Khipha izitifiketi ku-P12 ngaphandle kokhiye wangasese

Ithikithi lokusekela liyabuza ukuthi iyiphi isitifiketi engaphakathi kwephakethe le-VPN, futhi umgudu wokuqala ukukhipha konke nokukunamathisela. Ifayela le-P12 lipakisha izitifiketi kanye nempahla yokhiye wangasese esitsheni esisodwa, ngakho ukukhipha konke kuyinto ngempela ongafanele uyithumele. Umyalo ophendula umbuzo uyinkinga yokukhetha, hhayi inkinga yokuguqula. Amabhanzi amane anquma ukuthi uthola uphi uhhafu wesitsha, futhi amabili kuwo azwakala ephephile kunalokho ayikho.

Qala ngokufunda isitsha esikhundleni sokusikhipha konke.

Ifayela le-PKCS12 liqukethe ini ngempela

Isitsha se-PKCS12 siqukethe isitifiketi esisodwa noma eziningi, mhlawumbe ukhiye wangasese kanye ne-message authentication code phezu kokuqukethwe. Izitifiketi zingafaka isitifiketi seqabunga lobuwena bomklami kanye neziphakathi ezixhumanisa ne-CA. Ukhiye, uma ukhona, yiwo owenza ifayela libe yimfihlo hhayi idokhumenti.

Lowo mehluko uyisizathu sokuthi -nokeys likhona nokuthi yilona bhanzi oludingayo lolu cwaningo.

Funda iphakethe ngaphandle kokubhala ukhiye

Ifomu lokuhlola liphrinta isakhiwo nemininingwane ye-algorithm futhi alibhali lutho: openssl pkcs12 -in client.p12 -info -noout. Licela iphasiwedi yokungenisa, okuyindawo efanele yalelo nani, futhi likutshela ukuthi ifayela linokhiye yini nhlobo. Sebenzisa -passin env:PKCS12_PASS lapho iphasiwedi ingeke ithayiphwe khona, ngoba iphasiwedi ngaphakathi komyalo we-shell iyiphasiwedi ohlwini lwezinqubo. Lesi sinyathelo asikhiphi lutho, futhi lowo umongo wonke.

Funda okukhiphayo ngezinto ezintathu: zingaki izitifiketi, ingabe ukhona ukhiye, futhi yimaphi ama-algorithm ayivikelayo.

Sebenzisa -nokeys, futhi ungayihlanganisi ne--nocerts

-nokeys likhipha okhiye bangasese futhi lishiya izitifiketi. -clcerts linciphisa lokho kuzitifiketi zomklami, -cacerts likunciphisa kuzitifiketi ze-CA, futhi lezi zimbili zingezihlungi hhayi ezinye izindlela. -nocerts lifundeka njengopelo oluphephile lombono ofanayo futhi lisho okuphambene: azikho izitifiketi, okushiya okhiye kuphela. Ukulihlanganisa ekukhipheni izitifiketi yindlela ukhiye wangasese ogcina ngokuba sediski.

Ifomu lemigqa emibili elikhiqiza ifayela lezitifiketi nefayela le-CA, futhi akukho okunye, yilokhu:

openssl pkcs12 -in client.p12 -nokeys -clcerts -out client-certificates.pem
openssl pkcs12 -in client.p12 -nokeys -cacerts -out ca-certificates.pem

Amaphakethe amadala adinga -legacy ku-OpenSSL 3 ukuze afunde ukubethela kwawo kwakudala, futhi lowo bhanzi ushintsha lokho okwamukelwa yi-parser, hhayi lokho ekukhiphayo. Uma ukuhlaziya kwehluleka ngephutha mayelana ne-algorithm engasekelwe, ukwengeza -legacy yisinyathelo sokuqala esifanele futhi ukweqa ukuhlolwa kwe-MAC akusiso.

Hlola okukhiphayo, hhayi ikhodi yokuphuma

Isimo sokuphuma esingu-zero sisho ukuthi umyalo uqalile, hhayi ukuthi ifayela liqukethe lokho okulindele. Bala izitifiketi kokukhiphayo futhi ufunde i-subject nezinsuku: openssl x509 -in client-certificates.pem -noout -subject -dates -fingerprint. Qhathanisa isigxivizo somunwe nalokho okulindelwe yithimba lokusekela, ngoba iphakethe elinamazitifiketi amabili omklami likhiqiza ifayela elinamabhulokhi amabili futhi amathuluzi amaningi afunda elokuqala kuphela. Inhloso, ukwethemba nokuhambisana kokhiye kuyizivivinyo ezihlukile futhi.

Isitifiketi esihlaziyekayo yisitifiketi esihlaziyekayo. Akusona isitifiketi esamukelwa yi-VPN.

Nquma ukuthi uyawadinga yini amafayela

Uma iklayenti elamukelayo lingenisa i-PKCS12 ngqo, ukuthumela iphakethe lasekuqaleni ngomzila ogunyaziwe ngephasiwedi egcinwe yodwa kulula futhi kugcina ukuvikelwa. Ukukhipha kungenxa yokuhlola, kweklayenti elidinga i-PEM, noma kwicala lokusekela elicele i-artifact ethile. Ukukhipha ngakunye kususa isendlalelo esisodwa futhi kufanele kube nesizathu.

Izitifiketi zomphakathi azinakho ukhiye wangasese, kodwa zinamagama nemininingwane yenhlangano. Yabelana ngezinkambu ebezicelwe yithikithi esikhundleni sefayela, ngaphandle uma ifayela kuyilo ebeliceliwe.