Isitifiketi se-OpenVPN siphelelwe yisikhathi? Hlola iwashi kuqala, bese kuba isitifiketi

Iklayenti iyaxhuma, ixoxisane isikhashana esisodwa, bese ibika ukuthi isitifiketi siphelelwe yisikhathi. Ngaphambi kokucela noma ubani ukuthi aphinde akhiphe noma yini, bheka usuku kudivayisi ephambi kwakho: ilaptop elele inyanga yonke, ifoni enewashi elibekwe ngesandla kanye nerotha elingenamthombo we-NTP osebenzayo konke kubika isikhathi esingalungile ku-TLS stack. Isitifiketi sivumelekile kuphela ngaphakathi kwewindi lesikhathi, futhi ukuhlola kuqhathanisa lelo windi nalokho okushiwo iwashi lendawo. Lungisa iwashi, bese unquma ukuthi inkinga ingempela yini.

Qala ngewashi kudivayisi

Vula itheminali futhi ufunde umbono wesistimu mayelana ne-UTC, hhayi iwijethi yewashi ledeskithophu, engase ibonise umbono olungiswe ngokwesigaba sikhathi noma inani elidala eligcinwe kukhashi yi-GUI.

date -u
timedatectl status

Iwashi elishesha kakhulu lenza isitifiketi esivumelekile sibonakale siphelelwe yisikhathi, futhi elilufifi kakhulu lenza sibonakale singakavumeleki, okuyinto amanye amaklayenti ayibika ngephutha elifanayo elijwayelekile lokuxhawula. Uma ukuvumelanisa kucishiwe noma umthombo wesikhathi ungafinyeleleki, lungisa lokho kuqala futhi uhlole futhi ngaphambi kokuthinta noma yiliphi ifayela. Ukubuyisela iwashi emuva ukuze ugweme ukuphelelwa yisikhathi akusona isisombululo: kuphula ezinye izinsizakalo kudivayisi futhi kushiya inkinga yobunikazi khona lapho ibikhona.

Uma iwashi lilungile, ukuphelelwa yisikhathi kungempela futhi ingxenye esele yalo mhlahlandlela iyasebenza. Qaphela ukuthi ilogi yeklayenti isebenzisa isiphi isigaba sikhathi ngaphambi kokuqhathanisa izitembu zesikhathi ezivela kumadivayisi amabili. Iseva kwesinye isigaba ingenza ukuvuselelwa kubonakale kusesikhathi noma sekwedlule isikhathi kuyilapho kungekho kokubili. Qhathanisa nesitembu sesikhathi emugqeni welogi weklayenti uqobo hhayi ngewashi lodonga phezu kwetafula lakho.

Funda umugqa wephutha ngaphambi kwephrofayela

Gcina umbhalo oqondile. Ukuhluleka kokuqinisekisa kwe-OpenVPN kusho ukujula nesizathu, futhi lezi zinkambu ezimbili zikutshela ukuthi ubani okufanele athathe isinyathelo.

VERIFY ERROR kanye ne-error=certificate has expired ukuhluleka kokuvumeleka endaweni ethile yochungechunge. Lokhu akukona ukwenqatshwa kwephasiwedi futhi akukona ukuphela kwesikhathi, futhi zontathu zidinga izimpendulo ezehlukene.

Kopisha umugqa wonke kumanothi akho kanye nenguqulo yeklayenti. Uma umyalezo usho ukuthi isitifiketi asikavumeleki, ubuyele embuzweni wewashi. Uma usho ukuthi umkhiphi akaziwa, unenkinga yokwethemba hhayi inkinga yesikhathi, futhi akukho ukuvuselelwa okuzokushintsha lokho.

Thola ukuthi isiphi isitifiketi esiphelelwe yisikhathi

Ukujula kweziro isitifiketi esethulwe yilowo enixhumene naye, futhi ukujula okuphezulu kuya empandeni. I-VPN yomsebenzi ivamise ukuvumela ubunikazi beklayenti noma isitifiketi seseva ukuthi siphele isikhathi, futhi ngezinye izikhathi nesitifiketi esiphakathi inhlangano eyayikhohliwe ukuthi iyinaso.

Phrinta izinsuku zamafayela iphrofayela ewabhekisela ngempela, uqala ngelo elisekujuleni okushiwo Kuphutha.

openssl x509 -in client.crt -noout -subject -issuer -dates
openssl x509 -in ca.crt -noout -subject -dates

Uma iphrofayela ifaka izitifiketi njengamabhulokhi angaphakathi esikhundleni sokukhomba amafayela, amafayela ahlukene kudiski angaba madala noma amasha kunalokho okusetshenziswa yiklayenti, yikho ukufanisa iphutha nefayela kudinga ukufunda iphrofayela hhayi uhlu lwedirekhithori.

Vuselela ngomkhiphi

Isitifiketi seklayenti sithathelwa indawo yilowo esikhiphe, futhi ukusetha kabusha iphasiwedi ye-akhawunti akuvuseleli lutho. Ngokuxhumana komsebenzi, sebenzisa isiteshi sokuvuselela esishicilelwe yinhlangano yakho; ngensizakalo ebungazwe, ngena kuphothali yomhlinzeki ngokukhethekile ikheli eliqinisekisiwe esikhundleni sokuvula okunamathiselwe okuthi kuqukethe iphrofayela entsha. Ipaki engaceliwe ayithembekile ngenxa nje yokuthi igama layo lefayela likhuluma nge-VPN.

Uma uphatha iseva, hlola imininingwane yomphakathi namarekhodi okukhipha ngaphambi kokushintsha impahla, ngoba ukushintsha kwe-CA kuthinta wonke iklayenti elithembayo.

Ukuvuselela ubunikazi obubodwa akufanele kudinge ukushintshwa kwesigaba sokwethemba. Uma othile ephakamisa i-CA entsha ukuze alungise iqabunga elilodwa eliphelelwe isikhathi, buza kuqala ukuthi yini enye encike kwelidala. Imodeli elandelwa yizinhlangothi zombili RFC 5280 imikhawulo yokuvumeleka nendlela.

Yenza iklayenti lisebenzise okungena esikhundleni

Ukulanda ifayela akukona ukulingenisa. Hlola okufakiwe kuxhumano okuyikho ngempela okukhethayo, futhi uhlole ukuthi iphrofayela ibhekisela emikhondweni yezitifiketi yangaphandle oyikhohliwe ukuyibhala phezu kwayo.

Gcina okufakiwe okudala kubonakala kuze kuxhumane okusha, bese ukususa ukuze kimina umuntu angakhethi iphrofayela ephelelwe isikhathi ngomkhuba. Xhuma futhi uqinisekise ukuthi iphutha elithile lokuphelelwa yisikhathi selinyamalele.

Uma kusala elinye iphutha le-TLS, liphathe njengenkinga entsha esikhundleni sokunciphisa izilungiselelo zokuqinisekisa ukuze ulidlule. Ukwenqatshwa kwe-akhawunti noma umzila ongekho ngemuva kokuvuselela okuphumelelayo kuwukuhluleka okuhlukile okunesixazululo esihlukile.