strongSwan send_cert: kuthi isikhathi sini esithunyelwa isitifiketi se-IKE

I-send_cert inquma ukuthi i-peer ithumela isitifiketi sayo noma cha, kuyilapho i-send_certreq icela enye ohlangothini. Hlola amalogi ngaphambi kokushintsha ukuthembela komamukeli.

Amasango abhala ukwehluleka kokuqinisekisa okuhlobene nezitifiketi, futhi umcabango wokuqala ukwengeza enye i-CA kumamukeli. Lokho kucabanga ukuthi isitifiketi safika futhi sanqatshwa. Elinye ithuba ukuthi asikaze sithunyelwe, futhi inqubomgomo yoxhumano yomthumeli inquma lokho. Thola ukuthi yikuphi kwalaba ababili okwenzeka ngaphambi kokushintsha ukuthembela.

I-send_cert ilawula ini ngempela

Ukuqinisekisa ngesitifiketi kudinga ukuthi isitifiketi sobunikazi bokugcina se-peer sifinyelele kolunye uhlangothi ngokushintshana kwe-IKE noma ngokuhlinzekwa kwangaphambili. Ku-swanctl isilungiselelo soxhumano send_cert sinquma ukuthi le ndawo yokugcina ifaka umthwalo wayo wesitifiketi: neze, njalo noma ifasked. Okuzenzakalelayo i-ifasked kuyithumela njengempendulo esicelweni sesitifiketi esivela ku-peer. Ukucela isitifiketi kuyisilungiselelo esihlukile, ngoba ukucela uhlangothi olunye ngesitifiketi salo akufani nokunikezela okwakho.

Ukusetshenziswa kwakudala kwe-ipsec.conf kwakusebenzisa i-leftsendcert ne-rightsendcert, futhi lawo magama ahambisana neziqeshana zasendaweni nezakude, hhayi ngqo ne-swanctl.

Funda umzamo owodwa ngaphambi kokushintsha uxhumano

Hlonza kusukela kumzamo owodwa olawulwayo, hhayi emcabangweni ojwayelekile wokuthi izitifiketi ziyabandakanyeka. Kokubili inqubomgomo kanye nobudlelwano obusebenzayo kungahlolwa.

swanctl --list-conns
swanctl --list-sas
journalctl -u strongswan --since "10 min ago" | grep -iE "cert|CERT"

Uhlu loxhumano lukhombisa inani elilungisiwe le-send_cert, futhi uhlu lwe-SA lukhombisa ukuthi yikuphi ukuxhumana okwavela ngempela. Ilogi yengeza imininingwane yezingxoxo: ukuthi isicelo sesitifiketi satholakala yini nokuthi umthwalo wesitifiketi uphumile yini. Ukwehluleka kokuqinisekisa okuvamile akubonisi inkinga yokulethwa, ngakho funa ukushintshana okuqondile ngaphambi kokuphetha noma yini. Bhala isigxivizo sikhathi somzamo ukuze iwindi lelogi lihlanganise ukuxhawulana kwezandla konke.

Ukuthembela komamukeli kuyisinqumo esihlukile

Ukulethwa nokuthembela kuyizici ezihlukile, futhi ukulungisa okukodwa akukulungisi okunye. Umamukeli kufanele abe ne-anchor yokuthembela ehlosiwe, athole uchungechunge olusebenzisekayo futhi ahambisane nobunikazi be-peer obulindelekile. Isitifiketi sobunikazi bokugcina esifika ngaphandle kwesitifiketi saso esimaphakathi sisahluleka ekuhlolweni okuqinile kochungechunge. Ngokuphambene, ukufaka i-CA akukuphoqi neze i-peer ukuthi ithumele isitifiketi sayo.

openssl x509 -in peer-chain.pem -noout -subject -issuer -dates

Ukuhlola kukhombisa ukuthi yimuphi umkhiphi osayine isitifiketi nokuthi siphela nini, futhi i-anchor yomamukeli kufanele ihambisane nalokho. Themba i-CA ekhiphayo ephethwe ukusetshenziswa, hhayi zonke izitifiketi ezimaphakathi ochungechungeni, ngoba ukuphakamisa sonke isitifiketi esimaphakathi sibe yimpande kwandisa ukuthembela kude kakhulu kunepheya elilodwa. Gcina ukuqinisekiswa kobunikazi kusebenza, ngoba uxhumano oluphelela kuphela lapho ukuqinisekisa kucishiwe akulona ilungiso. Lapho uchungechunge lungaphelele, lungisa ukuhlinzekwa hhayi inqubomgomo yomthumeli.

Shintsha umthumeli kuphela uma unobufakazi

Lapho ilogi ikhombisa ukuthi isitifiketi asikaze sithunyelwe futhi umamukeli wasicela ngempela, ukusetha i-send_cert ku-always kuwushintsho olufanele kulo xhumano. Kusebenzise ekulungiselelweni kwe-swanctl, layisha kabusha ukuxhumana futhi usungule isikhathi esisha esikhundleni sokusebenzisa kabusha i-SA ekhona. Qinisekisa ukuthi umthwalo wesitifiketi manje uyavela nokuthi umamukeli uyamukela ngokumelene ne-anchor ehlosiwe. Uma kungashintshi lutho, iphutha lalikolunye uhlangothi lokuthembela futhi isilungiselelo somthumeli sasingeyona imbangela.

Bhala ukushintshana okubonwe, i-anchor kanye nokuqinisekisa okuwumphumela kurekhodi lezinguquko. Ilungiso lesitifiketi elingakwazi ukuchazwa ngalawo magama liyingozi nje.

Izihloko ezihlobene