva sitholwe ngokuphelele.
Indlela yokuqinisekisa yendawo yokugcina iwukuzikhethela, hhayi imfuneko evamile.
I-Active Directory nokuqinisekisa okuhlangene kuphendula umbuzo ofanayo ngezinye izindlela. Iresiphi yesitifiketi sangaphambili ayiyona ngokuzenzakalela idizayini yokungena yalokho kusetshenziswa, futhi ukuqinisekiswa kwe-TLS kweseseva kuhlala kukhona kungakhathaliseki ukuthi umsebenzisi wamukelwa kanjani.
Kungani i-ARN ye-CA efanayo kungekona ukwabelana ngokhiye
I-AWS ibhala ukuthi lapho isitifiketi seseva nesekhasimende sikhishwe yi-CA efanayo, i-ARN yesitifiketi seseva ingasetshenziswa futhi ekukhetheni isitifiketi sekhasimende. Lowo musho umayelana nokuthi iyiphi i-chain indawo yokugcina eyethembayo lapho iqinisekisa. Awutsheli amakhasimende ukuthi asebenzise ukhiye wangasese weseseva. Ikhompyutha ephathekayo isadinga isitifiketi sayo sekhasimende nokhiye wayo ohambisanayo.
Lapho i-CA yekhasimende ingumkhiphi ohlukile, indlela ebhaliwe iwukungenisa leyo CA ku-ACM nokuyikhetha endimeni yekhasimende.
Landelela ukwehluleka emuva esigabeni
Khomba ukuthi yisiphi isigaba esihlulekayo ngaphambi kokushintsha noma yini. Uma ikhasimende lenqaba indawo yokugcina, i-ARN yeseseva noma uchungechunge lwayo yikona okusolwayo. Uma indawo yokugcina inqaba ikhasimende, bheka isitifiketi sekhasimende, umkhiphi waso nendlela yokuqinisekisa ekhethiwe. Uma umhubhe uphuma futhi ithrafikhi isahluleka, usudlule izitifiketi.
Shintsha into eyodwa ngesikhathi, ngoba ukushintsha zombili iziphetho ngesikhathi esisodwa kuphinda kudale ukungaqondakali owaqala nakho.
Hlola futhi ama-algorithm okhiye asekelwayo nezandiso ezidingekayo zensizakalo endimeni ethile. Isitifiketi esenelisa iwebhusayithi yomphakathi akusona ubufakazi bokuthi zonke izimfuneko zobunikazi ze-Client VPN zifeziwe.
Bhala ukuthi iyiphi i-ARN ephethwe yisigaba ngasinye, iyiphi i-CA ekhiphe isitifiketi sekhasimende nendlela yokuqinisekisa indawo yokugcina eyisebenzisa ngempela. Imigqa emithathu yokurekhoda yenza ukuvuselela okulandelayo kube umsebenzi hhayi uphenyo.