Isitifiketi sesayithi efinyeleleka nge-VPN kuphela: i-DNS-01 noma i-CA yangasese?

Izimo ezintathu zinquma ukuthi isayithi efinyeleleka nge-VPN kuphela kufanele isithole kanjani isitifiketi sayo: ukuthi uyayilawula yini indawo ye-DNS yomphakathi, ukuthi igama lomsingathi lingavela kumarekhodi omphakathi, nokuthi iklayenti ngayinye inganikezwa yini i-ankha yokuthembela yangasese. Zombili izindlela zomphakathi neyasese zikhiqiza ukhiye osebenzayo futhi ziphendula imibuzo ehlukene. Ukukhetha eyodwa ngaphandle kokuxazulula lezo zimo yindlela isayithi eligcina ngayo linesitifiketi somphakathi ebesingasifuni, noma linesitifiketi sangaphakathi esilawa uhhafu wamaklayenti.

Isitifiketi sifakazela igama; i-VPN ne-DNS yangaphakathi zinikeza indlela.

Izindlela ezimbili eziya egameni elithenjwayo

Umkhiphi womphakathi onekuhlolwa kwe-DNS-01 ufakazela ukulawula kwegama ngerekhodi le-TXT endaweni oyilawulayo, ngakho isevisi yewebhu akudingeki ukuthi yamukele ukuxhumana kwe-HTTP yomphakathi. I-CA yangasese ikhipha izitifiketi zamaqabunga amagama angaphakathi futhi isabalalisa i-ankha yayo yokuthembela ngokuphathwa kwamadivaysi, ngakho awekho umarekhodi womphakathi owaziyo igama. Kokubili kusemthethweni, futhi ukukhetha kuvela kulezo zimo ezintathu hhayi ekuvumeleni. Ayikho indlela enikeza umzila noma ukufakwa kwesixazululi okudingwa yiklayenti.

Isitifiketi somphakathi siphinde sishicilele igama lomsingathi kumarekhodi okusobala kwezitifiketi. Uma igama ngokwalo libucayi, lokwo kwambula kuyisinqumo somklamo hhayi umphumela oseceleni ozotholakala kamuva.

I-DNS-01 ngaphandle kokuveza isevisi

Irekhodi lensela lingukufakwa kwe-TXT ngaphansi kwesiqalo esigcinelwe endaweni, futhi umkhiphi ulifunda ku-DNS enegunya. Khetha iklayenti le-ACME nokuhlanganiswa kwe-DNS okungakha futhi kususe lelo rekhodi, futhi ugunyaze ukubuyekezwa ngendlela encane: imininingwane ye-API enomkhawulo wendawo, noma umsingathi olawulwayo osetshenziselwa ukuqinisekisa kuphela. Ukunikeza iseva yohlelo imininingwane yombhalisi engenamkhawulo ukuze kuvuselelwe isitifiketi esisodwa kuyigunya elikhulu kakhulu kunalokho okudingwa umsebenzi. Uma ama-oda amaningi abelana ngegama elilodwa, gcina amanani awo e-TXT ahlukene ukuze ukuhlanza elinye kungasusi inani elisadingwa elinye.

Linde ukusabalala ngokuhlola ngokumelene namaseva anegunya esikhundleni sokulinda isikhathi esinqunyiwe. Ukuziphatha kokusabalala kuncike kumhlinzeki, futhi ukulinda okusebenza namuhla akubona ubufakazi bakusasa.

Amaklayenti aphethwe namagama ayimfihlo ngamabomu

Amadivaysi aphethwe namagama ayimfihlo ngamabomu ahambisana kahle ne-CA yangaphakathi. Sabalalisa umkhiphi othembekile ngokuphathwa kwamadivaysi, bese ukhipha izitifiketi zamaqabunga amagama ahlosiwe. Hlola ukuthi iyiphi indawo yokugcina ekwatheni ngayinye esetshenziswa ngamaklayenti, ngoba ukufakwa okukodwa kuhlelo lokusebenza akusona isitatimende esijwayelekile ngaso sonke isiphequluli nohlelo. Ukugxilisa iqabunga kungenye indlela lapho kusekelwa khona ngokusobala, ngezindleko zokunye ukubuyekezwa kokuthembela njalo lapho iqabunga lishintsha.

Isiteshi sokusabalalisa sibalulekile njengokhiye: impande okungekho muntu oyifakayo ayivikeli lutho.

Ukuvuselela kuyingxenye yomklamo

Noma iyiphi indlela oyikhethayo, ukuvuselela kudinga umnikazi nenqubo. Ukuvuselela ubufakazi bokuqinisekisa, ukufaka into entsha nokulayisha kabusha isilaleli ngomshini walo osekelwayo kuyizinyathelo ezintathu ezihlukene, futhi eyesiyingi kuphela ezenziwa ngokuzenzekela amaklayenti amaningi e-ACME. Isitifiketi esivuselelwa ngendlela efanele kodwa singakalayishwa sibangela ukuphazamiseka okufanayo nesiphelelwe yisikhathi.

Isitifiketi asifaki umzila we-VPN futhi asidali irekhodi le-DNS langaphakathi. Amaklayenti asadinga isixazululi esihlanganisa igama nekheli langasese kanye nomzila wokufinyelela lapho. Hlola isayithi ngegama kusukela kuklayenti enazo zombili.

Rekhoda umkhiphi, indlela yokuqinisekisa, isiteshi sokusabalalisa ukuthembela nomshini wokulayisha kabusha. Lezo zine ziyihlelo lokuvuselela.