AWS Client VPN: iyiphi i-CA okufanele ikhiphe izitifiketi zeklayenti?
I-CA ekhona, umkhiphi ozilawulayo kanye ne-AWS Private CA bahlukanisa umsebenzi ngendlela ehlukile. Nquma ukuthi ubani ogunyazayo, ovusezelayo futhi ohoxisayo izitifiketi zeklayenti ngaphambi kokuqalisa.
Umbuzo wesitifiketi ku-AWS Client VPN ubuzwa njengombuzo womkhiqizo, kanti empeleni umbuzo wokusebenza. Noma yikuphi kwezilungiselelo ezintathu ezijwayelekile kuzogcina ithuneli esebenzayo: i-CA yenhlangano ekhona, umkhiphi ozilawulayo oqokiwe, noma i-AWS Private CA. Ziyahluka ngokuthi ubani ogunyaza idivayisi, ubani ophethe ukhiye wokusayina, nokuthi ubani ophendulayo lapho ikhompyutha ephathekayo ilahleka ngikhathi engalungile. Khetha inketho ongayisho umnikazi wayo.
I-AWS ayidingi i-Private CA ekuhloleni ngezitifiketi. Ukubeka isitifiketi somseva ku-ACM kuyisinyathelo sokusabalalisa, hhayi inqubo yokubhalisa.
Imibandela emithathu enqumayo
Imibandela emithathu yehlukanisa izinketho ngokucacile: ukuthi inqubo yokubhalisa idivayisi egunyaziwe isivele ikhona yini, ukuthi ungakwazi yini ukuphatha ukhiye wokusayina onezinsila zokulondoloza nomnikazi obaluliwe, nokuthi ukuhoxiswa kufinyelela kanjani endaweni yokugcina. Ngayinye iseduze kwalo yebo noma cha, futhi ucha wokuqala uvame ukunquma isakhiwo.
Zisebenzele ngokulandelana. Ukugxuma ngqo ekuqhathaniseni izindleko yikho okwenza amaqembu aphele ene-CA elawulwayo futhi kungabikho muntu owaziyo ukuthi ubani ozokhipha isitifiketi esilandelayo sekhompyutha ephathekayo.
| Option | You still own | Fits when |
|---|---|---|
| Existing organizational CA | Enrollment, approvals, revocation list | A device process already exists |
| Self-run issuer | Signing-key custody, backups, revocation list | You can staff key custody |
| AWS Private CA | Policy, permissions, certificate delivery | Your PKI already lives in AWS |
Umbatela wokuqala: ingabe ukubhalisa sekukhona?
Uma inhlangano yakho isivele iphethe i-CA enendlela egunyaziwe yokubhalisa idivayisi, ukukhipha izitifiketi zeklayenti ze-Client VPN kusuka kuyo kuyindlela emfushane kakhulu. Izigunyazo, inqubo namarekhodi empahla asekhona. Umkhiphi ongaphansi oqokiwe ngaphansi kwalolo hlelo lwezikhundla uvame ukuba ngcono kune-CA ekhipha ejwayelekile, ngoba inikeza i-VPN umngcele wayo wokuthembela nohlu lwayo lokuhoxisa. Gcina lolo hlu luhlukile kusukela kuyo yonke enye ingxenye yohlelo, ukuze isigameko se-VPN singaphoqi ushintsho kuyo yonke i-PKI.
Uma kungekho nqubo enjalo, umbuzo wangempela ukuthi ingabe uyafuna ukuyakha. I-CA kulula ukuyiqala futhi iyabiza ukuyiphatha kabi.
Umbatela wesibili: ingabe ungakwazi ukuphatha ukhiye wokusayina?
Umkhiphi ozilawulayo usebenza nemodeli yokungenisa ebhaliwe, futhi i-EasyRSA noma ithuluzi elincane langaphakathi lingakhiqiza impahla. Ukusebenzisa umyalo akuyona ingxenye enzima. Ingxenye enzima amakhopi angaxhunyiwe kwi-inthanethi okhiye wokusayina, indlela yokubuyisela umuntu oyihlole ngempela, umnikazi ongekho eholidini, kanye nomthetho wokuthi ukhiye awulokothi ungene kumbhalo weklayenti noma ekukhishweni kwesimo. Bhala lokhu njengenqubo ngaphambi kokukhishwa kwesitifiketi sokuqala, hhayi ngemva kwesigameko sokuqala.
I-AWS Private CA ihambisa lokho kugcinwa emsebenzini olawulwayo. Ayihambisi inqubomgomo yokubhalisa, isinyathelo sokugunyaza noma ukulethwa kwesitifiketi kudivayisi.
Umbatela wesithathu: ukuhoxiswa kufika kanjani?
I-Client VPN isebenzisa uhlu lokuhoxisa izitifiketi zeklayenti olungenisa endaweni yokugcina, njengoba kuchazwe kumhlahlandlela womjikelezo wempilo wesitifiketi. Ukushicilela i-CRL kwenye indawo ku-PKI yakho akukuyiseli emsebenzini. Ukungenisa kungumsebenzi ohlukile, ohleliwe, futhi uhlu oluphelelwe yisikhathi lumisa ukuxhumana esikhundleni sokuba buthaka buthule. Beka ukuvusezela kukhalenda elifanayo nezitifiketi ngokwazo.
Lokho kwenza ukuvusezela kube into yokuqapha enomnikazi, hhayi umsebenzi ophela ekuqaliseni. Hoxisa isitifiketi sokuhlola esisodwa kusukela ekuqaleni kuze kube sekugcineni ngaphambi kokuba uwudinga ngempela lo mshini.
Okungekho kukhetho okukususayo
Yonke inketho isadinga isitifiketi nokhiye weklayenti ohlukile kudivayisi ngayinye ephethwe ngokuzimela. Isifundo esabela ubunikazi obubodwa kubo bonke siyisinqamuleli sesifundo, futhi senza nokuhoxiswa okukhethiwe kungabinedzeki.
Izitifiketi zomseva ezingenisiwe ku-ACM azinakho ukuvusezela okulawulwayo, ngakho umnikazi kufanele athole okubuyisela esikhundleni, akungenise futhi, bese eqinisekisa ukuthi indawo yokugcina ikwamukele. Ukuvusezela isitifiketi somseva akuvusezeli izinkomba zeklayenti esezivele zisemakhompyutheni aphathekayo. Leyo yimijikelezo yempilo ehlukile enamakhalenda ahlukile.
Hlola izinhlobo zokhiye nezandiso umsebenzi ozenzelayo ngaphambi kokukhipha noma yini. Ukuthi i-CA isekela i-algorithm akusho ukuthi indawo yokugcina izoyamukela.
Ngaphambi kokuqalisa, sebenzisa ukuvusezela okukodwa nokususwa kweklayenti okukodwa ngohlelo lomsebenzi olukhethile, futhi bhala ukuthi yikuphi ukwaziswa okwaguqulwa, yikuphi ukulungiselela kwendawo yokugcina okwaguqulwa nokuthi kwenzeka nini esikhathini esisebenzayo. Uma lowo msebenzi uphela ngaphandle komnikazi ocacile, ukukhethwa komkhiphi akuphelile.