Ukungena okusha kwe-VPN kuyahluleka ngenkathi izitifiketi zisebenza: hlola i-CRL

Izitifiketi ezisele izinyanga kanye nokungena okuhluleka ngokushesha kukhomba izinto ezimbili ezihlukene ezinamawashi amabili ahlukene. Iseva yenqaba ukuxhumana ngoba uhlu lwamasisitifiketi akhanseliwe elusebenzisa seludlule usuku lwaso lokuphela, hhayi ngoba izitifiketi zabasebenzisi zigugile. Ukuvuselela isitifiketi somsebenzisi akusizi lutho kulolo hlu.

Ukwehlukanisa lezi zinhlelo ezimbili zokugcina isikhathi ukuxilonga konke, futhi kushintsha ukuthi ukulungiswa kufanele kube kanjani.

Amawashi amabili, futhi lilodwa kuphela kuwo okuyisitifiketi

Isitifiketi siphethe isikhathi sokusebenza. Uhlu lokukhansela izitifiketi luphethe isikhathi salo, kanye nomkhiphi nesiginesha, futhi abahloli benqaba ukuthemba uhlu isikhathi salo sokulandelayo sokubuyekeza esedlulile. Lapho lokho kwenzeka, iklayenti lethula isitifiketi esisebenza ngokuphelele kodwa iseva isanqamula ukuxhumana ngomlayezo ophathelene nohlu. Abasebenzisi bafunda lowo mlayezo ngokuthi 'isitifiketi siphelelwe yisikhathi', okuthumela isicelo sokuvuselela endaweni engalungile.

Lezi zinto ezimbili zibuye zibe nabanikazi abahlukene: isitifiketi sivela ku-CA eyasikhipha, kanti uhlu lukhiqizwa ngohlelo ngumuntu osebenzisa leyo CA. Umsebenzisi akakwazi ukuluvuselela, futhi ukukhipha kabusha izitifiketi akukwazi ukulwandisa.

Funda uhlu isevisi elulayisha ngempela

Qala kusimo sokusebenza esikhona, hhayi kufayela olilindele. Indlela ye-crl-verify ingaba ngokuphelele, ngokuhlobene nephrofayela, noma ikhophi efakwe esithombeni, futhi umhloli ufunda leyo khophi. Yihlole endaweni yayo nge-openssl crl -in /etc/openvpn/crl.pem -noout -issuer -lastupdate -nextupdate bese uqhathanisa izinsuku newashi leseva.

Bese uqinisekisa ukuthi ifayela liwukuthi elisetshenziswayo ngempela: hlola isiginesha yalo nge-openssl crl -in /etc/openvpn/crl.pem -CAfile /etc/openvpn/ca.crt -noout, okubika umphumela wokuhlola esikhundleni sokuphrinta izinkambu buthule. Uhlu olusayinwe enye i-CA, noma ikhophi endala esele kwisikhombisi sesibili, luhluleka ngendlela efanayo nohlu oluphelelwe yisikhathi.

Khiqiza kabusha kusizindalwazi sokukhansela, hhayi kusukela ekuqaleni

Uhlu olusha kufanele luvele kusizindalwazi sokukhansela samanje se-CA, ngohlelo olugunyaziwe lokusayina. Ukukhiqiza uhlu olungenalutho, noma ukukhiqiza kabusha kusuka kukhophi yasemuva endala yenkomba, kususa buthule ukukhansela kwabo bonke ubunikazi obengezwe kusukela kuleyo khophi. Lokho kuguqula ukuphazamiseka kokungena kube ukuhlehla kwezokuphepha, futhi akekho okuqaphelayo ngoba uphawu luyanyamalala.

Gcina isinyathelo sokukhiqiza ekulawulweni kwenguqulo kanye namanye amathuluzi e-CA, ukuze isikhathi nokhiye wokusayina kubhalwe phansi hhayi ukukhunjulwa. Umugqa encwadini yokusebenza oveza umyalo, umsayini kanye nomgomo wokushicilela wanele. Noma ubani osemsebenzini angakhiqiza kabusha ngaphandle kokuqagela ukuthi iyiphi ifayela lenkomba elinegunya. Gcina inombolo yochungechunge yohlu kanye nesikhathi sokubuyekeza okulandelayo kanye nerekhodi lokusatshalaliswa.

Satshalalisa lapho umhloli ebheka khona

Kopisha uhlu olusha endleleni isevisi eyifundayo, setha ubunikazi nemodi ukuze i-akhawunti yesevisi ikwazi ukulufunda kodwa abanye bangakwazi, bese ululayisha kabusha noma uqala kabusha ngokwendlela ebhaliwe yokuziphatha. Uma isevisi yangemuva igcina uhlu emkhathini wesikhashana lapho iqala, ukushintsha ifayela ngaphandle kokulayisha kabusha akukushintshi lutho inqubo esebenzayo engakubonayo. Qinisekisa isigxivizo sesikhathi inqubo esikubikayo ngemva kokulayisha kabusha.

Uma izevisi eziningi zihlola amaklayenti, satshalalisa kuyo yonke. Ukubuyekeza indawo eyodwa bese ushiya enye nekhophi endala kukhiqiza ukwehluleka okuvela kuphela kubasebenzisi abafika kwesibili. Gcina uhlu olufushane lwalezo zindawo encwadini yokusebenza efanayo. Ngemva kokusatshalaliswa, hlola usuku lohlu olubikwa yilowo nalowo hhayi ukucabanga ukuthi ikhophi ifikile.

Yenza umnqamulajuqu olandelayo ubonakale ngaphambi kokuba udlule

Isikhathi eside sokushicilela sehlisa imvamisa yalesi sigameko ngaphandle kokwakha inqubo. Khetha isikhathi kusuka kunqubomgomo yomqhubi, bese usetha isexwayiso enkambini yokubuyekeza okulandelayo yohlu olusatshalalisiwe ngesikhathi esanele sokuqala sokukhiqiza kabusha nokusatshalalisa. Xwayisa ngekhophi esatshalalisiwe, hhayi kusiseva se-CA, ngoba ikhophi esatshalalisiwe iyona ehlulekayo.

Ngemva kokusatshalaliswa, qinisekisa izinhlangothi zombili: umsebenzisi ovunyelwe uyaxhuma, futhi ubunikazi obukhanseliwe obaziwayo busahluleka. Ukuhlola kwesibili yikho okubamba ukukhiqizwa kabusha okungaphelele, futhi kudinga umyalo owodwa ngokumelene nephrofayela yokuhlola oyigcina ngqo yile njongo.