I-SSTP ne-IKEv2 zisebenzisa izilawuli zezitifiketi ze-RRAS ezihlukene

Uma ushintsha «isitifiketi se-VPN», kungenzeka ushintshe isevisi engalungile. I-RRAS igcina okungenani izilawuli ezintathu zezitifiketi, ngayinye ingeyephrothokholi ehlukile nendima ehlukile yokuxhumana. Ukuqamba iphrothokholi kuqala kushintsha ukuqagela okuyingozi kube ukushintsha kokubopha okukodwa okubuyisekayo. Konke okungezansi kuncike kuleso sigwebo esisodwa.

Qamba iphrothokholi ngaphambi kwesitifiketi

Isilaleli se-SSTP sethula isitifiketi se-TLS kuklayenti eziphatha njenge-HTTPS. Ukuxhumana kwe-IKEv2 ye-site-to-site engenayo kumemezela ubunikazi besiseva futhi kuqinisekisa izitifiketi zoontanga ngokumelene nempande ethembekile. Incazelo ye-site-to-site yesixhumi esibonakalayo ngasinye ithwala ubunikazi bayo bemishini.

Lezi yizilawuli ezintathu ezinobubanzi obuthathu. Ukuzihlanganisa kukhiqiza ushintsho olubonakala lusebenza kwiphrothokholi eyodwa futhi lungenawo umphumela kwelinye, okubi kakhulu kunokuhluleka okusobala. Bhala ukuthi iyiphi iphrothokholi ehlulekile, yiluphi uhlangothi olwethule isitifiketi nokuthi yiluphi uhlangothi olwenqabile ngaphambi kokuthinta noma yini.

I-SSTP iwukubopha kwe-HTTPS

Ekusetshenzisweni kwe-Remote Access okusekelwayo, i-Set-RemoteAccess iveza ipharamitha ye-SslCertificate esetshenziselwa ukuxhumana kwe-SSTP kanye nendima ye-DirectAccess ehlobene ne-HTTPS.

Ububanzi bayo bokuqinisekisa nokwethulwa bulandela ukucushwa kwe-Remote Access, ngakho ukushintsha kokubopha okukodwa kungafinyelela ekuxhumaneni noma kunodi engaphezu kweyodwa. Ekusetshenzisweni okulinganisa umthwalo, lobo bubanzi buhlanganisa yonke inodi ehlanganiswa ukucushwa. Ukushintsha inodi eyodwa nokuhlola iklayenti elilodwa kushiya ezinye zethula iqabunga elidala, futhi lolu wuhlobo loshintsho oluyingxenye olusinda iwindi lokulungisa.

Ngaphambi kokubuyekeza, qinisekisa igama lesevisi elilindelekile, uchungechunge, ukusebenza, ukusetshenziswa okuhlosiwe nokutholakala kokhiye oyimfihlo. Isitifiketi kufanele sihambisane negama iklayenti elizolihlola, futhi ilebula ye-adaptha ayilona lelo gama.

I-IKEv2 engenayo inepharamitha yayo

I-Set-VpnAuthProtocol iconga ubuqiniso be-IKEv2 ye-site-to-site engenayo, futhi i-CertificateAdvertised inikeza isitifiketi lapho imodi yokuqinisekisa yomhubhe isisebenzisa. Lona akuwona umyalo ojwayelekile wokukhetha noma yisiphi isitifiketi seseva kusibungu.

Hlukanisa izinto ezimbili: iqabunga isiseva esiliveza njengobunikazi baso, nempande esiyisebenzisayo ukwamukela izitifiketi zoontanga. Ukukhetha ukuthi iyiphi inkampani ekhiphayo oyithembayo akusho lutho mayelana nokuthi iliphi iqabunga isiseva esilivezayo.

Ubunikazi besixhumi esibonakalayo se-site-to-site ngasinye busetwa nge-Set-VpnS2SInterface. Akusona ngokuzenzakalela isitifiketi se-SSTP, ngisho noma zombili zisemgwini ofanayo kumishini efanayo.

Hlola umgadli kuqala

Umbono ogxilile womgwaqo womishini wasendaweni ubonisa imethadatha yomphakathi ngaphandle kokuthumela ngaphandle into eyimfihlo:

Get-ChildItem Cert:\LocalMachine\My |
    Select-Object Thumbprint, Subject, HasPrivateKey, NotAfter

Lolo hlu luyisiqalo, akulona ukuhlolwa kokufaneleka. Hlola amangeno e-SAN, ukusetshenziswa kokhiye okunwetshiwe, uchungechunge nokufinyelela kwe-akhawunti yesevisi kukhiye oyimfihlo wephrothokholi oyicongayo.

Isitifiketi esifakelwe ubunikazi beklayenti lefu ezingahlobene asifaneleki ngoba nje sivele emgwini ofanayo. Ukubonakala akukona ukufaneleka, futhi uphawu lweminwe kusithombe-skrini alufakazeli lutho mayelana nokuthi i-akhawunti yesevisi ingakwazi yini ukufunda ukhiye. Hlola lokho kufinyelela ngokucacile, ngoba imvume yokhiye engekho ihluleka kuphela lapho isevisi iqala kabusha futhi izama ukusebenzisa isitifiketi.

Rekhoda ukubopha kwamanje futhi uqinisekise ukuthi usengafinyelela kusibungu ngolunye uhlobo ngaphambi kokukushintsha. Indlela yokubuyisela iyingxenye yoshintsho, hhayi yesehlakalo esilandelayo.

Ukuvuselela akukona ukusebenza

Ukukhipha isitifiketi kabusha kuyisenzo esihlukile ekukhetheni kwasevisi esisebenzayo. Iqabunga elisha lingagcina ubunikazi be-DNS obuhlosiwe futhi liphathe uphawu lweminwe oluhlukile, ngakho akukho okukhombisa kulo kuze kube ukubopha kubuyekezwa. Ukuvuselela kushintsha into; ukusebenza kushintsha isethenjwa kuyo. Ukuhlanganisa lezi ezimbili yisizathu esenza isitifiketi esivuselelwe ngendlela efanele sihlale singasetshenziswa amasonto.

Sebenzisa ushintsho olusekelwayo ewindini elifanele, kuhlanganise noma yikuphi ukuqalisa kabusha okubhaliwe, bese uhlola isitifiketi kusuka ekuxhumaneni okusha kwephrothokholi ehlosiwe. Iseshini yeklayenti egciniwe ingase ibonise iqabunga elidala futhi yenze ushintsho olulungile lubonakale luphukile.

Hoxisa isitifiketi sangaphambilini ngokusebenzisa inqubo ejwayelekile kuphela ngemva kokuthi lokho kuhlola kudlulile. Isethenjwa se-Set-RemoteAccess sibhala ububanzi bepharamitha ye-SSL, kuhlanganise nomphumela wayo ekusetshenzisweni okulinganisa umthwalo, futhi leyo yingxenye okufanele ifundwe ngaphambi koshintsho lokubopha.