Ukusetha isitifiketi se-IKEv2 ku-iPhone: ukubhaliswa ngesandla noma okulawulwayo
Indlela yokubhalisa inquma ukuthi yiziphi izinketho zesitifiketi ezikhona. Qala ngokukhetha eyesandla noma elawulwayo, bese uhlanganisa ubunikazi beseva, imininingwane yeklayenti kanye ne-algorithm.
Ukukhetha i-RSA ngoba nje ithuluzi lesitifiketi segethiwey liyisebenzisa ngokuzenzakalela yisinqumo esithathwa ngaphambi kombuzo obalulekile: zizobhaliswa kanjani lezi iPhone? Ukuxhumana umsebenzisi azibhala ngokwakhe kanye nephrofayili yokumisa enikezwa ukuphathwa kubonisa izilungiselelo ezihlukene, futhi ezinye izinketho zesitifiketi zikhona endleleni eyodwa kuphela kulezi. Hlela ukulandelana kahle futhi uhlelo lwesitifiketi lube lufushane; phambuka futhi uzokhipha ubufakazi obungeke busetshenziswe ucingo. Thatha izinyathelo ezingezansi njengokulandelana, ngoba ngayinye inciphisa izinketho ezitholakalayo kwelandelayo.
Isinyathelo sokuqala: khetha indlela yokubhalisa
Ukumisa ngesandla kusho ukuthi umsebenzisi ufaka ikheli leseva, ukhetha indlela yokuqinisekisa futhi anikeze noma yibuphi ubufakazi obuvunyelwe yisixhumi. Ukubhaliswa okulawulwayo kusho ukuthi iphrofayili ithwala ikheli, izinkomba kanye nereferensi yomthwalo wobufakazi. Indlela elawulwayo ingaveza inhlanganisela isikrini sesandla esingakwazi ukuziveza, ngakho isinqumo sesitifiketi kufanele sifike ngemuva kwalokhu kukhetha, hhayi ngaphambi.
Zombili izindlela zingaqinisekisa ucingo. Ziyahluka kulokho ongakumisa nokuthi ubunikazi bungobani, ngakho khetha okukodwa ngamabomu esikhundleni sokuhlanganisa iphrofayili elawulwayo nokufaka ubufakazi ngesandla.
Isinyathelo sesibili: khetha ama-algorithm endlela oyikhethile
Kuma-iPhone amiswe ngesandla, amanothi okusebenzisana e-iOS e-strongSwan ancoma isitifiketi seseva se-RSA, ngoba iklayenti lesandla lingase lingasamukeli isitifiketi seseva se-ECDSA; lawo manothi afanayo aphatha i-macOS ngokwehlukile. Funda lokhu njengesiqondiso seqembu leklayenti elisekelwayo, hhayi njengomthetho waphakade ngezinto ze-Apple. Iphrofayili elawulwayo inendawo eningi: ingakhetha uhlobo lwesitifiketi ngokusobala, kuhlanganise nobunikazi beklayenti le-ECDSA, lapho umthwalo negethiwey kokubili kukusekela.
Qinisekisa izinguqulo ze-iOS ozisekelayo ngempela ngaphambi kokuthumela noma yini. Ucingo lwaselabhorethri kunguqulo entsha kakhulu aluchazi iqembu elihlanganisa amadivayisi amadala, futhi i-algorithm esebenza elabhorethri ingase yehluleke ocingweni oludala kakhulu ensimini. Thatha ububanzi bezinguqulo kusuka ekuphathweni kwamadivayisi hhayi enkumbulweni. Uma iqembu lihlanganisa izinguqulo eziningi, hlola elidala kuqala, ngoba yilapho isixhumi sesandla sikhawulela kakhulu.
Isinyathelo sesithathu: funda izinkambu zephrofayili njengezinto ezihlukene
Amakhiye amaningi anamagama afanayo achaza izinto ezihlukene. Ikheli elikude iyihosti ucingo olushayayo. Isikhombi esikude ubunikazi be-IKE okulindeleke ukuthi igethiwey ibuveze. Ireferensi yesitifiketi kumthwalo ikhomba ebufakazini beklayenti, futhi inkambu yohlobo lwesitifiketi ikhetha uhlobo olusetshenziswa ekuqinisekiseni umshini we-IKEv2. Akukho kulokhu okuyi-algorithm yesiginesha ye-CA, nakuba amagama ehlangana.
Inkomba yomthwalo we-IKEv2 ye-Apple ibala i-RSA njengohlobo lwesitifiketi oluzenzakalelayo olunezinhlobo ezicacile ze-ECDSA, futhi ixhumanisa ukhiye wegama lomkhiphi nezilungiselelo ezithile zokuqinisekisa. Funda lobo budlelwano enkombeni yendlela oyikhethile esikhundleni sokukopisha ukhiye owodwa kusuka ekusetshenzisweni okusebenzayo.
Isinyathelo sesine: hlanganisa ubunikazi begethiwey nesitifiketi sayo
Sebenzisa igama legethiwey elicacile, isibonelo vpn.example.com bese ufaka igama lesihloko elihambisanayo kusitifiketi seseva. Isiqondiso se-Apple se-strongSwan silindela nokusetshenziswa okwandisiwe kokhiye ekuqinisekiseni iseva. Ukukhetha i-RSA noma i-ECDSA akushintshi lutho kulokhu: i-algorithm ayikwazi ukulungisa ukungafani kwegama, i-EKU engekho noma uchungechunge olungaphelele.
Ukusabalalisa i-ankha yokwethemba kuwumsebenzi ohlukile ekumemezeleni ubunikazi. Ucingo ludinga uchungechunge lwezitifiketi olungaluqinisekisa, futhi kufanele lumiswe ukulindela igama owafaka ngempela kusitifiketi.
Ukuxhumana ngempumelelo kwelinye ipulatifomu kuwubufakazi ngemithetho yokuqinisekisa yaleyo pulatifomu, hhayi imvume yokukhulula imithetho yocingo. Gcina izihlolo zifana phakathi kwamaklayenti ngaphandle uma unesizathu esibhaliwe sokwehluka.
Isinyathelo sesihlanu: hlukanisa ubunikazi beklayenti nokwethemba kwe-CA
Isitifiketi seklayenti nokhiye waso wangasese akuzona into efanayo nesitifiketi se-CA ucingo oluthemba kuso. Ukufaka isitifiketi se-CA ngaphakathi kobunikazi be-PKCS#12 akusifaki ngokuzenzakalela njenge-ankha yokwethemba kudivayisi ngayinye esekelwayo, ngakho thatha ukusabalalisa ukwethemba njengesinyathelo saso esinokuhlola kwaso.
Uma umklamo usebenzisa i-EAP esekelwe kwiphasiwedi esikhundleni salokho, ucingo ludinga ukuqinisekiswa kwe-akhawunti okuhlosiwe kanye nokuqinisekiswa kweseva. Leyo ndlela ayithetheleli ukuthumela ukhiye oyedwa wangasese weklayenti owabiwe kulo lonke iqembu, okuwumklamo ohlukile onesimo sokwehluleka esibi kakhulu.
Qeda uhlelo ngokucabangela ukuvuselelwa nokuhoxiswa: ubani okhipha kabusha ubufakazi beklayenti, iphrofayili ibuyekezwa kanjani futhi ucingo olulahlekile lunqanyulwa kanjani. Rekhoda inguqulo yephrofayili nezinguqulo zamadivayisi oziqinisekise ngazo, ngoba loyo mbhalo wenza ukushintshwa kwesitifiketi okulandelayo kube umsebenzi ojwayelekile.