Iklayenti elihoxisiwe lisaxhuma: uhlu aluzange lufike
Ukuhoxisa kungukufaka kokuhlolwa kwesitifiketi, hhayi umyalo oqeda iseshini. Qhathanisa ukuthi ukuxhumana okusha kanye nomhubhe ogijimayo bakubona kanjani uhlu.
Ukuhoxisa akulokothi kungene emhubheni ogijimayo ukuze kususe iseshini. Uhlu lungukufaka kokuhlolwa kwesitifiketi futhi lufundwa ngesikhathi sokushintshana kweshanneli yokulawula eqala iseshini ye-TLS. Leli qiniso elilodwa lichaza izimanga zombili: iklayenti elihoxisiwe lixhuma futhi ngoba uhlu aluzange lufike kumhloli, futhi iseshini ekhona iyasinda ngoba akekho ohlole kabusha lutho.
Uhlu kungukufaka, hhayi isenzo
Ngesikhathi kusungulwa iseshini iseva iqinisekisa isitifiketi seklayenti ngokumelene namakhonzo ayo okuthembela, futhi umyalo wokuhoxisa wengeza ukusesha kohlu kuleso sinqumo. Ukuhlolwa kwenzeka kuseva, ngakho iklayenti alikwazi ukubona ukuthi isitifiketi salo sihoxisiwe futhi liyaqhubeka nokunikeza leso esisodwa. Ngakho iphrofayili esaxhumayo ibonisa kuphela ukuthi umhloli othile wamukele uchungechunge, hhayi ukuthi ukuhoxisa kwehlulekile.
Uhlu ngokwalo luyinto esayiniwe enosuku lokukhishwa nosuku lokubuyekezwa olulandelayo. Uhlu olungahlobene, olusayinwe esinye isiphathimandla noma olosuku lokubuyekezwa olulandelayo seludlulile aluthathi indawo yalolo lwamanje, futhi ukuthi uhlu oludala luyenqatshwa noma lwamukelwe buthule kuncike ekusetshenzisweni.
Ukuxhumana okusha kanye neseshini egijimayo
Ukuhoxisa kuhlolwa lapho iseshini isungulwa noma ixoxisana kabusha, hhayi ngokumelene neshanneli yedatha kupakethe ngalinye. Iklayenti eselixhunyiwe kakade linokhiye bethrafikhi, ngakho liyaqhubeka nokudlulisa amapakethe ngemva kokuba isitifiketi salo sivele ohlwini. Isikhawu sokusebenzisana kabusha esizenzakalelayo silinganiswa ngamahora, ngakho uhlu olubuyekeziwe lungasebenza kwabasha ngenkathi umhubhe ogijimayo uhlala ukhona.
| Situation | What the list does | When it applies |
|---|---|---|
| Fresh connection | Blocks the handshake | At verification, immediately |
| Renegotiation | Blocks the new exchange | At the next renegotiation interval |
| Established data channel | Nothing | Until the session ends |
Ukuphoqelela ngokushesha kudinga isenzo samabomu hhayi uhlu kuphela. Ukuqala kabusha isevisi kuphoqa iklayenti ngalinye ukuthi lixhume futhi, kanti ukuqeda iseshini eyodwa ngokusebenzisa isixhumanisi sokuphatha kushiya ezinye zingathintwanga. Khetha okukodwa umcimbi ngamunye bese ubhala ukuthi usebenzise okukuphi. Izinketho zozimbili zinethonya elihlukile, futhi leso yisinqumo sangempela.
Letha ifayela umhloli alifunda ngempela
Uhlu kufanele lukhiqizwe kusuka kurekhodi lesiphathimandla bese lucoshwa kuyo yonke imishini ehlola izitifiketi. Ukulukhiqiza kusibungu se-CA bese ungalokothi ulufake kuseva yikhona kwehluleka okuvame kakhulu, futhi kubukeka njengento yokuhoxisa ephukile.
ca ca.crt
cert server.crt
key server.key
crl-verify /etc/openvpn/crl.pemImininingwane emibili inquma ukuthi ifayela lifundwa ngempela. Indlela ehlobene ixazululwa ngokumelene nedirectory yokumisa, ngakho ikhophi eshiywe ekhaya lomsebenzisi ingase ingatholakali. Futhi i-daemon ivamise ukushiya amalungelo ngemva kokuqala, ngakho i-akhawunti yokusebenza idinga imvume yokusesha kuyo yonke idirectory engumzali kanye nemvume yokufunda efayeleni. Hlola kokubili nge-akhawunti yokusebenza hhayi nge-root, uma kungenjalo isivivinyo sibonisa okungalungile.
Kumakhasthi e-systemd iyunithi eqinisiwe nayo ingafihla indlela, ngokubuka kokufunda kuphela noma idirectory yesistimu evikelwe. Ngaphakathi kwesevisi lokho akuhlukaniseki nefayela elilahlekile, ngakho hlola imikhawulo yeyunithi ngaphambi kokuyofuna iphutha lemvume. Funda ifayela leyunithi ngaphambi kokusola imodi yefayela.
Qinisekisa kuseva, hhayi kuklayenti
Ilogi yeseva ibiza okwenzekile: ukuvula uhlu, ukululayisha noma ukwehluleka kokuhlola ngenombolo yochungechunge ehoxisiwe. Iklayenti libika kuphela ukwehluleka kokuxhawulana okujwayelekile, ngakho amalogi eklayenti ayindawo embi yokufuna isinqumo sokuhoxisa.
Hlola ngomzamo omusha osuka kuphrofayili ehoxisiwe bese uyayeka. Ukuxhumana okuphumelelayo kusuka kuleyo phrofayili kuwuphawu lokuhlola indlela yefayela kanye ne-akhawunti yokusebenza, hhayi ukucabanga ukuthi uhlu belungalungile. Gcina lowo mzamo ophumelelayo njengokuhlolwa kokwamukela, futhi ungabali ukuxhumana kabusha ongakubonanga.
Okuyikho okuhoxisa lutho
Ukususa iphrofayili kukhompyutha ephathekayo, ukukhipha ifayela lesitifiketi kuklayenti noma ukutshela umsebenzisi ukuthi ayeke ukuxhuma akushintshi lutho kuseva. Isitifiketi sihlala sisebenza kuze kube yilapho isiphathimandla sibhala ukuhoxisa futhi umhloli efunda uhlu olusuka lapho.
Yingakho kufanele kubhalwe uchungechunge: bhala ukuhoxisa, khipha futhi usayine uhlu, satshalalisa leyo fayela ngqo, futhi uqinisekise ukuthi i-akhawunti yesevisi ingalifunda. Isixhumanisi ngasinye sifushane, futhi noma yisiphi esilahlekile sishiya iklayenti elihoxisiwe lixhuma ngenjabulo. Uhlu lokuhlola lwemigqa emine luyahlula kucabango olungenawu ngisho umugqa owodwa.