OpenVPN verify-x509-name: subject, name ne-name-prefix
Uhlobo lokufanisa lunquma ukuthi yiliphi igama lesitifiketi eliqhathaniswayo. subject, name ne-name-prefix akuzona izinto ezilindelekile ezilinganayo, futhi okuzenzakalelayo yi-subject.
Qala ngokufunda uhlobo lokufanisa, bese kuba umbhalo: verify-x509-name umyalelo ungabonakala ulungile kodwa wamukele isitifiketi obungazimisele ukwethemba sona. Imigqa emibili enombhalo ofanayo olindelekile kodwa izinhlobo ezahlukene yizimfuno ezimbili ezahlukene. Qala ngokufunda uhlobo, bese kuba umbhalo. Thatha umyalelo njengesinye isimo esengeziwe kuxhumano, hhayi njengokuhlola konke.
Okushiwo ngempela yilokhu kukhetha
Umyalelo usho ubunikazi okufanele isitifiketi sohlangothi olunye sibe naso. Uma ukuqhathanisa kwehluleka, OpenVPN iyeka ukuxhawula futhi akukho thaneli eliphakamayo. Konke okunye kuphrofayela kusasebenza: isitifiketi kufanele sixhume ku-CA ethembekile futhi ukuhlolwa kwendima kufanele kudlule, ngakho lesi yisimo esengeziwe hhayi esikhundleni. Iphrofayela eyanelisa okulindelekile kwegama kodwa ehluleka ekuhlolweni kwendima isagcinwe iphukile, futhi ilogi ivamise ukusho lokho.
Ihluke futhi ekuhlolweni kwegama lomsingathi okwenziwa isiphequluli. Isiphequluli siqhathanisa amagama namagama angomunye we-subject ngokwemithetho yesitaki saso se-TLS, kuyilapho i-OpenVPN iqhathanisa inkambu eyodwa yesitifiketi nohlobo olukhethile. Yingakho ukunamathisela igama lomsingathi ngendlela yesiphequluli kumyalelo kungase kubangele ukungafani ngisho noma isitifiketi sihlanganisa isevisi ngempela.
subject: igama elihlukile eliphelele, uhlamvu ngohlamvu
Uma kungabhalwanga luhlobo, okuzenzakalelayo yi-subject, futhi inani elilindelekile kufanele likhiqize kabusha i-subject DN ephelele yesitifiketi. Ukulandelana kwezinkambu, izihlukanisi, izikhala ne-escaping konke kubalwa, ngoba ukuqhathanisa kuhamba kuphreyinti njengoba ifakwe ikhodi. Uma ushiya uhlobo, ukhethe okuqinile kakhulu kwezintathu zokuqhathanisa. Asikho isinyathelo sokulinganisa esingasindisa umehluko wokubukeka. Lokhu kufanele kwaziwe ngaphambi kokuvuselelwa kokuqala, hhayi ngemva.
Lokho kuqina kubuthakathaka phakathi kokuvuselelwa. I-CA ehlela kabusha izimfanelo, efaka inkambu eyengeziwe noma eshintsha indlela eye yenza escaping yanani ikhiqiza ucingo olusha kumshini ofanayo, futhi umyalelo obesebenza iminyaka uqala ukwehluleka ekukhishweni okulandelayo. Ukugcina i-DN eyamukelwe kurekhodi lezinguquko kwenza ukuvuselelwa okulandelayo kube umehluko. Lapho umqhubi eshicilela i-DN ephelele futhi eqinisekisa ukuma kwayo, i-subject iyisinqumo esinengqondo; kwezinye izindawo inkambu encane kulula ukuyigcina iyiqiniso.
name: inkambu eyodwa, ngokuvamile igama elijwayelekile
Uhlobo name luqhathanisa inkambu eyodwa ye-subject. Ngaphandle uma iphrofayela isho okunye, leyo nkambu yigama elijwayelekile, futhi inani elilindelekile iyona leyo nkambu ngqo, hhayi i-DN eyizungezile.
Umgibe wukuthi izitifiketi zesimanje azihlali zifaka igama lesevisi ku-CN. Eziningi ziligcina egameni elingomunye we-subject futhi zishiya i-CN ingenalutho noma ijwayelekile, ngakho isitifiketi esamukelwa isiphequluli singase sehluleke kulokhu kuqhathanisa. Hlola isitifiketi owanikwa sona ngempela ngaphambi kokubhala okulindelekile, futhi uqinisekise ukuthi iyiphi inkambu ekuqoka iphrofayela. I-CN engenalutho eqhathaniswa negama ukungafani, hhayi ingozi yokuhlela.
name-prefix: ibanzi ngokwakhiwa, ngakho khawulela ububanzi
Okulindelekile kohlobo name-prefix kuhambisana nokuqala kwenkambu ekhethiwe. Lokho kulula kuhlelo lokwenza amagama futhi kuyingozi kunoma yini eyabiwayo.
Uma okulindelekile kuyi-vpn.example , kokubili vpn.example.com kanye vpn.example.net kuzodlula, inqobo nje uma uchungechunge olusele luthembekile. Ububanzi yisici, futhi futhi yingxenye okufanele isekelwe ngokubhaliwe. Isiqalo siyisinqumo esinengqondo uma i-CA nohlelo lwamagama kungolwakho, futhi kubuthakathaka kakhulu uma i-CA yomphakathi ikhipha ngendlela efanayo. Uma uhlelo ludinga ukuguquguquka, lukhawulele ku-CA esikhundleni sokwandisa ukuhlolwa kweklayenti.
Khetha uhlobo kusukela kumhlonzi, bese ubuqinisekisa
Sebenza ubuyela emuva kusukela kubunikazi obuhloswe ngumqhubi. Uma eshicilela i-DN ephelele futhi eyigcina izinzile, subject lokho kuyakubeka. Uma eqamba isevisi ngegama elijwayelekile, sebenzisa name . Uma ephethe uhlelo lwamagama futhi amukela isikhala saso sonke, name-prefix lokho kukusho ngokucacile.
Ukuvuselelwa yikhona lapho umyalelo uvivinywa khona. Qhathanisa ubunikazi obugunyaziwe nesitifiketi esisha hhayi nefayela elidala, ngoba ikheli elisha lokugcina alisho ubunikazi obusha besitifiketi. Ungasusi umyalelo ngoba nje ikheli elijwayelekile liyaphendula: ukufinyeleleka kanye nohlangothi olunye oluhloswe yizinto ezimbili ezahlukene , futhi ikheli lifakaza kuphela ukuthi kukhona okuphendulile. Rekhoda iphutha eliqondile kanye nemininingwane yegama yomphakathi kumbiko ohlanjululwe, ngoba ukungafani kwegama kungaboniswa ngaphandle kwanoma yiziphi izinto zokhiye wangasese.
Ngemva kokulungiswa okusekelwayo, xhuma futhi ngakho konke ukuhlola okuhloswe kuvuliwe futhi uqinisekise insiza oyidinga ngempela. Impumelelo isho ukuthi iseva ehlosiwe yamukelwa, hhayi ukuthi isitifiketi esithile saphogwa ukuba sidlule. Incwadi yomhlahlandlela esemthethweni OpenVPN 2.6 manual ibhala izinhlobo ezintathu kanye namanothi azo okwethemba, futhi iyisihloko esicashunwayo uma isixhumanisi somthengisi singavumelani nephrofayela.