Yisiphi isitifiketi somshini esinikezwa yi-VPN ye-Windows?

Izitifiketi zifakiwe, okhiye abayimfihlo bakhona, futhi umhubhe usahluleka ekuqinisekiseni. Umshini onezitifiketi eziningi unganikeza i-VPN umfakisicelo ayengamqondile, futhi iklayenti alinayo indlela yokwazi ukuthi yisiphi isango elizokwamukela. Ukususa ezinye kuyinqubomgomo yokukhetha enemiphumela kuyo yonke insiza emshinini. Nciphisa isethi evumelekile esikhundleni salokho, bese uqinisekisa ukuthi yisiphi isitifiketi esanikezwa ngempela.

Izitifiketi eziningi, esisodwa sinikeziwe

Amaphrofayili e-VPN omdabu e-Windows anokuqinisekisa ngesitifiketi somshini ahlinzeka ngezihlungi ezimbili ezikhawulela abafakisicelo: isihlungi somkhiphi nesihlungi sokusetshenziswa kokhiye okunwetshiwe. Zinciphisa isethi iklayenti elingakhetha kuyo. Azilungisi isitifiketi esingafanele, futhi aziqinisekisi ukuthi iseva izokwamukela okusele. Lowo mngcele kufanele ubhalwe kurekhodi yoshintsho, ngoba umfundi olandelayo uzocabanga ukuthi isihlungi sithathe isinqumo esingaphezu kwalokho esikuthathile.

Ukwehluleka abakubhekana nakho kuncane futhi kucacile. Isitifiketi esivumelekile esivela kwisiphathimandla esingalungile, noma esakhishwa ngenjongo isango elingayamukeli, sikhethwa ngaphambi kwesihlosiwe, okukhipha ukwehluleka kokuqinisekisa eduze kwesitoreji esinempilo. Izihlungi ezimbili zikwenza kube yisethi encane ngokwanele ukucabanga ngayo, futhi ingxenye esele yaleli khasi iyazisebenzisa ngokulandelana.

Hlola isitoreji ngaphambi kokuhlela iphrofayili

Bhala abafakisicelo kanye nezakhiwo zabo esitorejini iphrofayili eliyisebenzisa ngempela. Akukho okukhiphela okhiye oyimfihlo lapha, futhi asikho isitifiketi okufanele sishiye umshini:

Get-VpnConnection -Name 'Office' | Select-Object Name, TunnelType, AuthenticationMethod
Get-ChildItem Cert:\LocalMachine\My | Select-Object Subject, Issuer, Thumbprint, NotAfter, HasPrivateKey, EnhancedKeyUsageList

Funda umphumela wezakhiwo okuncike kuzo isinqumo: ukhiye oyimfihlo osebenzisekayo, isikhathi sokusebenza esamukelekayo, umkhiphi ohlosiwe kanye nezinhloso ezikusandiso. Isitifiketi singaba khona, sibhaliswe kahle futhi singabi nasidingo kulokhu kuxhumana ngasikhathi sinye. Ikholomu yomwhato womunwe yiyo ozoyiqhathanisa kamuva, ngakho gcina umphumela.

Qinisekisa iphrofayili kanye nobukhulu bayo ngaphambi kokuhlela, ngoba isitifiketi somshini ku-LocalMachine, isitifiketi se-EAP-TLS somsebenzisi kanye nesitoreji sakho sokhiye oyimfihlo sohlelo kuyizimo ezintathu ezihlukene. Sebenzisa ubukhulu babo bonke abasebenzisi nesimo sokuphatha lapho iphrofayili ephethwe ikhona. Ukudala iphrofayili yesibili enegama elifanayo kufihla ukuthi yikuphi ukucushwa okusetshenziswa wukuxhumana ngempela.

Isihlungi somkhiphi sifuna into

Ipharamitha yomkhiphi ilindele into yesitifiketi, hhayi igama lokubonisa futhi hhayi umucu womwhato womunwe ongenalutho. Nikeza isitifiketi sesiphathimandla esigunyaziwe kusuka endleleni oyihlolile, esitorejini lapho sifanele khona:

$issuerPath = Read-Host 'Certificate-provider path for the approved issuer CA'
$issuer = Get-Item -LiteralPath $issuerPath
Set-VpnConnection -Name 'Office' -MachineCertificateIssuerFilter $issuer

Ungashintshi isitifiketi sekhasi liklayenti uqobo, esinye isiphathimandla esinesihloko esifanayo, noma impande entsha eyakhiwe ngenxa nje yokuthi uhlobo lwepharamitha luyayamukela. Iziphathimandla ezimbili zingabelana ngomucu oyedwa wesihloko, futhi yingakho into ibaluleke ukwedlula umbhalo. Incwadi yokubhekisa ye-cmdlet yakwa-Microsoft ibhala zombili izinhlobo zokufaka, futhi kufanele ifundwe ngaphambi kokuhlela kokuqala hhayi ngemva komzamo ohlulekile.

Isihlungi sokusetshenziswa sifuna umucu we-OID

Ipharamitha yokusetshenziswa kokhiye okunwetshiwe ithatha imicu ye-OID, futhi injongo yokuqinisekisa iklayenti 1.3.6.1.5.5.7.3.2. Ukuyisebenzisa kukhawulela abafakisicelo ezitifiketini eziphethe leyo njongo, okuyikho ngqo okufunwa wukusetshenziswa kokuqinisekisa iklayenti:

Set-VpnConnection -Name 'Office' -MachineCertificateEKUFilter '1.3.6.1.5.5.7.3.2'

Inani liwuhlu, ngakho ukusetshenziswa okudinga izinhloso eziningi kudlulisa nguhlu. Isihlungi asikwazi ukwengeza injongo esitifiketini: siyisisho sokukhetha esihlolwa ngokuqhathaniswa nezandiso ezisayiniwe, futhi asikho isihlungi esizibhala kabusha, ngakho isitifiketi esingenayo injongo kufanele sidlule ekubhalisweni futhi.

Gcina ukucushwa kwe-EAP kwezitifiketi zabasebenzisi kuhlukile ekuhlungeni kwezitifiketi zomshini, ngoba zihlala ezindaweni ezihlukene futhi ushintsho kolunye akuvamisile ukuchaza ukwehluleka kolunye. Hlola futhi ukuthi ingabe isizinda noma ukuphathwa kwamadivayisi kungumnikazi wephrofayili, ngoba ukuhlela kwasendaweni kungashintshwa ekuhlaziyweni kwenqubomgomo okulandelayo ngaphandle kokuthi othile athinte umshini.

Fakazela ukuthi yisiphi isitifiketi iklayenti esinikezile

Sungula ukuxhumana okusha futhi ufunde ubufakazi bokuqinisekisa kweklayenti neseva bobuqobo obuhlosiwe. Lapho izitifiketi ezingaphezu kwesisodwa zihlangabezana nezihlungi, umphumela uba yiqeqebana elincane hhayi iqabunga eliboshelwe, ngakho umzamo olandelayo ungakhetha ilungu elihlukile. Bhala umwhato womunwe ovela kulobo bufakazi futhi uwuqhathanise nalowo owubhale esitorejini.

Umyalo ophumelelayo awukho ukuqinisekisa okuphumelelayo. Umphumela okufanele ubhalwe wukuthi isitifiketi esihlosiwe siyaziqinisekisa ngaphansi kwenqubomgomo ephethwe kuyilapho isitifiketi ngasinye esingahlobene sihlala sitholakala kumasevisi ancike kuso. Uma ukwehluleka kudlula kuzo zombili izihlungi, indawo elandelayo yokubheka ingabafakisicelo abasele hhayi iphrofayili yonke.