Uyenza kanjani i-HTTPS Isicelo sokuqala Nge-VPN

Isiphequluli esithayipha u-http:// kuqala bese sihlala ku-https:// ngemva kokuqondisa kabusha sesithumele isicelo esisodwa ngokucacile, futhi i-VPN ayikushintshi lokho. Umhubhe uvikela umlenze kusuka kuklayenti ukuya endaweni yokuphuma; ayibetheli lutho ngaphezu kwesendlalelo sezokuthutha, ngakho-ke umbukeli phakathi kokuphuma nomsuka usabona i-plain hop. Ukwenza i-HTTPS isicelo sokuqala wushintsho lohlangothi lweklayenti olunezingxenye ezintathu: ikheli langempela le-HTTPS, imodi yokuthuthukisa yesiphequluli, kanye nenqubomgomo yesayithi uqobo. Izinyathelo ezingezansi ziyi-oda engilisebenzisayo, ngasinye sinesheke elikutshela ukuthi lithathiwe.

Isinyathelo 1: qinisekisa ukuthi siyini isicelo sokuqala

Ngaphambi kokushintsha noma yini, bheka ukuthi isiphequluli sithumela ini. Vula iphaneli yenethiwekhi nekhasi elilayishwe kabusha kusuka kunqolobane ebandayo futhi ufunde umugqa wokuqala: uma uhlelo luyi-http futhi isimo singu-301 noma 308, yonke into ngemva kwalowo mugqa isicelo sesibili. curl -sS -o /dev/null -w '%{http_code} %{url_effective}\n' http://example.com ikhiqiza kabusha ukulandelana okufanayo ngaphandle kwesiphequluli futhi iphrinte i-URL ogcine ngayo.

Imiphumela emibili ingenzeka futhi idinga ukulungiswa okuhlukile. Uma isayithi linikezela nge-HTTPS kumsingathi ofanayo, ukulungiswa kuwukumisa ukushicilela ifomu le-HTTP: buyekeza ibhukhimakhi, isixhumanisi se-wiki, isinqamuleli sedeskithophu kanye nesifanekiso se-imeyili abantu abasichofozayo. Uma isayithi lingayisebenzisi nhlobo i-HTTPS, asikho isilungiselelo sesiphequluli esizoyidala, futhi impendulo eqotho ukuthi indawo okuyiwa kuyo inkinga. Ungaphephi ecaleni lesibili ngaphandle kokukhetha, ngoba ukukhishwa kwesitifiketi ekhasini le-akhawunti kuguqula inkinga yezokuthutha ibe inkinga yokuqinisekisa. Bhala phansi ukuthi ukusiphi isimo ngaphambi kokuthi uthinte isilungiselelo.

Isinyathelo 2: vula imodi yesiphequluli ye-HTTPS kuphela

Imodi yokuthuthukisa ingxenye yesibili, futhi izindlela azishintsheki. Hlola ukuthi eyakho yenzani ngaphambi kokuthi uyinike amandla: thuthukisa ngokuthula, thuthukisa ngesixwayiso, noma yenqaba ukulayisha.

Ku-Firefox izilawuli zihlala ngemuva kokuthi about:config nasekhasini lezilungiselelo zobumfihlo, ngo-dom.security.https_only_mode njengokushintshwa nokuhlukile kwesayithi ngalinye okulawulwa kumenyu yokukhiya. Ku-Chrome naku-Edge umqondo ofanayo uhlezi ngaphansi kokuthi Izilungiselelo, Ubumfihlo Nokuphepha, Ukuphepha, okunelebula ukuthi Sebenzisa njalo ukuxhumana okuvikelekile. Noma ngabe iyiphi ilebula, qinisekisa ukuziphatha ngokumelene nomsingathi ophendula kuphela ku-port 80, ngoba imodi ethuthukayo bese ibuyela emuva buthule ayikona ukuvikela ocabanga ukuthi ukunike amandla. Amadokhumenti eFirefox HTTPS-Only acacisa ngokuthuthukiswa, isexwayiso nokuziphatha okuhlukile kwaleso siphequluli.

Isinyathelo sesi-3: lungisa izinsiza, hhayi nje ibha yekheli

Uma ukuthuthukiswa kwehluleka, funda iphutha eliqondile esikhundleni sebha yekheli. Umsingathi ongenawo umlaleli we-HTTPS, igama lomethuleli elingafani nesitifiketi kanye nochungechunge oluphelelwe yisikhathi lukhiqiza imilayezo ehlukene futhi lungabanikazi abahlukene. Eyokuqala kuphela igebe ohlangothini lweseva; okwesibili ngokuvamile ibhukhimakhi engakaze ibuyekezwe; okwesithathu inkinga yokuvuselela uxhumo lwe-VPN olungahlangene nayo.

Ungangezi okukhishiwe kwesitifiketi kusayithi le-akhawunti ngoba i-VPN ivuliwe. Okukhishiwe kukhubaza isheke ebelingabamba ngqo ukuvinjwa i-VPN ehloselwe ukukunqanda.

Ingxenye yesithathu ingaphakathi kwekhasi, futhi yileyo abantu abayigejayo. Ikhasi elilayisha nge-HTTPS lisengakwazi ukudonsa izithombe, amafonti noma izikripthi ku-URL ye-http, futhi isiphequluli sizozivimba noma sehlise isibonisi sokuvikela salo lonke ikhasi. Hlola izicelo ezihlulekile kuphaneli yenethiwekhi futhi ulungise izinkomba zensiza kumnikazi wazo kunokuba ucabange ukuthi ibha yekheli ichaza sonke isicelo. Esayithini olisebenzisayo, lokho kusho ukulungisa ama-URL agciniwe ku-CMS noma kusifanekiso esikhundleni sokuwabhala kabusha esipheqululini. Uma ungeke ukwazi ukushintsha umthombo, rekhoda okuqukethwe okuxubile njengegebe elaziwayo, ngoba ilokhi ekhasini elidonsa izinsiza zemibhalo engenalutho iyisiginali engamanga.

Isinyathelo 4: lokho i-HSTS engezayo, nalokho engakwenzanga

I-HSTS iyinqubomgomo yesayithi kunokuncanyelwayo kwesiphequluli, futhi iyona ndlela kuphela lapha esinda ku-http:// ethayiphiwe kuphrofayela entsha. Uma isiphequluli sesibone isihloko esithi Strict-Transport-Security somsingathi, sibhala kabusha izicelo zakamuva ku-https ngaphambi kokuzithumela, okuyiyona kanye indawo oyifunayo. Ayenzi lutho kumsingathi isiphequluli esingakaze simvakashele, futhi akukho lutho lwegama lomethuleli elihlukile elisebenzela uhlelo olufanayo.

Hlola ukuthi imvelaphi ithumela ini ngokuthi curl -sSI https://example.com | grep -i strict-transport-security. Unhlokweni ongekho wushintsho lweseva hhayi okuthile okungafakwa iklayenti. Uma ikhona, funda max-age kanye nokuthi includeSubDomains isethiwe yini, ngoba ubude obufushane buphelelwa yisikhathi phakathi kokuvakasha kanye nokushoda kwe-includeSubDomains kushiya sonke isizinda esingaphansi kwesinye singavikelekile. I-RFC 6797 ichaza ukuthi i-ejenti yomsebenzisi iyisebenzisa kanjani inqubomgomo nokuthi yini engaziba. Ukulayisha kuqala kuwukuzibophezela okuhlukile, ngakho hlola isimo nge-hstspreload.org API ngaphambi kokwethembisa noma ubani ukuthi isizinda sisohlwini.

Ukuqinisekisa nokubuyisela emuva

Ukubuyisela emuva ishibhile kuzilungiselelo zeklayenti futhi kuyabiza nge-HSTS. Ukuvala imodi ye-HTTPS kuphela kubuyisela ukuziphatha kwangaphambilini ngokushesha; iminyaka yobudala ende ayikwenzi, futhi izivakashi esezivele ziyitholile ziyaqhubeka nokuthuthuka kuze kuphele isikhathi.

Ngakho qinisekisa ngokulandelana ngaphambi kokuyibiza ngokuthi yenziwe. Layisha kabusha kusuka kunqolobane ebandayo futhi uqinisekise isicelo sokuqala kuphaneli yenethiwekhi i-https ngaphandle kokuqondisa kabusha kwangaphambilini. Bese uhlola isizinda esingaphansi kwesinye, ngoba includeSubDomains kulapho lezi zinqubomgomo zivame ukuba zincane kunalokho obekucatshangwa. Bese uhlola ikhasi elilodwa elidonsa izimpahla zezinkampani zangaphandle, njengoba okuqukethwe okuxubile kuwukwehluleka okusinda kukho konke ukulungiswa.

Uma isicelo sokuqala sisese ngu-http ngemuva kwakho konke lokho, iklayenti aliselona okuguquguqukayo: isixhumanisi abantu abasichofozayo sithi. Sesha izindawo ozilawulayo ukuze uthole ifomu le-http legama lomethuleli, uzibuyekeze, futhi uphinde uhlole ngokulayisha kabusha okufanayo kwenqolobane ebandayo. Gcina umbuzo we-VPN uhlukene kuyo yonke indawo, ngoba umhubhe ushintsha ukuthi ubani ongabona isicelo futhi awushintshi noma ngabe isicelo sibethelwe. Umugqa okufanele uwufake ethikithini wukuthi isicelo sokuqala yisona esibalulekile, futhi ukuqondisa kabusha kuyirisidi yesicelo esesivele sithunyelwe.