Ukuhoxiswa kwezitifiketi kuyahluleka: i-host iphi engakwazi ukufinyelela ini

Izitifiketi zingaba ngaphakathi kwesikhathi sokusebenza kwazo kuyilapho i-VPN isa bika ukwehluleka kokuqinisekisa, bese omunye ephetha ngokuthi isitifiketi sikhishiwe. Lezo ziqiniso ezintathu ezihlukene. Idatha yokuhoxiswa kufanele ithathwe idivayisi eyenza ukuqinisekisa, isuka endaweni yokushicilela ebhalwe ngaphakathi kwesitifiketi uqobo. Uma leyo divayisi ingakwazi ukufinyelela kuleyo ndawo, ukuhlolwa kuyahluleka ngenxa yezizathu ezingahlobene nesimo sesitifiketi.

Umqinisekisi ungumnikazi wendlela yokuthatha

Qala ngokukhomba umqinisekisi. Uma ikhompyutha ephathwayo ihlola isitifiketi segedi, ikhompyutha ephathwayo iyayithatha idatha; uma igedi ihlola isitifiketi somsebenzisi, igedi iyakwenza. Insizakalo yokuqinisekisa engemuva ingeza umqinisekisi wesithathu onesimo sayo senethiwekhi. Ngamunye unendlela ehlukile eya ku-inthanethi nokuhlelwa kwe-proxy okuhlukile. Ubufakazi obuqoqwe esiteshini somlawuli abusho lutho ngeseva engaphakathi kwe-DMZ.

Bhala phansi isitifiketi, umqinisekisi, isikhathi somzamo kanye nekhodi yesimo eqondile ngaphambi kokushintsha noma yini.

Funda iphoyinti lokushicilela kusitifiketi

Isitifiketi sisho lapho isimo saso sikhona. Funda lezo zinkambu esikhundleni sokuqagela ikheli le-CA.

openssl x509 -in gateway.cer -noout -text | grep -A3 "CRL Distribution Points"
openssl x509 -in gateway.cer -noout -text | grep -A2 "Authority Information Access"

Isandiso sokuqala siklelisa amaphoyinti okusabalalisa e-CRL, kanti sesibili siklelisa izindlela zokufinyelela ulwazi lomkhiphi, ezingase zihlanganise isimo se-OCSP nokuthathwa kwesitifiketi somkhiphi. Lezi zindlela ezihlukene, futhi isiphenduli se-OCSP akulona ifayela le-CRL. I-host yokushicilela ivamise ukuba iseva yewebhu evamile hhayi umshini we-CA, ngoba umkhiphi ongaxhunyiwe angasayina i-CRL esatshalaliswa enye iseva. Ngakho umthetho we-firewall ochazwa njengokufinyelela ku-CA ubanzi kakhulu ukuba ungasetshenziswa noma ubuyekezwe.

Hlola ukuthatha kudivayisi eqinisekisayo

Gijimisa ukuhlolwa kokuthatha endaweni eyenza ukuqinisekisa ngempela, ngezinto zesitifiketi ezigunyaziwe futhi ngaphandle kokhiye abayimfihlo.

certutil -urlfetch -verify .\client-test.cer
curl -sS -o /dev/null -w "%{http_code}\n" http://crl.example.com/ca.crl

Ukugijima kwe-certutil kuqinisekisa uchungechunge futhi kubike ukuthi yikuphi ukuthathwa kwe-URL okuphumelele noma kwehlulekile, kuyilapho ucingo lwe-curl luhlola ikheli elilodwa lokushicilela kusuka kuleyo host futhi lubuyisela ikhodi yesimo kuphela. Ukuthathwa okwehlulekile kusuka ekhelini elifinyelelekayo kukhombisa izinkinga zokuqukethwe noma zesiginesha; iphutha lokuxhumana likhombisa umzila, i-DNS noma i-proxy. Gcina yomibili imiphumela, ngoba ukuthathwa okukodwa okuphumelele akufakazi ukuthi lonke uchungechunge luyasebenza. Shintsha i-host nendlela yesibonelo ngephoyinti lokusabalalisa elitholakale kusitifiketi.

Hlukanisa idatha engekho nesimo sokuhoxiswa

Imiphumela emine ibukeka ifana ngaphandle: iphoyinti alifinyeleleki, uhlu ludala, uhlu lusayinwe umkhiphi ongafanele, noma isitifiketi sikhishiwe ngempela. Eyokugcina kuphela ingumphumela wesimo, futhi yiyo kuphela eqinisekisa ukususwa kokufinyelela. Ukugcinwa kwekhashu kwenza isithombe sibe nzima nakakhulu, ngoba idatha ethathwe ngaphambili ingafihla indlela yokushicilela ephukile kuze kube ukuvuselelwa okulandelayo. Ukucisha ukuhlolwa kokuhoxiswa, ukususa izitifiketi ezingahlobene noma ukuqalisa kabusha igedi konke kufaka umsebenzi esikhundleni sokuxilonga.

Ngemva kokulungisa, phoqa ukuqinisekisa okusha futhi uqinisekise ukuthi ukuthathwa kwesimo okuhlosiwe kuyaphumelela. Lapho kukhona ubunikazi bokuhlola obulawulwayo, qinisekisa ukuthi kusenqatshwa, ngoba ukutholakala okususa ukuhlolwa akulona ukulungisa.