Iyiphi ifayela le-CA elingena kuphrofayela ye-OpenVPN enegama lokungena kuphela?

Dlula emibuzweni emine ngokulandelana futhi ingxoxo ye-CA ngeke isaba ngokungaqondakali. Yikuphi okokusebenza okukhishwe umqhubi ngempela, yini iphrofayela esivele inayo, yiphi inkambu ebuza, futhi kwenzekani ngemva kokulayishwa kwefayela? Misa embuzweni wokuqala ongakwazi ukuwuphendula ngemiyalelo yomqhubi uqobo, ngoba ukuqagela ngalé kwawo yikho kanye indlela isitifiketi se-CA esidlangalaleni esigcina sibhangqwe khona nokhiye oyimfihlo okwakungafanele neze ukuba uphume kuseva.

Ukulandelana kubalulekile: imibuzo emibili yokugcina inencazelo kuphela uma wazi ukuthi yikuphi okokusebenza okufanele kube khona.

Qala ngalokho iphrofayela esevele inakho

Vula iphrofayela kuhleli-mbhalo bese ufuna ibhlokhi ye-ca ngaphambi kokufuna ifayela. Ibhlokhi ye-ca efakiwe ephethe i-CA yomqhubi esidlangalaleni isho ukuthi iphrofayela iyazimela, futhi iklayenti elisacela ifayela le-CA kungenzeka lifunda enye iphrofayela noma ukungeniswa okungaphelele. Uma iphrofayela inolayini we-ca okhomba endleleni esikhundleni salokho, leyo ndlela ihlobene nesikhombisi sokusebenza sekliyenti kokunye ukuhlanganiswa futhi iphelele kokunye. Bhala ukuthi iluphi uhlobo onalo ngaphambi kokushintsha noma yini.

ca /absolute/path/operator-ca.crt
auth-user-pass
remote-cert-tls server

Hlola iphakethe elethiwe ngezifayela iphrofayela ekhomba kuzo: isitifiketi se-CA, ngezinye izikhathi isitifiketi sekliyenti nokhiye ohlukile, futhi mhlawumbe ifayela le-tls-auth noma le-tls-crypt. Iphrofayela ekhomba kumafayela amane kodwa efika namabili ayiphelele, futhi akukho nani lokukhomba ezinkambini elingalungisa lokho. Cela umqhubi ingxenye engekho esikhundleni sokufaka isitifiketi osobona unaso.

Hlukanisa izinhlobo ezine zezinto

Isitifiketi se-CA siwukokusebenza okudlangalala okusetshenziswa ukuqinisekisa ubunikazi besiva. Isitifiketi sekliyenti sikhomba umsebenzisi noma idivayisi kuseva. Ukhiye oyimfihlo uyingxenye eyimfihlo yaleso sitifiketi sekliyenti, futhi akufanele neze ube ukhiye wokusayina we-CA noma ukhiye wesiva. Ukokusebenza kwe-tls-auth noma kwe-tls-crypt kuyimfihlo eyabiwe ehlukile evikela isiteshi sokulawula. Lezi zine azishintshiswani, futhi ukukhomba inkambu ye-CA esitifiketini sekliyenti kukhiqiza ukuhluleka kokuqinisekisa okubonakala njengenkinga yokwethemba.

Ukuqinisekisa ngokugama lokungena kuphela kushintsha ukuthi iyiphi kwezine oyidingayo, hhayi ukuthi zisho ukuthini. Nge-auth-user-pass ne-remote-cert-tls server iklayenti lisahlola iseva ngokuqhathanisa ne-CA, yingakho inkambu ye-CA ivela ngisho lapho kungekho sitifiketi sekliyenti. Inqubomgomo yomqhubi iyona enquma ukuthi isitifiketi sekliyenti sidingeka yini futhi, futhi ayikho ingxoxo engakutshela lokho.

Khomba iklayenti efayeleni lokwethemba

Khetha ifayela lesitifiketi se-CA ngokwalo, hhayi ifolda elinalo futhi hhayi iphakethe le-.p12 eliqukethe ubunikazi bekliyenti. Ku-Windows isakhiwo sendlela nesikhethi sefayela siziphatha ngendlela ehlukile kunezibonelo ze-Linux emihlahlandleleni eminingi, ngakho sebenzisa lokho iklayenti elifakiwe elikwamukayo futhi uqinisekise ukuthi ifayela liyafundeka ku-akhawunti eyilisebenzisayo. Inkinga yemvume nefayela elingekho kubonakala kufana engxoxweni kodwa kukhiqiza imigqa yelogi ehlukile. Ngemva kokukhetha, vula kabusha izilungiselelo zephrofayela ukuqinisekisa ukuthi iklayenti ligcine ukukhetha.

<ca>
-----BEGIN CERTIFICATE-----
...operator-provided public CA...
-----END CERTIFICATE-----
</ca>

Uma iklayenti lisekela amabhlokhi afakiwe, khetha iphrofayela efakiwe yomqhubi esikhundleni yaleyo ehlanganiswe ngesandla. Ukokusebenza okufakiwe kuhamba nephrofayela futhi kusinda ekungenisweni kabusha, kuyilapho indlela ephelele yephuka khona lapho iphrofayela isiyiswa komunye umshini.

Funda iphutha elilandelayo, hhayi lelo elifanayo

Injongo yokunikeza i-CA efanele ukushintsha iphutha, hhayi ukulenza inyamalale. Ukuhluleka kobunikazi besiva ngemva kokulayishwa kwe-CA kusho ukuthi isitifiketi asizange sivumelane negama elilindelekile noma nokulindelwa kwe-remote-cert-tls, okuwukulungiswa okuhlukile ekunqatshweni kwegama lokungena. Ukunqatshwa kwegama lokungena kusho ukuthi isendlalelo se-TLS siphumelele futhi izifakazelo zingalungile. Gcina umlayezo omusha wokuqala; yiwo olusizo.

Iklayenti elixhumayo kodwa elingafinyeleli ndawo lweqe ukwethemba ngokuphelele futhi manje libhekene nombuzo womzila noma we-DNS.

Ungalokothi uvale ukuqinisekisa ukuze udlule leyo ngxoxo. Iklayenti elamukela noma yisiphi isitifiketi alinasizathu sokucela i-CA, futhi umhubhe eliwakhayo akukhona lowo umqhubi ayewuhlosile.