Indlela i-OpenVPN exazulula ngayo isitifiketi nokhiye: i-PEM yangaphakathi noma indlela

Umlayezo uthi OpenVPN ayikwazi ukulayisha isitifiketi sangaphakathi, kanti igama lefayela elisemqondweni wakho lithi okunye. Lokho okwamukelwa umhlaziyi kubalulekile ukwedlula lokho okuqukethwe uhlelo lwamafayela, ngoba umyalelo we-cert wamukela izinhlobo ezimbili ezihluke ngokuphelele zenani. Enye iyindlela eyivulayo; enye umbhalo we-PEM owangena ngaphakathi kokumiswa. Kuze kube yilapho wazi ukuthi iqembu elisebenzayo lathola yiphi ifomu, konke ukulungisa kuwukuqagela.

Izinhlobo ezimbili zokugcina, umyalelo owodwa

Imithetho ye-cert, key ne-ca ngayinye yamukela indlela noma ibhlokhi yangaphakathi. Uma inani kuyindlela, i-OpenVPN ivula leyo fayela futhi ifunde into kudiski. Uma ukumiswa kuqukethe ibhlokhi elibekwe imingcele ngamathegi e-cert, umyalelo ofanayo usebenzisa esikhundleni salokho okuqukethwe phakathi kwalawa mathegi, futhi akukho fayela elihlukile elihilelekile.

Zombili izinhlobo zikhiqiza uhlobo olufanayo lwento ekugcineni, yingakho ukusetshenziswa okusebenzayo kungashintsha phakathi kwazo ngaphandle kolunye ushintsho. Iphrofayela ethwala isitifiketi sekhasimende nokhiye oyimfihlo kufakiwe ayidingi usizo lwangaphandle, futhi ukuyikopisha komunye umshini kuyasebenza ngaphandle kokuphinda ukopishe nendawo yezitifiketi.

Okuphambene akulona iqiniso. Ukubeka i-client.crt eduze kwephrofayela efaka idatha yayo siqu akushintshi lutho, ngoba akukho lutho ekumisweni okubhekisela kuleyo fayela. Lesi yisizathu esivame kakhulu sokuthi ifayela elikhona ngokusobala libonakale linganakwa.

Ibhulokhi yangaphakathi iba into kanjani

Okuqukethwe kwangaphakathi kukhishwa ekumisweni bese kunikezwa umhlaziyi we-PEM njengombhalo. Lowo mhlaziyi ulindele imingcele ejwayelekile: umugqa we-BEGIN, umthwalo we-base64 nomugqa we-END ohambisanayo. Uma ibhlokhi yanqunywa ukukopisha okuhlulekile, yagoqwa ku-HTML yikhasi lokulanda noma yavulwa kusihleli esenza amadashi abe sezingeni elifanayo, umhlaziyi uhluleka kokugqukethwe okubonakala kukhona.

<cert>
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
</cert>

Yingakho futhi amagama ephutha edukisa. Igama elithi yangaphakathi lichaza lapho umlayishi wabheka khona, hhayi lokho akuthola lapho. Ifayela eliqanjwe ekumisweni nento efakwe kulo kungakhiqiza isikhalo esifanayo lapho amabhayithi ayisisekelo engasebenziseki.

Hlola ukuthi iphrofayela elayishiwe lisebenzisa yiphi ifomu ngempela, hhayi ukuthi isiphi isifayela esivulwe yisihleli sakho ngengozi:

grep -nE '^(ca|cert|key) |^<(ca|cert|key)>' client.ovpn

Isithenjwa sendlela sixazululwa kanjani

Inani lendlela livulwa ngokuhlobene nendawo yokusebenza yekhasimende, hhayi indawo equkethe ukumiswa. Ngaphansi kwe-systemd leyo ndawo yokusebenza yilokho okubekwa iyunithi, futhi ukusebenza okusebenzisanayo okuvela ku-shell yakho kuzuza okunye ngokuphelele. Yingakho ifayela lokumiswa elifanayo lingasebenza uma ulihlola ngesandla bese lihluleka njengensizakalo.

Izindlela ezihlobene zizuza ukungacaci okufanayo. Uma ubona igama lefayela elingenalutho, buza ukuthi iyiphi indawo yamanje yohlelo lokusebenza endaweni yokukhiqiza esikhundleni sokucabanga ukuthi iyahambisana netheminali yakho.

Esitifiketini esigcinwe ngokwehlukile, ukuhlaziya ngaphandle kwe-inthanethi kuqinisekisa into ngaphambi kokuthi ulungise noma yini engaphezulu kwayo:

openssl x509 -in client.crt -noout -subject -issuer -dates
openssl pkey -in client.key -noout -check

Lemiyalelo ifakazela ukuthi amafayela ayafundeka futhi avumelekile ngokwesakhiwo. Ayifakazeli ukuthi uzakwethu uyethemba umkhiphi, ukuthi isitifiketi sisengaphakathi kwesikhathi saso sokusebenza, noma ukuthi ukhiye ungowaso.

Iphutha lomhlaziyi lingasho ini futhi lingasho ini

Ukwehluleka kokuhlaziya kubeka inkinga kokokufaka okukodwa nasesigabeni esisodwa. Akusho ukuthi ikhasimende lisebenzise yiphi kwezimbili izinhlobo zokugcina, futhi akusho ukuthi into yayizokwamukelwa. Lezo ziyimibuzo ehlukene enobufakazi obuhlukene.

Uma ukuhlaziya kuphumelela, ukwehluleka okulandelayo kungokwesigaba sakamuva. Ukunqatshwa kokwethemba, ukungafani kwenhloso noma ukungafani kokhiye kubikwa uzakwethu noma ungqimba lwe-TLS, hhayi umlayishi. Ukushintsha ifayela elifanayo kaningi ngeke kususe leyo phutha.

Gcina uhhafu obucayi ngaphandle kwemibiko yomphakathi ngenkathi uphenya. Yabelana ngamagama emiyalelo, umbhalo wephutha nokwakheka kwebhlokhi, kususwe impahla yokhiye nanoma yimuphi umthwalo okhonjayo. Incwadi ye-openvpn(8) ibhala zombili izinhlobo zemiyalelo yefayela nokuziphatha kwendawo yokusebenza engemuva kwayo.