Ukhanselile isitifiketi se-VPN esingalungile? Izinketho zokubuyisela nemikhawulo

Othile ukhanselile isitifiketi kukhonso le-CA futhi manje umsebenzisi akakwazi ukuxhuma. Umcabango wokuqala ukuthola ukuhoxiswa, futhi kuma-PKI amaningi akukho: ukukhansela kuyiqiniso elimenyezelwe mayelana nenombolo yokulandelana, futhi indlela yokubuya esekelwayo iyisitifiketi esisha, hhayi irekhodi elihlanekezelwe. Hamba ngezohlolo ezingezansi ngokulandelana, ngoba ukulungiswa okuvunyelwe kuncike kwikhodi yesizathu nasekutheni ukhiye wake wadalulwa yini.

Khomba isitifiketi, hhayi umuntu

Amagama ajwayelekile ayaphindana. Umsebenzisi obhalise kabusha ngekota edlule angaba nezitifiketi ezimbili ezine-CN efanayo nezinombolo zokulandelana ezihlukile, futhi ukukhansela esisodwa kushiya esinye sisebenza. Qala ngokuqinisekisa into eqondile:

openssl x509 -in client.crt -noout -serial -issuer -subject -dates
openssl crl -in ca.crl -noout -text | head -40

Bhala inombolo yokulandelana, umkhiphi, usuku lokukhansela nesizathu esibhalwe ku-CRL. Bese uqinisekisa ukuthi yiziphi izinto ezethula leyo nombolo yokulandelana, ngoba isitifiketi esikhanseliwe singase sikwazi ukufakwa kukhompyutha ephathwayo, ifoni nomuxhumi womsakazo oyisipele, futhi ukushintsha okufinyelela kwenye kuphela kudala isigameko sesibili.

Ukuhlola kokuziphatha okusheshayo kuqinisekisa isimo ngaphandle kokushintsha lutho:

openssl verify -crl_check -CAfile ca.crt -CRLfile ca.crl client.crt

Uma kubika isitifiketi njengesikhanseliwe, i-CRL neklayenti ziyavumelana; uma kuqinisekiswa kahle, iklayenti oliphethe akulona elikhanseliwe, futhi ukusesha kuyaqhubeka.

Hlola ukuthi i-CA isebenzise ukubamba noma ukukhansela unomphela

I-RFC 5280 ichaza certificateHold njengesimo sesikhashana, futhi removeFromCRL njengesiginali esikukhululayo. Lowo mjikelezo wokuphila ungokoqobo, kodwa akusona isigqoko sokuhoxisa jikelele. Ukufunda ikhodi yesizathu kukutshela ukuthi umkhiphi wake wahlose ukusekela ukukhululwa yini.

Umgibe ukucabanga ukuthi inhloso yesikhashana isho irekhodi lesikhashana. Uma irekhodi le-CA liphethe keyCompromise noma cessationOfOperation, isitifiketi sikhanselwe unomphela, kungakhathaliseki ukuthi umuntu ocinde isigqoko wayehlose ukwenzani. Ngakolunye uhlangothi, irekhodi elimakwe certificateHold ku-CA engakusebenzisi ukukhululwa kokubamba lingunomphela empeleni, ngoba akukho okuzoke kusakaze ukukhululwa.

Ama-CA asekelwe ku-OpenSSL akhombisa umkhawulo. Umyalo ca wamukela amanani -crl_reason, kuhlanganise certificateHold ne-removeFromCRL, kodwa awukhiqizi ama-CRL e-delta — idokhumenti ye-OpenSSL CA isho lowo mkhawulo ngokukhishwa kwayo kwe-CRL. I-CRL ephelele emane ishiye inombolo yokulandelana ingumodeli wokushicilela ohlukile kune-delta ethi "leli rekhodi likhululiwe", ngakho ukunamathisela removeFromCRL ku-CA ye-VPN esekelwe ku-OpenSSL akukhiqizi ukukhululwa okuchazwe amazinga.

Uma ukhiye kungenzeka ukuthi wadalulwa, shintsha

Isitifiketi esikhanseliwe isitatimende sokuthi lo khiye kungenzeka ukuthi awusathembekile. Uma ukukhansela kwakulungile ngokwengqikithi — ikhompyutha ephathwayo yalahleka, ukhiye wakopishwa kudiski ekwabelwana ngayo, ukhiye oyimfihlo wanamathiselwa kuthikithi — ukubuyisela isitifiketi esifanayo kuhlanekezela isinqumo sokuphepha ebesisebenza ngendlela ebilindelekile.

Khipha ipheya elisha lokhiye ngenqubo yokubhalisa, satshalalisa iphrofayela entsha, futhi ushiye inombolo yokulandelana endala ikhanseliwe isikhathi sayo sonke. Buyekeza konke okubopha ubunikazi ngenombolo yokulandelana noma ngomthetho weminwe, kuhlanganise uhlu lokwamukelwa, uhlu lwezinto nezokuqapha okulindele isitifiketi esithile.

Impikiswano yokunethezeka yokubuyisela esidala ingokoqobo, kodwa kufanele iphendulwe ngokusobala hhayi ngokuthula. "Umsebenzisi udinga ukufinyelela namuhla" yisizathu sokusheshisa ukukhishwa, hhayi isizathu sokuhoxisa ukukhanselwa kokhiye ongakwazi ukuphendula ngawo.

Uma kwakuyiphutha lokuphatha, shintsha ngaphansi kokulawula

Lapho ukukhansela kwakumane kungalungile futhi ukhiye awuzange wadalulwe, ukulungiswa kuseyinto yokushintsha elawulwayo hhayi ukuhlela. Sebenzisa inqubo esekelwayo yomkhiphi, gcina inombolo yokulandelana nomlando wokukhishwa ungalimele, futhi ugweme izindlela ezimbili ezilinge ezimfishane: ukuphendula uhlamvu lwesimo ku-index.txt kusuka ku-R kubuyela ku-V, nokwasusa umugqa wokukhishwa ukuze isitifiketi esisha siphinda sisebenzise inombolo yokulandelana.

Ku-CA ye-OpenSSL isizindalwazi sihlukaniswe nge-tab futhi kulula ukusifunda ngokungalungile, okwenza ukuhlela ngesandla kube yinto ehehayo:

awk -F'\t' '$1=="R" {print $4, $3, $6}' index.txt

Yifunde, ungayibhali. Ukuhlela ifayela kushintsha i-CRL elandelayo ngaphandle komkhondo wokucwaninga, futhi noma yisiphi isibonelo sesibili se-CA noma ikhophi yokugcina esaphethe umugqa wangempela kuzophikisana nayo kamuva.

Ngemva kokukhipha okushintshayo, satshalalisa i-CRL entsha ngomshini ojwayelekile futhi uvumele amaklayenti ukuthi ayithathe. Ukususa i-CRL, ukufinyeza impilo yayo ibe lutho noma ukukhubaza ukuhlolwa kokukhansela kuphrofayela yeklayenti kulungisa umsebenzisi oyedwa ngokwenza buthaka konke okunye ukukhansela i-CA eye yakusakaza.

Qinisekisa ukwamukelwa okusha futhi gcina irekhodi

Hlola ngoxhumano olusha, hhayi ngesikhathi esivele sivuliwe. Ithuneli eliphilayo lingase lingaphindi ligijime izohlolo zokwamukela ezenziwa ukuxhawulana okusha, futhi izingqikithi ze-CRL zisho ukuthi iklayenti lingaqhubeka nokuxhuma kuze kube yilapho lisebenza kabusha. Nqamula, xhuma futhi, futhi uqinisekise kulogi yeseva ukuthi iyiphi inombolo yokulandelana eyamukelwe.

Rekhoda okwenzekile ngesikhathi kusasha: iyiphi inombolo yokulandelana eyakhanselwa, ngubani, ngasiphi isizathu, yikuphi ukushintsha okwakhishwa, nokuthi i-CRL yasakazwa kabusha nini. Lelo rekhodi liyenza ibe nokwenzeka ukubuyekezwa kokukhansela okulandelayo, futhi liyibufakazi bokuthi iphutha lasingathwa hhayi ukufihlwa.

Kuma-suspension amafushane esikhathini esizayo, sebenzisa umshini wokumisa ukwamukela uma ukusatshalaliswa unawo — i-akhawunti ekhutshaziwe kungqimba lobunikazi, ubulungu beqembu obususiwe, iphrofayela yeklayenti ebhaliwe. Lokho kuhlukanisa isinqumo senqubomgomo sesikhashana nombuzo wokuthi isitifiketi esikhishiwe sisathembekile yini, futhi ukwehluka kanye lokho okwalahleka okokuqala.