SoftEther ServerCertSet: ngenisa uchungechunge oluvuselelwe nge-vpncmd

I-Certbot ibika ukuvuselelwa okuyimpumelelo, amafayela asediskeni anezinsuku ezintsha, futhi amaklayenti asahlangana nobunikazi obudala. I-SoftEther igcina isitifiketi sayo se-SSL sesiphakamiso ekuhlelweni kwayo kwezinga lesiphakamiso, ngakho ifayela elisha elisediskeni alishintshi lutho kuze kungeniswe iqabunga nokhiye walo. Ukulandelana okungezansi kuhlanganisa ukungeniswa okukodwa kwesandla, isisonge esisebenza ngemva kokuvuselelwa ngakunye, kanye nokuhlola okufunda lokho isilaleli esikukhombisa ngempela. Isinyathelo ngasinye sishiya ubufakazi ongabuqhathanisa naso ngemva kokuvuselelwa okulandelayo.

Ifayela elivuselelwe alishintshi ubunikazi besiphakamiso

Ukukhishwa nokuthunyelwa yizigameko ezihlukene ezinezindlela zokwehluleka ezihlukene. Iklayenti le-ACME libhala amafayela kusikhombisi sogqo futhi lirekhode impumelelo; i-SoftEther iyaqhubeka nokusebenzisa isitifiketi esagcinwa ekuhlelweni kwayo. Ngakho isimo sokuphuma esinguziro sichaza amafayela, hhayi isevisi, futhi lezi ezimbili zingahluka uma nje kungekho obukayo. Thatha ukungeniswa njengegxathu lokuthunyelwa futhi ukuvuselelwa njengokufakwayo kwaso.

Lowo mehluko uphinde uchaze ukwehluleka kwengxenye okudidayo: isitifiketi esidala siqhubeka sisebenza kuze kuphele isikhathi saso, ngakho ekuqaleni akukho okubonakala kuphukile. Uma sepedwa yisikhathi, wonke amaklayenti ehluleka ngesikhathi esisodwa, okubonakala njengokuphazamiseka hhayi njengegxathu lokuthunyelwa elingeziwe. Ukuhlola ubunikazi obukhonjisiwe ngemva kokuvuselelwa ngakunye kuguqula lokho kumangala kube ukubheka okujwayelekile.

Khetha inselele ehambisana nesilaleli

Isitifiketi kufanele sisho isiphakamiso esiqinisekiswa amaklayenti, ngakho sebenzisa igama le-DNS lomphakathi esikhundleni selebula langaphakathi noma ikheli. I-HTTP-01 idinga ukuthi inselele iphendulwe embobeni 80 isikhashana, okuyisilaleli sesikhashana futhi akusoze kube isizathu sokuhambisa imbobo ye-SoftEther uqobo. I-DNS-01 ifakazela ukulawula ngerekhodi futhi ayidingi i-HTTP engenayo nhlobo.

Ukuvuselelwa okungenakuqashwa kusho ukuhlanganiswa kwe-DNS okuzenzakalelayo ngezifakazelo ezigcinwe endaweni eyodwa, hhayi irekhodi le-TXT elibhalwa ngesandla njalo ezinyangeni ezimbili. I-wildcard ishintsha uhlobo lwenselele, hhayi isidingo salokho kuzenzakalela. Nquma lokhu ngaphambi kokuba kube khona isitifiketi sokuqala, ngoba ukushintsha uhlobo lwenselele kamuva kusho ukuthinta ukuhlelwa kweklayenti nomthombo womlilo kanyekanye.

Gcina izinto zomsebenzi zihlelekile ngesikhathi usuke ulapha. Iqabunga nezitifiketi eziphakathi kufika njengamafayela ahlukene nanjengokuba ifayela elilodwa lomchungezo ohlangene, ukhiye oyimfihlo uhlukile futhi, futhi ukungeniswa kudinga umchungechunge nokhiye ohambisanayo, hhayi isitifiketi somphakathi sisodwa.

Ngenisa umchungechunge ezingeni lesiphakamiso

Yenza ikhophi yokuphepha yokuhlelwa kwesiphakamiso futhi uqinisekise ukuthi usakwazi ukufinyelela isixhumanisi sokuphatha ngaphambi kokuthinta isitifiketi. Xhuma njengomphathi wesiphakamiso hhayi umphathi we-Virtual Hub, ngoba isitifiketi singesento yesiphakamiso. Bese ulayisha umchungechunge nokhiye ngendlela ephelele, kusukela kumafayela akwazi ukuwafunda i-akhawunti esebenzisa umyalo. Qaphela ukuthi izindlela ziphelele ngoba umyalo uzixazulula kusukela kusikhombisi sokusebenza senqubo eyasebenzisa i-vpncmd:

ServerCertSet /LOADCERT:/etc/letsencrypt/live/vpn.example.com/fullchain.pem /LOADKEY:/etc/letsencrypt/live/vpn.example.com/privkey.pem

Funda okukhishwe umyalo esikhundleni sokucabanga ukuthi kuphumelele, bese ufunda umchungechunge futhi esikhundleni sokwethemba ifayela olinikeze lona. Umngcele phakathi kokwakhiwa okungenisa ingqikithi ephelele ye-PEM nokwakhiwa okuthatha kuphela isitifiketi sokuqala akubhalwanga endaweni eyodwa, ngakho ukuhlola yikho okunqumayo kokwakhiwa okungaphambi kwakho. Bala izitifiketi isilaleli esizikhombisayo; iqabunga elingenabo abaphakathi wuphawu lomngenisi osebenzise ibhlokhi yokuqala kuphela.

Gcina ukhiye ongenisiwe ufundeka kuphela i-akhawunti esebenzisa isiphakamiso, futhi gcina iphasiwedi yokuphatha ngaphandle komlando we-shell. Kulokhu kungeniswa kokuqala, bhala iphasiwedi endaweni yokubuza esikhundleni sokuyidlulisela njengengxabano yomyalo. Le mikhuba emibili ayibizi lutho futhi isusa indlela evame kakhulu yokuthi ukuthunyelwa kwesitifiketi kuveze okuthile obekufanele kukuvikele. Yenza lokho ngaphambi kokungeniswa kokuqala, hhayi ngemva kwakho.

Xhuma ukuthunyelwa, hhayi ukuvuselelwa

Uma ukungeniswa kwesandla kusebenza, faka lezo zinyathelo ngqo kwisisonge esincane futhi usibize kusukela kuklayenti le-ACME ngemva kokuvuselelwa okuyimpumelelo. I-Certbot isetha i-RENEWED_LINEAGE ne-RENEWED_DOMAINS kwi-hook, ngakho isisonge singasebenza esitifiketini esisodwa kumshini ophatha eziningi. Hlunga ngokogqo esikhundleni sokuphendula kukho konke ukuvuselelwa kumsingathi. Isisonge siyikhodi yokuthunyelwa esebenza ngamalungelo esiphakamiso, ngakho sihlole njenganoma yimuphi omunye umbhalo kuleso sikhundla.

certbot renew --deploy-hook /usr/local/sbin/softether-deploy.sh

I-hook esebenza ngaphandle kokuqashwa idinga isitoreji sayo sezifakazelo esivikelwe kanye nesiginali yokwehluleka efinyelela umuntu. Uma ukukhishwa kuphumelela kanti ukungeniswa kwehluleka, phinda ukungeniswa esikhundleni sokucela esinye isitifiketi, ngoba isicelo sesibili sifihla iphutha lokuthunyelwa ngemva kwefayela elisha. Imibhalo yokuvuselelwa ye-Certbot isho ngokucacile ukuthi ukusebenza okungabuyekezi lutho kuwumphumela ojwayelekile, ngakho i-hook yikho okuhlukanisa lezi ezimbili.

Qhathanisa umchungechunge okhonjisiwe nefayela

Funda isilaleli, hhayi idiski. Xhuma embobeni ebheke kumaklayenti ngegama lesiphakamiso elisetshenziswa amaklayenti, bese uqhathanisa umnyakazo womunwe nomchungechunge olethiwe nogqo olwafakwa yi-hook. Imiyalo emibili ihlanganisa lokho, futhi eyokuqala ikhombisa nokuthi izitifiketi eziphakathi ziyafika yini:

openssl s_client -connect vpn.example.com:443 -servername vpn.example.com -showcerts </dev/null 2>/dev/null | grep -c 'BEGIN CERTIFICATE'
openssl s_client -connect vpn.example.com:443 -servername vpn.example.com </dev/null 2>/dev/null | openssl x509 -noout -subject -dates -fingerprint -sha256

Bese wenza ukuxhumana okusha kweklayenti, ngoba izikhathi ezasungulwa ngaphambi kokungeniswa zaqinisekiswa ngobunikazi bangaphambili futhi azifakazeli lutho ngobusha. Uma amaklayenti ebophela iqabunga elidala, adinga ukubuyekezwa okuhleliwe ngisho lapho umchungechunge womphakathi uvumelekile, futhi lowo msebenzi ungaphansi kwe-runbook efanayo nokuvuselelwa. I-proxy ephambene phambi kwesevisi ingakhombisa isitifiketi esihle kuyilapho isilaleli se-VPN sisabambe esidala, yikho ukuhlola kufanele kusho imbobo amaklayenti afinyelela kuyo ngempela. Bhala umnyakazo womunwe eduze kosuku lokuvuselelwa, ukuze ukuqhathanisa okulandelayo kube ukuhlola hhayi isenzo senkumbulo.