I-CA esayinwe ngokunqamula: ukhiye uyafana, ukuxhumeka kwe-AKI akufani

Amasertifiketi amabili e-CA angaba nokhiye womphakathi ofanayo kanye ne-subject efanayo futhi angashintsheki. Elinye lisayinwe ngokwalo, elinye lisayinwe ngokunqamula impande endala, futhi amagama abakhiphi, izinombolo zokulandelana kanye nezasayini zawo ziyehluka. Iqabunga lingazibopha ngqo kwelinye lawo ngokusebenzisa i-Authority Key Identifier yalo. Lokho kubopha kuhlala kungabonakali kuze kube yilapho iklayenti likhetha iketanga elingalungile futhi i-handshake yehluleka ngaphandle kwesizathu esicacile.

Yenza lezi zihlolo ezinhlanu ngokulandelana: ngayinye isusa ukwehluleka okuhlukile.

Uhlolo 1: dweba amaketanga womabili ngaphambi kokuthinta isifanekiso

Bhala izindlela. Umphakathi omdala wethemba iMpande Endala A, eyakhipha i-CA B, eyakhipha iqabunga lesiphakeli. Umphakathi omusha wethemba ngqo i-CA B esayinwe ngokwayo. Womabili amasertifiketi e-B anokhiye ne-subject efanayo, futhi yingakho umuntu ofunda umugqa we-subject ebona i-CA eyodwa lapho iklayenti libona khona ezimbili.

Ikhophi elisayinwe ngokunqamula kufanele futhi libe isertifiketi se-CA sangempela, eline-basic constraints ne-key usage ezivumela ukusayina.

Uhlolo 2: qhathanisa izinkambu ze-AKI, hhayi ukhiye kuphela

Igama lomkhiphi weqabunga kufanele lihambisane ne-subject ye-B, futhi leyo ngxenye ivamise ukuma. I-Authority Key Identifier yilapho amakhophi amabili ehlukana khona, ngoba ingathwala isikhombisi sokhiye, isertifiketi somkhiphi kanye nenombolo yokulandelana. Isikhombisi sokhiye sihambisana namakhophi womabili, ngoba ukhiye uyafana. Izinkambu zomkhiphi nokulandelana zihambisana nelilodwa ngqo, futhi yingakho iketanga elakhiwe ngokumelene nekhophi elisayinwe ngokwalo lingehluleka ngokumelene nelisayinwe ngokunqamula.

Hlola iqabunga esikhundleni sokuqagela: openssl x509 -in server.pem -noout -ext authorityKeyIdentifier.

Bese uqhathanisa abazongenela ukhetho bobabili nge-openssl x509 -in b-cross.pem -noout -text | grep -A2 "Authority Key Identifier", futhi usebenzise umyalo ofanayo ngokumelene nekhophi elisayinwe ngokwalo.

Uma iqabunga lithwala umkhiphi nenombolo yokulandelana, yisertifiketi kuphela esichazwa yilawa mabanga esiqedela iketanga, noma yiliphi ikhophi elilayishwe yiklayenti.

Uhlolo 3: shintsha inqubomgomo yokukhipha, hhayi amabhayithi asayiniwe

Izandiso zihlala ngaphakathi kwesayini. Ukwengeza, ukususa noma ukuhlela okukodwa eqabungeni elikhona akulona ukulungisa, kungenye isertifiketi, futhi kudinga ukukhishwa kabusha. Ushintsho lungokwenqubomgomo yokukhipha: i-authorityKeyIdentifier = keyid,issuer:always yenza amaqabunga amasha athwale ukuxhumeka okuqondene nesertifiketi, kuyilapho i-keyid yodwa igcina isimo esixekethile esifanele ukudlula kwamabomu kokusayina ngokunqamula. Nquma ukuthi iyiphi i-PKI yakho eyifunayo ngaphambi kokusayina iqembu elilandelayo.

Ukuhlela isifanekiso esabiwe nakho kushintsha zonke izertifiketi zesikhathi esizayo, hhayi kuphela isiphakeli esiphambi kwakho.

Uhlolo 4: qinisekisa umphakathi ngamunye wokwethemba ngokwahlukana

Hlola indlela endala nendlela entsha njengokugijima okuhlukene. I-openssl verify -purpose sslserver -verify_hostname vpn.example -CAfile old-root.pem -untrusted b-cross-signed.pem server.pem izilolonga indlela esayinwe ngokunqamula, futhi umyalo ofanayo nempande entsha ngaphandle kwefayela le-untrusted uzilolonga indlela esayinwe ngokwayo. Ukuhlanganisa zombili izimpande kuyibhandela elilodwa kufihla ukuthi iyiphi iketanga ekhethiwe. Bese uphinda namaklayenti angempela, ngoba i-backend ye-VPN ingase ithande iketanga elithile noma iphine isertifiketi ngezindlela i-openssl engazenzeki.

Letha isertifiketi esiphakathi nge-configuration yensiza iklayenti eliyifunda ngempela, hhayi ngekhasi le-wiki.

Uhlolo 5: gcina indlela endala kuwashi yokuthatha umhlalaphansi

Ukusayina ngokunqamula kugcina indlela endala yokwethemba iphila ngokwakhiwa, okuyiyo inhloso nengozi ngasikhathi sinye. Akulungisi impande endala ehlanekezelwe, futhi akususi leyo mpande kunoma yiliphi iklayenti. Bhala ukuthi indlela endala izophela nini ukunikeza ukwethemba, futhi uqinisekise ukuthi lolo suku luyafika ngempela.

Uma iklayenti ngalinye lingamukela impande entsha ngaphambi kokuba amaqabunga anyakaze, ukwethulwa okulula kokwethemba kabili kulula kunokusayina ngokunqamula, futhi kushiya into eyodwa encane okufanele isuswe.