Ukuvuselela isitifiketi se-VPN ngaphandle kokushintsha ubunikazi baso

Ukuvuselela isitifiketi okushintsha ubunikazi akukhona ukuvuselela, kuwukufuduka okugqoke ithikithi lokulungisa. Iklayenti liqinisekisa igama, iketanga futhi ngezinye izikhathi ukhiye othile, futhi zontathu zingashintsha ngaphandle kokushintsha usuku lokuphelelwa. Ngaphambi kokucela ukushintshwa, bhala lokho iklayenti elikuhlola ngempela: igama lomsingathi noma ubunikazi bozakwabo, inhloso yesitifiketi, inqubomgomo yokhiye kanye neketanga lomkhiphi. Ukuvuselela kujwayelekile noma kuhleliwe kuye ngokuthi ukushintshwa kushintsha ini kulezi.

Izimo ezintathu zinquma isimo sokuphinda kuvuselelwe

Izimo ezintathu yilezi: ingabe kukhona okubopha iqabunga, ingabe iketanga liyashintsha, futhi ubani omunye oqinisekisa igama. Phendula ngasohlangothini lweklayenti hhayi ngokulahleka kwe-CA, ngoba iklayenti yilona elihlulekayo ngehora lesithathu ekuseni.

Qala ngokuhlola isitifiketi osinayo. openssl x509 -in server.crt -noout -subject -issuer -dates -ext subjectAltName iphrinta isihloko, umkhiphi, isikhathi sokusebenza kanye namagama isitifiketi esisebenza ngempela kuwo. Leyo nkambu yokugcina ibaluleke kakhulu futhi icatshangwa kakhulu: isicelo sokuvuselela esishiya i-SAN iklayenti elincike kuyo sikhiqiza isitifiketi esisebenza ngokobuchwepheshe kodwa esingalungile ngokokusebenza. Kopisha uhlu lwe-SAN kusuka esitifiketini esidala uyise esicelweni esikhundleni sokuphinda uyithayiphe kusuka enkumbulweni.

Isimo sokuqala: ingabe kukhona okubopha iqabunga

Uma amaklayenti ethemba i-CA enakekelwayo futhi eqinisekisa igama, ukuvuselela kweqabunga ngokhiye omusha akubonakali kubo. Uma noma iyiphi iklayenti ibopha isitifiketi seqabunga, isigxivizo somunwe waso noma ukhiye waso womphakathi, ukushintshwa kuwushintsho oluhleliwe olunoshintsho oluqinile, ngoba ukubopha okudala akukwazi ukuqinisekisa isitifiketi esisha.

Thola ukuthi usesimweni sini ngaphambi koku-oda noma yini. Ukubopha okungekho muntu okubhalile kuseyikubopha uma kwephuka.

Isimo sesibili: qhathanisa ukubopha neketanga

Izigxivizo zomunwe zenza ukubopha kuhlolwe: openssl x509 -noout -fingerprint -sha256 -in server.crt kusitifiketi esidala nesisha, kanye ne-openssl x509 -noout -pubkey ukuqhathanisa okhiye bomphakathi. Uma ukumiswa kweklayenti, iphrofayela yeselula noma isitoreji sokwethembana sedivayisi kuqukethe elinye lamavelu, unokubopha. Amaphrofayela e-VPN eselula ayindawo yokucasha ejwayelekile, ngoba iphrofayela isatshalaliswa kanye futhi ayiphinde ihlolwe.

Uma ukushintshwa kuvela esiphakathini esifanayo futhi iklayenti selivele sinaso noma ingasithola, akukho okushintshayo ohlangothini lokwethembana. Isiphakathi esisha, umkhiphi ohlukile noma iketanga elethwe ngokulandelana okungalungile kuguqula ukuvuselela kube wushintsho lokwethembana, futhi ukwehluleka kubonakala njengomkhiphi ongaziwa hhayi njengesitifiketi esiphelelwe yisikhathi.

Hlola iketanga iseva esilithumela ngempela nge-openssl s_client -connect vpn.example.com:443 -servername vpn.example.com -showcerts, futhi uliqinisekise endaweni nge-openssl verify -CAfile ca.pem -untrusted chain.pem server.crt. Ukwenza lokho ngaphambi koshintsho kukunikeza umugqa wesisekelo wokuqhathanisa ngemuva kwalokho.

Isimo sesithathu: ubani omunye oqinisekisa igama

Isihlanganisi se-VPN, isilinganisi somthwalo, uphenyo lokuqapha, ukuhlanganiswa kwe-RADIUS noma i-SAML kanye nephrofayela yeselula ngakunye kungagcina ikhophi yako yegama elilindelekile noma yesisekelo sokwethembana. Ukuvuselela yisikhathi lapho lezo zikhophi zihlukana khona, ngoba isitifiketi siyashintsha kanti izikhophi azishintshi.

Bhala uhlu lwabo bonke abasebenzisi ngaphambi koshintsho futhi unqume, kwabanye ngabanye, ukuthi bayadinga ukubuyekezwa yini. Lowo omkhohliwe yilona ozokushayela ucingo.

Kukhona nogibe lwesikhathi. Hlola ukuqala kokusebenza kanye nokuphelelwa, ngoba isitifiketi esilungiselelwe ukusebenza kamuva siyenqatshwa uma sifakwa kusenesikhathi kakhulu, futhi iphutha libonakala njengenkinga yewashi hhayi inkinga yokulungiselela. I-openssl x509 -noout -dates kufayela elisha ngaphambi kokulithumela iwukuhlola kwemizuzwana emibili. Gcina futhi indlela yokubuyisela esekelwe kanye nokumiswa okwaziwayo okuhle, ukuze ukuvuselela okungahambi kahle kubuyiselwe ngokuphinda kubuyiselwe isitifiketi nokhiye wangaphambili.

Thumela, qinisekisa ngokuqinisekisa okusha, bese uyahoxisa

Ithuneli esivele isungulwe ibonisa ukuqinisekisa okwenzeka ngesikhathi yakhiwa, ngakho ingabonakala iphilile kuyilapho ukuxhumana okusha ngakunye kwehluleka. Hlola ngokuqinisekisa okusha usebenzisa igama lensebenzo langempela elisetshenziswa amaklayenti.

Qedela ukuhlola kwezinga lohlelo lokusebenza okubalulekile kumsebenzisi, futhi uqinisekise ukulethwa kweketanga ngombono weklayenti hhayi wesiseva. Ungacindezeli ukuhlola kwegama noma kwesitifiketi ukuze uguquko luthule; lokho kuphendula inkinga yokuhambisana yesikhashana ibe ngunaphakade.

Hoxisa izinto eziphelelwe yisikhathi kuphela ngemuva kokuqinisekiswa kokuthunyelwa, futhi thatha ukhiye ophuliwe njengesimo esihluke ngokuphelele: ukuvuselela kukodwa akuhoxisi lutho, ngakho ubunikazi obuthintekile budinga inqubo yokuhoxisa nokulawula izikhathi zokuthunyelwa. RFC 5280 ichaza imithetho yesitifiketi nokuqinisekisa kwendlela engaphansi kwakho konke lokhu. Gcina ukuvuselela kweqabunga okujwayelekile kuhlukile ekushintsheni kwe-CA, ukuze amaklayenti angacelwa ukuthemba umkhiphi omusha ngaphandle kwesizathu.