Iphrofayela ye-OpenVPN inamabhulokhi amathathu wesitifiketi: iyiphi eyimfihlo?

Uvula ifayela le-.ovpn ukuze ushintshe umugqa owodwa bese uthola amabhulokhi amathathu e-base64 abukeka wonke njengemininingwane yokungena. Elilodwa liphephile ukulishicilela, elinye libucayi njengephasiwedi, futhi elinye iwukhiye osesidlangalaleni ongenantshisekelo ngaphandle uma okunye kusayinwe ngokubhangqa kwawo. Abantu banamathisela lonke ifayela emucu wokusekela ngoba amabhulokhi abukeka eshintshana, futhi yilapho ukhiye wekhasimende ugcina esekhona kungobo yomlando yomphakathi. Ukwehlukanisa ukuthi yiliphi ibhulokhi elenzani kuchaza iningi lokudideka mayelana nalezi ziphrofayela, futhi kukutshela nokuthi yikuphi ukwehluleka okufanele ukulungise wena.

Ifayela elilodwa, amabhulokhi amathathu, imisebenzi ehlukene

Iphrofayela evamile ifaka ibhulokhi le-ca, ibhulokhi le-cert nebhulokhi le-key phakathi kwezimpawu ze-BEGIN ne-END, noma ikhomba kulawo mathathu njengamafayela ahlukene. Amanye amaphrofayela engeza ibhulokhi lesine lokhiye we-tls-auth noma we-tls-crypt, okuyimfihlo eyabiwe hhayi isitifiketi. Ikhasimende lifunda ibhulokhi ngalinye ngokomyalelo elilibiza ngalo, ngakho amalebula abaluleke kakhulu kunokulandelana abonakala ngakho.

Thatha iphrofayela elihlanganisiwe njengelibucayi uze ulibheke ngempela ngaphakathi. Isitifiketi esisesidlangalaleni nokhiye oyimfihlo kungaba semigqeni embalwa uma komunye kwifayela elilodwa, futhi isithombe sesikrini esihlanganisa isihloko singafaka kokubili. Ukusibekela ngesandla i-base64 ebonakalayo nakho akuthembekile, ngoba ibhulokhi elingaphelele lisaphuza imininingwane yesitifiketi ebiza ukusetshenziswa kwakho. Ukukopisha imiyalelo emithathu ngaphandle kwamanani ayo ngokuvamile kwanele ukubuza umbuzo owusizo.

Imiyalelo ezungeze amabhulokhi inquma ukuthi asetshenziswa kanjani. Shintsha i-ca bese ikhasimende lithemba esinye isiphathimandla; shintsha i-cert ngaphandle kokushintsha i-key bese ukuxhawulana kwehluleka ngokungafani okungenasihlobo nokwethenjwa.

Ibhulokhi le-CA lisesidlangalaleni, ukhiye we-CA awusoze waba njalo

Isiphathimandla sezitifiketi sisayina izitifiketi ezihlanganisa ukhiye osesidlangalaleni nobuwena, futhi isitifiketi saso siyinsika ikhasimende elisebenzisayo ukunquma ukuthi uchungechunge luthembekile yini. Leso sitifiketi sisesidlangalaleni ngokwakhiwa: ukusithumela ngaphakathi kwephrofayela ngalinye kuvamile, futhi yingakho ukusetshenziswa okuzisayinile kungasebenza ngaphandle kwesiphathimandla sezentengiselwano.

Okungafanele kuvele neze kuphrofayela yekhasimende ukhiye wokusayina oyimfihlo wesiphathimandla. Ikhasimende aliwudingi ukuze kuqinisekiswe noma yini, futhi ukuba khona kwawo kusho ukuthi noma ubani onephrofayela angakha ubuwena obusha bakho konke ukusetshenziswa.

Ukwethemba isiphathimandla nakho kuncane kunalokho okuzwakalayo. Ikhasimende elamukela noma isiphi isitifiketi esisayinwe i-CA lizokwamukela isitifiketi esikhishwe komunye umsebenzi kuleyo CA. Izinketho ezibophela indima noma igama leseva elilindelekile zivala lelo gebe, futhi Isikhombo sezinketho ze-TLS sibala imiyalelo yokuqinisekisa eyenza lokho.

Izitifiketi zesiva nekhasimende zikhomba ezinhlangothini eziphambene

Isitifiketi sesiva yilokho ikhasimende elikuhlolayo ukuze siqinisekise ukuthi sifinyelele indawo yokugcina efanele. Isitifiketi sakho sekhasimende sihamba ngakolunye uhlangothi: iseva siyasebenzisa ukunquma ukuthi le divayisi noma lo msebenzisi ungenye yezinto ezibhalisiwe zayo. Ifomethi efanayo, uhlangothi lokwethenjwa oluphambene.

Ikheli akulona ubuwena. Ukufinyelela ku-IP efanele akufakazi lutho mayelana nokuthi ngubani ophendulile, ngakho ukuhlolwa kwegama lomsingathi noma kwegama lesitifiketi kusengokwephrofayela. Iphasiwedi ye-akhawunti nayo ayithathi indawo yesitifiketi sekhasimende esidingekayo ngokuthula, ngoba kokubili kuhlolwa ezigabeni ezahlukene futhi ukusetshenziswa kungadinga kokubili.

Ukhiye oyimfihlo wekhasimende uyingxenye okufanele ihlale iyimfihlo. Uma kungenzeka ukuthi yembulwa, ukususa ifayela ku-laptop yakho akushintshi lutho kuseva, ezoqhubeka yamukela isitifiketi esihambisanayo kuze kube yilapho umsebenzisi wayo eyihoxisa. Ukucela umsebenzisi ukuthi ashintshe noma ahoxise lobo buwena iwukuphela kwesisombululo esihamba nawe.

Izicelo ezimbili ezibukeka zifana futhi zingafani

Ukhiye ogcinwe ngendlela ebethelwe ucela umusho oyimfihlo ngaphambi kokuba ikhasimende uwusebenzise. Isevisi ye-VPN ingase icele iphasiwedi ye-akhawunti ngokwehlukana, futhi izicelo zombili zingavela ngokwehlukana kwemizuzwana ngamagama acishe afane. Umusho uvikela ifayela kudiski yakho; iphasiwedi ifakazela i-akhawunti kuseva. Ukudidanisa kokubili kuthumela abantu ekusethweni kabusha kwephasiwedi okungenakusiza nakancane.

Funda isicelo ngaphambi kokusetha kabusha noma yini. Ukusetha kabusha iphasiwedi ye-akhawunti akusizi lutho kumusho wekhiye okhohliwe, isitifiketi esihoxisiwe noma esiphelelwe isikhathi, futhi ukusetha kabusha iphasiwedi lapho ukwehluleka kuwukuqinisekisa isitifiketi kuguqula ukulungisa kwemizuzu emibili kube yicala lokusekela. Uma isikhalazo sisho izinsuku zokuqinisekisa, hlola iwashi ledivayisi kuqala bese kuba isikhathi sesitifiketi esishiwo.

Lapho isitifiketi siphelelwe isikhathi ngempela, okubuyisela kufanele kuvele kulowo osikhishele. Ukhiye womunye umuntu awuyona indlela yokuvuselela, futhi nokuboleka iphrofayela esebenzayo kumuntu osebenza naye akusiyo.

Yini efakazelwa ukuxhawulana okuhlanzekile nokungafakazelwa

Ukufinyelela ekuxhawulaneni kwe-TLS okuqediwe kusho ukuthi ubudlelwano bobuwena obulungisiwe buqhubekile: isitifiketi sesiva sahlanganiswa ne-CA yakho futhi isitifiketi sakho samukelwa. Lokho akusho lutho mayelana nenqubomgomo yokuloga yomsebenzisi, futhi akusho nokuthi izinhlelo zakho zizosebenza uma umhubhe usukhweziwe.

Imizila ne-DNS ziyizigaba zakamuva zokuxhumana, ngakho umsingathi we-intranet ongafinyeleleki ngemuva kokungena ngempumelelo inkinga yokuxhumana hhayi yesitifiketi. Sebenza kuleyo ngqimba esikhundleni sokushintsha imininingwane yokungena, futhi gcina ndawonye umsuka wephrofayela, izinto zayo eziyimfihlo nokuhlolwa kwayo kobuwena uma uyinikeza othile.