Isizindalwazi sikhombisa isitifiketi esingalungile? Thola isilaleli

Ukufaka isofthiwe ye-VPN kumsingathi wewebhu kungahlela kabusha izinsizakalo, kodwa isitifiketi esingalindelekile asifakazi ukuthi amafayela e-Apache abhalwa kabusha. Kukhona okwethula leso sitifiketi kusiphequluli sakho, futhi umsebenzi wokuqala ukusibiza ngegama. Kuze kube yilapho isilaleli ne-virtual host zikhonjiwe, konke ukulungisa kuwukuqagela okusetshenziswa engxenyeni engalungile. Konke ukuhlola ngezansi kungukufunda kuphela.

Akukho okugaywa kabusha, okususwayo noma okubhalwa phezulu ngenkathi uqoqa amaqiniso anquma icala.

Funda isitifiketi esatholwa ngusiphequluli ngempela

Bhala igama lomsingathi, ikheli elixazululiwe lomkhakha ngamunye, imbobo kanye nemininingwane yesitifiketi okwakukhala ngayo usiphequluli. Igama elixazulula kokubili irekhodi le-A ne-AAAA lingafinyelela izingaphambili ezimbili ezihlukene, futhi kunye kuphela kuzo okungenzeka ukuthi ingumsingathi onokufinyelela kwe-shell. Usiphequluli esingemuva kwe-proxy singathatha indlela yesithathu futhi. Ukuqagela ukuthi iyiphi eyakhipha isixwayiso kuchitha ukubona kuphela onakho.

Bese uphinda ukuxhawulana kusuka kumshini osendleleni efanayo, usho ikheli ngokucacile futhi uthumele igama leseva obekuhlosiwe ukuze impendulo ikhombise isayithi hhayi umsingathi ojwayelekile.

openssl s_client -connect 198.51.100.37:443 -servername www.example.net </dev/null 2>/dev/null |
  openssl x509 -noout -subject -issuer -fingerprint -sha256 -ext subjectAltName

Qhathanisa amanye amagama esihloko kanye nomnyathelo womunwe nesitifiketi osilindele, hhayi nomkhiphi ojwayelekile. Ukuxhumana nekheli elingenalutho ngaphandle kwegama leseva kungakhetha isitifiketi esijwayelekile, esibese sibonakala njengefayela elingalungile kuyilapho empeleni umbuzo ongalungile.

Khomba inqubo eboshelwe kuleyo mbobo

Kumsingathi okufanele wamukele uxhumano, bhala izilaleli bese ubhala ikheli lokubopha, umkhakha wamakheli kanye nomnikazi wenqubo. Insizakalo eboshelwe ekhelini le-loopback ayifani naleyo eboshelwe kuzo zonke izixhumanisi, futhi ukushicilelwa kwe-container kungabeka isilaleli somphakathi kwenye indawo ngokuphelele.

sudo ss -ltnp 'sport = :443'
sudo ss -ltnp | grep -E ':(443|943)\b'

Uma i-TLS ipheliswa isilinganisi somthwalo noma i-proxy engaphambili, yima lapha bese uhlola leso sikhathi sangaphambili esikhundleni salokho. Isigaba se-Apache esingemuva kwaso kungenzeka singakwazi ukwethula isitifiketi kusiphequluli somphakathi, ngakho ukuhlela ukucushwa kwaso akushintshi lutho kulokho okubona usiphequluli. Umbono we-socket nokuxhawulana kwangaphandle kufanele kuchaze indlela efanayo, futhi yilokho okutholwa yilokhu kuqhathanisa.

Fananisa i-virtual host ngaphambi kwefayela

Uma i-Apache iyisiphetho, yibuza ukuthi iyiphi i-virtual host ewina kulelo kheli nalelo gama. Umyalo wokulawula uprinta ukuhlelwa okusebenzayo, kufaka phakathi iqembu elihambisana ne-socket ngayinye, amagama eseva amenyezelwe kanye nomsingathi othathwa njengojwayelekile. Ukuhlela ifayela lesitifiketi ngaphandle kwaleyo mpendulo yindlela isayithi elingalungile ekugcineni elisebenza ngayo kusuka kufayela elifanele.

sudo apachectl -S

Imibuzo Evamile ye-SSL ye-Apache ichaza ukuthi isikhombisi segama leseva sikhetha kanjani isitifiketi. Isihloko se-Host se-HTTP sifika ngemuva kokuxhawulana futhi asikwazi ukushintsha emuva lokho osekuvele kwethulwa, ngakho igama elingafanisiyo noma elingekho libuyela kumsingathi ojwayelekile.

I-virtual host enamagama anephutha lokuthayipha ku-ServerAlias ikhiqiza kahle lesi sibonakaliso, futhi kunjalo nangefayela lesibili lokucushwa elilayisha kuqala umsingathi obamba konke. Kokubili kuyabonakala kulolo hlu lokuhlelwa.

Qinisekisa ukulungisa kuyo yonke indlela oyishoyo

Ngemuva koshintsho olugunyaziwe, phinda ukuhlola okuqondene negama lomsingathi kumkhakha ngamunye wamakheli bese uqeda ngokuqinisekisa okujwayelekile kosiphequluli esikhundleni sefulegi lokweqa. Gcina indlela yokuphatha ehlukile ngaphambi kokuthinta izilungiselelo ezabiwe zesilaleli, ngoba iphutha lapho lisusa ukufinyelela obekuzosebenzisa ukukuhoxisa. Bese ubhala ukuthi yisiphi isilaleli esaphendula, iyiphi i-virtual host eyafanisa nokuthi yisiphi isitifiketi esasetshenziswa ngaphambi nangemuva.

Ukususa iphakethe kungashintsha ukuhlelwa futhi kushiye ukungafani kwasekuqaleni kungachazwanga, yingakho lelo rekhodi liphila isikhathi eside kunokulungisa.

Lokho okufunayo yisayithi obekuhlosiwe endaweni yokungena obekuhlosiwe. Isitifiketi esihlukile ngemuva kokunyamalala kwensizakalo engahlobene akusona leso siphumo, ngisho nalapho usiphequluli siyeka ukukhala.