Inhloso yesitifiketi engasekelwe: kungani i-CA ephakathi ihluleka

Inhloso yesitifiketi seseva ibukeka ilungile, ukhiye uyahambisana, izinsuku zilungile, kodwa ukuxhumana kusahluleka ngombiko othi unsupported certificate purpose. Imininingwane eyixazululayo ivamise ukuba emgqeni ofanayo nephutha: inani lokujula kanye nesihloko esikhomba isitifiketi esiphezulu ochungechungeni. Kunezivivinyo ezimbili ezihlukene ezenziwayo, futhi eyodwa yazo kuphela ephathelene nekhasi. Ukuziqhathanisa kuchaza ukuthi kungani ukushintsha isitifiketi seseva kungashintshi lutho.

Isiphi isitifiketi esanqatshwa isihloli

Uchungechunge akusiyo into eyodwa ephindwe kathathu. Ikhasi liphethe igama leseva nokhiye, izitifiketi eziphakathi zixhumanisa nempande, futhi ngasinye sinesikhathi saso sokusebenza, imikhawulo kanye nokusetshenziswa kwaso. Uma iphutha lisho inani lokujula, lelo nani lakhomba indawo ochungechungeni olwakhiwe isihloli, okungenzeka ukuthi akuyona indawo oyilindele uma iseva ithumela uchungechunge olungajwayelekile.

Funda izinkambu zesitifiketi kulelo zinga lokujula, hhayi isitifiketi obucabanga ukuthi siyona inkinga. Cela izandiso ezimbili ezibopha ukukhishwa esikhundleni sokukhipha zonke izinkambu, ngoba impendulo cishe ihlala ingenye yazo. Umphumela wezandiso uphephile ukwabiwa; okhiye abayimfihlo abasoze babe njalo.

openssl x509 -in issuing-ca.pem -noout -subject -issuer -ext basicConstraints -ext extendedKeyUsage

Uma isitifiketi esishiwo siyi-CA ephakathi enokwandiswa kokusetshenziswa kokhiye okhuluma ngokungahlobene nokuqinisekiswa kweseva ye-TLS, ingxenye esele yephutha izolandela ngendlela yomshini. Uchungechunge angeke lusetshenziselwe inhloso ecelwe yi-OpenVPN.

Inhloso yekhasi nenqubomgomo yochungechunge yizivivinyo ezimbili

Ukwahlola ikhasi kubuza umbuzo omncane: ingabe lesi sitifiketi sokugcina sivumela ukuqinisekiswa kweseva yaleli gama? Ukwahlola uchungechunge kubuza umbuzo obanzi: ingabe zonke izitifiketi endleleni zingasebenzela leyo nhloso? Isikhungo esigunyazwe ukukhipha izitifiketi zamaklayenti kuphela sizodlula ukuhlolwa kwaso kwesiginesha bese sihluleka esivivinyweni sesibili, ngoba indlela esiyigunyazayo ayifaki inhloso edingwa uhlelo. Izivivinyo ezimbili zihluleka ngamagama afanayo futhi zinezindlela zokulungisa ezihluke ngokuphelele.

Yingakho isitifiketi sekhasi esisanda kukhishwa, esilungile kuzo zonke izinkambu ezibonakalayo, singahluleka ngokushesha. Yingakho futhi ukulungisa kuvamise ukuba kusephrofayilini yesikhungo esikhiphayo hhayi ekucushweni kwe-VPN.

I-EKU engekho ayiyona i-EKU evimbayo

I-RFC 5280 yenza ukwandiswa kokusetshenziswa kokhiye kube ukuzikhethela futhi, uma kukhona, kuyavimba. Ngakho isitifiketi se-CA esingenakho lokho kwandiswa asikasho “cha” ekuqinisekisweni kweseva, kuyilapho esikhomba kuphela inhloso engahlobene sisho into ethile eqondile. Ukuthatha lezo zinhlobo ezimbili njengezilinganayo kulethe ukuxilongwa okungalungile futhi, okubi kakhulu, ukulungiswa okungalungile. Umehluko futhi uchaza ukuthi kungani izikhungo ezimbili ezibukeka zifana kukhonsoli ziziphatha ngendlela ehluke kakhulu ochungechungeni.

Ukwenza kwelayibrari yekhodi akufani lapha futhi. Idokhumenti yezinketho zokuqinisekisa ye-OpenSSL ichaza indlela yayo yokuphatha ukuhlolwa kwenhloso kuzitifiketi ze-CA, futhi lokho kuphathwa kuyinqubomgomo yokusebenza hhayi umthetho olandelwa ngendlela efanayo yizo zonke izingqimba ze-TLS. Chaza okwenziwa isihloli sakho, bese ukuqinisekisa ngenguqulo oyisebenzisayo ngempela.

Phinda udale iphutha ngaphandle koxhumano ngaphambi kokukhipha kabusha

Ukuqinisekisa ngaphandle koxhumano kususa uhlelo embuzweni. Uma uchungechunge luhluleka ngendlela efanayo ngaphansi kwenhloso efanayo, isitifiketi siyinkinga futhi akukho ukulungiswa kokucushwa kweseva okungayifihla. Uma uchungechunge ludlula ngaphandle koxhumano kuyilapho insizakalo isala, uhlelo lucela enye inhloso noma lusebenzisa olunye uchungechunge kunalolo oluhlolile.

openssl verify -purpose sslserver -show_chain -CAfile root-ca.pem -untrusted issuing-ca.pem vpn-server.pem

-show_chain ibalulekile ngoba iphrinta indlela ethuluzi eliyakhile, okuvamise ukungafani nokulandelana kwamafayela owahunikezile. Lowo mphumela uyindlela esheshayo yokuthola ukuthi i-CA ephakathi yesibili ithathwa kusitolo sokuthembela, ukuthi iseva ithumela uhlobo olusayinwe ngaphesheya obungakuhlosile, noma ukuthi ifulegi yenhloso oyikopishe kusifundo lingelolunye iqhaza kunalelo elihanjiswayo.

Lungisa inqubomgomo yokukhipha, hhayi ucingo lokuqinisekisa

Ukulungiswa okuhlala njalo iyi-CA ephakathi ekhishwe ngaphansi kwenqubomgomo evumela izinhloso okufanele izisebenzele, nomkhawulo obhaliwe futhi obuyekeziwe. Ukwengeza yonke inhloso kuso sonke isikhungo akusiyo inqubomgomo; kususa umkhawulo owenza ukwandiswa kwaba nencazelo ekuqaleni, futhi kuvamise ukuphila isikhathi eside kunesehlakalo esikubangelile. Inothi elifushane kuphrofayili elichaza ukuthi isikhungo singaqinisekisa ziphi izindima livimbela ukukhipha okulandelayo ekubuyiseleni ingxabano.

Ukucisha ukuqinisekisa kungenye indlela ekhangayo, futhi kuguqula inkinga yesitifiketi ibe inkinga yokuthembela. Gcina ukuhlolwa kwenhloso kukhona, lungisa uchungechunge, bese uphinda ukuqinisekisa okufanayo ngaphandle koxhumano ukuze uqinisekise ukuthi indlela manje isebenzela iqhaza elihlosiwe ngaphambi kokuthinta insizakalo futhi.