Ulahlekelwe isitifiketi sekhasimende? Hoxisa ngenombolo yokulandelana, hhayi ngegama

Ifayela lesitifiketi sekhasimende sakho lilahlekile, futhi ukusabela kwangoko ukuhoxisa igama nokukhipha elisha. Lokho kusabela kushiya isitifiketi sokuqala sisebenza, ngoba ukuhoxisa kusebenza ngenombolo yokulandelana hhayi ngelebula. I-CA cishe ngokuqinisekile isagcina ikhophi yalokho ekukhiphile, futhi ukuthola leyo khophi umsebenzi wonke.

Ukulahlekelwa ifayela akukhona ukulahlekelwa irekhodi le-CA

I-Easy-RSA PKI igcina izitifiketi zomphakathi eziyikhiphile, futhi izinguqulo zamanje zibuye zigcine amakhophi ngokulandelana kudayirekhithi ye-PKI ethi certs_by_serial. Ukhiye wangasese awudingeki ukuze kuhoxiswe noma yini. Okubalulekile isitifiketi esiqondile esisayinwe yi-CA, futhi i-CA isivele inaso.

Sebenza kukhophi yokulondoloza ye-PKI efanele, kanye nomqondisi ongumnikazi wayo. Ukuhoxisa kuwumsebenzi olingeka, hhayi ukulungisa kusizindalwazi sokukhiqiza phakathi nobusuku.

Ikhophi yesitifiketi somphakathi esifakwe ngaphakathi sekhasimende nayo iyasebenza, uma ukusetshenziswa kugcine eyodwa.

Qala ngokufunda umkhiphi nenombolo yokulandelana

Hlola i-PEM etholiwe bese ubhala umkhiphi, inombolo yokulandelana, isihloko kanye nesikhathi sokusebenza. Inombolo yokulandelana ihlukile ngaphakathi kobubanzi bomkhiphi oyedwa, hhayi kuzo zonke izi-CA endaweni yakho, ngakho umkhiphi uyingxenye yobunikazi. Uma izitifiketi eziningi zabelana ngesihloko esisodwa, yilezo zinombolo ezihlukanisa.

Qhathanisa amanani namarekhodi e-CA kanye nedivayisi noma umuntu okholelwa ukuthi unesitifiketi.

Igama elivamile lingasetshenziswa futhi, futhi ngokuvamile kwenziwa kanjalo. Unganqumi ukuthi yiziphi izitifiketi ezizohoxiswa ngaphambi kokuba izinombolo zibhalwe phansi.

Kungani ukuhoxisa isitifiketi esisha kungenzi lutho

Ukukhipha okunye ngegama elivamile elifanayo kwakha isitifiketi sesibili esinenombolo ehlukile. Ukuhoxisa okunye kuhoxisa okusha futhi kushiya okokuqala kusebenza kuze kuphele isikhathi sako. Ngokombono we-CA lezi izinto ezimbili ezizimele, futhi i-CRL ibala izinombolo zokulandelana hhayi amagama. Inkomba ye-CA igcina umugqa owodwa wesitifiketi ngasinye esikhishiwe ngenxa yaleso sizathu.

Ukudideka okufanayo kudala iphutha elihlanekezelwe: ukususa ifayela lekhasimende nokucabanga ukuthi i-CA ikhohliwe. Ukususa kukhasimende akusona isigameko sokuhoxisa, futhi isitifiketi siyaqhubeka nokusebenza kunoma ngubani onekhophi.

Womabili amaphutha avela ekuthatheni igama njengobunikazi.

Hoxisa isitifiketi esinikezwa inombolo yokulandelana

Khomba into ngaphambi kokuthinta i-CA: openssl x509 -in recovered-client.pem -noout -issuer -serial -subject -dates iphrinta amanani amane ngokudlula okukodwa, futhi inombolo yokulandelana yiyo oyiqhathanisa nengqoqo le-CA. I-Easy-RSA igcina leyo ngqoqo ngaphansi kwe-pki/certs_by_serial, kunesifayela esisodwa senombolo ngayinye. Umyalo wokuhoxisa uthatha igama elivamile hhayi inombolo yokulandelana, ngakho kopisha ifayela eligciniwe ku-pki/issued/<common-name>.crt bese uvumela igama likhombe into oyikhonzile. Gijima i-easyrsa revoke <common-name> kusuka kudayirekhithi ye-PKI, bese uhlola ukuthi umugqa ohambisanayo ku-index.txt ushintshile waba yi-R. Inombolo yokulandelana iyindlela yokukhetha into, hhayi impikiswano eyamukelwa umyalo.

openssl x509 -in recovered-client.pem -noout -issuer -serial -subject -dates
cp pki/certs_by_serial/A1B2C3D4.pem pki/issued/client-01.crt
./easyrsa revoke client-01
grep -n client-01 pki/index.txt
./easyrsa gen-crl

Uma i-index.txt ingabonisi i-R, yima bese ufunda iphutha ngaphambi kokwakha i-CRL, ngoba i-CRL eyakhiwe kurekhodi elisasebenza ayihoxisi lutho. Kuphela ngemva kokushintsha komugqa lapho ugijima khona i-easyrsa gen-crl bese uqhubeka nokusabalalisa ifayela.

Shicilela i-CRL lapho isetshenziswa khona ngempela

Yakha i-CRL entsha ngohlelo lomsebenzi olusekelwayo lwe-PKI, bese uyishicilela kuso sonke isiqinisekisi esisebenzisa ukuhoxiswa kwalomkhiphi.

Ifayela elibuyekeziwe elilele ku-CA alishintshi lutho, ngoba i-VPN iqeda isinqumo kusiqinisekisi sayo. Hlola umkhiphi we-CRL, isikhathi sokusebenza kwayo kanye nezinombolo ezihoxisiwe, futhi uqinisekise ukuthi isevisi ilayisha kabusha ifayela esikhundleni sokugcina eledlule. Ubunikazi nendlela kubalulekile njengokuqukethwe: i-CRL i-daemon engakwazi ukuyifunda ayihlukile nokungabi khona kwe-CRL. Inketho ye-crl-verify ye-OpenVPN isho ifayela elifundwa i-daemon, ngakho hlola leyo ndlela kanye nobunikazi befayela kusimo seseva.

Qinisekisa ngomzamo wokuxhuma wangempela, hhayi ngesitembu sesikhathi sefayela.

Yazi ukuthi i-CRL iyithuluzi elingalungile nini

Uma ukhiye wangasese womkhiphi ungasathenjwa, ukuhoxisa izinombolo ezaziwayo akukwazi ukuvimbela umnikazi ongagunyaziwe ukuthi asayine izitifiketi ezintsha. Lokho ukushintsha kokuthenjwa komkhiphi, okusho i-CA entsha kanye nohlelo lokusabalalisa, hhayi okunye okufakiwe ku-CRL. Ukuthi umqondisi wangaphambili wayenokufinyelela akusona isiqinisekiso sokuthi ukhiye wasetshenziswa kabi, ngakho thola amaqiniso ngaphambi kokwakha kabusha ukuthenjwa.

Ukuhlela ngesandla isizindalwazi sokukhipha ukuze kuguqulwe uhlamvu lwesimo akusikho okufanayo nokuhoxisa okusayiniwe, futhi kushiya i-CRL ingavumelani namarekhodi.

Gcina inombolo yokulandelana, i-CRL kanye nesinyathelo sokusabalalisa kunothi olulodwa, futhi ukuhlolwa okulandelayo kuzoba ukufunda. I-phrojekthi ye-Easy-RSA ibhala imiyalo esekelwayo yenguqulo oyifakile, futhi iyona kuphela interface efanele ukulandelwa.