Kwenzekani uma ushintsha isiphathimandla sezitifiketi se-VPN

Ukushintsha isiphathimandla sezitifiketi se-VPN akukhona ukushintsha ifayela. Ngesikhathi i-CA entsha isayina isitifiketi sayo sokuqala, wonke umqinisekisi osathemba eyakudala kuphela kufanele anqume, futhi amahosthi angalitholi neze ihange elisha aqhubeka enqaba abalingani abalungile. Ngikubonile lokhu konakala kuzinhlangothi zombili: isango lafunda i-CA entsha kodwa amaklayenti awazange, ngakho ukuxhumana okusha kwahluleka, kuyilapho imigudu eyayivele imile yahlala imile futhi yenza ukuphazamiseka kubonakale njengenkinga yomzila. Nakhu okushintshayo, ngokulandelana okuvela ngakho ukwehluleka.

Ukushintsha okukodwa, izinguquko ezimbili ezihlukene

Isiphathimandla sezitifiketi igama, ukhiye womphakathi kanye nokhiye oyimfihlo osayinayo. Abaqinisekisi abalokothi bathembe «i-CA» ngendlela engabonakali. Bathemba isitifiketi esithile esivele sikwisitoreji sokuthembana, futhi bamukela umkhiphi kuphela uma uchungechunge lwezasayino lufinyelela kuleyo khophi egciniwe. Ngakho ukushintsha i-CA kushintsha izinto ezimbili ezihluleka ngokuzimela: ukuthi yimaphi amahange amukelwayo nokuthi yibuphi ubunikazi balingani obakhishwa ngaphansi kwawo.

Iningi lokufakwa kwe-VPN liqinisekisa kuzinhlangothi zombili. Iklayenti liqinisekisa isitifiketi sesango, isango liqinisekise eseklayenti. Ukushintsha okumasha kabusha iphakethe leklayenti kuphela kushiya iseva inqaba yonke iklayenti esaveza ubunikazi be-CA endala, futhi okuphambene nakho kuvamile. Qala ngokubala izindawo zokuphoqelela: izitoreji zokuthembana zamaklayenti, ifayela le-ca lesango, noma yimuphi ummeli oqeda i-TLS phambi kwalo, kanye nokuhlola okubheka indawo yokugcina ngaphandle.

Umqinisekisi uhlola ini, ngokulandelana

Ukuqinisekiswa komzila kukhuphuka kusuka esitifiketini somlingani ngokusebenzisa abalamuli kuze kufinyelele ihange elithembekile. Esigabeni ngasinye kuqinisekisa isasayino, kubheka ukuthi isitifiketi ngasinye sisekhasini laso lokuqinisekisa, futhi kuqinisekisa ukuthi imikhawulo eyisisekelo nokusetshenziswa kokhiye kuvumela umkhiphi ukuthi asayine. Ngemva kwalokho kuphela uhlelo lubheka isitifiketi seqabunga: amagama angomunye wesihloko kufanele amboze igama elishayiwe, futhi ukusetshenziswa kokhiye okunwetshiwe kufanele kuvume ukuqinisekiswa kweseva noma kweklayenti.

Ukuphinda lolo hambo ngaphandle kwenethiwekhi, khomba -CAfile eqoqweni eliqondile ozolisebenzisa, hhayi isitoreji sohlelo. Uma kungenjalo uhlola ihoshti, hhayi ushintsho:

openssl verify -CAfile new-ca.crt gateway.crt
openssl verify -CAfile new-ca.crt -untrusted intermediate.crt client.crt
openssl x509 -in gateway.crt -noout -subject -issuer -dates
openssl s_client -connect gw.example.net:443 -CAfile new-ca.crt

Lowo myalo usebenza kuphela ngokumelene nesilaleli se-TLS esilula njengekhasi lokuphatha le-HTTPS lesango; itshaneli yokulawula ye-OpenVPN iza ngaphambi kwe-TLS, ngakho i-s_client ayikwazi ukuhlola ukuxhawulana komgudu.

Imithetho yokwakha umzila ngemuva kwaleyo ziphutha ise-RFC 5280 isigaba 6. Ichaza ukwehluleka okubonakala kungaqondile: umlamuli ophelelwe yisikhathi okungekho owayekhumbula, isitifiketi okusetshenziswa kokhiye kwaso kwenqabela ukusayina, noma umkhawulo wegama okhipha ihoshti oyihlolayo.

Kungani umgudu omdala uqhubeka usebenza

I-TLS ne-OpenVPN zombili zigcina isikhathi sokuxhumana esisunguliwe siphila ngemva kokuphela kokuxhawulana. Akukho okugcina kuqinisekisa isitifiketi somlingani iphakethe ngalinye, ngakho iklayenti elaxhuma ngaphambi koshintsho liqhubeka lidlulisa ithrafikhi kuze kube yilapho lixoxa kabusha, lixhuma kabusha noma umgudu uwile. Yileli gebe elenza ukushintsha kwe-CA kubonakale kukuhle ihora bese kwehluleka ngesikhathi esibi kakhulu: ikhompyutha ivuka ebuthongweni, imephu ye-NAT iphelelwa yisikhathi, isango liqala kabusha.

Ukuqhubeka kwesikhathi sokuxhumana kwelula lo mboniso. Ithikithi lesikhathi se-TLS livumela iklayenti ukuthi libuye ngaphandle kokuthumela izitifiketi futhi, futhi ukuqhubeka kweqa ukuqinisekiswa komzila ngoba ukuxhawulana kokuqala kwasekwenze lokho. Ngakho ukuhlolwa okuthembekile ukuxhawulana okuphelele kunqubo entsha. Qala kabusha iklayenti esikhundleni sokuxhuma umgudu futhi, futhi kuphrofayela yokuhlola cabanga ukuvala amathikithi ukuze indlela yokuqhubeka ingakwazi ukufihla uchungechunge olugqabukile.

Gcina ungqimba lokhiye ongaguquki luhlukile kulokhu. Uma sikhuluma ngalokhu, tls-auth yengeza i-HMAC kutshaneli yokulawula, tls-crypt iyibethela futhi iyiqinisekise, futhi akukho kuzo okuthwala into yesitifiketi, ngakho ukuzungezisa noma yikuphi kuzo ukushintsha okuhlukile okunendlela yako yokwehluleka. Ukufakwa okuxubha kokubili kuphetha ngeklayenti elinokhiye ongaguquki olungile, isitifiketi esidala futhi umlayezo wephutha ongasho nalokukodwa.

Ugibe lokusebenzisa igama lesihloko kabusha

Kuyalingeka ukusebenzisa igama elihlukile lomanduleli kabusha ukuze kungabikho lutho olungezansi okufanele lushintshe. Lokho kugcina umugqa womkhiphi uzinzile kusixhumi futhi kucekela phansi uphawu olulodwa oludingayo. Izitifiketi ezimbili ezinamagama afanayo nokhiye abehlukene azikwazi ukuhlukaniswa ngegama, ngakho iqoqo elinamahange womabili linikeza umqinisekisi abantu ababili futhi kungekho mthetho wokukhetha.

Ukwakha umzila kungase kukhethe okungalungile, kubike ukuthi «akukwazi ukuthola isitifiketi somkhiphi wendawo» nakuba ihange elifanele likhona, noma kuphumelele kuhoshti eyodwa kwehluleke kwelinye elineqoqo elifanayo, ngoba ukulandelana kwabantu kwakuhlukile. Uma igama kufanele lisetshenziswe kabusha, gcina amahange womabili kumafayela ahlukene ngesikhathi soguquko futhi uwafake ngokucacile, futhi uwahlanganise kuphela lapho wonke umlingani esethula umkhiphi omusha. Uma kungenjalo nika ozongena esikhundleni igama elivamile elihlukile — isijobelelo sesizukulwane noma sosuku sanele — ukuze amarekhodi nemibhalo yamaphutha kusho ukuthi umlingani ohlulekile wakhishwa ngaphansi kwaluphi uphathimandla.

Ukuzungezisa okungawisi inethiwekhi

Okokushintsha okuhleliwe, amukela amahange womabili isikhathi esilinganiselwe esikhundleni sokushintsha esigabeni esisodwa. Khipha i-CA entsha nabalamuli bayo, faka ihange elisha eqoqweni lomqinisekisi ngamunye eceleni kwelidala, futhi ngemva kwalokho kuphela qala ukukhipha izitifiketi zomlingani kuyo. Abalingani abanobunikazi obudala baqinisekiswa ngokumelene nehange elidala; abasha basebenza ngokumelene nelisha.

Uma kwenziwe ngalolo kulandelana, isigaba ngasinye siyabuyiseka. Ukwehluleka okugwemayo ukushintsha ngesikhathi esisodwa, lapho iklayenti eligeje ukubuyekezwa kwephakethe lihlangana nesango eselivele lathatha umhlalaphansi ihange elidala, ukuxhawulana kuyafa, futhi akukho rekhodi elisho ukuthi yiluphi uhlangothi oludala.

Thatha umhlalaphansi ngakolunye uhlangothi. Khipha kabusha bonke ubunikazi okufanele businde, qinisekisa ukuthi ngakunye kwethula uchungechunge olusha, bese ususa ihange elidala emaqoqweni. Khipha ukhiye oyimfihlo we-CA endala emsebenzini, ngoba umkhiphi osakwazi ukusayina usho ukuthi ukuzungezisa akukapheli. Gcina izitifiketi namarekhodi okukhipha ukuze kuhlolwe. Umkhiphi olahlekile ubuyiselwa ekuthembaneni okufanayo; ukuchayeka kudinga ubunikazi obusha futhi akukho ukubuyela ehange elidala.

Qinisekisa umphumela, hhayi uhlu lwamafayela

Ifayela lokuthembana kusikhombandlela esilindelekile lifakazela okuncane. Uhlelo lungafunda omunye umzila, esinye isimo noma ikhophi engaphakathi kwephakethe elishintshwa ukuthuthukiswa. Hlola ukuziphatha kuzinhlangothi zombili, hhayi ukuba khona kwefayela.

Qinisekisa ukuthi ukuxhumana okusha ngobunikazi obusha kuyaphumelela, bese uqinisekisa ukuthi ubunikazi obukhishwe i-CA ethathelwe umhlalaphansi buyanqatshwa. Ukuhlolwa kwesibili yikho abantu abakweqayo, futhi yikho kuphela okubonisa ukuthi isiphathimandla esidala asisaniki ukufinyelela. Lapho ukufakwa kuncike ku-CRL noma ku-OCSP, hlola ukuthi izindawo zokusabalalisa ezisitifiketini ezintsha ziyaxazululwa nokuthi abalingani ababuzayo bayafinyelela umphenduli.

Qeda ngeklayenti elingakaze lixhume: sula isimo sephrofayela yalo, xhuma futhi ufunde uchungechunge okuxoxwe ngakho. Umlingani oqhubeka nesikhathi sokuxhumana esigciniwe uzobika ngenjabulo ukuthi ukufuduka kuphumelele nakuba engaqinisekisanga lutho.