Ukuhlola isitifiketi se-VPN ngaphandle kokukhipha ukhiye waso

Ukufunda izinkambu zomphakathi zesitifiketi akudingi ukukhombisa ukhiye oyimfihlo ohambisana naso, futhi amathuluzi okukwenza lokho akhona kuyo yonke into yokusebenza esebenza njengesiphetho se-VPN. Ingozi isekhathini elandulelayo: ifayela oyinikiwe kungenzeka lingeyona isitifiketi nhlobo. Isitifiketi se-PEM, iqoqo le-DER, iphakethe le-PKCS#12 kanye nephrofayili ye-OpenVPN zingafika zinegama elifanayo futhi ziqukethe izinto ezihluke kakhulu, ngakho hlola uhlobo lwesiqukathi ngaphambi kokukhetha umyalo.

Amaphuzu amathathu anquma ukuthi yimuphi umyalo ophephile: lokho ifayela elikuqukethe, lokho okudingeka ukukufunde kuwo, kanye nokuthi ubani ozobona umphumela. Uma kungahambi kahle nakanye kuzo, ukuhlolwa uqobo kuba yingozi.

Yimuphi kumafayela amathathu onawo

Isitifiketi se-PEM siwumbhalo onemikhawulo ebonakalayo ye-BEGIN ne-END, ifayela le-DER liwumbhalo kanambambili odinga ifulegi lefomethi yokufaka, kanti iphakethe liyisiqukathi esingagcina ukhiye eduze kwesitifiketi. file server.crt ihlukanisa umbhalo kanambambili ngomzuzwana, futhi ukubuka umugqa wokuqala kuhlukanisa isitifiketi esingenalutho nephrofayili efaka esinye. Ukuqagula lapha yikho okuguqula ukuhlolwa kube yingozi.

Uma ifayela liyiphrofayili hhayi isitifiketi, liphathe njengobufakazi bokungena kuze kube kuphikiswa okunye. Lokho kucabanga akubizi lutho, futhi kuvimbela iphutha elivame kakhulu kulo msebenzi wonke.

Ukufunda izinkambu zomphakathi zesitifiketi se-PEM

Esitifiketini ogunyaziwe ukusihlola, umyalo ongaphansi we-x509 ono--noout uphrinta kuphela izinkambu ozikhethile, hhayi okunye. Ukucindezela umzimba yikho okugcina umphumela kumethadatha, futhi yikho futhi okwenza kuphephe ukunamathisela ethikithini. Izikhethi ezingezansi ngezomphakathi, futhi idokhumenti ye-openssl x509 ibala okunye.

openssl x509 -in server.crt -noout -subject -issuer -dates -fingerprint -sha256

Esitifiketini sokuhlola esakhiwe endaweni, lowo myalo uphrinta umugqa wesihloko nomugqa womkhiphi, ipheya le-notBefore ne-notAfter, kanye nesigxivizo somunwe esisodwa se-SHA-256. Lezo zinkambu zikhomba into; azisunguli indlela yokuthembela evumelekile, okuwumsebenzi wokuqinisekisa ohlukile onomyalo wawo kanye nempendulo yawo. Ifayela lochungechunge lingase liphrinte kuphela isitifiketi sokuqala ngaphandle uma uzungeza ifayela ngokwakho. Ukuqhathanisa amafayela amabili ngale ndlela kubiza umyalo owodwa futhi kuqinisekisa ukuthi yiliphi ilowo ohlangothini olunye eliwethulayo ngempela.

Amaphakethe agcina ukhiye eduze kwesitifiketi

Ifayela le-.p12 noma le-.pfx lingaphatha ukhiye oyimfihlo, futhi umyalo wokuhlaziya uyawuphrinta ngaphandle uma ucindezela leyo ngxenye yomphumela. Nge--nokeys lowo myalo ofanayo usabika isakhiwo sesiqukathi, kufaka phakathi isikhwama sokhiye esifihliwe, ngaphandle kokukhipha noma yisiphi into yokhiye; yehlisa lelo fulegi bese kubonakala ibhlokhi yokhiye kutheminali nasemlandweni we-shell yakho.

openssl pkcs12 -in bundle.p12 -nokeys -info -passin env:P12PASS

Iphrofayili ye-OpenVPN ifaka leyo nto efanayo njengombhalo, ngakho umngcele uyabonakala uma wazi ukuthi ubheke kuphi. Izinto zomphakathi zihlala phakathi kwe-BEGIN CERTIFICATE ne-END CERTIFICATE, kanti noma yini ephakathi kwe-BEGIN PRIVATE KEY nomugqa we-END ohambisana nawo ingukhiye futhi akumele ishiye isiphathi. Ukukopisha iphrofayili yonke kushicilela kukho kokubili.

Ukuthola inani lesithenjwa kwenye indawo

Isigxivizo somunwe esifundwe kuxhumano oluzama ukuluqinisekisa asifakazisi lutho, ngoba sihanjiswe yiqembu ongalithembi. Lokho akusona isizathu sokumelana nezigxivizo zomunwe; kuyisizathu mayelana nomthombo. Qhathanisa inani nalelo elitholwe ngesiteshi iqembu elingakwazi ukubhala kulo, njengesitifiketi eshicilelwe endaweni yokugcina yangaphakathi noma i-hashi ephrintiwe kurekhodi loshintsho olusayiniwe.

Lapho isitolo sokuthembela senza ukuqinisekisa, siyeke sikwenze, futhi ufunde iphutha elikhiqizayo esikhundleni sokufaka ukuqhathanisa kwakho. Umehluko obalulekile ukuthi ubani ohanjise isithenjwa, hhayi ukuthi yimuphi umsebenzi we-hashi osetshenzisiwe.

Ukwabelana ngomphumela, nokuthi kwenziwe ini ngemuva kokuphambuka

Thumela iphutha lokuqinisekisa eliqondile, izinsuku ezifanele kanye nemininingwane yobunikazi edingwa umamukeli kuphela. Amagama asemkhakheni wangaphakathi kanye nezikhombisi ze-akhawunti kuhlala kuyinto ebucayi ngisho lapho kungekho ukhiye, futhi insizakalo yokunamathisela yomphakathi iyindawo engalungile yanoma yikuphi kwalokho. Namathisela ethikithini, hhayi kubhafa lesikhashana elabelwana ngalo omunye umuntu.

Uma into yokhiye ivele esikrinini noma efayeleni, yithathe njengento ephuliwe futhi uyishintshe esikhundleni sokuthemba ukuthi akekho obhekile. Bese ubhala phansi ifayela elihloliwe, umyalo osetshenzisiwe kanye nokuthi umphumela waya kuphi, ngoba lowo rekhodi yiwona oguqula ukwethuka kube inqubo. Ukushintsha kushibhe uma kuqhathaniswa nezindleko zokucabanga ukuthi akekho ogcina isithombe-skrini, futhi lowo rekhodo uxoxa unjiniyela olandelayo ukuthi yimaphi amafayela athintwa nhlobo. Yenza kokubili ngaphambi kokuthi ithikithi livalwe.