Gcina i-CA yomsuka ye-VPN yakho ingaxhunyiwe ku-inthanethi futhi usakhipha izitifiketi

I-VPN yakho iphendula ukuxhumana ngo-3 ekuseni kuyilapho umshini osayina izitifiketi zawo ulele ucishiwe edrojini. Iklayenti eliqinisekisa isitifiketi seseva alixhumani ne-CA yakho, ngakho i-CA akudingeki ukuthi ifinyeleleke kunoma yikuphi ukuxhumana. Ingxenye edinga ukuhlelwa usuku okufanele kukhishwe ngalo, kuvuselelwe noma kuhoxiswe isitifiketi kuyilapho ukhiye womsuka uhlala ukhiyiwe.

Ukuxhumana kuqinisekisa ini ngempela

Lapho iklayenti le-OpenVPN lixhuma, lihamba uchungechunge lwezisayino lisuka esitifiketini seqabunga seseva liye phezulu esitifiketini se-CA esivele silithemba, lihlola isikhathi sokusebenza futhi, uma iphrofayela isho kanjalo, libheka uhlu lokuhoxiswa. Alisoze lifune i-CA yakho yomsuka. Iseva yenza okufanayo njengesibuko ezitifiketini zamaklayenti. Ngesikhathi sokuxhumana kukhona kuphela iqabunga, eliphakathi kanye nenqwaba yokuthembela owayisabalalisa ngaphambili.

Okwehlulayo ngempela kungenye yezinto ezintathu: ukhiye wokusayina awutholakali ngesikhathi sokukhishwa, uhlu lokuhoxiswa selugugile, noma inqwaba yokuthembela yeklayenti indala kunochungechunge olwethulwa iseva. Eyokuqala inkinga yenqubo; ezinye ezimbili izinkinga zokusabalalisa. Akukho kuzo okudinga ukuthi ukhiye womsuka ube ku-inthanethi, futhi insizakalo ye-VPN ephethwe edinga isitifiketi sangasese sokuqinisekisa umhubhe idlulisela nje igunya lokusayina kumnikezeli. I-Azure yephuzu-kuya-sayithi isebenza ngokuphambene: ulayisha isitifiketi somsuka futhi izitifiketi ezisayinwe ngaphansi kwaso zithathwa njengezithembakele, ngakho buza ukuthi ngubani osayinayo, ngubani oqinisekisayo nokuthi isitifiketi sihoxiswa kanjani ngaphambi kwesikhathi.

Yakha umsuka kusibambi esingasoze sithole ikheli

Umsuka ongaxhunyiwe ku-inthanethi usetshenziswa kancane: ukusayina isitifiketi se-CA ephakathi futhi kamuva ukuyivuselela noma ukuyihoxisa. Konke okunye kwenzeka ezingeni elilodwa ngezansi. Yenza umsebenzi womsuka kumshini ogcinwa ngaphandle kwenethiwekhi, uma kungenzeka kusuka kusistimu ephilayo, futhi bhala ukuthi ngubani owayesekamelweni. Imiyalo icabanga i-OpenSSL 1.1.1 noma entsha, ngoba i--addext ayikho kuma-build amadala.

openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-256 -out root.key
openssl req -x509 -new -key root.key -sha256 -days 7300 \
  -subj "/CN=Example VPN Root CA" -out root.crt \
  -addext "basicConstraints=critical,CA:TRUE" \
  -addext "keyUsage=critical,keyCertSign,cRLSign"

Dala ephakathi kusibambi sokusayina futhi yisa isicelo sayo kuphela kumshini ongaxhunyiwe. Umsuka usayina leso sicelo ngobude bendlela obuyiqanda, ngakho i-CA ephakathi ingasayina izitifiketi zokugcina kodwa ayikwazi ukwakha enye i-CA ngaphansi kwayo. Leyo ndlela eyodwa yokunweba ivimbela isibambi sokusayina esihlaselwe ukuthi sakhe igunya elilingana nomsuka. Sebenzisa i-ECDSA kuphela uma wonke amaklayenti esebenza nge-OpenVPN 2.4 noma entsha; uma kungenjalo dala okhiye be-RSA futhi ugcine ukuhamba kufana.

openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-256 -out intermediate.key
openssl req -new -key intermediate.key -subj "/CN=Example VPN Intermediate CA" -out intermediate.csr
openssl x509 -req -in intermediate.csr -CA root.crt -CAkey root.key \
  -CAcreateserial -days 3650 -sha256 -extfile intermediate.ext -out intermediate.crt

intermediate.ext iqukethe i-basicConstraints=critical,CA:TRUE,pathlen:0, i-keyUsage=critical,keyCertSign,cRLSign kanye ne-authorityKeyIdentifier=keyid:always. Buyisela ukhiye womsuka esigcinweni sawo ngaphambi kokuxhuma kabusha isibambi sokusayina. Uma umsuka kufanele ukwazi ukuhoxisa ophakathi, sayina ngo-openssl ca -config root.cnf -extensions intermediate_ca ngokumelene ne-index.txt yezinga lomsuka esikhundleni se-openssl x509 -req, ukuze inombolo yochungechunge ibhalwe; bese uthumela uhlu lomsuka olukhiqiziwe ngaphakathi kwephrofayela yeklayenti, lapho i-crl-verify esekelwe kufayela iyifunda khona lapho iqala. Thumela amaklayenti inqwaba enezitifiketi ezimbili ze-CA; iqabunga lodwa ngeke liqinisekiswe ngokumelene nomsuka.

Khipha amaqabunga kusuka kophakathi, ngedathabhezi

Ukusayina nge-openssl x509 -req kusebenza kuze kudingeke ukuthi uhoxise, ngoba akukho okubhala inombolo yochungechunge. Sebenzisa i-openssl ca kusukela esitifiketini sokuqala ukuze inombolo yochungechunge, ukuphela kanye nesimo sokuhoxiswa kuhlale kudathabhezi elilodwa. Dala amafayela edathabhezi kanye, bese ukhomba ukucushwa kuwo:

mkdir -p /etc/vpn-ca/intermediate/newcerts
touch /etc/vpn-ca/intermediate/index.txt
echo 1000 > /etc/vpn-ca/intermediate/serial
echo 1000 > /etc/vpn-ca/intermediate/crlnumber

[ ca ]
default_ca = CA_default
[ CA_default ]
dir = /etc/vpn-ca/intermediate
database = $dir/index.txt
new_certs_dir = $dir/newcerts
serial = $dir/serial
crlnumber = $dir/crlnumber
certificate = $dir/intermediate.crt
private_key = $dir/intermediate.key
default_md = sha256
default_days = 365
default_crl_days = 30
unique_subject = no
policy = policy_any
[ policy_any ]
commonName = supplied
[ server_cert ]
basicConstraints = CA:FALSE
keyUsage = critical, digitalSignature
extendedKeyUsage = serverAuth
subjectAltName = @server_names
[ client_cert ]
basicConstraints = CA:FALSE
keyUsage = critical, digitalSignature
extendedKeyUsage = clientAuth
[ server_names ]
DNS.1 = vpn.example.com

Umugqa wokusetshenziswa kokhiye ucabanga ukhiye we-ECDSA; engeza i-keyEncipherment ye-RSA. Nika iklayenti ngalinye igama laso elijwayelekile, ngoba OpenVPN ibona ukuxhumana ngaleyo nkambu, futhi amalaptophi amabili abelana nge-CN=vpn-client awakwazi ukuhlukaniswa kumarekhodi, emithethweni ye-client-config-dir noma kunoma yikuphi ukusunduza komsebenzisi ngamunye, futhi ulahlekelwa ukwabiwa okwenza isinqumo sokuhoxisa sivikeleke. Khipha futhi uqinisekise iqabunga kanje:

openssl req -new -key alice.key -subj "/CN=alice-laptop" -out alice.csr
openssl ca -config intermediate.cnf -extensions client_cert -in alice.csr -out alice.crt -batch
openssl verify -CAfile ca-bundle.crt -untrusted intermediate.crt alice.crt

Gcina ukhiye wokusayina ngemuva komngcele wenqubomgomo esikhundleni sokuwukopisha kusibambi se-VPN: insizakalo encane eqinisekisa isicelo, ihlola igama elijwayelekile ngokumelene nohlu oluvunyelwe futhi ibuyisela isitifiketi kuphela. Bhala yonke inombolo yochungechunge; irekhodi liwukuxhumana kuphela phakathi kwesitifiketi nomuntu osicele.

Shicilela ukuhoxiswa ngaphandle kokuvusa umsuka

Izitifiketi zamaklayenti zihoxiswa ophakathi, hhayi umsuka. Uhlu lomsuka lubalulekile kuphela lapho ophakathi ushiswe. Khomba iseva ohlwini oluphakathi nge-crl-verify. I-CRL esekelwe kufayela ilayishwa lapho insizakalo iqala, ngakho ilayishe kabusha ngemva kokukhiqizwa kabusha ngakunye; ifomu ledikhithoni lifunda isimo ngesikhathi sokuxhumana futhi libiza ifayela elilodwa ngenombolo yochungechunge.

Hoxisa futhi ukhiqize kabusha ngemiyalo emibili kusuka kudathabhezi elifanayo:

openssl ca -config intermediate.cnf -revoke /etc/vpn-ca/intermediate/newcerts/1001.pem
openssl ca -config intermediate.cnf -gencrl -out /etc/openvpn/crl.pem

Bese ugada iwashi. I-CRL ithwala inkambu yokubuyekezwa okulandelayo, futhi lapho lolu suku ludlula, uzakwethu oqinisekisayo wenqaba uhlu esikhundleni sokulushaya indiva. Ukukhiqiza kabusha nyanga zonke nge-default_crl_days = 30 kushiya isikhala; minyaka yonke akukushiyi. Ukuphila okufushane kwamaqabunga kuwukulawula okwethembekile, ngoba ukuhoxiswa kusebenza kuphela lapho uhlu lubhekwa khona.

Hlola uchungechunge, bese ubhala umkhosi phansi

Phinda ukwehluleka okune ngaphambi kokuthemba umklamo. Qinisekisa uchungechunge nge-openssl verify -CAfile ca-bundle.crt -untrusted intermediate.crt server.crt. Xhuma ngesitifiketi seklayenti esiphelelwe yisikhathi futhi uqinisekise ukuthi iseva iyasinqaba. Hoxisa iklayenti lokuhlola, layisha kabusha futhi uqinisekise ukuthi uhlu luyasebenza. Hlehlisa iwashi lesibambi ngosuku olulodwa, ngoba iwashi elingalungile lingakhipha futhi lenqabe izitifiketi ezibonakala zivumelekile kwenye indawo.

Umsuka ongaxhunyiwe uwukulawula kuphela uma amaphepha akhona: abantu ababili abaqanjiwe bomkhosi, irekhodi layo yonke inombolo yochungechunge esayiniwe, ikhophi yokugcina ebhaliwe egcinwa ngokwehlukile kumsihini, kanye nokuhlolwa kokubuyisela kusibambi esihlukanisiwe. Sayina ophakathi wesipele emkhosini ofanayo ukuze isibambi sokusayina esifile singakup hoqi ukuthi uvule umsuka phakathi nobusuku.

Ngaphambi kokukubiza ngokuthi kuqediwe, qinisekisa izinto ezinhlanu: ukhiye womsuka awukho kusibambi esixhunyiwe kunethiwekhi, ukhiye ophakathi uhlala kuphela kusibambi sokusayina, inqwaba yeklayenti ithwala zombili izitifiketi ze-CA, i-CRL inokubuyekezwa okulandelayo esikhathini esizayo, futhi othile unokufakwa kwekhalenda kwakho konke ukuphela kochungechunge. Uma kukhona okushodayo, ukucushwa okubonakala kungaxhunyiwe akubhalwanga nje.