Indlela yokuqinisekisa umkhondo womunwe wesitifiketi se-VPN ngesiteshi esihlukile

Umkhondo womunwe ufanele ukuthenjwa ngendlela okuthenjwa ngayo isiteshi esikutshele ukuthi yini okufanele uyilindele. Uma inani olifanisa nalo lifike ngoxhumano olulodwa oluhlolayo, ukuqhathanisa akufakazeli lutho ngaphandle kokuthi lowo olawula lolo xhumano uyaqhubeka. Ukuhlola kufanele kuqhubeke ngendlela eqinile, futhi isinyathelo esihlulekayo kufanele kukuvimbe esikhundleni sokukusunduzela kwesilandelayo. Lena yindlela engiyisebenzisa lapho iklayenti le-VPN libika ukuthi isitifiketi sishintshile.

Qamba into ngaphambi kokuthi uqambe inani

Nquma ukuthi inani elilindelekile lingeleli phepha lesitifiketi seseva, ingele-CA eyikhiphile, noma ingelekhii yomphakathi engaphakathi kweqabunga. Lokhu kungukuhlola okuthathu okuhlukene, futhi kwehluleka ngezindlela ezihlukene. Umkhondo womunwe we-CA ohambisanayo awubophi iseva, futhi i-hash yekhii yomphakathi iyasinda ngamabomu ekukhishweni kabusha okugcina ikhii efanayo.

Bhala futhi i-algorithm. I-SHA-256 iyilokho okulindelekile okuvamile manje, kodwa amathuluzi amadala ayeshicilela i-SHA-1 ngaphandle uma ucele okunye, futhi inani le-hex elinezinhlamvu ezingama-40 liwuphawu lokuthi usuzofanisa izinto ezimbili ezihlukene.

Thola inani elilindelekile ngesiteshi sesibili

Isiteshi sesibili kufanele kube esingakwazi ukubhalwa yiqembu ozivikela kulo. Uhlelo lokuhlinzeka osuvele uzifakazela kulo, irekhodi eliphrintiwe esele ku-vault, isisekelo sedatha yokucushwa, noma idokhumenti esayiniwe elethwe enye inqubo, konke kuyafaneleka. Umlayezo wengxoxo ovela kumuntu osebenza naye, ikhasi losizo elifinyelelwe ngomphumela wokusesha, kanye nanoma yini enamathiselwe kutheminali osuvele ulungisa amaphutha kuyo, akufaneleki.

Cela inani eliphelele kanye ne-algorithm, hhayi isiqalo. Amakhoma kanye nofaka omkhulu noma omncane awabalulekile, kodwa ukusika kwenza ukuhlola kwamabhithi angama-256 kube umdlalo wokuqagela.

Uma kungekho ongakhipha inani elilindelekile emthonjeni ozimele, umphumela othembekile ukuthi lesi sitifiketi asikwazi ukuqinisekiswa namuhla. Ukusho lokho kungcono kunokubopha lokho okusanda kukhonjiswa yiklayenti, okuvamisa ukwenza isexwayiso sibe umkhuba.

Khipha inani ohlangothini lwakho

Ngefayela lesitifiketi, umyalo uyi-openssl x509 -in server.crt -noout -fingerprint -sha256. I-digest ecacile ibalulekile: ngaphandle kwayo, umphumela uncike kunguqulo yakho ye-OpenSSL. Umphumela uyichashazi le-hex elihlukaniswe ngamakhoma, ngakho susa amakhoma futhi uguqule izinhlangothi zombili zibe izinhlamvu ezincane ngaphambi kokuqhathanisa.

Ngesiphetho esikhuluma i-TLS ngqo, xhumana futhi ukhiphe isitifiketi ngepayipi: openssl s_client -connect vpn.example.com:443 -servername vpn.example.com < /dev/null | openssl x509 -noout -fingerprint -sha256. Lokhu kuyasebenza kuphaneli lokuphatha lewebhu noma isilaleli se-TLS, hhayi ku-OpenVPN, okuyisiteshi saso sokulawula singaphakathi komhubhe. Ku-OpenVPN, funda isitifiketi kuphrofayela elukhisini esikhundleni sokuzama ukusibamba kusokhethi.

Ukuqhathanisa kufanele kube okomshini. Yenza zombili izinto zibe ngendlela efanayo nge-tr -d ':' nokuhlanganisa izinhlamvu, bese uqhathanisa intambo yonke. Ukwenza ngamehlo yikho okwenza isiqalo esihambisanayo sifihle umehluko kubhayithi yokugcina. Uma izintambo zihlukile, thatha umehluko njengowangempela ngaphambi kokufuna incazelo.

Izimo zokuma

Yima uma into ihlukile, ngoba umkhondo womunwe we-CA awukwazi ukuthethelela isitifiketi seqabunga futhi iqabunga alikwazi ukuthethelela i-CA. Yima uma i-algorithm ihlukile, ngoba inani le-SHA-1 liqhathaniswa nenani le-SHA-256 akukutsheli lutho. Yima uma umkhondo womunwe uhambisana kodwa isitifiketi siphelelwe yisikhathi, sikhanseliwe noma sikhishwe ngelinye igama; i-hash ehambisanayo ayisiwona isihlolo sokusebenza futhi ayilungisi iketanga eliphukile. Yima futhi uma inombolo yokulandelana ingahambisani nenombolo yokulandelana kwirekhodi ohlola ngalo, ngoba yileyo indlela eshibhile yokubona isitifiketi esishintshiwe.

Yima uma inani elisha lifike ngesiteshi obuhlola ngaso. Ukujikeleza kungashintsha umkhondo womunwe ngokomthetho, kodwa inani lokushintsha kufanele lisavela enqubweni ethembekile, hhayi kubhokisi lesixwayiso elidale umbuzo.

Yima uma isixazululo esiphakanyisiwe kungukucisha ukuqinisekiswa kwegama lomsingathi noma kweketanga. Umkhondo womunwe wengeza umkhawulo ekuhloleni okuvamile; awukuthathi indawo yako ngaphandle uma ukusetshenziswa kukhethe ngamabomu imodeli ye-pin kuphela, futhi lokho kukhetha kuletha izindleko zokusebenza zako.

Ngemva kokuqhathanisa

Bhala phansi ukuthi uqhathanise ini, inani elilindelekile lavela kuphi, nanini. Uma isitifiketi sikhishwe kabusha, buyekeza okulindelekile okugciniwe ngesiteshi esithembekile esifanayo futhi bhala inombolo yokulandelana entsha, ngoba yiyo inombolo yokulandelana eyenza ukujikeleza okulandelayo kuhlolwe.

Bese ucacisa ngezinqumo. Umkhondo womunwe uqinisekisa ukuthi isitifiketi osinakho yiso lokho othile akutshele ukuthi usilindele. Awusho lutho mayelana nokuthi umsingathi akakho engcupheni, futhi awusho lutho mayelana nokuthi insizakalo ilogela noma ikhawulela lokho lesi sitifiketi esingakufinyelela.