Mac IKEv2 ECDSA: luphi uhlobo lwesitifiketi esingeseklayenti?
Ku-Mac, i-ECDSA256 kuzilungiselelo ze-IKEv2 ichaza isitifiketi sobunikazi sasendaweni, hhayi isango noma isiginesha yomkhiphi. Funda indima ngayinye ngaphambi kokukhetha.
Ku-macOS, ukukhetha kwe-ECDSA kusilungiselelo seklayenti se-IKEv2 kuphendula umbuzo omncane: isiphi isitifiketi esifakazela ubunikazi be-Mac. Asichazi isitifiketi sesango, isiginesha ekhiphe isitifiketi seklayenti, noma isiphakamiso sokubethela somhubhe. Ukuthatha lezi zindima ezine njengombuzo owodwa wokuvumelana yikho okwenza isilungiselelo sasendaweni esifanele sibe necala lokungavumelani ohlangothini lweseva. Isinqumo sincane, kodwa ubufakazi obusetshenziselwa ukusithatha kufanele bunembile.
Le nkambu isho isitifiketi esisodwa: ubunikazi basendaweni
I-Network Extension API yakwa-Apple iveza uhlobo lwesitifiketi semininingwane yeklayenti, kufaka phakathi NEVPNIKEv2CertificateType.ECDSA256, ebhalwe njengohlobo lwesitifiketi i-ECDSA p-256. Lesi sakhiwo sisebenza esitifiketini esinikezwe nge-identityReference noma nge-identityData.
Lokho kusho ukuthi isinqumo simayelana nesitifiketi esethulwa yi-Mac, kanye nokhiye oyimfihlo ohamba naso. Khetha uhlobo oluhambisana nokhiye womphakathi walelo khasi lesitifiketi bese unikeza ubunikazi ngendlela esekelwayo. Uma i-Mac ingenalo ukhiye oyimfihlo osebenzisekayo wobunikazi, ukukhetha uhlobo ngeke kusindise ukuxhumana.
Amaphrofayili aphethwe athatha isinqumo esifanayo nge-CertificateType yomthwalo we-IKEv2, kuhlangene nereferensi yesitifiketi efana ne-PayloadCertificateUUID. Lezi zinkambu zinezimfuneko zokuqala kanye nohlelo lwenguqulo ye-OS eqondiwe; inani lohlobo elingenalutho elikopishwe kuphrofayili alikwazi ukufakwa, futhi iwindi lezilungiselelo lingase lingabonisi zonke izinketho ze-API. Hlola izimfuneko zokuqala zomthwalo zale nguqulo ngaphambi kokusebenzisa.
Thathela isinqumo ngendima, hhayi ngelebula yesitifiketi
Funda inkambu ozoyishintsha bese ubuza ukuthi ikhomba kusiphi isitifiketi. Amalebula kusibonisi sesitifiketi ahlanganisa isihloko, umkhiphi kanye ne-algorithm yesiginesha, futhi kukodwa kuphela kuzo okuhlobene nokukhethwa kobunikazi beklayenti.
| What you inspected | What it controls | Does it choose the Mac certificate type? |
|---|---|---|
| Client leaf public key | The identity the Mac presents | Yes, this is the field's subject |
| Issuer signature algorithm | How the client certificate was signed | No |
| Gateway certificate | What the Mac validates as the peer | No, check it separately |
| IKE and ESP proposals | Algorithms for the tunnel | No, separate proposal settings |
Uma isibonisi sesitifiketi sibonisa isiginesha ye-ECDSA evela ku-CA, lokho kuchaza ukhiye wokusayina womkhiphi. Ukhiye weklayenti uqobo usengaba i-RSA, futhi inkambu yohlobo kufanele ilandele ukhiye weklayenti hhayi umugqa wesiginesha. Lokhu kudideka okukodwa kuchaza imibiko eminingi ethi "i-ECDSA ilungisiwe kodwa ukuxhumana kwehluleka". Qhathanisa uhlobo lokhiye kusikhathi nolohlobo olukhethwe kuphrofayili ngaphambi kokushintsha noma yini.
Isinqumo siba lula uma ikhasi selitholakele: i-ECDSA256 yokhiye weklayenti we-p-256, olunye uhlobo olusekelwayo lokhiye ohlukile. Uma isitifiketi seklayenti nokhiye waso kungavumelani, lungisa leyo mbhangqwana ngaphambi kokushintsha iphrofayili ye-VPN.
Isitifiketi sesango yisinqumo esihlukile
Isango lethula isitifiketi saso, futhi i-Mac isiqinisekisa ngokumelene ne-ankile yokuthembela kanye negama elilindelekile. Ukuthi leso sitifiketi sisebenzisa i-ECDSA, i-RSA noma olunye uhlobo lokhiye kuyisici seseva, hhayi sesilungiselelo sobunikazi beklayenti.
Ukusekelwa kwasendaweni kwesitifiketi seklayenti se-ECDSA akufakazeli ukuthi sonke isitifiketi sesango, ijika noma ukulungiselelwa kokuqinisekisa iseva kuzosebenzisana. Hlola ubunikazi beseva, uchungechunge lwaso kanye nendlela yokuqinisekisa ye-IKE njengezokufaka ezihlukile, futhi uhlole ngephrofayili ezosetshenziswa ngempela.
Uma isitifiketi sesango siyinkinga, uphawu luvame ukuvela ngesikhathi sokuqinisekiswa kozakwethu hhayi ngesikhathi sokukhetha ubunikazi. Funda isigaba sokwehluleka ngaphambi kokushintsha uhlobo lweklayenti, ngoba ukwehluleka kokuthembela nokungavumelani kokhiye weklayenti akuhlanganyeli isisombululo esisodwa.
Isiginesha yomkhiphi neqembu lokuvumelana kokhiye akulona uhlobo lweklayenti
I-X.509 igcina ukhiye womphakathi wesihloko kanye nesiginesha yomkhiphi ezinkambini ezihlukene. Imininingwane yokhiye womphakathi wesihloko ichaza ukhiye osesitifiketini; i-algorithm yesiginesha ichaza ukhiye we-CA kanye nomsebenzi wokusayina. Kuphela kokuqala okuhambisana nesilungiselelo sohlobo lwesitifiketi.
Iziphakamiso ze-IKE ne-Child SA zingenye i-eksisi. Uhlobo lwesitifiketi se-ECDSA akulona ukukhethwa kokubethela kwe-ESP, futhi ukushintsha iqembu lokuvumelana kokhiye akukhethi uhlobo lwesitifiketi. Iphrofayili ingaba neziphakamiso ezivumelekile kanye nohlobo lobunikazi olungalungile, noma uhlobo lobunikazi olulungile kanye nesiphakamiso esinqatshwa uozakwethu.
Gcina imigqa emithathu ihlukene kurekhodi lwezinguquko: isitifiketi nokhiye wobunikazi, okokufaka kokuthembela kwesango, kanye nama-algorithm eziphakamiso. Ukuzihlanganisa encwadini eyodwa "izilungiselelo ze-crypto" kwenza ukwehluleka okulandelayo kungakwazi ukwabiwa.
Qinisekisa isinqumo ngezinkambu ozilungiselele
Hlola ubunikazi okuyibo iphrofayili ekhomba kubo ngempela, bese uqinisekisa ukuthi isitifiketi kuleyo referensi sinokhiye womphakathi olindelekile nokhiye oyimfihlo osebenzisekayo. Uhlobo oluboniswa ku-UI, isitifiketi okubhekiswe kuso kanye nokhiye kudivayisi kufanele kuvumelane.
Bese uqinisekisa okokufaka kwesango: igama leseva elilindelekile, i-ankile yokuthembela kanye nendlela yokuqinisekisa ye-IKE. Ekugcineni, xhuma bese ufunda lapho ukuxhawulana kuma khona. Ukwehluleka ngaphambi kokushintshana kobunikazi kukhomba kude nalesi silungiselelo; ukwehluleka ekuqinisekiseni uozakwethu kukhomba ohlangothini lwesango.
Rekhoda uhlobo olukhethiwe, ireferensi yobunikazi kanye nesihloko sesitifiketi sesango kumanothi okusetshenziswa. Ukuvuselelwa kwephrofayili okulandelayo kungashintsha noma yikuphi kuzo, futhi amanani amathathu anamagama aqhathaniseka ngokushesha kunesithombe sesikrini sephaneli lezilungiselelo.