Amaphutha e-TLS ku-VPN yekampani kuphela: lungisa isitolo sokuthemba esifanele

Ukwakhiwa kwe-Go, ukufakwa kwe-Composer kanye neklayenti le-Python kusebenza ekhaya futhi konke kwehluleka ngaphakathi kwe-VPN yenkampani. Lelo phethini likutshela ngomzila, hhayi ngohlelo lokusebenza. Okuthile emhubheni kushintshe uchungechunge lwesitifiketi umqhubi wakho awubonayo, noma kusetha kabusha ukuxhawulana ngaphambi kokuba noma yiluphi uchungechunge lufike. La maphutha amabili abonakala efana kutheminali futhi adinga izimpendulo ezihluke ngokuphelele.

Imilayezo emithathu, izindlela ezintathu

Iphutha le-x509 certificate signed by unknown authority lisho ukuthi uchungechunge lwakhiwe futhi impande yalo ayikho esitolo sokuthemba esisetshenziswa yilowo mqhubi. Iphutha le-self-signed certificate in certificate chain ngokuvamile lisho ukuthi ummeleli wokuhlola uphendule ngesitifiketi sakhe, futhi lowo uchungechunge umgudlu wakho wokusebenza awuwazi. I-SSL EOF ngesikhathi sokuxhawulana isho ukuthi uxhumano lwalulwe ngaphambi kokuba kuthunyelwe noma yisiphi isitifiketi esisebenzayo, futhi lokho idivayisi ephakathi enqaba i-ClientHello, hhayi inkinga yokuthemba nhlobo.

Ukungeza ifulegi lokungaphephile kwenza yomithathu imilayezo inyamalale kuyilapho ukungena kusaqhubeka, futhi kususa isihlolo ebesingabamba umhlaseli wangempela.

Thola iphakethe umqhubi awufunda ngempela

Impande yenkampani efakwe esitolo se-Windows ilungisa iziphequluli nezinhlelo ze-.NET ezibheka isitolo sohlelo. Ayenzi lutho ekwakhiweni okugijima ngaphakathi kwesitsha, esithwala iphakethe lalo le-CA, futhi ayenzi lutho kumqhubi we-Python osebenzisa i-certifi noma umqhubi we-Node osebenzisa uhlu lwayo olufakiwe. I-Go ifunda iqoqo lohlelo lomgudlu okugijima kuwo ifayela lensimbi, okungukuthi isitsha, hhayi ikhompiyutha ephathekayo. Ngakho umshini owodwa ukhiqiza ngasikhathi sinye isiphequluli esisebenzayo nethuluzi lokwakha elihlulekayo.

Buza ithuluzi esikhundleni sokucabanga. python3 -c "import ssl; print(ssl.get_default_verify_paths())" liphrinta amafayela i-Python ezobheka kuwo, futhi node -e "console.log(process.env.NODE_EXTRA_CA_CERTS)" likhombisa ukuthi ukushintshwa sekusethiwe yini. Esitsheni, gijimisa isihlolo esifanayo ngaphakathi kwesithombe, ngoba yilowo mgudlu okusetshenziswa ngukho ngempela ukwakhiwa.

Faka impande eyodwa lapho kugijima khona ukwakhiwa

Thola impande yokuhlola ku-IT njengefayela le-PEM bese uqinisekisa umkhondo womunwe wayo ngomzila ohlukile ngaphambi kokuyethemba. Ezithombeni ezisekelwe ku-Debian, kopisha ku-/usr/local/share/ca-certificates/ bese ugijimisa i-update-ca-certificates; izithombe zomndeni we-RHEL zisebenzisa i-update-ca-trust ngemva kokufaka ifayela ku-/etc/pki/ca-trust/source/anchors/. Ekwakhiweni kwesitsha, engeza lezo zinyathelo ngaphambi komyalo ohlulekayo ukuze isendlalelo sigcinwe kusilondolozi ngaphezu kokufakwa kwemibandela encikile.

Kudevcontainer yasendaweni, hlanganisa i-PEM bese ugijimisa umyalo wokubuyekeza ofanayo ekuqaleni esikhundleni sokuwubhaka esithombeni somuntu angenakho ukusiphindaphinda. Amathuluzi aletha iphakethe lawo adinga ukushintshwa kwawo okubhaliwe: i-pip inesethingi sesitifiketi, i-npm inesethingi se-cafile, futhi iningi lezinye zamukela iziguquguquki zomgudlu ezijwayelekile.

Lokhu akufani nokwamukela noma yisiphi isitifiketi. Ungeza impande ethile eqondile, etholwe ohlangothini olwenza ukuhlola, emgudlwini owodwa, futhi ukuqinisekisa kuhlala kuvuliwe kulo lonke olunye uchungechunge. Bhala ukuthi yiliphi ifayela elengezwe nokuthi lizophela nini, ngoba impande yokuhlola ibuyekezwa njenganoma iyiphi enye i-CA.

Lapho ukuxhawulana kufa ngaphambi kwesitifiketi

Uma kungethulwanga lutho, akukho shintsho esitolo sokuthemba oluzosiza. Qhathanisa isicelo esifanayo nomhubhe uvuliwe futhi uvaliwe, bese uhlola uchungechunge ngqo nge-openssl s_client -connect host:443 -servername host -showcerts. Uxhumano oluphela ngaphandle kwe-VPN futhi lusethwe kabusha ngaphakathi kwayo yisinqumo senqubomgomo sedivayisi ephakathi, futhi ikhambi ukukhululwa kwalowo msingathi, hhayi esinye isitifiketi. Cela ukuthi irejista yephakethe noma iphoyinti lokugcina le-API kudlule kungashintshiwe.

Ukwahlukanisa umhubhe ukuze ithuluzi lidlule i-VPN kugwema ukuhlola kwalowo mgudu, okungase kweqe inqubomgomo futhi akwenzi ithuluzi lithembeke.

Bhala umphumela kuthuluzi ngalinye

Inothi elifushane elibala ifayela lensimbi, ifayela lokuthemba elilifundayo, isiguquguquki somgudlu esisebenzayo kanye nokukhululwa okuvunyiwe kusindisa umuntu olandelayo ukuxilongwa konke. Gcina inothi ngethuluzi ngalinye hhayi ngekhompiyutha ephathekayo ngayinye, ngoba ikhompiyutha ephathekayo ayivamisile ukuba yiyo into eshintshile.

Futhi gcina imisho emibili yehlukene kuthikithi: safaka impande yenkampani ethile, futhi sacisha ukuqinisekisa. Kukodwa kuphela kwalokho okuyisenzo sosekelo.