I-Easy-RSA ithi i-PKI ayikho? Ibheka kwenye indawo

Umyalo uyama ngenxa ye-ca.crt engekho noma i-index.txt engekho, kuyilapho i-CA isikhulile izitifiketi izinyanga. Akukho okushintshile kugunya; umyalo ubheke kwenye indawo nje. I-Easy-RSA 3 inquma indawo ye-PKI kusukela kukhetho, ukuguquguquka kwemvelo, ifayela le-vars kanye nenani elizimisela elakhelwe ngaphakathi, futhi noma yikuphi kwalokhu kungakhomba kude kugunya lokusatshalaliswa. Hlola ukuthi yikuphi okuphumelele ngaphambi kokuthi wakhe noma yini.

Iphutha libiza ifayela, hhayi indawo

Indawo yokufaka kanye nendawo yomkhiphi yizindawo ezimbili ezihlukene. Ukuthola easyrsa emshinini kufakazela kuphela ukuthi ithuluzi lifakiwe, hhayi ukuthi lithole ugunya i-VPN yakho eyethembayo.

Yingakho ukufaka kabusha iphakethe noma ukuphinda ugijime isinyathelo se-init kubonakala kusiza futhi akushintshi lutho.

Hlola isikhethi ngaphambi kwanoma yini enye

Ku-Easy-RSA 3 isikhethi yi EASYRSA_PKI noma ukhetho oluhambisanayo --pki-dir. Nikeza indlela ephelele njenge --pki-dir=/srv/pki/office, futhi impendulo iyeka ukuncika endaweni obekade ume kuyo ngengozi. Lowo mkhuba owodwa ususa isigaba sonke sale phutha, ikakhulukazi kuma-script agijinywa kusukela ku-cron noma ku-CI checkout.

Qinisekisa kuqala isizukulwane, ngoba umkhuba we-Easy-RSA 2 wefayela le-vars kanye ne-build-key uyimodeli ehlukile kunaleyondlela elindelwe yi-Easy-RSA 3. easyrsa --version iphrinta isizukulwane ngaphambi kokwenza enye into, futhi ./easyrsa --help ibala imiyalo engaphansi: umgomo build-key usho i-2.x, kuyilapho build-client-full usho i-3.x. Ukuthwala indlela KEY_DIR endala ungene ocwaningweni lwe-3.x ngenxa yokuthi igama lendawo libonakala lijwayelekile kukhiqiza kanye nale phutha.

Uma uchungechunge lwenguqulo kanye nesimo somyalo kungavumelani, yima futhi ufunde imibhalo yenguqulo efakiwe.

Ukubaluleka kuchaza ifayela le-vars elahluliwe

Ukubaluleka okubhaliwe ukhetho lomugqa womyalo, bese kuba imvelo, bese kuba ifayela le-vars, bese kuba inani elizimisela elakhelwe ngaphakathi. Ngakho-ke inani elifanele ku-vars lihlulwa ukuguquguquka kwemvelo okuzuzwe njengefa, futhi lena inguqulo ethule yalokhu kwehluleka. Hlola ukuguquguquka okuhloswe kanye nokukhethwa kwefayela esikhundleni sokuthululela yonke imvelo kuthikithi. Umehluko phakathi kwalokhu kokubili ngokuvamile uyimfihlo.

Hamba ngochungechunge ngokulandelana futhi uphawule ukuthi yimuphi umthombo onikeze indlela esetshenziswe umyalo. Uma usukwazi lokho, ukulungisa iyifulegi noma i-export, hhayi ugunya olusha lwezitifiketi.

Isikhombisi sokuhlela se-Easy-RSA sichaza isikhethi nokubaluleka, futhi yiso leso esicashuniwe okufanele sifakwe kuthikithi.

Qinisekisa umkhiphi ngempahla yomphakathi

Kumkhiphi ojwayelekile osuselwa kumafayela, funda ca.crt futhi uqondanise umkhondo womunwe wawo nerekhodi yomkhiphi oyivumile. Igama lesihloko eliqondanayo akubona ubufakazi bobuwena, futhi nendawo ebizwa nge-production ayisiyo. Umkhondo womunwe kuphela oxhumanisa ifayela olitholile nogunya okwathiwa ontanga yakho bayethembe.

Ukuhlola kokufunda kuphela kwanele: openssl x509 -in /srv/pki/office/ca.crt -noout -subject -issuer -serial -fingerprint -sha256.

Bese usungula indima yendawo. Indawo yezicelo esetshenziswa iklayenti ayisona isizindalwazi somkhiphi, futhi ukhiye wokusayina ogcinwa ngaphandle kwenethiwekhi awunamsebenzi kusilo sonke isiphathi se-VPN. Ukungabi khona kwe-ca.key kuleso sakhiwo kuyisici somklamo, hhayi imvume yokuqamba ugunya oluyisikhundla.

Uma isimo sesihambile ngempela

Ngezinye izikhathi indlela ilungile futhi isimo asikho ngempela. Ifayela le-index.txt elingenalutho kanye nesibali sokulandelana esiqalwe kabusha kukunika i-PKI ebukeka iphilile futhi engakwazi ukufakazela lutho ngezitifiketi engakaze zibone: ukunwetshwa ngeke kuhoxise ezindala, futhi izinombolo ezintsha zizoshayisana nomlando. Esikhundleni salokho buyisela kusukela kusipele esigunyaziwe se-CA, ngoba ukuqalisa i-PKI engenalutho kwenye indawo kudlulisa iphutha futhi kushiye ngemuva ugunya lwesibili olungahlobene.

Uma indlela nomkhiphi sekuvumelana, bhekana nokwehluleka okulandelayo ngokwalo. I-Permission denied, ukhiye wokusayina odinga umusho wayo wokugqama, kanye nerekhodi lokukhishwa elingekho yizinkinga ezintathu ezihlukene, futhi eyodwa kuphela yazo ephathelene nendawo oyilungisile manje.

Ungalokothi ususe ukubethela kokhiye noma wandise izimvume zendawo ukuze ufihle iphutha lendlela. Iphutha lishibhile ukulilungisa; ukulungisa akusona.