Amagama amanye esihloko: i-VPN server ibonakala kanjani

Iklayenti lakho lenqaba isitifiketi esihlolwa kahle uchungechunge lwaso, kanti iphutha lithi igama alihambisani. Lowo mlayezo awukhulumi ngokuthi ubani wasayina isitifiketi. Ukhuluma ngesandiso samagama amanye esihloko, esiphethe ubunikazi isitifiketi esivunyelwe ukusimelela, nokuthi ubunikazi obusimisele ukusebenza ngakho buyavela yini lapho ngendlela efanele. Ukwethemba luphendula ukuthi ubani wasayina, kanti ukuhlolwa kwegama luphendula ukuthi ingeyiphi ihhashi.

Iklayenti liqhathanisa ini ngempela

Iklayenti liguqula ukumiswa kwakho kube ubunikazi obuyisithenjwa: igama lehhashi, ikheli, noma isihlonzi esikhethekile sephrothokholi. Bese lifuna lobo bunikazi esitifiketini, lisebenzisa imithetho yokuhambisana yephrathokholi esetshenziswayo. Kubalwa kuphela okufakiwe kohlobo olufanayo, ngakho okufakiwe kwe-DNS akukwazi ukwanelisa ikheli, futhi ukuqhathaniswa kwenzeka noma ngabe ubani ubheka isitifiketi noma cha.

Uma ubunikazi obuyisithenjwa bungekho kuleso sandiso, ukuhlolwa kuyahluleka ngisho noma igama elijwayelekile elidala lihambisana. Isitifiketi singakhishwa ngokusemthethweni enkampanini futhi sibe singalungile ku-vpn.example.com uma igama lingakaze lifakwe. Ukuhluleka wukungahambisani kwegama ngisho noma isitifiketi singeqiniso.

Amagama e-DNS namakheli e-IP kuyizinto ezifakiwe ezihlukene

Iphrofayela ekhomba ku-203.0.113.10 kuyilapho isitifiketi sibala kuphela i-vpn.example.com iyenqatshwa, ngoba amaphakethe ayafika kodwa ubunikazi abuhambisani. Amagama e-DNS namakheli angokoqobo agcinwa njengezinhlobo ezahlukene zokufakiwe, futhi elinye alikaze lithathe indawo kwelinye. Yingakho isevisi ingafinyeleleka ngekheli kodwa ingasetshenziswa ngophrofayela osebenzisa lelo kheli.

Izimpawu ezijokerayo nazo zilandela imithetho yazo: isijokera sihlanganisa ilebula elilodwa, hhayi wonke amagama angaphansi kwesizinda. Ukuqhathanisa kwe-DNS akunaki ukuthi uhlamvu lungaphezulu noma lungezansi, kanti ezinye izinhlobo zesihlonzi ziyakunaka, ngakho inani elibonakala lifana esibonakalayo lingahluleka ekuqhathanisweni okuqinile. Hlola imithetho yokuhambisana yohlobo lobunikazi olusetshenziswayo esikhundleni sokuqhathanisa imigqa ngamehlo. Ukwengeza igama esandisweni kuyisinqumo sokukhishwa, hhayi into engatholakala ngokumiswa kweklayenti.

Hlola isitifiketi esasetshenziswa ngempela ukuxhumana

Funda okwethulwa yindawo yokugcina esebenzayo, hhayi ifayela elikopishwe ekhasini lokuphatha. Isilinganisi somthwalo noma isimo esikhundleni kungase kwethule okuhlukile kunestitifiketi esalayishwa ezinyangeni ezedlule, futhi lowo mehluko awubonakali kukhonsoli.

openssl s_client -connect vpn.example.com:443 -showcerts </dev/null | openssl x509 -noout -text

Ibhlokhi lamagama amanye esihloko, uchungechunge lomkhiphi nesikhathi sokusebenza kuyingxenye yokufunda okukodwa, ngoba ukungahambisani kwegama nokuphela kwesikhathi kukhiqiza amaphutha ahlukene. Qhathanisa igama ngalinye kulelo bhlokhi nobunikazi obumiswe kuphrofayela, uhlamvu ngohlamvu, futhi uphawule ukuthi uluhlobo luni. Ukuphinda umyalo mayelana nesimo sekheli lendawo yokugcina kukhombisa ukuthi isitifiketi sihlanganisa kokubili ubunikazi noma okukodwa kuphela. Ukwethulwa kobunikazi okunobungani kukhonsoli yokuphatha akusona umphumela wokuqinisekisa futhi akusho lutho ngamagama aqukethwe isandiso.

Igama elijwayelekile akusona umthombo weqiniso wanamuhla

Iziphequluli kanye nemitapo eminingi ye-TLS manje azikunaki igama elijwayelekile ekuhambiseni igama lehhashi futhi zibheka isandiso. Amanye amaklayenti e-VPN asaqhathanisa kuqala igama elijwayelekile noma abuyele kulo uma isandiso singekho, futhi yingakho isitifiketi esisodwa singadlula kusiphequluli sehluleke kuklayenti. Ukuhlolwa kwegama okufanayo kungadlula endaweni eyodwa kwehluleke kwenye ngaphandle kokuthi isitifiketi sishintshe nakancane.

Thola ukuthi iklayenti lakho lifunda yiphi indima ngaphambi kokunquma ukuthi isitifiketi asilungile. Amaklayenti amabili endaweni yokugcina eyodwa angase angavumelani, futhi ukungavumelani kungulwazi mayelana neklayenti hhayi isitifiketi.

Lungisa ukukhishwa noma iphrofayela, hhayi ukuhlolwa

Uma iphrofayela yakhiwe ngasegameni elikhombisayo, kungaba yiqondise egameni lehhashi elibhaliwe noma iphinde ikhiphe isitifiketi salelo gama bese usisabalalisa ngesikhathi esihleliwe. Ukwenza uthule isixwayiso akusona isinqumo sesithathu, ngoba ukuhlolwa yisona sinyathelo sodwa esixhumanisa isitifiketi esisayiniwe naleli hhashi elithile. Ukusisusa kusho ukuthi noma isiphi isitifiketi esivela kugunyaziwe ofanayo singamela iseva obufuna ukuyifinyelela.

Ukuvuselela kufanele kugcine amagama nenjongo okuhloswe ngayo, hhayi ukuhambisa usuku lokuphelelwa phambili kuphela. Ukuvuselela okulahlekelwa igama kuwukuphazamiseka okusha okuhlelelwe ukuqala kabusha okulandelayo, futhi ngokuvamile kuza ngaphandle kwesixwayiso ngoba isitifiketi esidala sasisebenza ngesikhathi kwenziwa ushintsho.

Rekhoda ubunikazi obulindelekile, amagama ethulwe kanye nochungechunge olwasayina. Leyo rekhodi yenza ukuvuselela okulandelayo kube ukuqhathanisa hhayi uphenyo. Incazelo yesandiso ise-RFC 5280 uma udinga ukuhlola ukukhishwa okuthile.