Indlela yokukhiqiza ukhiye weklayenti le-VPN nokuthumela i-CSR ukuze isayinwe

Kungashiwo ngokushesha noma ngokuhamba kwesikhathi, umsebenzisi we-VPN unikeza ukuthumela ukhiye oyimfihlo nge-imeyili ukuze umphathi akwazi ukwenza isitifiketi, futhi yiso leso siphakamiso okufanele senqatshwe. Ukugeleza okusebenzayo kugcina ukhiye kuklayenti kusukela kumyalo wokuqala: iklayenti uyawukhiqiza, ithumela isicelo sokusayina isitifiketi, umkhiphi uyaqinisekisa futhi ugunyaze, futhi isitifiketi esisayiniwe sibuya sizohlala eduze kokhiye owasikhiqizayo. Uhlu lokuhlola olungezansi lwehluleka ngokuvaliwe esigabeni ngasinye, futhi yilokho okubalulekile, ngoba izigaba ezimbili kweziyisihlanu yizona abantu abazidlulayo lapho begijima.

Isigaba 1: khiphiza ukhiye lapho uzohlala khona

Khiphiza emshinini ozogcina ukhiye, futhi uwushiye lapho. Ukhiye wesofthiwe ungena efayeleni elinezimvume eziqinile; ukhiye osekelwa yi-hardware noma osesitolo esilawulwayo awusoze waba ifayela, futhi indlela yawo yokubhalisa ngokuvamile iyithuluzi elihlukile hhayi umyalo we-OpenSSL. Noma kunjalo, akekho odinga ukubona ingxenye eyimfihlo.

Ukugeleza kwesofthiwe kubukeka kanje, ukhiye nesicelo kwenziwa esimweni esisodwa:

umask 077
openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:3072 -out client.key
openssl req -new -key client.key -out client.csr -subj "/CN=alice-vpn/O=Example"

Umugqa umask ubaluleke kakhulu kunalokho okubonakala. Ngaphandle kwawo ukhiye ubhalwa ngendlela wonke umuntu angayifunda kusistimu evumela ngokuzenzakalelayo, futhi ukukopisha ifayela kamuva kusabalalisa lokho. Ukusebenzisa ukhiye okhona futhi kusemthethweni lapho usuvikelwe futhi uhambisana nenqubomgomo yakho; ukukhiqiza okusha kudivayisi ngayinye kulula ukukucacisa.

Isigaba 2: faka ubunikazi esicelweni, hhayi ku-imeyili

Nquma ukuthi i-VPN iqinisekisa ini ngempela ngaphambi kokuba isicelo senziwe, ngoba leyo mpendulo ingaphakathi kwe-CSR. OpenVPN ngokwesiko lixhumanisa ubunikazi beklayenti negama elivamile lesitifiketi, futhi amathuluzi afana ne-strongSwan ahlanganisa umucu wobunikazi nesihloko noma igama elihlukile lesihloko. I-imeyili ethi igama lami ngu-alice ayibona ubufakazi, futhi isicelo esithi isihloko saso lokho kufana sincane kakhulu kunokunye.

Engeza igama elihlukile lesihloko lapho isiqinisekisi sakho sihlola elinye, ngoba ukufanisa kwesimanje ngokuvamile akunaki i-CN endala:

openssl req -new -key client.key -out client.csr \
  -subj "/CN=alice-vpn/O=Example" \
  -addext "subjectAltName=DNS:alice-vpn"

Gcina i-CN imfushane, izinzile futhi iboshelwe ku-akhawunti hhayi kumodeli yekhompyutha ephathwayo. Igama eliqukethe inombolo yochungechunge yedivayisi yomsebenzisi inkinga yokusekelwa elindele ukushintshwa kokuqala kwe-hardware.

Isigaba 3: qinisekisa isicelo ngaphambi kokusisayina

Umkhiphi uqinisekisa izinto ezimbili ezihlukene, futhi ukuzihlanganisa iyiphutha lendabuko. Okokuqala, ukuthi isicelo sihambisana ngaphakathi: isiginesha iqinisekiswa ngokumelene nokhiye womphakathi esiwuthwalayo. Okwesibili, ukuthi umceli unelungelo kulokho isicelo esikucelayo, futhi lokho akukho ukuhlola kwe-cryptographic okungakuphendula.

Ingxenye yomshini ingumyalo owodwa, futhi kufanele iphrinte umphumela wokuqinisekisa kanye nesihloko:

openssl req -in client.csr -noout -verify -subject
openssl req -in client.csr -noout -pubkey | openssl pkey -pubin -noout -text

Qaphela ukuthi lokho kufakazelani. Isicelo esiqinisekisiwe sibonisa kuphela ukuthi umthumeli wayenokhiye oyimfihlo ohambisanayo ngesikhathi sokuthumela; asifakazeli ukuthi umthumeli ungumuntu oshiwo esihlokweni, futhi asigunyazi ukufinyelela kweqembu noma komzila ocelwayo. Ukubuyekezwa kokubhalisa kuyisango elihlukile, futhi isicelo seqembu okungekho owasivumayo kufanele senqatshwe kunokuba silungiswe buthule.

Isigaba 4: gunyaza, bese usayina ngezandiso ezicacile

Ukusayina yilapho i-CA inquma inqubomgomo esikhundleni sokwamukela isicelo ngokwezwi nezwi. Ukusebenza, ukusetshenziswa kokhiye kanye nesandiso sendima kungokwasefayeleni lezandiso, hhayi kumavalue okuzenzakalelayo ongayikhumbuli ngemuva kwezinyanga eziyisithupha. Isitifiketi seklayenti sokufakazela i-VPN sidinga ukufakazelwa kweklayenti njengenjongo yaso.

cat > client.ext <<'EOF'
basicConstraints = CA:FALSE
keyUsage = digitalSignature
extendedKeyUsage = clientAuth
EOF
openssl x509 -req -in client.csr -CA ca.crt -CAkey ca.key \
  -CAcreateserial -days 365 -extfile client.ext -out client.crt

Sebenzisa -CAserial nefayela lomfula elikhona uma elinye selisetshenziswa, futhi gcina ukhiye we-CA ngokungaxhunyiwe noma esitolo esivikelwe inqubomgomo yakho eqamba kuso. Izinombolo zomfula zezitifiketi kufanele zihluke kumkhiphi ngamunye; ukwakha kabusha ifayela lomfula kusukela ekuqaleni kubeka engcupheni ukungqubuzana okwenza ukuhoxiswa kungacaci.

Rekhoda okwakhishiwe: inombolo yomfula, isihloko, ubunikazi obuceliwe, umuntu ovumile kanye nokuphela. Leyo rekhodi iyona okuncike kuyo isinqumo sokuhoxiswa kamuva, futhi ayikwazi ukwakhiwa kabusha kusukela esitifiketini kuphela uma umkhondo wokubhalisa uhlala ebhokisini leposi kuphela.

Isigaba 5: faka eduze kokhiye ohambisanayo futhi ufake ubufakazi bombhangqwana

Iklayenti lithola isitifiketi kanye nochungechunge lomkhiphi, hhayi ukhiye. Ngaphambi kokuxhuma, qinisekisa ukuthi isitifiketi sibhangqa ngempela nokhiye osevele usesidikini, ngoba umbhangqwana ongahambisani ukhiqiza ukwehluleka kokuxhawulana okudidayo kamuva kakhulu:

openssl x509 -in client.crt -noout -pubkey | openssl pkey -pubin -outform DER | openssl sha256
openssl pkey -in client.key -pubout -outform DER | openssl sha256

Ama-digest amabili kufanele afane. Bese uxhuma futhi uqinisekise ukuthi ubunikazi oburekhodwa iseva yibo obugunyazile, hhayi nje ukuthi ithumbu laphuma. Uma ukhiye ulahleka noma idivayisi ishintshwa, impendulo ukuhoxiswa kanye nesicelo esisha esivela kudivayisi entsha; ukucela umphathi ukuthi abuyisele ukhiye kwelinye indawo akubuyiseli owasekuqaleni futhi kwephula buthule imodeli eyenza isicelo saphepha.