I-OCSP ne-CRL: ukuthi ukuhlolwa ngakunye kokuchithwa kusebenza kanjani ngempela

Okukodwa kwalokhu kuhlolwa okubili kokuchithwa kubuyisela impendulo esayiniwe mayelana nesitifiketi esisodwa, kanti okunye kubuyisela uhlu olusayiniwe olulanda wonke. Kokubili kuhloselwe ukutshela umqinisekisi ukuthi imininingwane yokufinyelela isathembeke yini, futhi kokubili kwehluleka ngezindlela ezingafani neze. Ukulandelana okungezansi kulandela lokho umsebenzi ahlangabezana nakho ngempela ekukhiqizeni, kusuka kumabhayithi asentanjeni kuze kufike esangweni elenqabayo ukuxhumana. Ukweqa isinyathelo yikho kanye okwenza ukusetshenziswa kuphele kunomgomo wokuchithwa okhona ephepheni kuphela.

Isinyathelo 1: Ukuhlolwa ngakunye kubuyisela ini futhi kuhlala isikhathi esingakanani sikwazi ukusetshenziswa

I-CRL ishicilelwa njengento eyodwa esayiniwe ehlanganisa zonke izitifiketi umkhiphi azichithile, ngakho umqinisekisi uyithatha kanye bese eyisebenzisa futhi kuze kudlule i-nextUpdate yohlu. Impendulo ye-OCSP incane kakhulu: iphendula ngqo ngesitifiketi esisodwa futhi ithwala i-thisUpdate, i-producedAt futhi ngokuvamile ne-nextUpdate. Lowo mehluko uqondisa konke okunye. I-CRL egcinwe kumemori iguga buthule, ngoba ifayela lisahlaziywa futhi isignesha yalo isaqinisekiswa, kuyilapho impendulo ye-OCSP ephelelwe isikhathi ingenamsebenzi ngokusobala ngomzuzu owufundayo umaka wayo wesikhathi.

Ngakho ukugcinwa kumemori yinto yokuqala okufanele kunqunywe: iyiphi ingxenye egcina ikhophi, futhi ikhophi leyo ilandela muphi umkhawulo ophezulu. Esangweni umkhawulo kufanele ube yi-nextUpdate kususwa imarjini yokuphepha, hhayi neze lokho okushiwo yisihloko sememori se-HTTP ngengozi. openssl crl -in issuer.crl -noout -lastupdate -nextupdate liphrinta zombili izinsuku, futhi uhlu okungathi i-nextUpdate yalo isivele isesikhathini esedlule kufanele luthathwe njengolungekho hhayi nje oludala.

Isinyathelo 2: Isitifiketi sikhomba iklayenti kuphi

Isitifiketi seqabunga ngokuvamile sithwala izinkomba ezimbili: isandiso sendawo yokusabalalisa ye-CRL kanye nokufakwa kokufinyelela kolwazi lwesiphathimandla se-OCSP. openssl x509 -in client.pem -noout -ext crlDistributionPoints liphrinta okokuqala, kanti okwesibili kungaphansi kwesigaba se-AIA se-openssl x509 -in client.pem -noout -text. Noma isiphi isandiso siyinkomba, hhayi isibopho. Iklayenti elingakaze lisebenzise ukuhlolwa kokuchithwa lizoxhumana kahle neze nesitifiketi okukhombisa kwaso kunezandiso ezisho umphenduli osefile unyaka wonke.

Izindawo zokusabalalisa zivame ukusho umsingathi wangaphakathi oxazululwa kuphela esigabeni esisodwa senethiwekhi, futhi amanye amaklayenti amadala enqaba ngokuphelele ama-URL e-ldap. Hlola ukufinyeleleka kumsingathi ophetha umhubhe, hhayi kukhompyutha yakho ephathekayo, ngoba yilowo kuphela umbono okuhluleka kwawo okubalulekile ngempela.

Isinyathelo 3: Khetha i-fail-closed noma i-fail-open ngaphambi kokuphazamiseka

Umphenduli ongafinyeleleki noma uhlu oluphelelwe isikhathi kuphoqa isinqumo: nqaba ukuxhumana, noma kwamukele futhi urekhode igebe. Umyalo ongaphansi we-verify we-OpenSSL wenza ukukhetha okuqinile kucace, ngoba ukwengeza -crl_check kuguqula i-CRL engatholakali ibe unable to get certificate CRL nokuhlolwa okuhlulekile. Ukwehluleka okuthambile ezinqwabeni eziningi akulona neze ifulegi, ukungabikho kokuhlolwa, futhi yikho kanye okwenza kuthunyelwe ngengozi.

Ukuze ubone ukuziphatha iklayenti elinakho ngempela, susa umphenduli bese uxhuma futhi. Uma umhubhe usakhuphuka, thola umugqa wencwadi yokurekhoda owabhala ukuhlolwa okweqiwe, bese ubuza ukuthi ngabe ukhona yini umuntu obengawufunda lowo mugqa ngesikhathi sesigameko. Umdayisi oyedwa angahluka ngokwephrothokholi: iklayenti le-IKEv2 neklayenti le-OpenVPN kumshini owodwa lifunda izilungiselelo zokumisa ezingahlobene.

Isinyathelo 4: Khombisa ukuthi ukuhlolwa kwenzeka lapho kwamukelwa khona ithrafikhi

Thola inqubo ephetha noma egunyaza ukuxhumana, bese ubuza umugqa wokumisa ovumela ukuhlolwa kokuchithwa. Isango eliqinisekisa iketanga kodwa lingakaze libuze ngokuchithwa lisebenzisa umgomo ohlukile kuleyo esemibhalweni yakho, futhi asikho isithombe sesikrini seketanga lezitifiketi esikhombisa okuphambene. I-OpenVPN ibhala le nketho njenge-crl-verify; i-strongSwan igcina ukusesha kwe-CRL ne-OCSP ngaphansi kokumisa kwe-CA, lapho kubekwa khona crl_uris noma ocsp_uris. Uma ungeke ukwazi ukukhomba kwenye yazo zombili, thatha ukuthi ukuhlolwa akukho.

Impendulo ye-OCSP ivumelekile kuphela lapho i-CA ekhiphayo iyisayinile, noma lapho umphenduli ophethe ukusetshenziswa kokhiye okunwetshiwe kwe-OCSPSigning okugunyazwe yileyo CA uyisayinile, ngakho impendulo evela kusevisi engahlobene ayikhombisi lutho. Uma wena ngokwakho uqhuba umphenduli, uwubheke njengokuncika okuqinile, ngoba isevisi eyodwa efile iba ukuphazamiseka kwabo bonke abaklayenti be-fail-closed ngasikhathi sinye.

Isinyathelo 5: Chitha isitifiketi esisodwa ngamabomu

Thatha isitifiketi sokuhlola, sichithe ngesiteshi esifanayo esisetshenziswa ukukhiqiza, bese ubuza umphenduli ngqo. openssl ocsp -issuer ca.pem -cert old.pem -url http://ocsp.example.net -resp_text kufanele libike Cert Status: revoked kanye nesikhathi sokuchithwa, futhi impendulo ethi good isho ukuthi ukuchithwa kwakho akuzange kufinyelele kumphenduli obuzwa ngamaklayenti akho. Bese ugijima openssl verify -crl_check -CRLfile issuer.crl -CAfile ca.pem old.pem ukuze ubone isinqumo esifanayo ngomzila wohlu. Funda uchungechunge lwesizathu esikhundleni sekhodi yokuphuma, ngoba ukwenqatshwa kokuchithwa kanye nephutha leketanga kokubili kuphetha ngokwehluleka.

Isinyathelo esibaluleke ngempela yisokugcina: xhuma futhi nephrofayela endala ngokumelene nendawo yangempela yokuphoqelela futhi uqinisekise ukuthi ukwenqaba kuvela ekuchithweni. Bese uxhuma futhi ngesitifiketi esisha, esivumelekile ukuze ukhombise ukuthi awuzange ucekela phansi isilaleli kuphela. Ukususa iphrofayela kuklayenti akukhombisi lutho ngosinqumo seseva, futhi nokugijima ngempumelelo kwe-openssl verify kumshini ongaphethi umhubhe neze akukhombisi. RFC 6960 ichaza okuqukethwe yimpendulo ye-OCSP evumelanayo, kuhlanganise namagugu esimo afundwa yilolu hlolo.