Isitifiketi esisodwa sedivayisi ngayinye asikwenzi ukhiye uboshelwe kudivayisi
Isitifiketi sedivayisi ngayinye siyisinqumo somphathi, hhayi ukubopha idivayisi. Okunquma ukubopha yilapho ukhiye oyimfihlo ekhona, kusukela kufayela elikopikekayo kuya ku-TPM.
Ukhipha isitifiketi esihlukile se-laptop ngayinye, ngakho ucabanga ukuthi i-VPN ingazihlukanisa. Ayikwazi. Isitifiketi sekhasimende sifakazela ukuthi lowo oxhumayo unokhiye oyimfihlo ohambisanayo, futhi iphrofayili ekopishiwe nayo inawo.
Isitifiketi sedivayisi ngayinye siseyisiphakamiso esihle. Senza nje umsebenzi ohlukile kunalokho abantu abaningi abakulindele.
Isitifiketi sekhasimende sifakazela ini ngempela
Ngesikhathi sokuxhumana, ikhasimende lisayina ngokhiye oyimfihlo ohambisana nesitifiketi salo, futhi iseva iqinisekisa lokho kusayina ku-CA eyethembayo. Akukho lutho kulokho kushintshana okuchaza umshini. Noma yiliphi idivayisi eliphethe isitifiketi nokhiye kokubili likhiqiza ukusayina okufanayo, ngakho iphrofayili ekopishwe kwi-laptop yesibili ibukeka ifana ncamashi neyokuqala. Isitifiketi sibiza ubunikazi; asibizi ihadiwe.
Ukwehluka kwedivayisi ngayinye kusabalulekile, ngoba kwenza ukuhoxiswa kube nembayo. Kungumphemelelo wokuphatha, hhayi ingidi yezobuchwepheshe.
Amazinga amathathu okugcina ukhiye
Izinga lokuqala yifayela likhiye elikudiski. Liyathwaleka ngokwakhiwa kwalo, futhi yilapho iphrofayili eziningi ze-OpenVPN zihlala khona.
Izinga lesibili ukhiye okhiye isistimu yokusebenza eyimaka njengongakwazi ukukhishwa. I-Windows ingakhiqiza ukhiye wedivayisi esitolo sayo sezitifiketi futhi yenqabe ukukhishwa okuvamile, okumisa ukukopishwa okungenhloso. Awusekelwe yihediwe, futhi ngokufinyelela okwanele emshinini imikhiye enjalo ingabuyiselwa, ngakho inyusa umzamo esikhundleni sokwakha udonga.
Izinga lesithathu ukhiye okhiqizwa ngaphakathi kwehadiwe yezokuphepha: i-TPM, ikhadi elesiliva, i-SIM noma ithokheni ye-PIV. Lezo mojuli azinayo isekethe yokukhishwa kokhiye eziwukhiqizile, futhi ukusayina kwenzeka ngaphakathi kumojuli. Ukhiye awulokothi ube yifayela umuntu angalikopisha.
| Where the key lives | Copyable | What it buys you |
|---|---|---|
| Key file inside the profile | Trivially | Revocation granularity, nothing more |
| OS non-exportable key store | Hard, not impossible | Stops casual profile sharing |
| TPM or PIV token | No | Binding the server can rely on |
Leyo thebula yiwo wonke umqondo emigqeni emithathu.
easy-rsa ingenzani futhi ayikwazi ukwenzani
Ukukhishwa kwesitifiketi sedivayisi ngayinye kuqondile. Yakha igama elivamile elihlukile ledivayisi ngayinye ku-CA efanayo, isibonelo ./easyrsa build-client-full laptop-a nopass, bese uphinda kwedivayisi ngayinye. Bhala ukuthi yiliphi igama elivamile elingeliphi umuntu futhi imuphi umshini.
Ukuhoxiswa nakho kuqondile: ./easyrsa revoke laptop-a, phinda ukhiqize i-CRL nge-./easyrsa gen-crl, futhi uqinisekise ukuthi iseva iyifunda ngempela nge-crl-verify.
Into i-CA engakwazi ukuyenza ukuqinisekisa ukuthi ukhiye oyimfihlo usukhona kuphi ngemva kwalokho. Uma ukhiqiza ukhiye kusihambisi se-CA bese uwukopa kudivayisi, usuwukhiqizile umbhalo wesibili ngesikhathi sokukhishwa. Ukhiye ongakwazi ukukhishwa kufanele ukhiqizwe kudivayisi ngokwayo, noma ungeniswe kuhadiwe engasoze yawudedela.
Izilawuli ezisinda kwiphrofayili ekopishiwe
Cabanga ukuthi iphrofayili ingakopishwa futhi klama ngakho. Xhumanisa i-akhawunti nento yesibili ukuze isitifiketi sisodwa singanele. Nika idivayisi ngayinye inqubomgomo yayo ukuze ubukhulu bobunikazi obunye buhlale buningiwe. Futhi ubheke igama elivamile elifanayo elixhunywe kumakheli amabili ngasikhathi sinye, okuwukho okubonakala kwephrofayili eyabiwe kurekhodi lokuxhumana.
Ukuhoxiswa okusheshayo nokubhaliwe yisilawuli esisebenza ngisho ngemva kokuba ukukopishwa kwenzekile. Konke okunye ukuvimbela.
Isimangalo iseva engathembela kuso ngempela
Ukwehluka kuvela ku-CA. Ukubopha idivayisi kuvela ekugcineni ukhiye. Ihediwe kuphela engakwazi ukukhishwa ukhiye wayo eguqula isitifiketi esisodwa sedivayisi ngayinye sibe yisimangalo iseva esiyiphogelelayo, esikhundleni senqubomgomo wonke umuntu avumayo ukuyilandela.