Isitifiketi se-VPN asikakavumeleki: izimbangela ezintathu, ukulandelana kokuhlola okukodwa
Ukuthi asikakavumeleki kusho ukuthi iwashi ledivayisi lingsemuva, iwindi liqala kamuva ngempela, noma isitifiketi esiphakathi asikavuleki. Zihlole ngokulandelana kwalokho.
Uvula iklayenti, ukhetha iphrofayili oyisebenzise izinyanga, bese ima nge "certificate is not yet valid". Akukho okushintshile ekungeneni kwakho, futhi isitoreji sokuthembela cishe silungile: isitifiketi esethulwe ekuxhawuliseni sinesikhathi sokusebenza esiqala kamuva kunesikhathi esisetshenziswa umhloli. Izimo ezintathu ezihlukene zikhiqiza lowo mlayezo, futhi zidinga izinyathelo ezihlukene. Ukulandelana ngezansi kukutshela ukuthi yikuphi onakho ngaphambi kokuthinta iwashi noma ifayela lesitifiketi.
Iyiphi kwezimbangela ezintathu oyibonayo
Imbangela yokuqala ingeyasekhaya: idivayisi eyenza ukuhlola inewashi elingaphambi kosuku lokuqala lwesitifiketi. Ukubona lokhu kuhadiwe elinebhethri le-CMOS elifile, kumishini ebonakalayo ebuyiselwe kusithombe esidala, kumadivayisi ahlale evalile isikhathi eside ngokwanele ukulahlekelwa isikhathi, nasemaxhoxhweni lapho i-NTP ephumayo ivinjiwe futhi akekho owabona. Isitifiketi singase sisebenze ngokuphelele futhi sehluleke ngale ndlela.
Imbangela yesibili ingeyomkhiphi, ngoba isitifiketi siqala ngempela esikhathini esizayo: sikhishwe ngaphambi kwesikhathi, sadalwa ngesikhathi sokuqala esicacile, noma sasayinwa njengengxenye yesinyathelo sokusebenza esingakashayi. Imbangela yesithathu ichitha isikhathi esiningi, ngoba iqabunga likhona ngenkathi esinye isitifiketi ochungechungeni olwethuliwe singekho, ngakho iphutha libiza impahla ongakaze uyifake.
Umbuzo owodwa uyabahlukanisa. Ingabe ukwehluleka kulandela idivayisi noma insiza? Imishini emibili kuxhoxho olulodwa eziphatha ngendlela ehlukile ikhomba emawashini. Wonke iklayenti lehluleka ngendlela efanayo likhomba ewindini lesitifiketi nasochungechungeni olungemuva kwalo.
Funda iwindi kusitifiketi esethulwe ngempela
Ungahloli ifayela le-PEM elisele ekusetshenzisweni kwangaphambili; cela insiza ukuthi ikunikeze uchungechunge elikuthumayo manje. openssl s_client -connect vpn.example.com:443 -servername vpn.example.com -showcerts liphrinta zonke izitifiketi ochungechungeni. Gcina ibhlokhi oyidingayo bese usebenzisa openssl x509 -noout -subject -issuer -dates; eyedlule iphrinta i-notBefore ne-notAfter, futhi yilezo zindinganiso ezimbili ezinqumayo. Ku-Windows, ibhokisi lengxoxo lesitifiketi sokuxhumana kanye ne-certutil -dump efayelini elikhishelwe ngaphandle kukhombisa izinkambu ezifanayo.
Funda zombili iziphetho zewindi, hhayi ukuqala kuphela. Isitifiketi esivuleka emahoreni amabili naleso esivaleka emahoreni amabili sehluleka ngemilayezo ehlukene futhi sibandakanya amaqembu ahlukene. Qaphela ukuthi yisiphi isitifiketi esishiwo iphutha — iqabunga, esiphakathi noma impande — ngoba lokho kunquma ukuthi kukhona yini okungalungiseka ohlangothini lweklayenti.
Ungahlola iwindi ngaphandle kokulilinda. Ukuqinisekisa kwamukela isikhathi esicacile: openssl verify -attime 1793600000 -CAfile ca.pem -untrusted intermediate.pem leaf.pem lihlola uchungechunge ngaleyo ntika yesikhathi. Yisebenzise ngesikhathi samanje ukuze uphinde ukwehluleka, bese kuba ngesikhathi sokuqala sesitifiketi ukuze uqinisekise ukuthi uchungechunge olufanayo luyadlula lapho iwindi livuleka. RFC 5280 lichaza inkambu yokusebenza kanye nomthetho wokuthi isitifiketi akufanele sisetshenziswe ngaphandle kwayo, futhi lowo umthetho yiwona owawusetshenziswa iklayenti lakho.
Iwashi lakho, noma elabo
Qhathanisa iwashi ledivayisi nokuqala kwesitifiketi nge-UTC, kusuka emthonjeni owuthembayo. date -u linikeza isikhathi, futhi ku-systemd host i-timedatectl status ibika nokuthi iwashi livumelanisiwe yini. Ku-Windows, w32tm /query /status likhombisa umthombo wamanje nokuvumelanisa kokugcina okuphumelele. Isikhathi sendawo esiboniswa kutreyi ukukhetha kokubonisa, hhayi iwashi elingalungile; umhloli uqhathanisa izikhathi ze-UTC.
| What you see | Most likely reading | Next step |
|---|---|---|
| Clock behind, one device affected | Local time fault | Resync time, keep validation on, retest |
| Clock correct, window opens soon | Certificate staged early | Wait for the window or follow the cutover plan |
| Clock correct, intermediate not yet valid | Chain material mismatch | Operator replaces the intermediate |
| Some peers pass, others do not | Inconsistent nodes | Record each peer's chain before changing anything |
Uma iwashi lingemuva, vumelanisa futhi uhlole futhi ngaphambi kokushintsha noma iyiphi impahla yesitifiketi. Idivayisi eliphutha ngamaminithi noma amahora livimbela zonke izitifiketi ezisanda kukhishwa elihlangana nazo, hhayi insiza eyodwa kuphela, ngakho incazelo yensiza eyodwa ngokuvamile iyiyo engalungile. Uma iwashi lilungile futhi livumelanisiwe, yeka ukubheka idivayisi: iwindi ngelomkhiphi, futhi akukho silungiselelo sendawo okufanele silungiswe ukuze lidlule.
Leyo thebula iyisinqumo sonke. Ukuhambisa iwashi kulokho okulindelwe yisitifiketi akulona ukulungisa, futhi ukuvala ukuhlola kwesikhathi nakho akulona, ngoba kokubili kufihla isimo esidale iphutha.
Kungani uchungechunge lwehluleka ngenkathi iqabunga libonakala lilungile
Amaqabunga avuselelwe nezitifiketi eziphakathi zokushintsha ngokuvamile zithunyelwa ndawonye, futhi azihlali zifika ngesikhathi esifanayo. Insiza ingathumela iqabunga elisha elisayinwe isiphakathi esiwindi laso liqala kamuva, noma iqhubeke inikeza isiphakathi esidala ngaphansi kweqabunga elisha. Noma ngabe yikuphi, uchungechunge lwehluleka ngenkathi izinsuku zeqabunga ngokwalo zibonakala zizwakala.
Amaphuzu okugcina alinganiselwe umthwalo ashintsha lokhu kusuka kokugqekeziwe kuya kokungavumelani. Uma umzamo ophindwayo uphumelela, noma inethiwekhi eyodwa isebenza kanti enye ayisebenzi, qopha ukuthi iyiphi intanga ephendulile nokuthi yiluphi uchungechunge eyaluthumela ngaphambi kokushintsha izilungiselelo. openssl s_client liphrinta ikheli elixhunyiwe, ngakho imizamo embalwa iveza ukuthi inodi ngayinye inikeza uchungechunge olufanayo yini.
Izindlela zokulungisa ezigcina ukuqinisekisa kuphelele
Inkinga yewashi ilungiswa kudivayisi kushiywe ukuqinisekisa kuvuliwe. Inkinga yesitifiketi ilungiswa umsebenzisi ngempahla ekhishwe yewindi eselivele lihlanganisa manje. Akukho silungiselelo seklayenti elenza isitifiketi esingakasebenzi sisebenze; amafulegi adlula ukuhlola kwesikhathi akhona ukuze uqinisekise ukuxilongwa, hhayi ukuze kukhishwe emkhiqizweni.
Lapho isitifiketi silungiselelwe ukusebenza okuhleliwe, landela uhlelo lokushintsha. Sifake lapho iwindi laso livuleka, noma sebenzisa inqubo yokugqagqana echazwe umhlinzeki, esikhundleni sokusifaka ngaphambi kwesikhathi nokufundisa abasebenzisi ukuchofoza izixwayiso. Izixwayiso abantu abazifunda ukuzishaya indiva zibiza kakhulu kunokubambezeleka okufushane.
Ekugcineni, hlola futhi ngendlela ukwehluleka okwenzeka ngayo: iseshini entsha, iklayenti elifanayo, insiza oyidinga ngempela. Amathala e-TLS angagcina uchungechunge oluqinisekisiwe isikhathi sokuphila koxhumano, futhi iseshini eqalisiwe ayidingi ukuphinda iluhlole, ngakho iseshini endala ingaqhubeka yehluleka ngemva kokulungiswa noma iqhubeke isebenza ngemva kokuhlehla. Ifayela elivuleka kumbukisi lifakazela kuphela ukuthi ifayela liyafundeka; ukuxhawulana okuqediwe kufakazela ukuthi uchungechunge luyaqinisekiswa.
Ngaphambi kokuvala ithikithi, qinisekisa izinto ezine: isikhathi se-UTC nesimo sokuvumelanisa sedivayisi ehlulekile, i-notBefore ne-notAfter yesitifiketi ngasinye ochungechungeni olwethuliwe, uchungechunge olufanayo kusuka kuklayenti lesibili, kanye negama elinikezwa iphutha esitifiketini. Uma iwashi lilungile futhi iwindi lingakavuleki, okusele kungumsebenzi womsebenzisi, futhi isinyathelo esilungile ohlangothini lwakho ukulinda iwindi esikhundleni sokwenza buthaka ukuhlola.