Isitifiketi se-VPN esivuselelwe: amanye amaklayenti asasenqaba

Ingxenye yendawo ixhuma kabusha ngemva kokuvuselela kanti amadivayisi amathathu ayenqaba, ngalinye linesexwayiso mayelana nobuwena begethiweyi. Ukuvuselela ngokwako kuyinto evamile. Lokho lawa madivayisi amathathu akugcinayo ipini entweni endala, futhi ipini akulona uhlu lwe-CA, ukuhlolwa kwegama noma ukufakwa esitolo sokuthembela. Qhathanisa izindlela ezintathu ngaphambi kokuthinta noma iliphi iklayenti.

Ukuvuselela okukodwa, ukuziphatha okubili

Amaklayenti axhuma kabusha anesinqumo sokuthembela esisadlulayo, kanti lawo anqabayo anesidingo isitifiketi esisha esingasifezi. Lowo mehluko wulwazi, hhayi umsindo. Funda umyalezo weklayenti ehlulekayo ngokunemba. Ukungafani kwegama, umkhiphi ongaziwa kanye nefingaphrinti eshintshile kuyizinqumo ezintathu ezihlukene, futhi eyokugcina kuphela ekhomba ipini.

Hlola futhi ukuthi iklayenti ehlulekayo likhethe iphrofayili iphi. Ikhophi engenisiwe ehlala esitolo sayo ayishintshi lapho umqondisi ehlela ifayela lokuqala kwenye indawo.

Ukuvuselela kushintsha into, hhayi usuku kuphela

Ifingaphrinti ikhomba okuqukethwe okufihliwe kwesitifiketi. Ukuvuselela kwakha isitifiketi esisha, ngakho ifingaphrinti iyashintsha ngisho lapho igama lesihloko nokhiye womphakathi kuhlala kufana. Lokho kulindelekile futhi akunangozi kumaklayenti athembela ku-CA futhi aqinisekisa igama. Kuyabulala iklayenti elilungiselelwe ukwamukela isitifiketi esisodwa ncamashi, futhi kuyabulala futhi iklayenti okungafakwanga kuso umkhiphi omusha esitolo sokuthembela.

openssl x509 -in server.pem -noout -subject -issuer -dates -fingerprint -sha256
openssl x509 -in server.pem -noout -pubkey | openssl sha256

Umugqa wesibili uphendula omunye umbuzo, ukuthi ngabe ipheya lokhiye lasinda. Ukuvuselela okusebenzisa ukhiye futhi kugcina lelo nani futhi kushintsha isitifiketi kuphela, futhi yiso leso simo lapho umqondisi ecishe acabange ukuthi akukho okushintshile. Hlola isitifiketi esisetshenzisiwe, hhayi leso esisembonini yokwakha. Ukuqhathanisa ifayela kusitoreji kufakazela okwakhiwe, hhayi lokho umlaleli akwethulayo njengamanje.

Funda ukuthi iklayenti lipina ini

Amanye amaklayenti agcina ifingaphrinti kuphrofayili yawo futhi ayiqhathanise kukho konke ukuxhumana. Amanye ayigcina esitolo sokuthembela seplathifomu, kanti amanye ancika ku-CA kuphela. Ukulungisa kuyahluka esimeni ngasinye, ngakho qala ngokukhomba indlela.

grep -n 'peer-fingerprint' /etc/openvpn/client/*.conf
openssl s_client -connect gw.lab.example.net:443 -servername gw.lab.example.net < /dev/null 2>&1 | openssl x509 -noout -fingerprint -sha256

Umyalo wokuqala ukhombisa ipini kuphrofayili evamile; owesibili ukhombisa ifingaphrinti i-endpoint eyithulayo ngempela njengamanje. Uma lezo ezimbili zehluka, usuthole isiphambeko ngaphandle kokuqagela. Unganamatheli inani elisha kuwo wonke amaklayenti akhonondayo. Iklayenti elinqaba ngenxa yomkhiphi lizoqhubeka linqaba, futhi uzobe uzifundisile ukuthi ifingaphrinti iyiyo inkinga ngenkathi ingeyona.

Qhathanisa isitifiketi esihlinzekwa yi-backend ngayinye

Imiphumela ephazamukayo ngokuvamile isho i-endpoint engaphezu kweyodwa, futhi ukuvuselela okusetshenziswe kunodi eyodwa kushiya ezinye zethula into endala. Qhathanisa i-backend ngayinye ngekheli hhayi ngegama elabiwe.

for h in 10.30.0.11 10.30.0.12; do echo "$h"; openssl s_client -connect $h:443 -servername gw.lab.example.net < /dev/null 2>&1 | openssl x509 -noout -subject -dates -fingerprint -sha256; done

Iqembu elinodi eyodwa esemuva lichaza iklayenti elixhuma emzameni wesibili futhi lehluleka kowokuqala. Futhi lichaza ukuhlolwa kokuqapha okudlula ngenkathi abasebenzisi bekhononda. Lungisa ukusalela emuva kuqala. Ukugingqika kokumiswa kokuthembela ngaphambi kokuba inodi ngayinye ihlinzeke isitifiketi esisha kudala isikhathi lapho kungekho lutho olusebenzayo, futhi ukugingqika ngemuva kwalokho kushiya amaklayenti ehluleka ngendlela engalindelekile.

Shintsha ukuthembela ngomzila ophethwe

Qinisekisa ukushintshwa ngesiteshi sokuphatha esivele sithembekile ngaphambi kokukwamukela noma kuphi. Usuku lokuphelelwa isikhathi oluzwakalayo akulona ubufakazi bobunikazi. Buyekeza ukumiswa okuphethwe ngohlelo olukuphethe, nanoma yikuphi ukudlulana okuhleliwe kobuwena obamukelekayo, futhi gcina ukuqinisekiswa kwegama okudingwa ukusetshenziswa. Ipini elingenawo ukuhlolwa kwegama liwumklamo obuthaka kunokuthembela kwe-CA elikushintshile.

Bese uqinisekisa iklayenti ngalinye, xhuma, qinisekisa ubuwena elikwamukele, futhi qopha inguqulo yesitifiketi eseyithembayo manje. Isexwayiso esilahliwe kanye sinomkhuba wokubuya ekuvuseleleni okulandelayo.