Igama lefayela elifanayo ca.crt, isitifiketi esihlukile: yini okufanele iqhathaniswe

Amaphrofayili amabili womabili aletha ifayela elibizwa nge-ca.crt, ithaneli elilodwa liyenyuka kanti elinye lihluleka ngephutha leketanga. Ukuvula amafayela amabili eceleni komunye akulungisi lokhu ngokuvamile, futhi ukucisha ukuqinisekisa kulungisa lokhu ngendlela engafanele. Umbuzo owenziwa yiphutha ngempela mncane: yisiphi isitifiketi inqubo ngayinye esilayisha njenge-anchor yayo yethemba, futhi ngabe zombili ziyinto eyodwa? Phendula lokho kuqala futhi ukuxilongwa okusele kuzothola indlela. Igama lefayela iyilebula yokupakisha, futhi indlela ebhalwe kuphrofayili nayo ayinagunya, ngakho konke kuncike kulokho inqubo ekufunda ngempela.

Thola isitifiketi esilayishwa ngiklayenti ngempela

OpenVPN yamukela igunya ngezindlela ezimbili, futhi indlela inquma ukuthi yimaphi amabhayithi abalulekile. Iphrofayili ingakhomba efayeleni langaphandle nge-ca, noma ifake isitifiketi ngaphakathi kwebhlokhi <ca> kuphrofayili uqobo. Lapho zombili zikhona, ibhlokhi efakiwe iyawina futhi ifayela eliseduze kwephrofayili alivulwa neze.

Funda iphrofayili ehlulekayo futhi uthole ukuthi isebenzisa yiphi indlela ngaphambi kokuthi uqhathanise noma yini. Ikhophi ethathwe kusikhombisi esiseduze, noma epakejini iphrofayili enye eyavela kulo, ayikutsheli lutho mayelana nalokho okukholelwa yile nqubo. Kuyafana nendlela esekucushweni: ixazululwa ngokuhlobene nendawo lapho iklayenti laqalwa khona, okuyinto engeyona njalo isikhombisi osibhekile. Funda iphrofayili, hhayi ifolda.

Izitifiketi zibonakala ngokuqukethwe kwazo: ukhiye womphakathi, isihloko nomkhiphi, isikhathi sokusebenza kanye nesiginesha phezu kwakho konke lokho. Amafayela amabili anamabhayithi afanayo ayisitifiketi esisodwa noma ngabe abizwa ngani, futhi amafayela amabili anegama elifanayo angaba iziphathimandla ezingahlobene. Igama iyilebula yokupakisha, hhayi ubunikazi.

Thatha umbhalo weminwe wamakhophi womabili nge-openssl

Umbhalo weminwe i-hash phezu kokubhalwa kwe-DER kwesitifiketi, uhlobo oluhlanganiswa yisiginesha, ngakho ukuphela kwemigqa nombhalo wekhanda awukwazi ukuba nomthelela kuwo. Kubalele ifayela ngalinye futhi uzoba nezingcezwana ezimbili ze-hex ezihlukaniswe ngekoloni ezihambisanayo noma ezingahambisani. Akukho okunye esitifiketini okudinga ukufundwa ukuze kuphendulwe umbuzo wokuqhathanisa.

openssl x509 -in /etc/openvpn/office/ca.crt -noout -fingerprint -sha256
openssl x509 -in ~/profiles/lab-ca.pem -noout -fingerprint -sha256

Kuyalinga ukukhomba i-openssl kuphrofayili uqobo, kodwa ifunda ibhlokhi yesitifiketi yokuqala evela efayeleni, futhi iphrofayili ivamise ukuba ne-<cert> ngaphambi kwe-<ca>. Khipha ibhlokhi yegunya, bese uthatha umbhalo weminwe wefayela elikhishiwe, ngoba yilowo khophi iklayenti elizoyisebenzisa ngempela.

sed -n '/^<ca>$/,/^<\/ca>$/p' office.ovpn | sed '1d;$d' > /tmp/office-ca.pem
openssl x509 -in /tmp/office-ca.pem -noout -fingerprint -sha256

Imibhalo yeminwe efanayo isho ukuthi impahla yethemba iyafana nokuthi iphutha leketanga linembangela enye, okunguphenyo oluhlukile. Imibhalo yeminwe ehlukile isho izitifiketi ezihlukile, futhi isigaba esilandelayo siqala khona.

Funda ukungafani ngaphambi kokuthi acabange ukuhlaselwa

Imibhalo yeminwe ehlukile isho izitifiketi ezihlukile futhi akukho okunye. Ukukhishwa kabusha, ukuzungezisa, isiphathimandla esishintshiwe igama noma inqwaba endala konke kukhiqiza amafayela ahlukile anomlando osemthethweni ngokuphelele. Yikuphi okungokwakwa ukusetshenziswa kuwumbuzo womqhubi noma irekhodi lokusetshenziswa, hhayi isikhathi sokushintshwa kwefayela. Izingobo zifaka amasitembu esikhathi, ngakho ifayela elisha akulona i-anchor efanele ngokuzenzakalela.

Impande ezisayina yona iqobo ijwayelekile, ngakho ukuyithola akubona ubufakazi benkinga. Umsebenzi womhloli ukwakha indlela esuka esitifiketini seseva kuya ku-anchor eyanikezwa yona, futhi iphutha leketanga ngokuvamile lisho ukuthi leyo ndlela ayikwazanga ukuqedwa.

Hlola ukuthi i-anchor yephrofayili ehlulekayo ingumphathi okusetshenziswa kuwo kusakhishwa khona. Uma umbhalo weminwe ungahambisani nalutho kurekhodi lokusetshenziswa, iphrofayili imane igugile, futhi akukho kulungisa ohlangothini lweklayenti okuzokulungisa lokho.

Lungisa ukuthembela ngaphandle kokucisha ukuqinisekisa

Isilungiso sesikhashana ukucisha ukuqinisekisa noma ukwengeza isitifiketi ngasinye seketanga njenge-anchor. Kokubili kwenza umyalezo unyamalale, futhi kokubili kushintsha ukuthi yimaphi amaseva iklayenti elizowamukela kusukela lapho. Phinda uvule ukuqinisekisa, faka i-anchor ehlosiwe futhi uphinde uhlole.

Uma iketanga manje lakhiwe kodwa kuvela elinye iphutha, lokho kuyinqubekela phambili: ukuqinisekisa kwegama, izinsuku zokusebenza nokuhoxiswa kuyizinto ezihlukile zokuhlola ezinemiyalezo ehlukile. Gcina ipheya lombhalo weminwe kanye nombhalo wangempela wephutha ndawonye kwithikithi, ukuze umuntu olandelayo abone ukuthi iyiphi i-anchor elayishiwe nokuthi iyiphi eyayilindelwe. Ipheya lombhalo weminwe lincane ngokwanele ukuba linanyathiselwe encwadini yokudlulisela, futhi isigameko esilandelayo sizothatha imizuzu emihlanu esikhundleni sentambama.

Thola umphathi ofanele ngesiteshi esiqinisekisiwe esifanayo esahambisa iphrofayili. Ukudonsa isitifiketi kuseva ngoba isihloko sayo sibonakala sijwayelekile kuyisenzo esihlukile, futhi kwandisa ngokuthula lokho iklayenti elizokukholwa.