openssl ca: usuku lokuphelelwa olungalungile ku-index.txt nendlela yokulungisa

Ukuqhubeka kokukhipha kuyama ku-entry 22: invalid expiry date, kuyilapho isicelo esiphambi kwakho silungile ngokuphelele. Isikhalazo sivela kumhlaziyi wesizindalwazi se-CA, hhayi ku-CSR futhi hhayi kuklayenti ye-VPN ezokwethula isitifiketi ekugcineni. Lowo mehluko unquma konke okulandelayo: irekhodi likhohlakele, ngakho ukulungisa kungokwesimo se-CA hhayi esicelweni noma ekuhlelweni kozakwabo. Thatha irekhodi elinezinombolo njengomugqa ku-index.txt, futhi inkinga incipha ibe umbuzo wedatha obekiwe onempendulo engaqinisekiswa.

Funda iphutha njengesikhalazo mayelana nesizindalwazi

Njalo openssl ca ucingo ludlula kwisizindalwazi salo sombhalo ngaphambi kokusayina noma yini. Umgqa ngamunye unohlamvu lwesimo, isigxivizo sesikhathi sokuphelelwa, isigxivizo sokuhoxiswa esingakhethwa, inombolo yochungechunge nge-hex, igama lefayela kanye nesihloko. Uma insimu eyodwa ingakwazi ukuhlaziywa, umyalo ubika inombolo yomugqa bese uyama esikhundleni sokuqagela ingxenye esele yerekhodi.

Lokho kuma kuyisivikelo hhayi ukuqina ngokweqile. Irekhodi elingakwazi ukufundwa ithuluzi liyashiya lingakwazi ukunquma ukuthi isihloko esiceliwe sivele sikhona, ukuthi inombolo yochungechunge isinikeziwe, noma ukuthi i-CRL elandelayo kufanele ibe nani. Ukuqhubeka udlule umugqa omubi kungakhiqiza lokho kungahambisani okuthule okuvela ezinyangeni kamuva, ngokuvamile ngesikhathi sokuhoxiswa okungekho muntu ongakuchaza. Funda umyalezo njengesikhalazo mayelana nedatha, futhi uphenyo luhlala ngaphakathi kwemikhombandlela ye-CA.

Kopisha isimo se-CA ngaphambi kokuthinta noma yini

Thatha isithombe sayo yonke imikhombandlela ye-CA, hhayi ifayela lesizindalwazi kuphela. Inkomba, ifayela layo lezimpawu, amafayela enombolo yochungechunge kanye nenombolo ye-CRL, ukhiye oyimfihlo kanye nezitifiketi ezikhishiwe konke kuyabamba iqhaza emisebenzini elandelayo, futhi ukulungisa okubuyisela okukodwa kuyishiye eminye kwakha ingozi yesibili. Lapho kukhona khona sebenzisa inqubo yokugcina ye-CA uqobo, futhi umise ukukhipha okuhleliwe isikhathi sonke somsebenzi.

Bhala inguqulo ye-OpenSSL kanye nefayela lokuhlela umyalo ohlulekile elikulayishe ngempela. Ukufakwa kuvame ukugcina imikhombandlela ye-CA engaphezu kweyodwa, futhi iphutha linencazelo kuphela uma liqhathaniswa nesizindalwazi esishiwo ukuhlela okukhethiwe.

Thola irekhodi bese ukhipha umkhondo wensimu yalo yosuku

Inombolo yomugqa ebikiwe ibalwa kusukela kurekhodi lokuqala, ngakho sed -n '22p' index.txt ihla phezu kwerekhodi elinenkinga uma usuqinisekisile ukuthi awekho imigqa engenalutho noma imibono ngaphezulu kwayo. Phrinta lowo mugqa ngezihlukanisi ezibonakalayo, ngoba amathebhu kanye nezikhala zokugcina zivamile futhi azibonakali efasiteleni lomhleli elivamile.

Insimu yokuphelelwa yisikhathi esigxivizwa esikhathi esinobubanzi obuncike onyakeni. Amanani afika ku-2049 abhalwa ku-UTCTime njenge-YYMMDDHHMMSSZ, kuyilapho amanani akamuva edlulela ku-GeneralizedTime enonyaka wezinombolo ezine. Irekhodi elihlanganisa izinhlobo ezimbili, noma elithwala unyaka wezinombolo ezimbili lapho umhlaziyi manje elindele ezine, lehla khona kanye kuleli phuzu. Kanjalo futhi insimu enqunyiwe eyashiywa ukubhala okuphazamisekile.

Qhathanisa irekhodi nesitifiketi elibhekisa kuso hhayi nefayela lelinye i-CA. Isitifiketi esisayiniwe siyigunya lokuthi ukusebenza kufanele kusho ukuthini, futhi sivele sikhona njengento engahlaziywa.

Lungisa irekhodi ngokwesitifiketi esisayiniwe

Funda izinsuku zangempela nge-openssl x509 -in issued.pem -noout -dates -serial -subject. Guqula notAfter ube ububanzi besigxivizo esibhalwa inguqulo yakho walowo nyaka, futhi ngaphambi kokushintsha uhlamvu olulodwa qinisekisa ukuthi inombolo yochungechunge ihambisana nerekhodi ozolihlela.

Hlela kuphela insimu ephukile, gcina uhlamvu lwesimo kanye nenombolo yochungechunge, futhi ushiye ingxenye esele yomugqa. Uma irekhodi lingakwazi ukuhambisana nanoma yisiphi isitifiketi esisayiniwe, lithathe njengerekhodi elilahlekile bese ulihoxisa ngendlela ye-CA uqobo esikhundleni sokusula umugqa ngesandla.

Ungalungisi ngokusika usuku ukuze luhambisane nokuqagela ngonyaka. Ukusika kwezinhlamvu ezimbili akudluliseki phakathi kwezinguqulo, futhi kushintsha buthule ukusebenza okubikwa yisizindalwazi ekuhlolweni kwesihloko esiphindwayo kanye ne-CRL esizayo. Uma inani lokuqala lingakwazi ukubuyiswa, khipha kabusha ngaphansi kwenombolo entsha yochungechunge futhi ubhale ukuthi kungani elidala lashiywa. Umkhondo wokucwaninga uyingxenye yokulungisa, hhayi amaphepha azungezile.

Qinisekisa ukukhipha nokwakhiwa kwe-CRL ngaphambi kokuhamba

Qhuba ukukhipha okukodwa ngokuhlela okufanayo futhi uqinisekise ukuthi kuphela ngaphandle kwesikhalazo senombolo yomugqa. Bese wakha i-CRL nge-openssl ca -gencrl -config openssl.cnf futhi uhlole ukuthi iyahlaziywa, ngoba irekhodi elilimele livame ukuvela lapho hhayi ngesikhathi sokusayina.

Hlola isitifiketi esisha nge-openssl x509 -noout -dates -serial futhi usiqhathanise nomugqa osanda kubhalwa yi-CA. Qinisekisa ukuthi uhlamvu lwesimo nosuku lokuphelelwa kuhambisana nesitifiketi, futhi uqinisekise ukuthi openssl verify -CAfile ca.pem issued.pem ibuya ngaphandle kwephutha. Bese ubuyisela ukukhipha okuhleliwe futhi ubheke ukuqhubeka kokuqala, ngoba umugqa wesibili okhohlakele uzozimemezela ngokushesha.