Amasertifikhethi amabili e-OpenVPN, igama elilodwa le-CCD: kwenzeka ini okungalungile

Inombolo yochungechunge ihlukile kuphela kumkhiphi wayo, kuyilapho i-OpenVPN ikhetha ifayela le-CCD ngokwegama. Beka lelo gama elisebenzayo lapho kubhaliswa futhi ulawule ukuvuselelwa.

Amasertifikhethi amabili eklayenti anezinombolo zochungechunge ezihlukene, okhiye abahlukene futhi ngisho nezingqikithi ezigcwele ezihlukene angahle agcine esefayeleni elilodwa lenqubomgomo, ngoba iseva ayibheki lokhu. Ifunda igama kusertifikhethi bese ivula ifayela lokuhlelwa kweklayenti elihambisanayo. Uma womabili amasertifikhethi ephethe igama elifanayo, elesibili lizothola njengefa inqubomgomo yelokuqala lapho lixhuma khona.

Ukungqubuzana kudalwa ngesikhathi sokubhalisa futhi kutholakala kuphela ngesikhathi sokuxhumana, ngokuvamile lapho idivayisi ithola ikheli noma isethi yemizila engeyenye imishini. Ukuvimbela lokho kusho ukuvumelana ukuthi yisiphi isigaba iseva esihlela kuso, bese ubeka lelo nani eceleni ngaphambi kokuba kusayinwe noma yini.

Amathuluzi akho amasertifikhethi ngeke akuxwayise, ngoba ukuhluka ngaphakathi kwe-X.509 nokuhluka kwegama lenqubomgomo ye-OpenVPN kuyizimfuneko ezihlukene eziqiniswa izinhlelo ezihlukene.

Iseva ibheka igama, hhayi umkhondo womunwe

Ekuhlelweni okuvamile okusekelwe kumasertifikhethi, iseva ithatha igama elivamile kusertifikhethi ethuliwe bese ifuna ifayela elinalelo gama kusikhombisi sayo sokuhlelwa kwamaklayenti. Lelo fayela lingagxilisa ikheli elingaguquki, lihambise imizila noma lisebenzise izimpawu zodonga lomlilo kuklayenti ngayinye. Ukufuna kuwukufana kochungechunge negama lefayela, ngakho ubukhulu bezinhlamvu, izikhala kanye nezimpawu zokubhala konke kubalulekile.

Okunye ukusetshenziswa kushintsha ngamabomu ukuhlela ukuze igama lomsebenzisi eligunyaziwe lithathe indawo yegama elivamile, futhi lapho igama lomsebenzisi yilona okumele lihluke. Kungakhathaleki, inani elikhetha inqubomgomo yilona nani olibeka eceleni. Nquma ukuthi iliphi ngaphambi kokukhipha noma yini; ukuqagela ngemuva kokungqubuzana kubiza kakhulu kunokubuza.

Lapho iziphathimandla ezimbili zihlangana khona egameni elilodwa

Inhlangano eyamukela amasertifikhethi avela eziphathimandleni ezingaphezu kwesisodwa zokukhipha isebenza izinqubo ezimbili ezizimele zokubhalisa ezibhala endaweni eyodwa yamagama. Imithetho yokuhluka yephathimandla ngayinye isebenza ngaphakathi kwayo, ngakho zombili zingakhipha ngokusemthethweni igama elifanayo elivamile ngaphandle kokuthi noma yiliphi libone okungalungile.

Izinombolo zochungechunge azisizi. I-X.509 idinga ukuthi inombolo yochungechunge ihluke ngaphakathi kobubanzi bomkhiphi wayo, okuyisici sokubalwa kwencwadi yalelo phathimandla hhayi ubunikazi bomhlaba jikelele bedivayisi. Ukuhlola ingqikithi nakho kuwukuhlolwa okuhlukile ekuhloleni igama elivamile: amasertifikhethi amabili angabelana nge-CN kodwa ahluke ngophiko lwenhlangano futhi ngalokho aphethe izingqikithi ezihlukene. Zonke lezo zici zingase zibe khona kuyilapho iseva isahlela womabili amasertifikhethi egameni elilodwa lefayela.

Amadokhumenti e-OpenSSL CA akhuluma ngokuhlelwa kwe-unique_subject okulawula umbono wesizindalwazi sakho, futhi indawo yokuqala eqotho iwukufunda ukuhlelwa kwakho kokukhipha esikhundleni sokuthi ucabange ukuthi okunye okujwayelekile kwe-EasyRSA noma i-OpenSSL kuyasebenza.

Beka igama elisebenzayo ngaphambi kokusayina

Gcina irejista ehlela idivayisi kurekhodi layo eligunyaziwe futhi isuka lapho iye egameni eliqondile lefayela lenqubomgomo, ukuze igama linikezwe kanye futhi lihlale linikeziwe. Ukubeka eceleni kufanele kube okwe-athomu, okusho ukuthi empeleni umkhawulo wesizindalwazi noma isivalo esizungeze isinyathelo sokwaba-bese-usayina, hhayi ispredishithi ehlelwa abantu ababili.

Bese wenza ukuhlola kube yingxenye yokukhipha: nqaba ukusayina lapho igama eliceliwe likhona kakade, futhi ufake kuleso sihlolo zonke iziphathimandla iseva ezethembayo, ngoba igama elibekwe eceleni ngolunye uphathimandla nalo limakiwe. Isicelo esenqatshiwe ngesizathu esicacile sishibhe kakhulu kunethikithi mayelana nedivayisi eqhubeka ithola ikheli elingaguquki lomunye umuntu.

Ukuvuselelwa kusebenzisa igama futhi ngamabomu

Ukukhipha kabusha idivayisi ekhona kufanele kukhiqize inombolo entsha yochungechunge ngaphansi kwegama elifanayo lenqubomgomo, futhi lokho kuwukusebenzisa futhi okusemthethweni hhayi ukungqubuzana. Okumele kunqunywe kusengaphambili ukuhlangana: ukuthi amasertifikhethi amadala namasha angaba semthethweni ngesikhathi esisodwa yini, kanye nokuthi isiqinisekiso esidala siyekiswa kanjani.

Ungafinyeleli ku-duplicate-cn ukuxazulula lokhu. Leyo nketho yesova ilawula ukuxhumana kwangasikhathi esifanayo okwethula igama elifanayo; ayikhiyi ukubhalisa, futhi ukuyivula akwenzi ikheli elilodwa elingaguquki elabelwana ngalo liphephe emishinini emibili ngesikhathi esisodwa. Ukuhoxiswa ngokuvamile kukhombisa isertifikhethi ngomkhiphi nangenombolo yochungechunge, ngakho ukuyekisa isiqinisekiso esidala akudingeki kwenze esisikhundla saso singavumeleki uma iseva yamukela futhi isebenzisa idatha yokuhoxiswa efanele.

Qinisekisa ukuhlelwa ngamathuluzi asemishinini

Ngaphambi kokunikeza idivayisi isiqinisekiso sayo esisha, funda igama kusertifikhethi ngendlela iseva ezolifunda ngayo, bese ulifanisa nefayela lenqubomgomo obheke ukuthi lizokhethwa.

openssl x509 -in device42.crt -noout -subject -nameopt sep_multiline
ls -l /etc/openvpn/ccd/device42
grep -n "duplicate-cn" /etc/openvpn/server.conf

Umyalo wokuqala uprinta izigaba zengqikithi ngokwehlukana, okwenza uphiko lwenhlangano olulahlekile noma isikhala esiphindwe kabili kubonakale ngokushesha. Owesibili uqinisekisa ukuthi ifayela lenqubomgomo likhona ngaphansi kwalelo gama ngqo, kanti owesithathu ukhombisa ukuthi iseva ihlelwe yini ukuvumela amaseshini amaningi egameni elilodwa. Sebenzisa womathathu kusertifikhethi esisha ngaphambi kokuthi ishiye isinyathelo sokubhalisa, lapho iphutha lisabiza ukusayina hhayi isigameko. Gcina okukhiphiwe kanye nethikithi ukuze umuntu olandelayo abone ukuthi iseva ithole liphi igama ngempela.

Qedela ngokuxhumana kwangempela bese ufanisa ikheli elinikeziwe kanye nemizila edonsiwe nefayela lenqubomgomo, hhayi nalokho obukuhlela ukukubhala. Uma amadivayisi amabili ebika ikheli elingaguquki elifanayo, irejista inokungqubuzana okungeke kukwazeke ukwembulwa yinoma yikuphi ukuhlolwa kwamasertifikhethi.

Izihloko ezihlobene