Isitifiketi se-VPN se-Mac: kungani isikhethi sobunikazi sihlala singenalutho
Iklayenti lidinga isitifiketi kanye nokhiye wakho oyimfihlo, esitolo esikufundayo. Hlola ubunikazi kuqala, bese ubona ukuthi ingabe isango liyakwamukela.
Ufake isitifiketi, siyavela ku-Keychain Access ngegama elilula, kodwa isikhethi sobunikazi seklayenti le-VPN sisinalutho. Iklayenti alifuni isitifiketi. Lifuna ubunikazi: isitifiketi esihambisana nokhiye oyimfihlo ongafakazela ubunikazi, sigcinwe lapho iklayenti livunyelwe khona ukusifunda.
Lokho iklayenti elikucelayo ubunikazi
Uhlaka lwezokuphepha lwe-Apple lubheka isitifiketi nobunikazi njengezinto ezihlukene. Isitifiketi idatha yomphakathi. Ubunikazi yileso sitifiketi kanye nokhiye waso oyimfihlo, futhi ubunikazi kuphela obungaqeda inselelo. Isitifiketi se-CA esithenjwayo, ngakolunye uhlangothi, sivumela iklayenti ukuhlola umkhiphi; asenzi umshini ube umnikazi wemininingwane yeklayenti ekhishiwe.
| Item | What it can do | What it cannot do |
|---|---|---|
| CA or server certificate | Validate the gateway's chain | Authenticate this client |
| Client certificate without key | Nothing for authentication | Prove possession of anything |
| Identity (cert plus key) | Answer the authentication challenge | Guarantee the gateway accepts it |
Yingakho ukungenisa ifayela le-.cer akukhiqizi ubunikazi beklayenti olusebenzisekayo. Ifayela liqukethe kuphela izinto zomphakathi, futhi akukho kuqamba kabusha noma ukwethemba okukwenza kube umbhangqwana wokhiye.
Izizathu ezintathu zokuthi isikhethi sihlale singenalutho
Esokuqala ukungabi khona kokhiye oyimfihlo, okusho ukuthi inqubo yokubhalisa noma yokungenisa ayizange ilethe noyedwa. Esokubili isitolo iklayenti elingasihloli: iphrofayela yobubanzi bomsebenzisi ibheka kukhiye womsebenzisi, futhi into ebekwe esitolo sohlelo ingase ingabonakali kulo. Esokuthathu ukungafani kwenhloso noma kwenqubomgomo, lapho isitifiketi sikhona kodwa singavumelekile ekufakazeleni iklayenti ngaphansi kwemithetho yokwethula.
security find-identity -v -p ssl-clientLokhu kubala ubunikazi uhlelo olukubheka njengokuvumelekile ekufakazeleni iklayenti. Uma inani linguqanda, inkinga ingaphambi kweklayenti le-VPN futhi akukho ukuhlela iphrofayela okuzokuyilungisa. Uma ubunikazi buvela lapha kodwa bungaveli eklayentini, umehluko usestolo noma ebubanzini beklayenti.
Ukhiye oyimfihlo uhlala kuphi, futhi ubani ongawusebenzisa
Uma ungenisa ubunikazi nge-Keychain Access, ibhokisi lengxoxo yokungenisa linikeza ikhiye okuyiwa kulo. Iyiphi indawo okuyiwa kuyo efanele kuncike eklayentini nasekutheni iphrofayela ingeyobubanzi bomsebenzisi noma bedivaysi. Impendulo endala encoma ikhiye yohlelo akuwona umthetho jikelele, futhi ukukopisha izinto phakathi kwezitolo akulona ukulungisa.
I-System Roots iqoqo lokwethemba. Ukubeka isitifiketi lapho kushintsha ukuthi yimiphi imikhiphi uhlelo oluyethembayo; akudali ukhiye oyimfihlo, futhi akusona isitolo sobunikazi. Ukuhambisa izitifiketi ezingahlobene ukuze kugcwaliswe isikhethi kuwuhlobo lokulungisa okushiya umshini unesethi yokwethemba ekhulisiwe unomphela.
Ukufinyelela kukhiye oyimfihlo ukulawula okwehlukile. Ukunikeza yonke inhlelo imvume yokusebenzisa ukhiye kuxazulula inkinga yokukhetha yeklayenti elilodwa futhi kunikeza ikhono elifanayo kukho konke okunye emshinini. Yinikeze iklayenti eliyidingayo, futhi uhlole ukuthi ukhiye usekelwa yi-hardware noma umakwe njengongakwazi ukuthunyelwa ngaphandle; uma kunjalo, kufanele kusetshenziswe umhlinzeki osekelwayo esikhundleni sekhophi ethunyelwe ngaphandle.
Iphrofayela ikhomba kanjani emininingwaneni yokufakazela
Kumisindo we-IKEv2 wangempela ophethwe, iphrofayela ikhomba kumthwalo wayo wemininingwane ngokusebenzisa PayloadCertificateUUID. Okubalulekile ubunikazi obukhonjiwe kanye nendlela obunikezwe ngayo; ukuhlela igama lokubonisa kuphrofayela akulungisi isikhombo esikhomba kumthwalo ongafanele noma kumthwalo ongakaze unikeze ukhiye.
Umhlinzeki womuntu wesithathu angase asebenzise indlela ehluke ngokuphelele yokukhetha, njengesitolo sakhe noma isicelo sohlelo. Funda imibhalo yalowo mhlinzeki esikhundleni sokudlulisa imicabango yephrofayela yangempela, futhi qinisekisa isikhombo kuphrofayela efakwe ngempela, hhayi kumbhalo osalungiswa kukhonsoli yokuphatha.
Ukukhetha nokwamukela kuyizigaba ezihlukene
Isikhethi esigcwele sisho ukuthi iklayenti lingathola futhi lisebenzise ubunikazi. Akusho lutho mayelana nokuthi isango lizokwamukela. Iseva isahlola umkhiphi, isikhathi sokusebenza, isimo sokuhoxiswa kanye nokuxhumanisa kwalowo mininingwane ne-akhawunti.
Hlola izigaba zombili ngokusobala, ngaleyo ndlela. Qinisekisa ukuthi ubunikazi bunikezwa, xhuma, bese ucela umnikazi wesango ukuthi aqinisekise ukuthi imininingwane iphi eyethulwa nokuthi yimuphi umthetho wokuxhumanisa oyisebenzisile. Uma iklayenti linikeza ubunikazi futhi iseva liyenqaba, umsebenzi osele usohlangothini lweseva. Ukufaka kabusha isitifiketi ku-Mac ngeke kushintshe lowo mphumela, noma ngabe kuphindwa kangaki.