Yimaphi amavalidetha athinteka isitifiketi somsuka esengeziwe?

Uthola isitifiketi somsuka obekungafanele sibe lapho, futhi umbuzo wokuqala ukuthi ingabuqamba ubuni bani. Impendulo eqotho incike ekutheni iyiphi isoftware ebheka leso sitsha kanye nokuthi i-VPN yakho iqinisekisa kanjani isango layo. Isiphequluli, umphathi wamaphakethe kanye neklayenti le-VPN elinominwe oboshiwe akudingekile ukuthi babelane ngesinqumo esifanayo sokuthemba. Hlela amavalidetha ngaphambi kokunquma ububanzi.

Umsuka esitokweni sesistimu akulona ukhiye wendawo yonke

Ukufaka umsuka kwenza izitifiketi ezisayinwe ngalowo khiye zamukeleke ezinhlelweni ezisebenzisa isitokwe esithintekile. Lokho akwenzi ukuthi zamukeleke yonke indawo ngokuzenzakalela, ngoba ezinye izinhlelo ziletha ingqikithi yazo noma zihlola inani eliboshiwe. Futhi akufakazi ukuthi othile wagijima ikhodi emshinini; ushintsho lokuthemba lungenye yamakhono ambalwa. Thatha isitifiketi njengokutholakele okudinga ukulinganiselwa, hhayi njengayo yonke ingozi.

Isitokwe sibalulekile njengesitifiketi: ingqikithi yezinga lomsebenzisi kanye ne-ankile yezinga lesistimu kufinyelela kubasebenzisi abahlukene.

Hlela i-validetha ngayinye kanye nomthombo wayo wokuthemba

Bhala yonke ingxenye eqinisekisa izitifiketi emiseleni yokusebenza ethintekile: isiphequluli, umphathi wamaphakethe, iklayenti le-imeyili, i-VPN. Bese uthola umthombo wokuthemba okufundwa yiwo ngayinye.

ls /usr/local/share/ca-certificates
trust list | grep -i -E "vpn|corp"

Uhlu lwedirekhthori lukhombisa ama-ankile engezwe endaweni ezinhlelweni zesitayela se-Debian, futhi uhlu lokuthemba lukhombisa lokho isitokwe sesistimu esikudalulayo njengamanje. Isiphequluli esinesitokwe saso ngeke sivele lapho, futhi uhlelo lwe-Java noma lwe-Python lungasebenzisa enye ingqikithi. Bhala ukuthi yikuphi okufakiwe okulindelekile nokungakulindelekile, usebenzisa umthetho weminwe esikhundleni segama elibonisiwe kuphela. Lolo hlu yilokho okudingwa umphenduli wengozi ngaphambi kokususa noma yini.

Hlola ukuqinisekiswa kontanga kwe-VPN ngokwayo

I-VPN ene-CA yangasese noma umthetho weminwe ocacile ihlola isango ngokulungiselelwa kwayo. Qhathanisa lokho iklayenti elikulindele nalokho isango elikwethulayo.

openssl s_client -connect vpn.example.com:443 -servername vpn.example.com -showcerts </dev/null 2>/dev/null | openssl x509 -noout -fingerprint -sha256 -subject

Umphumela unikeza umthetho weminwe we-SHA-256 kanye nesihloko sesitifiketi esethulwa indawo yokugcina, ongasiqhathanisa nenani elilungiselelwe. OpenVPN inenketho yomthetho weminwe wontanga eyenza lokho kuqhathanisa emhubheni ngaphandle kokudinga ukuthi isitokwe sesistimu samukele umsayini. Leyo nkululeko iwusizo emhubheni futhi ayisho lutho ngesiphequluli. Futhi ayisizi uma umthetho weminwe olindelekile wawukotshwe kusukela ekuqaleni kuxhumano olusolisayo.

Nquma ububanzi bengozi ngale kwesitifiketi

Sebenzisa inqubo yomnikazi wedivayisi ukususa ama-ankile angagunyaziwe nokufuna izinguquko ezivame ukuhamba nawo: amasevisi amasha, amaklayenti ashintshiwe, izilungiselelo ze-proxy ezishintshiwe. Emshinini ophethwe, qinisekisa ukulungiselelwa okusemthethweni ngaphambi kokususa into encike kuyo enye isoftware. Ku-validetha ngayinye, bhala ukuthi ukuthemba kwayo kuvela kuphi, ubuni obukulindele nokuthi waqinisekisa kanjani ukuthi ukulungiselelwa kwamanje kulungile. Umhubhe osebenzayo ngemva kokuhlanza uwukubona okukodwa, hhayi ubufakazi bokuthi indawo yokugcina ihlanzekile.

Bese uphinda uhlole imiseleni yokusebenza eyayisebenzisa isitokwe, ngoba ukususa i-ankile kungaphula isevisi yangaphakathi eyayithembile ngokusemthethweni kuyo. Ukubuyisela kuqedwa lapho ubudlelwano bokuthemba obulindelekile busebenza futhi obungalindelekile bungasebenzi.