ca md too weak: ukhiphe kabusha isitifiketi noma wehlise izinga?

OpenVPN iklayenti elalisebenza ngenyanga edlule manje lehluleka ekuqaliseni nge ca md too weak, futhi iphrofayili esediski iyafana ngebhayithi ngebhayithi naleyo eyayisebenza. Umlayezo umayelana nesiginesha esisitifiketini sesiphathimandla samasitifiketi, hhayi i-cipher yedatha, i-digest ye-auth noma iphasiwedi ye-akhawunti. Izimo ezintathu zinquma ukuthi ukulungisa kuyinto entsha yobunikazi, uchungechunge olusha, noma ushintsho lwenqubomgomo olwenziwe ngamabomu. Zisebenze ngokulandelana, futhi uzogwema umphumela ojwayelekile lapho umhubhe ubuya ngokwenza buthakathaka zonke izixhumanisi ze-TLS kumsingathi.

Iphutha lisho ini ngempela

I-OpenSSL iphakamisa leli phutha lokuqinisekisa ngenkathi yakha uchungechunge, lapho isitifiketi esisebenza njenge-CA sithwele i-digest yesiginesha izinga lokuphepha lomtapo wezincwadi engasayamukeli. I-MD5 iyenqatshwa ezingeni elijwayelekile, futhi i-SHA-1 iyenqatshwa uma izinga likhushulwa. I-digest esitifiketini seqabunga ayibalulekile lapha ukwedlula i-digest yomkhiphi oyisayinayo. Inqubomgomo efanayo ingayenqaba impande eyayijwayelekile ngokuphelele ngosuku eyakhishwa ngalo.

Yingakho ukuhlela auth noma data-ciphers kungenzi lutho kuleli phutha. Lezo zilungiselelo zilawula ukuthi amaphakethe avikelwa kanjani ngemuva kokuxhawulana, kuyilapho into enqatshiwe iyidokhumenti yobunikazi ebhekwa ngaphambi kokuba umhubhe ube khona. Isitifiketi singahlala kahle esikhathini saso sokusebenza futhi sisathwele isiginesha umtapo wezincwadi ongeke uyivume.

Gcina izivivinyo zihlukene engqondweni futhi iphutha liyeke ukubonakala liyimfihlakalo. Izinsuku zokusebenza, ukusetshenziswa kokhiye kanye ne-digest yesiginesha kuyizivivinyo ezizimele, futhi kunye kuphela kuzo okusanda kwehluleka.

Isimo sokuqala: ingabe into enqatshiwe iyimpande?

Phrinta isitifiketi ngasinye kuphrofayili bese ufunda izinkambu ze-subject ne-issuer. Impande ezisayine yona ikhombisa inani elifanayo kuzo zombili, futhi i-algorithm yayo yesiginesha iyona uchungechunge lonke oluncike kuyo. Uma i-digest ebuthakathaka ihlezi lapho, iqabunga ngalinye elingaphansi kwayo lizuzwa ifa lenkinga. Bhala i-algorithm eceleni kwe-subject ukuze ukuqhathanisa kwakamuva kube ngokomshini hhayi ngokukhumbula.

Amafayela e-CA ahlanganisiwe avame ukuba namabhuloki amaningi, ngakho khomba ibhuloki elilayishwa ngempela esikhundleni sokucabanga ukuthi elekuqala linecala. Umyalo openssl x509 -in ca.pem -noout -subject -issuer -text uchaza isitifiketi esisodwa ngesikhathi, okusho ukuthi kufanele kuqala kwehlukaniswe inqwaba uma iqukethe ngaphezulu kwesisodwa. Qhathanisa i-algorithm yesiginesha ephrintiwe ne-digest obungalindela kuyo kusukela enkathini eyadalwa ngayo impande.

Iqabunga elisayinwe nge-SHA-256 ngaphansi kwempande ebuthakathaka lisahluleka, ngoba ukuhlolwa kochungechunge kukhuphuka kuze kufike phezulu. Yilowo mgidingo owenza isimo esilandelayo sibaluleke.

Isimo sesibili: ingabe uyayilawula imkhiphi?

Uma impande ingeyenhlangano yakho, ukulungisa okuhlala njalo iwukuthi kube nempande entsha ene-digest yesimanje kanye namaphabunga akhishwe kabusha, alethelwa njengokubuyekezwa okukodwa kwephrofayili. Lokho kudinga iwindi lokunakekela kanye nohlelo lwamadivayisi angeke akwazi ukuthola ukubuyekezwa ngalo kanye lolo suku.

Uma uchungechunge lukhishwe ingxenye yesithathu, ukulungisa wukucela kulowo osebenza ngayo, futhi isinyathelo sasekhaya esisodwa esiwusizo wukuyeka ukuncika ezintweni ezindala. Ukuhlela umbhalo we-PEM noma ukugcina ifayela kabusha akushintshi lutho kulokho okumbozwa yisiginesha.

Isimo esisodwa esiphakathi sifanele igama: impande yangaphakathi endala ukwedlula izinto ezijwayelekile zamanje kodwa esayina izinto ezithenjwa ezinye izinhlelo. Ukuyishintsha kusho ukuhlola wonke umsebenzisi, kuhlanganise namadivayisi agxumeka isitifiketi esidala ngomnyathelo womunwe. Bala labo basebenzisi ngaphambi kokuhlela ushintsho, ngoba ukushintsha kwempande okweqiwe oyedwa kushintsha iphutha lokuqalisa libe ukuphazamiseka kwesevisi.

Isimo sesithathu: yini enye eyamukelwa ukwehlisa izinga

Ukwehlisa izinga lokuphepha, noma ukukhetha iphrofayili yamasitifiketi endala ye-OpenVPN, kwenza iklayenti lamukele futhi i-digest endala. Kubuye kuxegise ezinye izivivinyo emtapweni ofanayo wezincwadi, kukho konke ukuxhumana okwenziwa yileyo nqubo.

Lokho kungavikeleka elabhorethri, noma njengebhuloho elifushane ngenkathi kulungiselelwa izinto zokushintsha, inqobo nje uma ukukhululwa kukhawulelwe kuphrofayili eyodwa futhi kunosuku lokuphela. Njengesilungiselelo esihlala njalo kumsingathi owabiwe, kwandisa buthule lokho iklayenti ngalinye le-TLS lapho elizokwethemba.

Bhala ukukhululwa kanye nomnikazi kanye nesinyathelo sokususa. Ushintsho lwezinga olungabhalwanga alukwazi ukuhlukaniswa nephutha ezinyangeni eziyisithupha kamuva, futhi unjiniyela olandelayo ngeke azi ukuthi kwake kwaba yisinqumo.

Isinqumo, esibhalwe njengomthetho

Shintsha uchungechunge uma ulawula umkhiphi futhi ukwazi ukubala abasebenzisi bakhe. Khuphukela kumkhiphi uma ungayilawuli. Yehlisa izinga kuphela njengokukhululwa okunosuku nokulinganiselwe, nokushintsha okuhlelelwe kakade. Okunye konke kushiya isitifiketi esifanayo endaweni yaso futhi kuhambisa ingozi endaweni engabonakali kahle.

Bese uphinda uhlole iphrofayili kusuka kuklayenti elihlanzekile, qinisekisa ukuthi ukuxhawulana kuyaphela, futhi gcina umbhalo oqondile wokunqaba uma lisahluleka. Umlayezo wephutha oqondile uyinto eshibhe kakhulu ongayinikeza umnikazi wesigaba esilandelayo.