Uhlu lwezitifiketi ze-VPN: yini irejista ye-CA engayifakazela
Ifolda kuseva, irejista ye-CA, uhlu lokuhoxiswa kanye nethebula yamaseshini ziphendula imibuzo ehlukene. Zihlukanise lapho wenza uhlu lwezimpawu ze-VPN.
Isango lakho lamukela isitifiketi sekhasimende elingakaze lisibone, ngoba lokho elikulungiselelwe ngakho umkhiphi othembekile, futhi isitifiketi sifika ngesikhathi sokuxhawulana. Yilolo indlela iphrothokholi okufanele isebenze ngayo, futhi yisona sizathu sokuthi uhlu lwefolda kuseva lube uhlu olubi. Umkhiphi uyazi ukuthi wadala ini, iseva iyazi ukuthi yini exhumene, futhi isimo sokuhoxiswa siyazi ukuthi yini yahoxiswa. Uhlu oluhlanganisa lawa marekhodi amathathu ekugcineni lufakazela into okungekho noyedwa kuwona owayishilo.
Isango lithemba umkhiphi, hhayi uhlu lwamafayela
Ukuqinisekisa kuqhathanisa isitifiketi esethulwe nensika yokuthembela, ngakho ubunikazi obudalwe umkhiphi ofanayo izolo buxhumeka ngaphandle kokuthi bake babe khona kudiski yeseva. Akukho okudinga ukukopishwa ukuze lokho kwenzeke, futhi akukho muntu okufanele akugunyaze ngesandla. Ngakho amarekhodi eseva ngokwawo achaza ukufika, hhayi inani lezimpawu ezingafika.
Igebe elihlanekezelwe lilimbi ngendlela efanayo. Ifolda ingaba nezitifiketi eziphelelwe yisikhathi, ezihoxisiwe kanye nezimpawu ezikhishwe kumadivayisi angakaze asetshenziswe. Ukubala amafayela kuphendula ukuthi mangaki amafayela akhona, okungumbuzo ongakaze ubuzwe muntu. Esikhundleni salokho qala kumarekhodi anencazelo.
Imibuzo emine, amarekhodi amane ahlukene
Uhlobo ngalunye lwerekhodi luphendula kahle umbuzo owodwa futhi luphendule kabi eminye, yingakho umbiko ohlanganisa wonke ubonakala ugcwele ngenkathi unamaphutha ngendlela ethile. Ithebula elingezansi lihlela wona ngokombuzo ewuxazululayo, hhayi ngokohlelo olukhiqizayo.
| Question you are answering | Where the answer lives | How quickly it changes | What it will never show |
|---|---|---|---|
| Was this identity ever created? | The issuer's issuance database | Only when something is issued | Whether the device still exists |
| Is a copy sitting on this host? | The paths you actually inspected | Whenever anyone copies files | Certificates that were never copied here |
| Has the issuer withdrawn it? | Published revocation state | When the issuer next publishes | Withdrawals that are not published yet |
| Is it connected right now? | The live session table | Continuously | Anything about past or future sessions |
Ingobo yezitifiketi zomphakathi ayiyona imfihlo, ngoba ayinazo izikhiye zangasese, kodwa futhi ayinakwabiwa. Izihloko namagama amadivayisi embula imininingwane yokusebenza, futhi umbiko kufanele uhlale kubantu abawudingayo. Izikhiye zangasese zihlala ngokuphelele ngaphandle kohlu, ngoba uhlu ludinga imethadatha, hhayi ubufakazi bokuya.
Umkhiphi nenombolo yochungechunge ukuphela kokhiye ozinzile
Izihloko ziyaphinda zisetshenziswe namagama amafayela ayasetshenziswa futhi, ngakho igama elake labonisa idivayisi eyodwa nyakenye lingase libonise enye manje. Akukho kokubili okuyisikhiye, futhi umbiko owakhelwe kwelinye lawo ekugcineni uzohlanganisa izimpawu ezimbili emgqeni owodwa.
Ipheya lomkhiphi nenombolo yochungechunge likhomba isitifiketi ngendlela eyingqayizivele, futhi zombili izinkambu zivela kusitifiketi uqobo. Zirekhode kanye nesihloko, izinsuku zokusebenza, umthombo okwavela kuwo ikhophi kanye nomuntu noma idivayisi enesibopho. Engeza isimo sokuhoxiswa nokwethulwa njengezinkambu ezihlukene ezinezikhathi zazo zokubuka, ngoba isitifiketi esingaphakathi kwewindi lokusebenza kwesitifiketi asigunyaziwe ngokuzenzakalelayo. Lawa maqiniso amabili ahlala ezinhlelweni ezihlukene, futhi ukuwahlanganisa kufihla icala lapho uphawu lwahoxiswa khona ngenkathi ifayela lalo lisabonakala lisha.
Funda isitifiketi esisodwa ngesikhathi
Uphawu lwe-wildcard olusakazeka kuyo yonke ifolda akulona uxhumano lweqembu, futhi lufihla ukuthi iyiphi ifayela ekhiphe okukhiphile. Funda imethadatha ngesitifiketi ngasinye, futhi funda uhlangothi lokuhoxiswa kusukela ku-artefact yalo uqobo. Isiqondiso se-OpenSSL x509 sibala izinkambu ezinyatheliswa yilokho kukhetha.
openssl x509 -in <cert>.pem -noout -issuer -serial -subject -dates -fingerprint -sha256
openssl crl -in <issuer>.crl -noout -text | head -n 40Nge-PKI ye-Easy-RSA ephethwe, buza isizindalwazi sokukhishwa ngokusebenzisa ukuhamba komsebenzi okusekelwa yithuluzi esikhundleni sokucabanga ukuhlelwa kwefolda, futhi gcina okwangempela kufundwa kuphela ngenkathi uhlu luhlanganiswa. Ukuhlelwa kwerejista kuvamile ngokwanele ukuthi kubalwe okufakwe okusemthethweni futhi kubalwe okuhoxisiwe ngaphandle kokuvula isizindalwazi ngesandla.
grep -c '^V' pki/index.txt
grep '^R' pki/index.txt | cut -f4,5Uhlu oluyokweqa ukukhishwa okulandelayo
Ukudonswa kwefolda kanye kuphela kuguga ngaso leso sikhathi lapho kukhishwa isitifiketi esilandelayo, ngakho yakha umbiko ngokusebenzisa ukuhamba komsebenzi kokukhishwa futhi uwuvumele uvuseleleke njengengxenye yokusebenza okujwayelekile. Lokhu futhi kwenza umbiko ukwazi ukuphindwa, okuyinto ebalulekile lapho abantu ababili bengavumelani ngokuthi kwakhishwa ini.
Sebenzisa umphumela ezinqumweni zokuvuselela nokuhoxa emsebenzini, hhayi njengomsebenzi wespredishithi. Ukususa ikhophi yasendaweni akukwenzi kungavumeleki amakhophi akude asekhona kakade. Hoxisa uphawu ngokusebenzisa ukuhamba komsebenzi kokuhoxiswa nokugunyaza okulungisiwe, bese urekhoda ukuhoxiswa nosuku lwako. Uphawu olwanyamalala kuseva kodwa umkhiphi esaluthemba alukahoxiswa emsebenzini, futhi lowo mehluko uhlukanisa uhlu olunembile kolo olududuza kuphela.