Sebenzisa i-CA yakho yebhizinisi ekhona kuma-peer e-OpenVPN

Akukho lutho ku-OpenVPN okudinga ukuthi isitifiketi sivela ku-Easy-RSA, futhi iqembu lezinsimbi eline-PKI yenhlangano kakade ngokuvamile akufanele lakhe lesibili. Umsebenzi wangempela awukho ekukhetheni ithuluzi, kodwa ekunqumeni ukuthi kusho ukuthini ubunikazi obukhishiwe, yimaphi ama-peer umhubhe owamukelayo, kanye nokuthi ukuvuselelwa nokukhanselwa kufinyelela kanjani kumhloli. Hamba ngezinyathelo ezinhlanu ngezansi ngokulandelana, ngoba isinyathelo sakamuva asikwazi ukulungisa isinqumo sendima esithathwe kwesokuqala.

Khipha izindima ezimbili esikhundleni sobunikazi obunye obabiwe

I-peer ngayinye idinga isitifiketi sayo kanye nokhiye wangasese ohambisanayo. Cela iqembu le-PKI ubunikazi besiphakamisi obunokusetshenziswa kwesiphakamisi kanye nobunikazi bamakhasimende ahlukene obunokusetshenziswa kwekhasimende, ukuze umhubhe ukwazi ukwehlukanisa kokubili ngesikhathi sokuxhawulana.

Yima ngqo ezindleleni ezimfishane ezivela ngaphansi kwengcindezi yomhla wokugcina. Ukukopisha ukhiye wesiphakamisi sewebhu kuma-laptop kususa umehluko okuncike kuwo ukuhlolwa kwendima, futhi ukhiye wokusayina we-CA ofakwe endaweni yokugcina ye-VPN uguqula isiphakamisi esisodwa esihlaselwe sibe yizinga elihlaselwe. Iphakethe le-PKCS12 lingathwala ukhiye wendawo yokugcina kanye nochungechunge lwawo, kodwa alinikezi neze imvume yokuphinda usebenzise lobo bunikazi kwenye indima.

Xhuma okokufaka kokuthembela ohlangothini ngalunye

Iklayenti nesiphakamisi ngakunye kudinga i-ankela yokuthembela, ubunikazi bayo kanye nokulindela indima okucacile. Ingxenye yeklayenti echaza zontathu ibukeka kanje.

client
ca /etc/openvpn/pki/issuing-root.pem
cert /etc/openvpn/pki/device-17.crt
key /etc/openvpn/pki/device-17.key
remote-cert-tls server
verify-x509-name vpn.corp.example name
crl-verify /etc/openvpn/pki/issuing.crl

Uhlangothi lwesiphakamisi lukhombisa lokhu nge-remote-cert-tls client kanye nesitifiketi salo, futhi yilokhu okuvimbela isitifiketi sekhayenti ukuthi samukelwe njengesiphakamisi. Ukuhlolwa kwegama yisinqumo esihlukile ekuhlolweni kwendima. Funda ukumiswa okusetshenzisiwe ukuze ubone ukuthi iyiphi inkambu eqhathaniswayo esikhundleni sokucabanga ukufana kwegama lesiphakamisi ngendlela yesiphequluli. Izinhlangothi zombili kufanele futhi zicace ukuthi zithemba muphi umkhiphi, ngoba indlela yefayela eyabiwe kulo lonke iqembu ayifani nomgomo owabiwe.

Letha izitifiketi eziphakathi ngaphandle kokwandisa ukuthembela

Izinhlangothi ezimbili akudingeki zabelane nguchungechunge olulodwa lokukhipha. Lapho i-peer yethula isitifiketi esisayinwe umkhiphi ophakathi, uhlangothi oluhlolayo ludinga lowo mkhiphi ophakathi etholakala, futhi i-OpenVPN yehlukanisa okokufaka kwe-ankela yokuthembela kusuka kwezinye izitifiketi ezisetshenziselwa ukuqedela uchungechunge olwethulwe endaweni. Incwadi yokubhekisa yezinketho ze-TLS ye-OpenVPN 2.6 ibhala zombili.

I-CA ephakathi ayiyona inkinga ngokwayo, kodwa impande yebhizinisi ebanzi ephonswe kuphakethe lokuthembela iyinkinga. Uma i-ankela ibanzi, kuba izitifiketi eziningi ezedlula ukuhlolwa kochungechunge, futhi ukuhlolwa kwendima akukuguquli lokho kube uhlu lwabasebenzi abagunyaziwe. Nciphisa i-ankela kumkhiphi ogcina ngempela usayina ubunikazi be-VPN lapho izinga likuvumela khona. Uma kungavumi, bhala i-ankela ebanzi njengengozi eyamukelwe ngamabomu esikhundleni sokuyishiya ingacacile.

Vumelana neqembu le-PKI ukuthi ukuvuselelwa nokukhanselwa kufinyelela kanjani kubahloli be-VPN, kufaka phakathi ukuthi yibaphi abakhiphi ababalulekile nokuthi ngubani oshicilela uhlu. Iphuzu lokusabalalisa le-CRL elifakwe esitifiketini liwumyalelo, hhayi ubufakazi bokuthi okuthile kuyitholile.

Nquma ukuthi ukukhanselwa kufika kanjani ngempela

crl-verify kwenza umhloli abheke ifayela noma indawo yokugcina, futhi loluhlelo ludinga umnikazi kanye nendlela yokuvuselela. Uhlu olukopishwe kanye ngesikhathi sokuphakwa luyeka buthule ukukuvikela lapho isitifiketi sikhanselwa okokuqala.

Bhala isikhathi sokubhebhetheka esilindelekile futhi usihlole ngesitifiketi ozimisele ukusikhansela. Uma uhlu lungakwazi ukuvuselelwa kusiphakamisi se-VPN, enye indlela isikhathi sokulunga esifushane kanye nenqubo yokuvuselela esebenza ngempela, hhayi ukucabanga ukuthi ukukhanselwa kuyasebenza ngoba i-URL ikhona.

Bonisa ukwamukelwa ngeklayenti langempela

Xhuma iklayenti okufanele livunyelwe bese uqinisekisa imininingwane yesitifiketi okwaxoxiwe ngayo kusigele. Bese uzama amacala okufanele ehluleke: isitifiketi sekhayenti esethulwe njengesiphakamisi, isitifiketi esivela kumkhiphi ongaphandle kwe-ankela yokuthembela, kanye nesitifiketi esikhanseliwe uma unaso esengeziwe.

Bhala umkhiphi owamukelwe, ukuhlolwa kwendima kanye nomthombo wokukhanselwa eduze kwephrofayela. Lowo mbhalo yiwona odingwa unjiniyela olandelayo lapho idivayisi eyayisebenza ngenyanga edlule iyeka ukuxhumana, futhi futhi uwubufakazi bokuthi i-CA yebhizinisi isetshenziswa ngaphakathi komngcele wokwamukela obhaliwe hhayi njengendawo yokulahla ukuthembela enjongo jikelele.