Ikhophi yokusekela ye-CA yangasese: i-archive ebhalisiwe noma ikhophi yokhiye ye-HSM

Umbuzo onquma ingxenye enkulu yalokhu awuwona ukuthi ubhala kanjani i-archive ngemfihlo. Uwukuthi ukhiye wakho oyimfihlo we-CA ungaphuma yini esitsheni sawo. Uma ukhiye uyifayela, ungakopisha yonke incwadi ye-CA kublob eyodwa ebhalisiwe futhi uqede ngemizuzu. Uma uhlala ku-HSM noma kutokheni ekhomba ukhiye njengongakhipheki, leyo khophi ayikho, futhi uhlelo lwakho luphenduka uhlelo olumayelana nenqubo yokugoqa nokubuyisela yomhlinzeki. Zombili izimodeli ziyasebenza, zihluleka ngendlela ehlukile, futhi ukwehluleka ongakusinda yikho okufanele kwakhiwe izinto zokuhlela zikho.

Lapho izimodeli ezimbili zekhophi yokusekela zihlukana khona

Imodeli A iyikhophi yencwadi. I-CA yesitayela se-OpenSSL iyincwadi yokusebenza, hhayi isitifiketi esisodwa: ca.key noma cakey.pem, ca.crt, isizindalwazi sokukhipha, izibali ze-serial ne-crlnumber, kanye ne-openssl.cnf. Vala leyo ncwadi ngesifiri esilinganayo, hambisa umphumela uye kwisithwali sesibili, futhi ukubuyisela kusho ukuvula, ukuqinisekisa, ukusayina. Konke okudingwa umkhiphi kuhamba ndawonye, kuhlanganise amasonto omlando wokuhoxiswa okungekho muntu okhumbulayo ukuthi wawubhala.

Imodeli B ukuvinjwa kokhiye. Ukhiye udalwa ngaphakathi kwemodyuli ye-PKCS#11 futhi umakwa njengongakhipheki; imodyuli ingawugoqa ukuze kube nekhophi yokusekela, kodwa akukho nqubo efunda amabhayithi aluhlaza. Ikhophi yakho yokusekela-ke izinto ezimbili okufanele zibuyiselwe ngokulandelana okufanele: iblob yokhiye eqoshiwe okungavulwa kuphela umndeni waleyo modyuli, kanye nekhophi evamile yesizindalwazi, ukuhleleka kanye nezitifiketi.

Ukuqhathanisa akukaze kumayelana nokuthi iyiphi imodeli enamandla kakhulu ngokomqondo. Kumayelana nokuthi iyiphi iqembu lakho elingayibuyisela ngu-2 ebusuku kanye nabantu abaphapheme ngempela. I-archive okungekho muntu ongayivula kanye neblob ye-HSM okungekho muntu oyihlolile zombili azilutho ngokufanayo. Umehluko ukuthi ukwehluleka kwe-archive kuvela kumphathi wamagama ayimfihlo, futhi ukwehluleka kwe-HSM kucasha esivumelwaneni sokulondoloza.

Okufanele kube nakho yonke ikhophi yokusekela ye-CA

Zombili izimodeli zidinga isethi efanayo yamarekhodi. Ku-CA ye-OpenSSL lawo mafayela yi-index.txt enomugqa owodwa wesitifiketi ngasinye esikhishiwe ohlanganisa isimo, ukuphelelwa, i-serial nesihloko, bese kuba yi-index.txt.attr, i-serial egcina i-serial elandelayo ezokhishwa, i-crlnumber egcina inombolo elandelayo ye-CRL, kanye ne-openssl.cnf ene-dir, i-policy kanye ne-default_days i-CA yakho esebenza nazo ngempela. Incwadi ye-openssl-ca ichaza ukuthi isibali ngasinye kulawa silawula ini. I-easy-rsa igcina idatha efanayo ngaphansi kwe-pki/, kanti ifayela le-vars linquma izinkambu zesitifiketi.

Ukhiye nesitifiketi yizingxenye ongakwazi ukuzakha kabusha. Isizindalwazi siyingxenye ongakwazi ukuyenza kabusha ngokukhumbula. Ukweqa i-index.txt kusakushiya ukwazi ukusayina izitifiketi ezintsha, futhi yilokho kanye ugibe: uthola ukuthi ayikho okokuqala lapho iklayenti libuza khona ukuthi isitifiketi sahoxiswa yini. Rekhoda umnyonselo we-CA ngaphandle kwekhophi yokusekela, ukuze ukubuyisela kuqhathaniswe nenani omethembayo hhayi nefayela osanda kulibuyisela.

openssl x509 -in ca.crt -noout -fingerprint -sha256
tar czf ca-state.tar.gz ca.crt ca.key index.txt* serial* crlnumber* openssl.cnf
openssl enc -aes-256-cbc -pbkdf2 -iter 200000 -salt -in ca-state.tar.gz -out ca-state.tar.gz.enc
openssl ca -config openssl.cnf -gencrl -out crl.pem

Izivivinyo zokubuyisela ezingahlukanisi umkhiphi

Ama-CA amabili aphilayo anesihloko esifanayo nokhiye ofanayo abonakala efana kuwo wonke amaklayenti athemba owokuqala. Ama-CRL amabili anenombolo efanayo kodwa okuqukethwe okuhlukile yindlela amaklayenti amukela ngayo buthule isitifiketi osihoxisile. Gijimisa ukubuyisela kusibungu esingenayo indlela eya kumaklayenti akho, noma ku-VM yokusebenzisa kanye, futhi ungaze ushicilele i-CRL ekhiqizwa yisivivinyo.

Isivivinyo esibonisa kuphela ukuthi i-archive iyavuleka asibonisi lutho mayelana nokukhishwa. Ukulandelana okubalulekile: qhathanisa umnyonselo we-ca.crt ebuyisiwe nenani olirekhodile, qinisekisa ukuthi i-serial ihambisana nalokho okushiwo yisitifiketi sakho sokugcina esikhishiwe, khipha isitifiketi esisodwa se-CN yokusebenzisa kanye bese ubuka i-index.txt ithola umugqa, bese uhoxisa leso sitifiketi futhi ukhiqize kabusha i-CRL.

openssl verify -CAfile ca.crt -CRLfile crl.pem -crl_check client.crt
openssl crl -in crl.pem -noout -lastupdate -nextupdate

Nge-HSM isivivinyo esifanayo sidlula emodyulini. Vula iblob kudivayisi yokushintsha, qinisekisa ukuthi isitifiketi se-CA esibikwa imodyuli sihambisana nomnyonselo wakho orekhodiwe, bese kube yilapho kuphela uvumela ukuthi sisayine. Uma imodyuli inesitolo sayo sezinto, ukugoqa kufanele kuhlanganise into yokhiye kanye nelebula yayo, ngoba ukubuyisela ukhiye ngaphansi kwelebula ehlukile kuphula ukuhleleka okukhomba kuwo.

Izimo zokwehluleka ezinquma ukukhetha

Ukwehluleka okuhlanu kuchaza iningi lokulahlekelwa kwangempela. Iphasiwedi ye-archive ekhohliwe ngaphandle kwekhophi ezimele yemfihlo yenza i-archive ibe yisitini. Ikhophi eyodwa kudiski elilodwa ifa ngalelo diski, futhi i-checksum ayikaze ikutshele ukuthi ukususa ukubhalisa kusasebenza yini. Izitifiketi ezihoxiswe ngemva kosuku lwekhophi yokusekela zibonakala zivumelekile futhi ngemva kokubuyisela, ngakho isikhathi sakho sekhophi yokusekela siyindawo yakho eyimpumputhe yokuhoxiswa. Ukubuyisela isibali se-serial esidala kusebenzisa kabusha izinombolo ze-serial futhi kudida ama-cache nokusesha kwe-CRL okusekelwe ku-serial. I-HSM yokushintsha enqaba iblob eqoshiwe yenza ukushintshwa kwehardware kube ukukhishwa kabusha okuphelele.

Imodeli A ibhekana nezinge ezine zokuqala kabi kodwa ngokubonakalayo. Imodeli B ibhekana nazo kahle kuze kube yilapho imodyuli noma inqubo yomhlinzeki yehluleka. Uma okhiye bakho bekhipheka futhi iqembu lincane, i-archive ebhalisiwe iwukukhetha okuqotho, okusekelwa izithwali ezimbili kanye nenqubo yephasiwedi ebhaliwe. Uma ukhiye ungakhipheki awunakho ukukhetha nhlobo, futhi umsebenzi ushintshela ekufakazeleni indlela yokubuyisela yomhlinzeki ngaphambi kosuku ozoyidinga ngalo.

Ukukhetha imodeli nokuhlela isikhathi

Izimo ezintathu zixazulula isinqumo. Ingabe ukhiye ungakhishwa ngaphandle kwenqubo yomhlinzeki? Ingabe ukubuyisela kufanele kwehlele ku-hardware ongenayo? Isikhathi esingakanani ukukhishwa kungama ngaleso sikhathi uphikisana nokusekelwa? Phendula lezo zintathu futhi imodeli inqunyiwe; konke ngemva kwalokho ukuhlela isikhathi.

Thatha ikhophi yokusekela ngemva komkhosi wokusayina ngamunye nangaphambi kwanoma yikuphi ukushintsha kokuhleleka, ngoba ukuhleleka kuyingxenye yesimo. Gcina amakhophi amabili ezithwalini ezihlukile ezindaweni ezihlukile, elilodwa lingekho ku-inthanethi, futhi gcina imfihlo yokususa ukubhalisa endaweni yokuthembela ehlukile kumakhophi. Bhala usuku lokubuyisela okuphumelelayo kokugcina kurekhodi lekhophi yokusekela. Ikhophi yokusekela engakaze ibuyiselwe iwumbono nje, hhayi ukulawula.

Ngaphambi kokuvala ithikithi, qinisekisa lezi zinto ezinhlanu:

• Umnyonselo we-ca.crt urekhodiwe endaweni ethile ngaphandle kwekhophi yokusekela.
• I-index.txt, i-serial, i-crlnumber ne-openssl.cnf konke kungaphakathi kwe-archive noma kusethi yamablob.
• Ukugcinwa kwephasiwedi noma kokhiye oqoshiwe kubhaliwe futhi kuphethwe omunye umuntu hhayi umnikazi we-archive.
• Ukubuyisela kuhlolwe kusibungu esihlukanisiwe ngokukhishwa okukodwa nokuhoxiswa okukodwa.
• Isikhala sokuhoxiswa esishiwo isikhathi sakho sekhophi yokusekela samukelwe ngokubhaliwe noma sencishiswa.