I-CSR yodwa ayikona ukubhaliswa: i-CA ye-VPN kufanele ihlole ini

Isicelo sokusayina isitifiketi sithwala ukhiye womphakathi kanye ne-subject eceliwe, kusayinwe ngokhiye oyimfihlo ohambisanayo. Lelo sayino lifakazela ukuthi umceli unokhiye. Alifakazeli ukuthi umceli unelungelo legama, idivayisi noma indima ye-VPN eceliwe, futhi ukuphatha isicelo sengathi sifakazela lokho yiyo impela indlela ithikithi losizo eliba ukunikezwa kokufinyelela.

Amamodeli amabili okubhaliswa kufanele aqhathaniswe ngokuthi abopha ini, hhayi ngokuthi akhuluma iphrothokholi iphi.

Isicelo sisho igama, asilifakazeli

Funda isicelo ngakho lokho esikukhomba ngempela: ukhiye womphakathi, i-subject ekhethwe umceli, kanye nesayino sakho phezu kwakho kokubili. Akukho lutho kuleso sakhiwo okubhekisela kwinventri yakho, kuhlu lwama-akhawunti noma inqubo yokugunyaza. I-subject efana ne-cn=finance-laptop iwuchungechunge umuntu alushicilelayo. Kuze kube yilapho inqubo yokukhipha ihlola lolo chungechunge ngokumelene nerekhodi eyithembayo, isitifiketi siyisimemezelo esinamathiselwe isayino. Lowo mehluko uyiso sonke isizathu sokuba khona kwenqubo yokubhaliswa.

Umphumela ubalulekile ekusebenzeni. Isiphathimandla sesitifiketi asilokothi sidinge ukhiye oyimfihlo weklayenti ukuze sikhiphe isitifiketi, futhi inqubo eyidingayo ihlanganisa ukusayina nokugcinwa kokhiye. Gcina ukukhiqizwa endaweni yokugcina futhi thumela ingxenye yomphakathi kuphela.

Qhathanisa amamodeli ngokuthi abopha ini

Ukusayina ngesandla kubopha lokho umsebenzi akhumbulayo ukukuhlola. Insizakalo yokubhaliswa ezenzakalelayo ibopha isicelo esiqinisekisiwe esinqumweni insizakalo engasiphakamisa, futhi i-RFC 7030 ichaza umklamo owodwa onjalo lapho iklayenti liziqinisekisa khona ngaphambi kokuba isitifiketi sibuyiselwe. Umehluko ohlala ngemva kocwaningo akukhona ukuzenzela, kodwa ukuthi ukuhlolwa kobunikazi kwenzeka ngaphakathi kwendlela yokukhipha noma eceleni kwayo.

Womabili amamodeli kusafanele aphendule imibuzo emithathu efanayo. Ubani ocela, kudivayisi iphi noma idima liphi, futhi isikhathi esingakanani. Uhlelo lwamathikithi olurekhoda izimpendulo lwenza umsebenzi wangempela; umugqa lapho othile egqolozele igama elijwayelekile awuwenzi, noma ngabe isitifiketi sihlelwa kahle kangakanani kamuva.

Khetha imodeli ngenani lokubhaliswa okulindele kanye nokushintshwa kwemishini. Amaseva ambalwa ngonyaka angakwazi ukubekezelela ukubuyekezwa ngesandla ngohlu lokuhlola olubhaliwe. Iqembu lamakhompyutha aphathwayo alikwazi.

Rekhoda umjikelezo wempilo kusukela ekukhishweni kokuqala

Gcina isihlonzi sesitifiketi, umnikazi, ukusetshenziswa okuhlosiwe, ukuphelelwa kwaso kanye nendlela yokukususa ngesikhathi sokukhipha, hhayi esigamekweni sokuqala. Ukusetshenziswa okuhlosiwe kufanele kube kusitifiketi uqobo ngokusebenzisa ukhiye okwandisiwe, futhi irekhodi kufanele livumelane nakho. Isitifiketi esikhiqizelwe ukuqinisekisa iklayenti akufanele singahlukaniseki kwesiseva.

Hlela ukuvuselelwa kanye nokuhoxiswa kwedivayisi elahlekile ngaphambi kokukhipha iphrofayili yeshumi. Isitifiketi esabiwe esigabeni sonke siguqula ukususwa okuhlosiwe kube ukuphazamiseka, futhi leso sinqumo kushibhile kakhulu ukusibuyekeza manje kunangesikhathi sesehlakalo sangoLwesihlanu.

Hlola isitifiketi esikhishiwe, bese kuba ukufinyelela

Ngemva kokubhaliswa, hlola lokho okukhiphiwe futhi uqinisekise ukuthi kuxhumana ngokuchungechunge kuya kusiphathimandla osilindele. Imiyalo emibili ihlanganisa amaphutha ajwayelekile: isitifiketi esisetshenziswe kabi, kanye nochungechunge olusebenza kuphela ngoba iklayenti lilungiselelwe ukungayinaki ukuqinisekisa.

openssl req -in client.csr -noout -verify -subject
openssl x509 -in client.crt -noout -subject -issuer -dates -ext extendedKeyUsage
openssl verify -CAfile ca.crt client.crt

Bese uhlola ukufinyelela hhayi into yobuciko. Isitifiketi sisungula ubunikazi, futhi inqubomgomo isananquma ukuthi yiziphi izinsizakalo lobo bunikazi obungazifinyelela. Hlola kokubili, ngoba into yobuciko efanele nenqubomgomo ebanzi kakhulu nayo yehluleka ekubuyekezweni. Qinisekisa ukuthi iklayenti liyaziqinisekisa futhi lithola kuphela imizila noma izinsiza ezihlosiwe. Bhala lokho okubonile, hhayi lokho iphrofayili okwakufanele ikwenze.

Iphrofayili esebenza ngesizathu esingalungile, njengegama elijwayelekile elihambisanayo nokungabikho kokuhlolwa kobunikazi, izoqhubeka nokusebenza ngemva kokususwa kokulawula obucabanga ukuthi unakho.