Ukungafani kwesitifiketi se-SSTP: igama okufanele iseva yakho ilinikeze

SSTP iklayenti le-SSTP lamukela iseva kuphela ngemva kokuphumelela kokuqinisekisa kwe-TLS, futhi lokho kuhlola kuqhathanisa igama, uchungechunge nenjongo. Igama livela kuphrofayela yokuxhumana, hhayi ekhelini ongase ukwazi ukuliphinga ngesikhathi esithile. Uma eyodwa kwezintathu ingafani, iklayenti libika inkinga yesitifiketi futhi alifiki neze kusikhombisi sokungena.

Igama lephrofayela linquma okuzohlolwa

I-SSTP isebenza nge-TLS phezu kwe-TCP 443, ngakho iklayenti liziphatha njenganoma iyiphi enye iklayenti ye-TLS: lithatha igama lomsingathi kuphrofayela, licela lelo gama futhi liqhathanise isitifiketi nalo. Uma uthayipha ikheli le-IP kuphrofayela, ukuqhathanisa kuba ukuqhathanisa kwamakheli e-IP, okungakufinyeleli ukugcwaliswa yizitifiketi eziningi zeseva.

Ngakho ukuhlola esipheqululini kungaphumelela kuyilapho i-VPN yehluleka, ngoba isiphequluli sisebenzise igama elihlukile kunelaphrofayela. Ukwehlukana okufanayo kuvela lapho i-DNS ye-split-horizon ixazulula igama lomsingathi we-VPN libe ikheli langaphakathi kuyilapho isiphequluli sifinyelele ikheli lomphakathi. Qala uhlanise iphrofayela negama lomsingathi elibhalwe phansi, bese uqhathanisa izitifiketi. Noma yini enye oyishintshayo ngaphambi kwalokho iwukucabanga.

Okufanele isitifiketi seseva sikuthwale

Amaklayenti esimanjemanje aqhathanisa nesandiso samagama ayizindlela esihloko, ngakho igama lomsingathi kufanele libe khona njengokufakwa kwe-DNS. Igama elivamile lodwa anele kuzinqwaba zokuqinisekisa zanamuhla, futhi uphawu lwenguquko luhlanganisa ilebula elilodwa, hhayi noma iyiphi isizinda esingaphansi osungiyo. Izitifiketi ezintathu zibonisa umngcele: igama elifanele ngenjongo engalungile liqinisekisa ubunikazi bese lihluleka ekuhlolweni kwenjongo, igama nesitifiketi esifanele kanye nesitifiketi esiphakathi esingekho kuyahluleka ochungechungeni, futhi igama elivela kuphela egameni elivamile lihluleka ngaphambi kokuba okukodwa kwalokho okubili kube nokubaluleka.

Isitifiketi sidinga futhi injongo yokuqinisekisa iseva, inani lokusetshenziswa kokhiye elinwetshiwe elishiwo ku-incazelo ye-SSTP yakwa-Microsoft, okungukuthi i-serverAuth enesihlonzi sento esingu-1.3.6.1.5.5.7.3.1. Ukusetshenziswa kokhiye nokuchungechunge okuvumelekile kuqedela isethi. Isitifiketi esikhona kuseva, esikhishwe ngegama elifanele kodwa sokwenza ukuqinisekiswa kweklayenti kuphela, sisahluleka.

Hlola uchungechunge newashi ngaphambi kwezifakazelo

Ukwehluleka kwesikhathi nokuthembela akhipha umphumela obonakalayo ofanayo nokungafani kwegama, futhi kokubili kutholakala kalula kunezinkinga zephasiwedi. Hlola iwashi leseva newashi leklayenti, bese ufunda uchungechunge ngendlela iklayenti elibona ngayo:

# from the client, or any host that runs openssl
openssl s_client -connect vpn.example.com:443 -servername vpn.example.com -showcerts </dev/null 2>/dev/null | openssl x509 -noout -subject -dates -ext subjectAltName
openssl s_client -connect vpn.example.com:443 -servername vpn.example.com -verify_return_error </dev/null
# on the Windows server that holds the SSTP listener
w32tm /query /status

Umyalo wokuqala ushicilela igama, iwindi lokusebenza namagama ayizindlela iklayenti elizowaqhathanisa nawo. Owesibili ubika amaphutha okuqinisekisa kanye nochungechunge njengoba kethulwe, futhi yilapho kuvela khona isitifiketi esiphakathi esingekho. Ku-Windows, umbuzo wensiza yesikhathi ukutshela ukuthi iwashi liyalungiswa noma livele lashiyeka.

I-CA yangaphakathi yengeza esinye isimo: iklayenti kufanele lithembele kuleyo CA. Faka impande yenhlangano ngomsele wayo wokusabalalisa ogunyaziwe, hhayi kusukela kukhasi elinikela ngesitifiketi esikhundleni, ngoba leso sinqumo siwukuphela kwemodeli yokuthembela encane.

Ukuqinisekisa iseva nokuqinisekisa umsebenzisi kuyizigaba ezilandelanayo ezinokwehluleka okuhlukene. Iphutha lesitifiketi lisho ukuthi iklayenti alizange lithembele kuseva, kuyilapho iphasiwedi enqatshiwe isho ukuthi lathembela kuyo futhi izifakazelo zazingalungile. Ukucisha ukuqinisekisa kwesitifiketi ukuze kufinyelelwe kusikhombisi sephasiwedi kususa isiqinisekiso esikhundleni sokulungisa. Ukuze ubonise ukuthi ingxenye esele yomzila iyasebenza, hlola igama lomsingathi nechweba elifanayo kusukela kuklayenti eselithembele ochungechungeni, futhi ushiye iphrofayela esetshenzisiwe injalo.

Lungisa igama noma isitifiketi bese uphinda uhlole

Izimo ezintathu zinquma ukulungiswa. Uma igama lephrofayela lingalungile, lungisa iphrofayela noma wengeze igama elingekho esitifiketini. Uma uchungechunge lungaphelele, faka isitifiketi esiphakathi kuseva. Uma injongo ingalungile, phinda ukhishe esikhundleni sokuxhuma ngezingcezu.

Ngemva koshintsho, xhuma futhi neklayenti elisekelwayo futhi uqinisekise ukuthi kuyavela isikhombisi sokungena, bese kuthi umhubhe unyuke. Bhala ethikithini igama lomsingathi elisetshenzisiwe, umkhiphi nosuku lokuphelelwa. Lowo mbhalo yiwo owenza ukunwetshwa okulandelayo kube umsebenzi ohleliwe esikhundleni sokuphazamiseka okunye, futhi ukhombisa umuntu olandelayo ukuthi yisiphi kwezimo ezintathu esasiphukile ngempela.