I-proxy ye-HTTPS isho izixhumanisi ezimbili ze-TLS, hhayi eyodwa
Isigaba se-proxy kanye newebhusayithi kuyizinto ezimbili ezihlukene ze-TLS ezinokwethenjelwa okuhlukene. Funda ukuthi iyiphi indawo yokugcina ehlulekile ngaphambi kokushintsha noma yisiphi isilungiselelo sesitifiketi.
Igama elithi i-proxy ye-HTTPS lichaza ukudluliswa phakathi kweklayenti lakho ne-proxy, futhi akukho okunye. Alisho ukuthi iwebhusayithi engemuva kwayo ibethelwe ngaleyo nxhumano efanayo, futhi alisho ukuthi i-proxy ingafunda ikhasi. Uma uhlukanisa izixhumanisi ezimbili, amaphutha esitifiketi ayeke ukuba yimfihlakalo futhi ukuqhathanisa ne-VPN kube sobala.
Amapheya amabili ezingxenye zokuphela, ukuqinisekisa okubili
Kumodi evamile ye-tunnel kunezihlobo ezimbili ze-TLS. Eyokuqala ihamba isuka eklayentini lakho iya ku-proxy futhi iqinisekise i-proxy. Eyesibili ihamba isuka eklayentini lakho iya kwiwebhusayithi engaphakathi kwe-tunnel, futhi iqinisekise iwebhusayithi. Zihluleka ngokuzimela futhi zilungiswa ngokuzimela.
Zineziphatho ezihlukene zokwethenjwa, imigqa emihlukene yesitifiketi kanye nemilayezo emihlukene yokwehluleka. I-proxy esebenzisa i-CA yenhlangano kanye newebhusayithi yomphakathi esebenzisa umugqa womphakathi kungase kudingeke ngokufanelekile ukulungiselela ukuqinisekisa okuhlukene, futhi lokho akusona isilungiselelo esingalungile.
Zithathe njengezixhumanisi ezimbili ezenzeka zabelana ngesokhethi elilodwa, ngoba yilokho eziyikho.
I-CONNECT iyenza ini ngempela njenge-tunnel
Iklayenti lithumela isicelo se-CONNECT esisho i-host ne-port, futhi i-proxy ivula uxhumano lwe-TCP oluya kuleyo ndawo. Ngemuva kokuba i-proxy iphendulile, amabhayithi alandelayo adluliswa ngaphandle kokuchazwa, yingakho i-TLS handshake yewebhusayithi ihamba nge-proxy ingashintshiwe. Ngakho-ke i-proxy ifunda igama lendawo kanye nemethadatha yoxhumano, futhi ayitholi amakhasi asuselwe ukubethelwa kusuka kulolo hlelo.
Lowo mehluko uyona mpikiswano yonke yezokuphepha yemodi ye-tunnel, futhi futhi uwumkhawulo wayo.
I-proxy ye-HTTP engenawo i-TLS esigabeni se-proxy isahambisa iwebhusayithi ye-HTTPS nge-CONNECT. Ukushintshana phakathi kweklayenti ne-proxy kusobala kuyilapho uxhumano lwewebhusayithi lungesona, futhi ukubiza yonke into ngokuthi i-proxy ye-HTTPS kufihla lowo mehluko.
Isiphi isitifiketi esihlulekile
Uma ukuqinisekisa kwehluleka, funda indawo yokugcina eshiwo kwiphutha ngaphambi kokushintsha noma yisiphi isilungiselelo sokwethenjwa. Lawa maphutha amabili abukeka efana kutheminali futhi akhomba izixazululo ezihluke ngokuphelele, yingakho umbuzo wokuqala uhlala uwukuthi uxhumano luni olwenqatshiwe.
I-curl ihlukanisa izinketho ngenxa yalesi sizathu. Ifayela le-CA le-proxy lilungiselela ukuqinisekisa kwe-proxy, kuyilapho ifayela le-CA lilungiselela ukuqinisekisa kweseva, futhi ukuziphatha kwesitoreji sokwethenjwa okusebenzayo nakho kuncike ekutheni i-curl yakhiwe kanjani.
curl -v --proxy https://proxy.example.net:443 \
--proxy-cacert org-ca.pem --cacert public-ca.pem https://www.example.com/Ukucindezela ukuhlola akusona ukulungisa. Akufakazeli lutho mayelana nanoma iyiphi indawo yokugcina.
Ukuhlola kuwuhlelo oluhlukile
Ukuhlola kwe-TLS akusona ukwenza i-tunnel. Umkhawuli ophakathi uqeda ubudlelwano bokwethenjwa obubheke kwiwebhusayithi futhi wethula isitifiketi sakhe eklayentini, ngakho iklayenti liqinisekisa umkhawuli ophakathi esikhundleni sayo isayithi. Lokho kungase kube semthethweni ngaphansi komklamo ogunyaziwe, futhi kuwumbono ohluke ngokubonakalayo ekudluliseni ibhayithi ngebhayithi. Ungacabangi ukuthi wonke ama-proxy ahlola, futhi ungacabangi ukuthi isigaba se-proxy esibethelwe sikuqeda lokho.
I-CA yenhlangano esitoreji sakho sokwethenjwa iyinkomba yokuthi ukuluphi uhlobo lohlelo, hhayi ubufakazi. Buza ngomklamo esikhundleni sokucabanga ngawo kusuka kumugqa wesitifiketi.
Lokho kuhlelo okubili kunikeza izimpendulo ezihlukene embuzweni wokuthi ubani angafunda ikhasi.
Qhathanisa i-proxy ne-VPN emigqeni emine efanayo
Ukuqhathanisa kuba usizo kuphela lapho kokubili ukusetshenziswa kuchazwa ngendlela efanayo.
| Line | What to state |
|---|---|
| Protected segments | Which hops are encrypted, and between which endpoints |
| Verified identities | What each end proves, and against which trust anchor |
| Trusted intermediaries | Who can read or alter traffic by design |
| Traffic included | Which processes and destinations the policy actually covers |
I-proxy elungiselelwe isicelo esisodwa ihlanganisa leso sicelo kuphela. Ayidlulisi zonke izinqubo zedivaysi ngayo, futhi umyalo wesibonelo mncane ngokunjalo. Ukusabalala kwe-VPN kuncike ekuhambeni kwayo kanye nenqubomgomo yohlelo lokusebenza, okumele nakho kubhekwe esikhundleni sokucatshangwa. Akukho ukukhetha okuhlanganisa konke nje ngoba kufakiwe.
Bhala imigqa emine yokukhetha ngakunye futhi impikiswano ivamise ukuzixazulula yona. Ukuqhathanisa okusizo akusikho ukuthi yiluphi ilebula elizwakala lifihliwe kakhulu. Yilokho ukuthi iziphi izingxenye zivikelwe, ubani uqinisekiswa emikhawulweni yazo, yibaphi abalamuli obathembayo, nokuthi inqubomgomo ihanganisa yiphi i-traffic ngempela.