Kungani ukukopisha ca.key kuwo wonke amaklayenti e-VPN kubhidliza i-CA
Iklayenti liqinisekisa isitifiketi esivamile se-CA; aliwudingi neze ukhiye osayinayo. Ukukopisha ca.key kudivayisi ngayinye kunikeza igunya lokukhipha kunoma ubani othatha ikhophi eyodwa.
Endaweni ethile emiyalweni yokuhlela, uhla lwamafayela lukopishwa luphelele kuyo yonke ikhompyutha ephathwayo ngoba kwakulula lokho kunokunquma ukuthi yimaphi amafayela afanele ukuba lapho. Lolo hla luqukethe i-ca.key, futhi lapho selufinyelela kudivayisi yesibili, isiphathimandla sezitifiketi asiseyona isiphathimandla. Manje noma ubani oyiphethe angakhipha ubunikazi ozokwethenjwa yiyo yonke enye inethiwekhi.
Kufanele ukuxazulula lokhu kudideka kanye, ngoba womabili amafayela abukeka efana kodwa enza izinto eziphambene.
Impahla yokuqinisekisa kanye nempahla yokusayina
Iklayenti lidinga isitifiketi esivamile se-CA ukuze liqinisekise ukuthi isitifiketi esethulwa olunye uhlangothi sasayinwa yileso siphathimandla. Lona umsebenzi wokuqinisekisa futhi awudingi mfihlo nhlobo. Ukusayina isitifiketi solunye uhlangothi kungomunye umsebenzi, owenziwa kanye ngogcina i-CA, ngokhiye oyimfihlo ongaphumi esitolo sakhe esivikelwe. Ukuhlukanisa le misebenzi emibili yikho konke okuhloswe ngokuthumela amafayela amabili.
Ngakho-ke i-ca.crt ingeyephrofayela futhi i-ca.key ayingeze yaba noma kuphi eduze kwayo. Amagama amafayela ayisivumelwano, hhayi isiqinisekiso, ngakho-ke uhlobo kufanele luhlolwe kunokuqagelwa egameni.
Isakhiwo esine-CA emaphakathi noma insizakalo yokukhipha eku-inthanethi akuyona into ehlukile. Yiyo indlela evamile yokugcina amandla okusayina kude namaphoyinti okugcina ngenkathi kukhishwa izitifiketi zamadivayisi ngesilinganiso esikhulu.
Iklayenti kufanele liqinisekise ini ngokhiye walo
Iddivayisi ngayinye ithola ipheya layo lokhiye nesitifiketi sayo, esisayinwe kanye yi-CA. Iklayenti lethula leso sitifiketi futhi liqinisekisa ukuthi liphethe ukhiye oyimfihlo ohambisanayo, futhi iseva inquma ukuthi izokwamukela yini. Lolu ubunikazi obuhoxiswayo lapho ikhompyutha ephathwayo ilahleka.
Umehluko ubaluleke kakhulu ngemva kokwebiwa. Ngobunikazi bodivayisi ngayinye, iklayenti elilodwa eliveziwe lisuswa ngokuhoxiswa noma ngokususa olunye uhlangothi, futhi lonke ibutho liyaqhubeka nokusebenza.
Ukhiye waleso siphathimandla ophumile awukwazi ukuphathwa ngale ndlela. Zonke izitifiketi ezazisayinwe yiyo noma ezazikwazi ukusayinwa ziba yizinsolo, ngakho-ke impendulo ukushintsha ukwethenjwa hhayi ukuhoxiswa okukodwa. Lona umsebenzi omkhulu, hhayi ithikithi.
| File | Role | Belongs on |
|---|---|---|
ca.crt | Public certificate used to verify signatures | Every client profile |
ca.key | Private key that issues certificates | Protected CA storage only |
| client key pair | Proves one device's identity | That device alone |
Funda ifayela ngaphambi kokulikopisha noma kuphi
Imiyalo emibili ikutshela ukuthi uphethe uhlobo luni lwento ngaphandle kokuphrinta imfihlo. Eyokuqala isho isihloko kanye nefulegi le-CA esitifiketini; eyesibili iqinisekisa ukhiye futhi ibike uhlobo lwawo. Sebenzisa kokubili kumafayela aseqoqweni ozokwabela lona. Noma yini eqinisekiswa njengokhiye oyimfihlo ayifanele ibe kuhla lwamafayela eklayenti.
openssl x509 -in ca.crt -noout -subject -ext basicConstraints openssl pkey -in ca.key -noout -check
Uma umyalo wesibili uphumelela efayeleni eliseqoqweni leklayenti, ma ukuqoqwa kuthathwe njengokuhlaselwe. Umphumela othi ukhiye uyavumeleka usho nokuthi ukhona, futhi ukuba khona kwawo yiyo yonke inkinga.
Qaphela futhi uhlangothi oluhlukile: iphrofayela leklayenti iqukethe ngokomthetho ukhiye oyimfihlo walelo klayenti. Ukususa wonke ukhiye othola wona kuphula uxhumano ngaphandle kokuthuthukisa lutho, ngakho-ke into kufanele ikhonjwe ngaphambi kokususwa.
Ukubamba ukhiye osuwabelile kakade
Ungacabangi ukuthi ukususa ikhophi yasendaweni kubuyisela emuva ukuvezwa. Noma ubani owayenalo ifayela wayengalikopisha, futhi umcabango ophephile ukuthi ukwenzile. Landela inqubo yezehlakalo yomqhubi futhi ushintshe i-ankile yokwethenjwa, ukhipha kabusha izitifiketi zamadivayisi ngaphansi kwe-CA entsha.
Bese ushintsha ukupakisha okudale inkinga. Thumela uhla lwesikhombisi kanye nohlu olucacile lwamafayela avunyelwe, gcina ukhiye we-CA emshinini ongahlangani neze nebutho lamaklayenti, futhi ubhale ukuthi yiluphi uhlelo oluwugcinayo.
Uma isiphathimandla kufanele sikhiphe njalo, hambisa ukusayina ngemuva kwensizakalo noma phakathi nesiphathimandla esinobubanzi obuncane nokusebenza isikhathi esifushane. Kanjalo iphutha lesikhathi esizayo lizoveza ingxenye yokukhipha hhayi impande yokwethenjwa kwayo yonke into yokusetshenziswa.