Lapho kuhlala khona u-n, e, d, p no-q be-RSA kufayela lokhiye we-VPN

Izinhlamvu encazelweni ye-RSA ziqamba izinkambu ezingaphakathi kwento eyodwa, hhayi amafayela akhishwa ithuluzi le-PKI. Ifayela lokhiye lomuntu siqu linokwakheka okukhambu zalo zokuqala zisobala kanti izinkambu zakamuva akufanele zilushiye ngisho noma nini umshini oqeda umhubhe. Phakathi kwalawa maqiniso amabili kukhona iningi lemibuzo yokusebenza mayelana nokuthi yiliphi ifayela eliphendula umbuzo uphi. Le ncwadi yokuqondisa ifunda kuqala isakhiwo, bese kuba imiyalo eyisihlola ngaphandle kokuyichitha.

Qinisekisa ukuthi ukhiye yi-RSA ngaphambi kokufuna izinombolo eziyisisekelo

Isitifiketi sifakaza ukuthi ukhona ukhiye futhi usayiniwe; asifakazi ukuthi ukhiye yi-RSA. Amasistimu angakhiwa phezu kwamajika e-elliptic noma i-Ed25519, futhi ukuhlelwa kwezincwadi okufanayo kukhonza kukho konke. Hlola i-algorithm ngaphambi kokufuna izinto eziyisisekelo ezingakaze zibe khona.

Le miyalo emithathu yokufunda kuphela iyaphendula umbuzo futhi iqopha inguqulo yethuluzi.

openssl version
openssl x509 -in vpn-client.crt -noout -text
openssl pkey -in vpn-client.key -noout -text

Inguqulo ibalulekile ngoba amagama ezinketho asukile phakathi kwezinguqulo ezinkulu. Kokuphuma kwesitifiketi thola umugqa we-algorithm yokhiye womphakathi kanye nosayizi wokhiye; kokuphuma kokhiye, ukhiye we-RSA uphrinta i-modulus kanye ne-exponent yomphakathi. Ukhiye wejika le-elliptic uphrinta ijika elinegama esikhundleni salokho, futhi alukho uphenyo oluzokhipha u-n noma u-q kuwo.

Funda isakhiwo esikhundleni se-base64

I-PEM yi-base64 esongwe emugqeni wekhanda, futhi ukuyikhodi kukhipha i-DER, okungukuthi isakhiwo esilandelanayo hhayi inombolo ephelele enkulu eyodwa. Okhiye abayimfihlo be-RSA bahamba ngezitsha ezimbili ezijwayelekile, i-PKCS#1 ne-PKCS#8, futhi zombili zixazululeka kusethi efanayo yezinombolo.

Uma kunezinombolo eziyisisekelo ezimbili, isakhiwo somuntu siqu sithwala izinkambu eziyisishiyagalolunye: inguqulo, i-modulus u-n, i-exponent yomphakathi u-e, i-exponent yomuntu siqu u-d, izinombolo eziyisisekelo u-p no-q, ama-exponent amabili e-CRT kanye ne-coefficient eyodwa ye-CRT. I-RFC 8017 isigaba A.1 ichaza lezo zingxenye kanye nokuhlelwa kwe-ASN.1, futhi ivumela nezinombolo eziyisisekelo ezingaphezu kwezimbili, yingakho umhlaziyi ojwayelekile engaphrinta okunye okufakiwe kwezinombolo eziyisisekelo. Qaphela ukulandelana, ngoba kuchaza iphutha elivamile: ingxenye yomphakathi igcinwa ngaphakathi kwefayela lomuntu siqu, ngakho ukuba khona kwensimu yomphakathi akulenti lelo fayela liphephe ukwabiwa. Konke okulandela lokho kungumthombo okufanele uhlale kusibungu.

Ukufaka ikhodi kunezela isendlalelo okulula ukusidida nokuqukethwe. I-openssl asn1parse idweba isakhiwo njengesihlahla ukuze ukulandelana kwezinkambu kubonakale, futhi ayikukhiphi okubhaliwe futhi ayisho nokuthi ukhiye uyasebenza yini.

Hlanganisa isitifiketi nokhiye ngaphandle kokuphrinta ukhiye

Umbuzo olandelayo ngokuvamile ukuthi isitifiketi nokhiye kuhlangene yini. Ukuqhathanisa ama-modulus uyawuphendula lowo, kodwa futhi ukopisha izinto eziseduze nezomuntu siqu kuqoshwa kwethemini okungagcina kungene kwithikithi. Ukuqhathanisa izingxenye zomphakathi kuphendula umbuzo ofanayo ngaphandle kwanoma yini ebucayi esikrinini.

openssl pkey -in vpn-client.key -pubout -out /tmp/key.pub
openssl x509 -in vpn-client.crt -pubkey -noout > /tmp/cert.pub
cmp /tmp/key.pub /tmp/cert.pub && echo MATCH

Amafayela afanayo asho ukuthi isitifiketi sithwala ingxenye yomphakathi yalowo khiye, futhi umehluko usho ukuthi uphethe ipheya elingalungile. Yikho lokho kungahambisani okuyimbangela ejwayeleke kakhulu yomhubhe oxoxa ngokujabula bese wenqaba ukuqinisekisa. Ngemva kwalokho susa amafayela amabili esikhashana; awanawo umfihlo, kodwa indawo yokusebenza ehlanzekile kulula ukucabanga ngayo phakathi nesehlakalo.

Yazi ukuthi amafayela aseduze akusiwona ini

Isitifiketi akusona ukhiye womphakathi obethelwe owezinye okuwuvula ngesitifiketi se-CA; kuwukuxhumana okusayiniwe phakathi kokhiye womphakathi nedatha yobunikazi. Ukhiye wokubhalisa wangasese we-CA uhlala wehlukile kwisitifiketi sawo kanye nakukho konke ukhiye weklayenti. Isicelo naso akusona isitifiketi: sithwala imininingwane eceliwe kanye nokhiye womphakathi kanye nesiginesha phezu kwesicelo, okusenza kube ukufakwa kokubhaliswa hhayi ubufakazi belungelo.

Okubili kwalokho kufakwa kungena kukhiye womphakathi we-RSA ngokushesha okwanele ukuthi kubizwe kabili. Ifayela lamapharamitha e-Diffie-Hellman liqukethe amapharamitha eqembu okusungula ukhiye futhi alinayo inombolo eyisisekelo ye-RSA, nakuba liphinde liphrintwe njengenombolo enkulu eyisisekelo. Uhlu lokuhoxiswa lusakaza isimo sezitifiketi futhi akusiyo indawo lapho i-exponent yomuntu siqu ingacasha khona.

Ngakho umugqa ngamunye wohlu kufanele uqophe izinto ezine: uhlobo lwento, umnikazi, inhloso kanye nokuthi ingabe umthombo womuntu siqu ufakiwe. Ikholomu yokugcina yiyo enquma ukuthi ifayela lingakopishwa kuphi, futhi yiyo abantu abayishiyayo.

Qopha ukuhlanganiswa, bese uqinisekisa ukuxhawana

Ngaphambi kokushintsha noma yini, gcina umphumela wokuqinisekisa kanye nosuku kanye nenguqulo ye-OpenSSL. Khona-ke ukujikeleza kwakamuva kungaqhathaniswa nobufakazi hhayi ngenkumbulo.

openssl verify -CAfile ca.crt vpn-client.crt
openssl x509 -in vpn-client.crt -noout -subject -issuer -dates

Ngemva kokuqhathaniswa kokhiye womphakathi, hambisa indlela esebenzisa ipheya: phakamisa umhubhe, qinisekisa ukuthi isitifiketi sethulwa futhi samukelwa, bese uhlola ukuthi yibuphi ubunikazi obuqoshwe isango. Uma ukhiye nesitifiketi kuhambisana kodwa ukuqinisekisa kusahluleka, iphutha lisekuthembeni, ekuhleleni ubunikazi noma kunqubomgomo yokufinyelela, hhayi kuphiweya.

Ukuze uhlehlele emuva, gcina ukhiye nesitifiketi kwesandulele kundawana enosuku bese ubuyisela kokubili ndawonye, hhayi okukodwa kokubili. Ukhiye ngaphandle kwesitifiketi sawo nesitifiketi ngaphandle kokhiye waso kuhluleka ngendlela efanayo ngaphandle, okwenza amapheya abuyiselwe ngengxenye abize kakhulu ukuwaqaqa ngehora lesibili ekuseni.