Isitifiketi se-VPN esizisayinele: sisho ukuthini futhi sithemba ini

Lapha izinkolelo ezimbili zenza umonakalo omkhulu: ukuthi isitifiketi se-VPN esizisayinele sisho ukuthi umhubhe awugxumiwe, nokuthi ukufaka noma yini ecelwe iklayenti le-VPN kuthinta i-VPN kuphela. Akukho kuzo okusinda lapho kuhlangana nokusetshenziswa kwangempela. Isitifiketi esizisayinele sichaza ubudlelwano bokusayina, hhayi isinqumo sokuphepha, futhi ububanzi bokuthemba okwengezayo buncike ekutheni kungena kusiphi isitoreji. Ngibonile ithimba losizo lingenisa impande yomhlinzeki kumshini we-Windows ukuze lithulise isixwayiso esisodwa, bese lichitha intambama yonke lichaza ukuthi kungani isiphequluli sayeka ukukhononda ngephothali engahlobene. Izingxenye ezimbili zalo mbuzo zihamba ndawonye, ngakho zithathe njengento eyodwa.

Isitifiketi akusona isitoreji sokuthemba

Ifayela elivezwa iseva lithwala ukhiye womphakathi, igama lesihloko, igama lomkhiphi, izinsuku zokusebenza nezandiso. Ukuzisayinela kusho ukuthi isihloko nomkhiphi bayinto eyodwa futhi isiginesha iqinisekiswa ngokhiye wesitifiketi uqobo. Akukho lutho kuleyo ncazelo okusho ukuthi uxhumano lubuthakathaka, futhi akukho lutho olusho ukuthi iklayenti lizokwamukela.

Ukwamukela kuvela kwenye indawo: ifayela le-CA olikhomba iklayenti, isigxivizo somunwe osiqhathanisa ngesandla, noma impande esivele ikusitoreji esifundwa iklayenti. Ukusetshenziswa kungaba nephila ngokuphelele kuyilapho isitifiketi saso singehluleka kuzo zonke izivivinyo zomphakathi. openssl verify ngokumelene nenqwaba yesistimu kuzobika umkhiphi ongaziwa, futhi lowo mbiko ulungile, akusona isiphambeko.

Inketho ye-ca ye-OpenVPN yisimo esicace kakhulu sokuthemba okulinganiselwe kuhlelo lokusebenza. Leyo fayela ibalula izingxenye zokubamba ezizokwamukelwa iklayenti, futhi ingaqukatha i-CA eyodwa yangasese noma ekusetshenzisweni okuncane isitifiketi sesiseva uqobo esizisayinele. Inguqulo 2.6 yamukela futhi --peer-fingerprint ukuze kubekwe isigxivizo somunwe se-SHA-256 esikhundleni sokusabalalisa ifayela le-CA. I-WireGuard isekudeshani nakakhulu: ayinazo nhlobo izitifiketi, inokhiye womphakathi ongaguquki womlingani ngamunye, ngakho umbuzo wokuzisayinela awusebenzi kuyo.

Lapho ufaka khona ukuthemba kunquma ukuthi ubani ozokuthola njengefa

Beka isitifiketi esifanayo ezindaweni ezintathu futhi uthola izindawo ezintathu zokuqhuma ezihlukene. Inqwaba efundwa iklayenti le-VPN kuphela ithinta lelo klayenti. Impande kusitoreji sesistimu yokusebenza ithinta lonke uhlelo oluxhumana naleso sitoreji. Isiphequluli esinesizindalwazi saso sokuthemba singazishaya indiva zombili, yingakho isixwayiso singasinda ngemva kokungenisa okwabonakala kusebenza.

Ku-Debian noma Ubuntu, ukubeka ifayela ku-/usr/local/share/ca-certificates/ nokusebenzisa i-update-ca-certificates kushintsha inqwaba yesistimu yonke. Ku-Windows, i-certutil -addstore -f Root ibhala kusitoreji somshini futhi idinga isiphakamiso esiphakanyisiwe, kuyilapho ukwengeza i--user kuqondisa kusitoreji somsebenzisi wamanje esikhundleni salokho; lezi ezimbili azikwazi ukushintshwa. I-Firefox igcina isizindalwazi sayo se-NSS, ngakho ukungenisa kwezinga le-OS kungase kungabonakali lapho.

Ububanzi bubalulekile ngenxa yalokho okungenziwa yisiphathimandla. I-CA ekhiphayo ingasayinela amagama engahlobene nawo, ngakho noma yini ethemba leso sitoreji izokwamukela lezo ziginesha. Iphepha elilodwa eliboshiwe alikwazi ukwenza lokho; liqinisekisa ubunikazi obulodwa bomlingani. Uma umgomo uwukuthi i-VPN eyodwa ixhumeke, i-CA elinganiselwe kuhlelo lokusebenza noma iphepha eliboshiwe iyafinyelela, kuyilapho impande yesistimu yonke iwukuyekelela okukhulu kakhulu kunalokho okudingwa uphawu.

Usagxuma ngaphandle kwe-CA yomphakathi

Ukuxhawana kwe-TLS kukhipha okhiye besikhathi, kungakhathali ukuthi isitifiketi somlingani sixhumana nento ose uyithemba noma cha. Ukuzisayinela akusho umbhalo osobala, futhi akusho ukuthi ithrafikhi iyafundeka isendizeni. Kusho ukuthi iklayenti alinasizathu sangaphambili sokukholelwa ukuthi ukhiye ungesiseva esiwucelile.

Kulelo gebe kulapho izihlaseli zangempela zihlala khona. Iklayenti elilungiselelwe ukwamukela noma yisiphi isitifiketi, kungaba ngesilungiselelo sokuqinisekisa esikhutshaziwe noma ngenkinobho yokuthemba-noma-kanjalo eyacindezelwa kanye yakhohlwa, lizogxuma ngokujabula kunoma ngubani ophendulayo. Ukugxambukela kwenzeka esigabeni sokuqinisekisa ubunikazi, ngaphambi kokuthi idatha yohlelo lokusebenza inyakaze. Ukugxuma ngaphandle kokuhlola ubunikazi kugcina umbonisi ongenzi lutho ngaphandle futhi akwenzi okunye okuningi.

Ukwethemba umkhiphi akweqi ukuhlolwa kwegama

Ukuqinisekisa uchungechunge, ukufanisa igama nenjongo yesitifiketi kuyizinqumo ezihlukene. Uchungechunge lungasebenza kuyilapho igama lingalungile, futhi igama lingafana kuyilapho isitifiketi sikhishwe ngendima ehlukile. RFC 5280 ichaza izinkambu ezithwala leyo mikhawulo, futhi ukuthi iklayenti liyisebenzisa ngokuqinile kangakanani kuyindaba yohlelo lokusebenza ngalunye.

I-OpenVPN yenza ukwehlukana kubonakale. I-verify-x509-name ibopha isihloko esilindelekile ngokufanisa i-name, i-name-prefix noma i-subject. I-remote-cert-tls server idinga ukuthi isitifiketi somlingani sisebenze njengesitifiketi seseva, okwenqaba isitifiketi seklayenti kuphela ngisho noma umkhiphi ethenjwa. Akukho kulokhu kulungiselelwa okubili okushintshwa ngokuthumela ifayela le-CA.

Hlola isitifiketi ngaphambi kokunquma noma yini:

• openssl x509 -in server.crt -noout -subject -issuer -dates -ext subjectAltName ibonisa ukuthi ubani wasikhipha, ngamagama api futhi kuze kube nini.
• openssl verify -CAfile ca.crt server.crt ihlola ukuthi uchungechunge ozothumela lona luqinisekisa ngempela iphepha yini.
• openssl s_client -connect vpn.example.net:443 -servername vpn.example.net -CAfile ca.crt -verify_return_error isebenza kumaphoyinti okugcina e-TLS njengephothali yewebhu; iphrothokholi ye-OpenVPN ku-1194 ayiwona umfudlana we-TLS ovamile, ngakho lokho kuhlola akusebenzi lapho.

Isitifiketi esinosuku oluphelelwe yisikhathi, esingenayo i-subjectAltName yegama oxhumana nalo, noma esingenakho ukusetshenziswa kwe-serverAuth siyehluleka kungakhathali ukuthi ibhange lafakwa ngokucophelela kangakanani.

Izinhlolovo ezinhlanu ngaphambi kokwamukela esisodwa

Qhathanisa isigxivizo somunwe ngomzila okungewona uxhumano oluzama ukulungisa: ikhonsoli, isifaki osuvele unaso, ifayela lokucwangisa elisayiniwe. I-openssl x509 -in server.crt -noout -fingerprint -sha256 kuseva kanye nelo nani elifanayo kungxelo yeklayenti kuyanele ukwazi ukuthi ubheka into eyodwa.

Ngemva kwalokho, nquma ukuthi ufaka ini: iphepha elilodwa noma isiphathimandla esingakha okwengeziwe. Bese unquma ukuthi iyaphi, futhi usho izinhlelo zokusebenza ezifunda leso sitoreji. Bhala indlela yokukhipha usakukhumbula, ngoba themba-bese-uya-phambili yindlela okungeniswa kwesikhashana okuba ngokunomphela.

Ekugcineni, hlela ushintsho. Isitifiketi noma isigxivizo somunwe esiboshiwe kufanele sibuyekezwe ngomzila ofanayo othembekile lapho isitifiketi sijika, futhi i-CA yangasese inomjikelezo wayo wokuphila wokukhipha nokuhoxiswa. Uma ukhiye wangasese uphuma, ukuthemba kabusha ikhophi yesitifiketi esifanayo akulungisi lutho; ubunikazi kufanele bushintshwe.

Uma isixwayiso sisinda kuzo zonke izinhlolovo ezinhlanu, umbuzo owusizo akusiwona ukuthi iyiphi inkinobho esithulisa, kodwa ukuthi yisiphi isitoreji iklayenti elisifunda ngempela nokuthi leyo mpande yavela kuphi. Phendula lokho, futhi ukungenisa osuzokwenza kuzoba yisinqumo esikhundleni sokusabela.