Isitifiketi somsebenzisi esizisayinele? Iseva ye-VPN isala ukusamukela

Umqhubi uthumela ikheli negama lomsebenzisi, futhi umsebenzisi ucela ifayela le-CA, isitifiketi nokhiye. Ukukhiqiza lezi zinto ezintathu endaweni kubonakala njengesinyathelo esilandelayo esicacile. Umphumela yisitifiketi esikholelwa kuphela umshini wakho. Ukwethemba kweseva kubambelele ku-CA ongayilawuliyo, ngakho ukuxhawulana kuphela ngaphambi kokuba kuqale.

Ukwethemba kuhlala kuseva, hhayi kuphrofayela yakho

Ukuqinisekiswa ngesitifiketi kuwukuqhathanisa. Umsebenzisi wethula isitifiketi; isango lihlola ukuthi sisayinwe yini enye ye-CA ekumisweni kwayo.

Iphrofayela yakho isho ifayela le-CA umsebenzisi okufanele alisebenzise ukuqinisekisa iseva. Ayikwazi ukusho i-CA iseva okufanele iyisebenzise ukuze ikuqinisekise. Leyo ngxenye yokumisa ayeyakho.

Isitifiketi ozikhisele sona siyahluleka kulokhu kuqhathanisa ngisho naso siphelele ngokobuchwepheshe. Sinesiginesha evumelekile, isihloko nezinsuku, kodwa umkhiphi yi-CA isango elingakaze lizwe ngayo. Iphutha livela ngesikhathi sokuxhawulana, ngemva kokuba iseva isicele isitifiketi. Akukho lutho kuphrofayela yomsebenzisi olungashintsha impendulo.

Kungani isitifiketi esizisayinele singenakuthatha indawo yaso

Isitifiketi esizisayinele sisayinwa ngokhiye waso. Isiginesha iqinisekiswa ngokumelene nefayela elifanayo, okusenza sizihambisane futhi singabi nalutho njengombhalo wokuqinisekisa wesango lomunye umuntu.

Isango alibuzi ukuthi isitifiketi siyahambisana yini ngaphakathi. Libuza ukuthi umkhiphi othembekile usisayinile yini.

Yingakho imilayezo yephutha iyadida. Umsebenzisi angabika ukuhluleka kokuqinisekisa okuzwakala njengenkinga yeseva, kuyilapho iseva irekhoda umkhiphi ongaziwa. Kokubili kuchaza ukungahambisani okufanayo kusuka ezinhlangothini eziphikisanayo.

Indlela ye-CSR igcina ukhiye wakho wangasese

Usengenza iningi lomsebenzi endaweni. Khiqiza ipheya lokhiye, yakha isicelo sokugunyazwa kwesitifiketi sizungeze ingxenye yomphakathi, bese uthumela leso sicelo kumqhubi. Isicelo kuphela esiphuma emshinini wakho. Ingxenye yangasese ihlala lapho uyikhiqize khona.

openssl req -new -newkey rsa:3072 -nodes -keyout client.key -out client.csr -subj "/CN=laptop-01"

Umqhubi usayina isicelo nge-CA yakhe futhi abuyisele isitifiketi. Ukhiye wakho wangasese awukaze uhambe, futhi umphumela uxhuma kumbambo isango elithembayo.

Izinsizakalo eziphethwe zivame ukweqa i-CSR futhi zikhiphe yonke inqwaba. Lokho kuwukushintshana okunengqondo lapho umhlinzeki ofanayo esevele eqeda umhubhe futhi ephethe i-CA. Ukugcinwa kokhiye akuthuthuki ngokuwugcina, ngoba umhlinzeki angakha omusha noma nini.

Amaqoqo angeniswa, awafakwa

Amaqoqo omhlinzeki anamagama azwakala njengokuphepha ngokuvamile ayiphrofayela ye-OpenVPN. Aqukethe ukumisa futhi ngezinye izikhathi izitifiketi, futhi awafaki lutho. Ngenisa ifayela kumsebenzisi okhuluma iphrothokholi, futhi uxhumano lusemisiwe.

Umthetho wokuphatha uvela kokugqukethwe. Uma iphrofayela ifaka ukhiye wangasese, uwumbhalo wokuqinisekisa futhi ufanele ukunakekelwa okufana nephasiwedi: akukho i-imeyili, akukho isitoreji, akukho folda yokulanda eyabiwe. Uma umqhubi enikeza ca.crt, client.crt ne-client.key ngokwehlukana, zigcine ndawonye ngezimvume eziqinile futhi ukhombe iphrofayela kuzo.

Engeza izinto zokuhlola umqhubi okungenzeka wazidlula

Iphrofayela ekhiqizwe i-roota ngezinye izikhathi ayinakho ukuqinisekiswa kozakwabo. I-remote-cert-tls server idinga ukuthi isitifiketi sozakwabo sibe nenjongo yokuqinisekisa iseva, ukuze isitifiketi somsebenzisi singadlalwa futhi njengeseva. Lowo mugqa owodwa uwushintsho oluncane olunesizathu esicacile.

I-verify-x509-name iya phambili lapho umqhubi engasho isihloko noma i-SAN elindelekile. Kokubili kuyizingezo ezincane kuphrofayela, futhi kokubili kuyavikelwa. Hlola lokho okutholile ngaphambi kokungenisa.

openssl x509 -in client.crt -noout -issuer -subject -dates
openssl verify -CAfile ca.crt client.crt

Izilungiselelo zokuqinisekisa akuzona ukulungiswa kochungechunge olwephukile. Uma umkhiphi ungalungile, impendulo isitifiketi esivela ku-CA efanele, hhayi ifulegi elicisha ukuhlola. Ukucisha ukuqinisekisa kuguqula ukuhluleka kokuqinisekisa kube ukuhluleka okungabonwanga.

Cela inqwaba eyodwa: isitifiketi sesiphathimandla ngefomethi ye-PEM, isitifiketi somsebenzisi esisayinwe yileso siphathimandla, ukhiye oyikhiqizele wena noma ofike ngomzila omethembayo, negama leseva eliqondile okufanele isitifiketi siveze lona. Bhala usuku lokuphelelwa yisikhathi kumlayezo ofanayo, ngoba isitifiketi esiphelelwe yisikhathi sibonakala njengokonakala kwenethiwekhi ezinyangeni ezingemuva.