Indlela yokususa isitifiketi se-VPN esiphelelwe yisikhathi esitolo sokuthembela

Iklayenti yakho ye-VPN isusiwe, iphrofayela isinyamalele kuzilungiselelo, kodwa umhubhe usakhula ngezimpawu zokungena ezindala. Noma uyayisusa, uqalise kabusha, bese uyithola ibuyile ngakusasa ekuseni. Akukho kulokhu okuyinkinobho yokususa eyephukile. Iphrofayela iwukulungiselela; isitifiketi siwukubalulekile kokhiye kanye nesinqumo sokuthembela esirekhodwe esitolo iphrofayela ekhomba kuso kuphela. Ukuthi yikuphi kwalokhu okubili okuphethe kuyona kunquma ukuthi 'susa' kufanele kusho ukuthini.

Iphrofayela akusona isitifiketi

Kusilungiselelo se-VPN, izinto ezintathu ezihlukene zibizwa ngokuthi 'isitifiketi'. Ubunikazi beklayenti isitifiketi seqabunga esinokhiye oyimfihlo, futhi isango liyisebenzisa ukunquma ukuthi ungubani. Isitifiketi seqabunga sesiphakeli uqobo kanye nesiphakathi saso yikho okuhlola iklayenti yakho lapho ixhuma. I-anchor yokuthembela, ngokuvamile i-root noma isitifiketi se-CA esiyimfihlo, yikho okwenza uchungechunge luqinisekiseke nakancane. RFC 5280 ibiza lezi ngokuthi i-anchor yokuthembela, isiphakathi kanye nebhizinisi lokugcina, futhi uchungechunge luvumeleka kuphela uma ikhonkco ngalinye lisayina ikhonkco elingezansi kwalo.

Susa ubunikazi bese idivaysi eyodwa ilahlekelwa ukufinyelela. Susa i-anchor bese uhlelo lokusebenza ngayinye oluqinisekisa ngokumelene naleso sitolo lulahlekelwa amandla okuhlola noma yini ekhishwe ngaphansi kwaso, kuhlanganise nokuxhumana okungenasihlobo ne-VPN. Lokho kungalingani yikho konke ubungozi lapha: i-root efakwe kusango elilodwa ivamise ukuba yiyo leyo root esayina ingosi yangaphakathi, isiphakeli se-imeyili noma isibuko sephakethe. Khumbula ukuthi yikuphi kwalokhu okubili okuphethe.

Ubunikazi bunquma ukuthi ukususa kuhlala kususiwe yini. Kumakhompyutha aphathekayo onayo, nguwe kuphela ongabuyisela isitifiketi. Kudivaysi ephethwe, iphrofayela yokulungiselela noma umthwalo we-MDM kungase kusifake futhi ekungena esilandelayo, yingakho 'sibuya' nyingakho ukususa ngamandla kungasizi.

Thola ukuthi isiphi isitolo esisikhona

Abantu baqala kuhlelo lokusebenza lwezilungiselelo, okuyiyona ndawo kuphela lapho isitifiketi singagcinwa khona. Izindawo zangempela yizitolo zokuthembela ze-OS, isitolo sesiphequluli uqobo kanye nesitolo esiyimfihlo sohlelo lokusebenza.

Qhathanisa ngenombolo yochungechunge noma ngomkhondo womunwe, hleze ngegama elibonakalayo. Amagama abonakalayo asetwa ngukhishi isitifiketi futhi ayaphinda asetshenziswe: 'Example VPN' kungaba yizitifiketi ezintathu ezinokhiye abathathu abahlukene, esisodwa sisasetshenziswa nsuku zonke.

certutil -user -store My
certutil -store Root
openssl x509 -in vpn-client.pem -noout -subject -issuer -serial -fingerprint -sha256

Ku-macOS ithuluzi le-security linikeza amaqiniso afanayo, futhi find-identity likhombisa ukuthi yiziphi izitifiketi ezisenokhiye oyimfihlo onamathiselwe:

security find-certificate -a -c "Example VPN" -Z /Library/Keychains/System.keychain
security find-identity -v -p ssl-client

Susa into encane, gcina umkhiphi owabiwe

Khipha ngaphandle ngaphambi kokususa. Ngaphandle kwekhophi yokulondoloza, ukululama kuphela ukuphinda kukhishwe, lokho ku-CA eyimfihlo kusho ukubuyela kumuntu ophethe i-PKI. I-PFX ekhishiwe nayo yikho okunikezayo uma ukususa kuvela njengesinqumo esingalungile.

certutil -user -exportPFX -p backup My <serial> C:\temp\vpn-id.pfx
certutil -user -delstore My <serial>
Remove-Item Cert:\CurrentUser\My<thumbprint>

Le -user fulegi yiyo abantu abayilahla ngengozi. Ngaphandle kwayo, i-certutil isebenza esitolo somshini esikhundleni salokho, okusho i-shell ephakanyisiwe, isethi ehlukile yezitifiketi kanye nendawo yomthelela manje ehlanganisa wonke amanye ama-akhawunti kumshini.

Ku-macOS ne-Linux ukuma kuyafana: khomba, khipha, bese ususa esitolo esincane kakhulu esichaza uphawu. Ukususa ifayela eliku- /usr/local/share/ca-certificates nokuphinda update-ca-certificates kusetshenziswe kwanele; --fresh kusiza kuphela uma izixhumanisi zophawu eziku- /etc/ssl/certs sezingavumelani. Amasistimu omndeni we-RHEL agcina ama-anchor ku- /etc/pki/ca-trust/source/anchors, lapho trust anchor --remove kwenza umsebenzi ofanayo.

sudo security delete-certificate -Z <sha1> /Library/Keychains/System.keychain
sudo rm /usr/local/share/ca-certificates/example-vpn.crt
sudo update-ca-certificates
sudo trust anchor --remove /etc/pki/ca-trust/source/anchors/example-vpn.crt

Ngaphambi kokususa isitifiketi se-CA, hlola ukuthi yini enye exhuma kuso. Ukubala izihloko ngaphakathi kwebhandela kuwukuhlola kwemigqa emibili futhi kuphendula ukuthi leyo anchor yenza omunye umsebenzi yini:

openssl crl2pkcs7 -nocrl -certfile /etc/ssl/certs/ca-certificates.crt \
  | openssl pkcs7 -print_certs -noout | grep -i example

Ukususa ifayela akusikho ukuhoxisa ubunikazi

Ukususa kwasendaweni kususa ikhophi eyodwa. Ukhiye oyimfihlo usengaba ku-p12 enamathiselwe ithikithi elidala, kufolda yekhophi yokulondoloza noma kukhompyutha ephathekayo yesibili eyahlelwa ngesikhathi esifanayo. Uma lokhu bekuwubunikazi beklayenti, isango liyaqhubeka nokwamukela noma iyiphi ikhophi yalowo khiye kuze kube ubunikazi bunyanywa ohlangothini lweseva.

Ku- OpenVPN PKI, lokho kusho ukuhoxisa isitifiketi nokuqinisekisa ukuthi i-CRL okubhekiswe kuyo ngu- crl-verify isesikhathini; easyrsa revoke bese easyrsa gen-crl inguqulo emfushane. Kusango eliboshelwe kumhlinzeki wobunikazi, khubaza umsebenzisi noma susa idivaysi lapho, ngoba isitifiketi siwumboniso owodwa emdlalweni. Ukususa ikhophi yasendaweni ngenkathi i-akhawunti isasebenza kubonakala njengokuhlanza futhi akusikho.

Umsebenzi wesigameko unokulandelana okuhlukile: gcina isitifiketi, inombolo yaso yochungechunge kanye nerekhodi lokuhoxiswa kuqala, bese ususa futhi uxhoxise. Lamasethingi awabizi lutho futhi awadingi ukushiya umboniso osebenzayo endaweni.

Qinisekisa ngokuxhawana ngesandla kanye nohlelo lwesibili

Hlola uchungechunge ngaphandle, hhayi kuhlu lwesitolo osanda kuluhlela. Isitolo sibonisa ukuhlela kwakho; ukuxhawana ngesandla kubonisa umphumela.

openssl s_client -connect vpn.example.com:443 -servername vpn.example.com \
  -CAfile /etc/ssl/certs/ca-certificates.crt -verify_return_error < /dev/null
openssl verify -CAfile /etc/ssl/certs/ca-certificates.crt vpn-gateway.pem

Ikhodi yokubuyisa engu-0 isho ukuthi ama-anchor asele asaqinisekisa isango. Iphutha lochungechunge ngemva kokususa i-anchor umphumela olindelekile, futhi kuqinisekisa ukuthi ushaye i-anchor esetshenziswayo hhayi ikhophi esitolo iklayenti engakaze ilifunde. Uma ukuxhumana kusasebenza, funa ikhophi yesibili, isitolo esifakwe ngaphakathi kohlelo noma isitifiketi esinamathiselwe, konke lokhu kuvamile kumaklayenti aletha uhlu lwawo lokuthembela.

Bese uhlola into engahlobene: isayithi langaphakathi, iklayenti le-imeyili, isibuko sephakethe. Lokho kulinganisa indawo yomthelela ngokushibhile, ngaphambi kokuthi iwindi loshintsho livaleke.

• Iqhaza likhonjwe njengobunikazi, isiphakathi noma i-anchor yokuthembela
• Inombolo yochungechunge nomkhondo womunwe kurekhodiwe, futhi ikhophi ikhishwe endaweni egunyaziwe
• Ukususa kwenziwe endaweni encane kakhulu echaza uphawu
• Ugunyazelo ohlangothini lweseva luxhoxisiwe lapho umuntu noma idivaysi lihamba
• Ukuxhawana ngesandla kuchaziwe, futhi uhlelo olulodwa olungahlobene luhlolwe kabusha
• Umthwalo we-MDM noma iphrofayela yokuphatha ibuyekezwe, kungenjalo isitifiketi siyabuya

Uma isitifiketi sibuyile ngemva kokuqalisa kabusha, umsebenzi awukapheli: kukhona okusiphethe futhi okusifaka kabusha. Thola lowo mnini ngaphambi kokususa futhi, ngoba ukususa kwesithathu kuzokwenza ngendlela efanayo ncamashi nezimbili zokuqala.