Ukwabelana ngokhiye kwe-TLS kanye nesitifiketi sekhasimende: yikuphi okungena?
Ihlukanise isivumelwano sokhiye nokuqinisekiswa kwekhasimende kanye nobuwena bohlelo, bese ufunda imiyalezo yokuxhawula ekhombisa ukuthi yikuphi uxhumano olusebenzise ngempela.
Ukuthwala inani lokushintshana kokhiye esidlangalaleni ekuxhawuleni akusona isigameko esifanayo nokungena kwekhasimende. Okunye kusungula isimo somfihlo soxhumano; okunye kusho ukuthi ukhasimende ungubani, futhi kwenzeka kuphela lapho iseva icela lokho nokushintshana kukusekela. Ukuthatha okokuqala njengokwesibili kuholela eziphethweni ezingalungile mayelana nokuthi i-VPN ikufihla nokuthi ayikufihli. Funda imiyalezo, bese unquma ukuthi yisiphi kwezici ezine osibonile ngempela.
Izinto ezimbili ezibonakala zifana ekuthunjweni
Ikhasimende le-TLS 1.3 lingafaka isandla ngempahla yokushintshana kokhiye endizeni yalo yokuqala ngaphandle kokwethula noma yisiphi isitifiketi. Lelo galelo liwumphakathi ngokwakhiwa, ngoba iseva iyalidinga ukuze ithole imfihlo eyabiwe. Isitifiketi sekhasimende ngomunye umyalezo, futhi sithunyelwa kuphela ngemva kokuba iseva icele esisodwa. Sithwala ubuwena iseva eyobe iqinisekisa, futhi ukuqinisekiswa kombili isinqumo seve, hhayi isici esibekwa yisethi yokubhala ngemfihlo. Ubuwena bohlelo yinto yesithathu ngokuphelele: ifomu lokungena, ithokheni ethwalayo, ikhukhi. Akukho kulokho okuvelayo ekuxhawuleni, futhi konke kudlula ekushintsheni komzila wenethiwekhi.
| Object in play | What it establishes |
|---|---|
| Key-exchange share | Cryptographic state for this connection |
| Server certificate | Which server the client reached |
| Client certificate | Client authentication, when requested |
| Application session | Account identity inside the application |
Imigqa emine izimele. Uxhumano lungaba nomugqa wokuqala nowesibili, lweqe owesithathu, futhi lusathwale owesine esihlokweni sekhukhi.
Nquma ukuthi ukuxhawula okuthunjiwe kungafakazela ini
Kusukela ekuxhawuleni kuphela, umqaphi ufunda inguqulo okwavunyelwana ngayo, isethi yokubhala ngemfihlo, isitifiketi seve kanye namanani okushintshana kokhiye asesidlangalaleni. Lokho kwanele ukuthatha uphawu lweminwe lomsebenzi wekhasimende nokubona ukuthi iyiphi iseva okwaxhunyanwa nayo. Engakunikezi isimo esiyimfihlo esidingekayo ukuze kuvulwe uxhumano, okugcinwa kwaso kuncike ekushintsheni kwesikhashana hhayi engxenyeni yomphakathi. Futhi akunikezi ubuwena be-akhawunti, obungakaze bube khona ekuxhawuleni kusukela ekuqaleni.
Ngakho isiphetho esithembekile sincane: akukho sitifiketi sekhasimende esethulwe kulokhu kushintshana. Akukhona ukuthi ikhasimende alithumanga lutho olungaxhumana, futhi ngokuqinisekile akukhona ukuthi iseshini ayithwalanga sikhombisi.
Funda imiyalezo, hhayi igama lokubhala ngemfihlo
Buza iseva ukuthi icela ini, esikhundleni sokucabanga kusukela kusethi yokubhala ngemfihlo. Ukuxhawula kwe-TLS 1.3 okufaka isicelo sesitifiketi kuyabonakala embhalweni, futhi ukungabikho kwaso kuyabonakala ngokufanayo.
openssl s_client -connect app.example.net:443 -tls1_3 -msg < /dev/null 2>&1 | grep -i -E 'key_share|CertificateRequest'Bese uphinda ngesitifiketi sekhasimende esilungisiwe, futhi uqhathanise. Ukugijima kwesibili kufanele kukhombise isitifiketi sithunyelwa futhi samukelwa; okokuqala akufanele kukhombise lutho, futhi lowo umahluko oqondile impikiswano ekhuluma ngawo.
openssl s_client -connect app.example.net:443 -tls1_3 -cert client.pem -key client.key -quietUma udinga kuphela icala elivamile lokuphequlula, okukhishwayo okunemininingwane yekhasimende kwanele ukubona inguqulo yephrothokholi, umphumela wokuqinisekisa nokuthi ngabe isitifiketi sekhasimende sanikezwa yini. Iseva engalokothi ithumele isicelo sesitifiketi ayikwazi ukuba ithole esisodwa.
Lapho ukuqhubeka kushintsha impendulo
Ukuqhubeka ku-TLS 1.3 kusebenzisa amathikithi axhumene nesimo esiyimfihlo, ngakho uxhumano lwakamuva lungaqedwa ngaphandle kokushintshana okuphelele kwezitifiketi. Lokho kunciphisa okubonwa umqaphi futhi kushintsha okufakazelwa umbhalo. Akudali ubuwena lapho kwakungekho khona. Iseshini eqhubekile isengeleseshini efanayo yohlelo, futhi noma iyiphi ikhukhi noma ithokheni kuleyo seshini isahlala iyisikhombisi esibalulekile.
Yingakho ukubuyekezwa kobumfihlo okuma ku-"akukho sitifiketi sekhasimende" kweqiwa ingxenye ethakazelisayo. Umbuzo okufanele ubuzwe ukuthi yiluphi uhlangothi oluphethe isikhombisi esizinzile, hhayi ukuthi wuphi umyalezo owawungekho ekuxhawuleni okukodwa.
Qopha izici ezine, hhayi isinqumo esisodwa
Bhala isivumelwano sokhiye, ukuqinisekiswa kweseva, ukuqinisekiswa kwekhasimende kanye nobuwena bohlelo njengemigqa emine ehlukene, nobufakazi bakho ngamunye. Lolu hlu luye luqhubeke lapho inguqulo yephrothokholi ishintsha, futhi lwenza impikiswano ngobumfihlo ihlolwe ngomunye umuntu. Bese wengeza okufakwa umzila wenethiwekhi. I-VPN ishintsha ikheli lomthombo elibonwa yisevisi; ayisusi ukungena, ikhukhi noma uphawu lweminwe lwedivayisi osekuvele lunohlelo.
Qopha ndawonye inguqulo yoxhumano okwavunyelwana ngayo kanye nomphumela wesicelo sesitifiketi, ngoba yilowo mbhangqwana okudingwa umbuyekezi ukuze aphinde akhiphe isiphetho sakho ngaphandle kokuthwebula kwakhe.