I-P12 endala iyehluleka ku-OpenSSL 3: iphasiwedi engalungile noma i-cipher endala?

Ingxoxo yokungenisa ithatha iphasiwedi yakho, ijike isikhashana bese ithi ayikwazi ukufunda ibhange. Akukho lutho kulo mlayezo olusho ukuthi ugqithise umusho wokungena ngokungalungile noma ukuthi ifayela lavalwa nge-cipher iklayenti engasayihlinzeki. Lokhu kuwukwehluleka okuhlukene ngezixazululo ezihlukene, futhi ukukhetha okungalungile kuholela ekwehlisweni kweklayenti okuhlehlisa isinqumo kuphela. Ukubuka isigaba lapho iklayenti ima khona kuhlukanisa kokubili cishe ngomzuzu.

Kwenzekani phakathi kwengxoxo nohlu lwezitifiketi

Ifayela le-.p12 liyisiqukathi, hhayi isitifiketi. Ngaphakathi kunesikhwama esisodwa noma eziningi zezitifiketi nesikhwama sokhiye oyimfihlo esibethelwe ngokhiye othathwe kwiphasiwedi yakho, kanye nokuhlolwa kobuqotho okubizwa nge-MAC kuyo yonke ifayela. Ukuyivula kusho ukuqinisekisa leyo MAC, ukususa ukubethela kwesikhwama sokhiye nokufanisa isitifiketi nokhiye ophumayo.

Inkinga yephasiwedi ifika esigabeni se-MAC. Inkinga ye-cipher ifika kamuva, lapho isikhwama sokhiye kufanele sivulwe futhi ukwakha okwenza lokho kungenawo ukusetshenziswa kwe-algorithm eshiwo efayeleni.

Icala lesibili livamile ezinhlelweni zanamuhla ngoba i-OpenSSL 3 ithuthe iqembu lama-algorithm amadala yafaka ku-legacy provider yokuzikhethela. Amabhange akhishwe yi-OpenSSL 1.x ayevame ukuvalisa izitifiketi nge-RC2 yamabhithi angu-40 nokhiye oyimfihlo nge-Triple DES enokhiye abathathu. Ukwakha okuzenzakalelayo kwe-OpenSSL 3 kusaqinisekisa i-MAC ngephasiwedi yakho efanele bese kwehluleka esikhwameni, ngakho iphasiwedi yayingakaze ibe ngalungile futhi ukuyiphindaphinda akushintshi lutho.

Funda isiqukathi ngaphandle kokukhipha ukhiye

Cela ukwakha kwe-OpenSSL emshinini wakho ukuthi kuhlaziywe ifayela futhi kufundwe indawo lapho kunikezela khona. Ukuhlola ngaphandle kwefayela lokuphuma kushiya ukhiye ubethelwe kudiski, futhi yiso leso sizathu kuphela esenza lesi sinyathelo siphephe kumphehli owabiwayo.

openssl pkcs12 -in vpn-identity.p12 -info -noout

Ebhangeni elidala elinephasiwedi efanele lokhu kuphrinta izimfanelo zesikhwama bese kuma nge-digital envelope routines::unsupported. Ngephasiwedi engalungile uthola i-Mac verify error: invalid password? ngaphambi kokuba kufundwe noma isiphi isikhwama. Imilayezo emibili ikhombisa izinhlangothi eziphambene, futhi yikho kanye ukwaziswa iklayenti elikufihlile.

Uma ukwehluleka kungokwe-algorithm engasekelwe, gijimisa umyalo ofanayo futhi ngokufaka i--legacy futhi kungashintshwanga okunye. Leyo fulegi ilayisha i-legacy provider kuphela kulowo msebenzi owodwa. Ayiphoqi iklayenti le-VPN ukuthi lihlaziye amabhange amadala, ayithinti inqubomgomo ye-crypto yesistimu yonke, futhi iwukulinganisa hhayi ukulungisa, ngoba ifayela kusafanele lishintshwe.

Yiliphi iphutha elisho isigaba sini

Ithebula elifushane lehlukanisa imiphumela emithathu, futhi amazwi abaluleke kakhulu kunendawo okwavela kuyo ingxoxo.

Umbhalo ofana ne-not enough data noma i-header too long awuweli kulelinye lamaqembu amabili okuqala. Le nkinga yefomethi: ifayela le-DER eliqanjwe kabusha nge-.pem, ikhophi eyonakaliswe isihleli esibhala kabusha iziphetho zemigqa, noma ukulandwa okungaphelele. Qhathanisa i-checksum naleyo ethunyelwe umkhiphi ngaphambi kokuba uqale ukubheka ama-cipher.

Thatha i-Mac verify error njengobufakazi mayelana nephasiwedi kuphela. Kusho ukuthi i-MAC ebalwe kulokho okugqithisile akuhambisani nenani eligciniwe, lokhu kwenzeka ngephutha lokugqitha, ngokuphasiwedi egcinwe kusikhashana kusuka ekungenisweni kwangaphambili, noma ngefayela elikhishwe kabusha ngaphansi komunye umusho wokungena. Akusho lutho mayelana nokuthi ama-algorithm angaphakathi madala yini.

Yakha ibhange iklayenti elingalivula ngempela

Lapho umhlaziyi we-legacy eqinisekisa ukuthi ifayela liphilile, isixazululo esihlala njalo ukufakwa okunama-algorithm asekelwa iklayenti elihlosiwe: i-AES-256-CBC yezikhwama zokhiye nezitifiketi, i-PBKDF2 ene-SHA-256 yokutholwa kanye ne-SHA-256 ye-MAC. Umlawuli wakho we-PKI angakukhipha kulokho kuqala kokhiye okufanayo, futhi isitifiketi esingaphakathi sihlala siyileso amaseva akho asevele ethemba kuso.

Lapho kudingeka uguqule endaweni, cela ithuluzi le-pkcs12 ukuthi liphinde livalise izikhwama esikhundleni sokuzikhipha kuqala. Gcina imisho yokungena yomibili kude nomlando we-shell ngokuyifunda kufayela.

openssl pkcs12 -in vpn-identity.p12 -out vpn-identity-aes.p12 \
  -keypbe AES-256-CBC -certpbe AES-256-CBC -macalg sha256 \
  -passin file:old.pass -passout file:new.pass

Ukuguqulwa okuphumelelayo akusho lutho mayelana nokuphelelwa yisikhathi, ukusetshenziswa kokhiye, ukufaniswa kokhiye oyimfihlo noma ukuthi iseva iyaluvethemba yini uhlu lomkhiphi. Ukupakisha kabusha ushintsho lwezokuthutha, hhayi ukuvuselelwa, futhi ngakunye kwalokho kusadinga ukuhlolwa kwako.

Yeqa noma iyiphi iresiphi ebhala ukhiye ophakathi ongavikelwe noma iphasiwedi yokuphuma engenalutho ngoba nje iklayenti lamukele ifayela kamuva. Ibhange elifundekayo elisuswe ukuvikelwa liwumphumela omubi kunokwehluleka kokungenisa owaqala nakho.

Qinisekisa ukuthi iklayenti ingenise ifayela owakhe

Ukuhlaziya okuhlanzekile kutheminali kufakazela ukuthi isiqukathi sivumelekile. Akufakazeli ukuthi iklayenti likikhethile, ngoba iphrofayela esele ingaqhubeka ikhombisa efayeleni elidala, futhi amanye amaklayenti egcina kubufihlo ubunikazi obungenisiwe ngaphansi kwegama ongalikhethanga.

Phrinta ubunikazi osuzongenisa futhi buqhathanise nalokho iklayenti elikukhombisa kumbono wezitifiketi.

openssl pkcs12 -in vpn-identity-aes.p12 -clcerts -nokeys -passin file:new.pass \
  | openssl x509 -noout -subject -dates -fingerprint -sha256

Khipha kuqala ingeno yephrofayela endala, bese ungenisa. Uma iklayenti libhala phansi isihloko noma umnyatselo womunwe elikulayishile, kufanise nomugqa ongenhla; uma likhombisa igama elilula kuphela, hlola usuku lokuphelelwa esikhundleni, ngoba kunzima ukukudidanisa nesinye isitifiketi esivela kumkhiphi ofanayo.

Incwadi yokubhekisela ye-PKCS12 ibala i-provider, umusho wokungena nezinketho zokuphuma ezisetshenziswe lapha. Ukugcina i-legacy provider ngaphandle kwendawo yeklayenti yikho okuyisihluthulelo: linganisa nayo, hlinzeka ngaphandle kwayo, futhi ushiye ukhiye oyimfihlo uvikelwe kudiski.