PKCS12, PEM noma DER: Ikliyenti ye-VPN idinga ini ngempela
Ukupakisha kunquma ukuthi ikliyenti yakho ingangenisa ubunikazi, hhayi ukuthi buthembekile. Qhathanisa i-PKCS12, PEM ne-DER, bese uqinisekisa.
Imibono emibili ijikelezayo ezingxoxweni zezitifiketi. Eyokuqala ukuthi i-.p12 iyisinqumo esiqinile kanti i-.pem iyinto exegayo; eyesibili ukuthi ifayela lombhalo kufanele liphephe ukuthunyelwa ngoba ungakwazi ukulifunda. Akukho kukho kokubili okumelana nomzuzu wokuhlola.
I-PKCS12, PEM ne-DER zichaza ukuthi izinto zesitifiketi zipakishwa futhi zifakwa kukhodi kanjani. Azinqumi ukuthi ubani ohlangothini olunye, ukuthi umkhiphi uthembekile yini, noma ukuthi ifayela lidinga iphasiwedi yini.
Lokho ikliyenti elikwamukelayo kuwumbuzo wokuhambisana. Lokho okusefayeleni kuwumbuzo wobunikazi. Hlukanisa lezi ezimbili, futhi iningi lamaphutha okungenisa liyophela ukuba yimfihlakalo.
Amabhokisi amathathu, imodeli eyodwa yezinto
Qala ngalokho onakho ngempela. Isitifiketi siyisitatimende esisayiniwe mayelana nokhiye womphakathi. Ukhiye wangasese uyinto ehlukile ebonisa ukuthi ulawula lowo khiye. Uchungechunge iqoqo labakhiphi abaxhumanisa isitifiketi sakho nempande ekliyenti ethembayo. Zontathu zikhona kungakhathalekile ukupakisha.
Ifayela le-PKCS12, ngokuvamile i-.p12 noma i-.pfx, iyibhokisi elichazwe ku-RFC 7292 elingathwala ukhiye wangasese, isitifiketi esisodwa noma ngaphezulu kanye nochungechunge kubhloki eyodwa evikelwe ngephasiwedi, nenegama elihlukile elibiza ubunikazi. Ifayela le-PEM liwuhlaka lombhalo oluchazwe ku-RFC 7468: umzimba we-base64 phakathi kwemigqa ye-BEGIN ne-END, futhi ifayela elilodwa lingagcina amabhulokhi amaningi ngokulandelana. I-DER iwukufakwa kukhodi kanambambili kwalezo zakhiwo ze-ASN.1, futhi umzimba we-PEM uwu-DER ngempela ogoqwe nge-base64.
Umshwana wokugcina yiwo ofanele ukhunjulwe. Ukuguqula i-PEM ibe yi-DER kubhala kabusha ukugoqa, hhayi okuqukethwe, futhi ukuguqula emuva kubuyisa amabhayithi okuqala.
| Container | Can hold | Does not decide |
|---|---|---|
| PKCS12 (.p12, .pfx) | Key, leaf certificate, chain, alias, password | Which root the client trusts |
| PEM (.pem, .crt, .cer) | Any number of base64 blocks | Whether the private key is present |
| DER (.der, .cer) | One binary structure | The object type, whatever the extension says |
Ukufaka kukhodi akulona ukubethela
I-Base64 iyizinhlamvu zokuthutha. Ayifihli lutho, futhi noma ubani angakwazi ukukhipha ikhodi yebhulokhi ye-PEM ku-shell. Ifayela le-DER linambambili futhi lisobala ngokulinganayo. Azikho lezi zimilo ezimbili eziyisivikelo, futhi azikho ezibonisa ukuthi ikhona iphasiwedi.
Isivikelo sangempela sisezintweni zokhiye. Ibhokisi le-PKCS12 lingabethela okuqukethwe kwalo ngokhiye otholakala kwiphasiwedi. Ukhiye wangasese we-PEM ungabethelwa ngebhulokhi yesihloko sakudala noma ugcinwe ngaphakathi kwe-PKCS#8 EncryptedPrivateKeyInfo. Isitifiketi sisodwa asinalutho oluyimfihlo, yingakho ukuthunyelwa ngaphandle okukhiphe isitifiketi kuphela kushiya ikliyenti lingakwazi ukufakazela ubunikazi, noma ngabe ulugoqa ngaluphi uhlobo.
Isandiso siyisikhombisi, akusona isivumelwano. Amafayela aphela nge-.cer nange-.crt avela kuzo zombili izinhlobo zokufaka kukhodi, futhi amadivayisi akhipha izitifiketi ze-DER ngaphansi kwamagama e-.pem kaningi kangangokuthi ukuqagela ngesijobelelo kudla intambama yonke. Funda amabhayithi okuqala esikhundleni salokho: ifayela le-PEM livula ngomugqa we-BEGIN, kanti i-DER iqala nge-0x30 ngoba isakhiwo sangaphandle yi-SEQUENCE.
Kungani ukungenisa kuhluleka ngempela
Imilayezo yephutha yekliyenti ihlanganisa izinkinga eziningana ezihlukene emshwaneni owodwa mayelana nesitifiketi esingavumelekile, ngakho zihlukanise ngesizathu. Evame kakhulu ukungafani kokufaka kukhodi: ikliyenti ehlaziya i-PEM ibuyisa iphutha lokuhlaziya kufayela le-DER, futhi isisombululo ukuguqula hhayi isitifiketi esisha. Eyesibili ukhiye ongekho, lapho isitifiketi silungile kodwa ubunikazi bungafakazelwa. Eyesithathu uchungechunge, lapho ibhokisi elingenaso isiphakathi libonakala lilungile embonini yokungenisa kodwa lihluleka ngesikhathi sokuxhawula.
Amapharamitha okubethela adala eyesine, futhi ibonakala ifana ncamashi nephasiwedi engalungile. Amadivayisi amadala akhipha amafayela e-PKCS12 nge-RC2-40 ne-3DES, i-OpenSSL 3 ewalahlayo ngaphandle kokuthi kufakwe umhlinzeki wakudala. Ukukhipha kabusha kudivayisi nge-AES-256-CBC ne-PBKDF2 yisisombululo esihlala njalo. Ukushiya amacipher akudala evuliwe unomphela kumshini wekliyenti ukuze kuhlangabezane nefayela elilodwa kuwukushintshana okubi.
Eyesihlanu ukungacaci. Ibhokisi eliqukethe okhiye ababili nezitifiketi ezimbili, noma ifayela le-PEM elinamabhulokhi amathathu e-CERTIFICATE, liphoqa ikliyenti ukuthi likhethe, futhi ukukhetha kwalo kuvame ukuba yinto yokuqala. Lapho ithenele liphuma nobunikazi obungalungile, leso ngokuvamile isizathu.
Hlola ngaphambi kokuguqula
Funda isakhiwo ngaphandle kokuphrinta izimfihlo. openssl pkcs12 -in bundle.p12 -info -noout ibika ama-algorithms okubethela namagama ahlukile ngenkathi ivimba ukuphuma kokhiye nesitifiketi, futhi incwadi ye-openssl-pkcs12 ibhala amafulegi. Ukususa i-noout nokwengeza i-nodes kwenzelwa ukukhiqiza amafayela ohlose ukuwagcina, hhayi ukubuka ngokushesha, ngoba kubhala ukhiye wangasese obala.
Kusitifiketi, openssl x509 -in cert.pem -noout -subject -issuer -dates iphendula lokho imboni yokungenisa engakuphenduli, futhi ukwengeza -ext subjectAltName kukhombisa amagama isitifiketi esivumelekile ngawo ngempela. Uma ifayela liyi-DER, engeza -inform DER; lelo fulegi elilodwa lixazulula iningi lamaphutha okungakwazi ukulayisha.
Ukuqhathanisa ukhiye nesitifiketi kungumsebenzi womshini, futhi kufanelekile ukwenziwa ngaphambi kwanoma yikuphi ukungenisa:
openssl x509 -in cert.pem -noout -pubkey | openssl sha256openssl pkey -in key.pem -pubout | openssl sha256
Ama-digest afanayo asho ukuthi laba ababili bangabanye. Ama-digest ahlukene asho ukuthi unokhiye ongalungile, futhi akukho nani kokuguqula ifomethi okungakushintsha lokho.
Lokho ifomethi engakushintshi neze
Izinqumo zokuthemba zenzeka ngaphezu kwebhokisi. Ikliyenti ihamba ngachungechunge iye empandeni esitolo sayo, ihlola isikhathi sokusebenza, ihlola ukusetshenziswa kokhiye okunwetshiwe kokufakazela ubunikazi bekliyenti, futhi ohlangothini lweseva ihlola ukuthi igama elishayiwe livela esitifiketini. Awekho kulezi zinyathelo afunda isandiso sefayela.
Yingakho ukuqamba kabusha ifayela kuze kunyamalale iphutha kuyindlela ethembekile yokulahlekelwa isikhathi. Ukungenisa kuyaphumelela, ubunikazi busengalungile, futhi ukwehluleka kubonakala futhi ngesikhathi sokuxhawula lapho umlayezo ungasizi kakhulu. Yingakho futhi ibhokisi elakhiphwa eminyakeni emibili edlule lingena kahle futhi lisalahlwa: usuku lokuphelelwa lwalugibela ngaphakathi kwesitifiketi, hhayi egameni lefayela.
Ukulandelana okugwema ukusebenza kabusha
Buza imibhalo yekliyenti ukuthi yiziphi izinhlobo zokufaka kukhodi eziyamukelayo nokuthi iliphi ibhokisi elilindelelwe kubunikazi bekliyenti, bese ubheka lokho okunikeziwe. Uma ikliyenti ifuna ubunikazi obulodwa obungenisekayo futhi unamafayela e-PEM ahlukene, yakha ibhokisi kanye ngephasiwedi oyilawulayo futhi ugcine imithombo. Uma ifuna i-PEM, khipha ukhiye nochungechunge, bese ususa amafayela aphakathi ngemuva kwalokho ngenqubo yokuphatha ubufakazi eyasetshenziswa yithimba lakho.
Ngemuva kokungenisa, qinisekisa ubunikazi hhayi imboni: isihloko, umkhiphi, ukuphelelwa, kanye negama ikliyenti ezoliveza. Igama elingokuzwana ohlwini liyilebula, akusona ubunikazi obuqinisekisiwe. Uma ithenele lihluleka ngemuva kwalokho, ulungisa ukufakazela ubunikazi noma ukuhlela izindlela hhayi ukupakisha, futhi leyo ingxoxo imfushane kakhulu.