Ngabe ukhiye we-CA wokuhlola i-TLS owebekwe unganquma amaseshini aqoshiwe?
Hlukanisa amandla okukhipha izitifiketi zokungena ezithenjwayo kanye nezimfihlo ezidingekayo ukuze kunqunywe amaseshini e-TLS aqoshiwe.
“Umhlaseli webe ukhiye oyimfihlo we-proxy” kushiya ngaphandle imininingwane enquma umonakalo: yiwuphi ukhiye oyimfihlo?
I-proxy ehlolayo ingase igcine ukhiye wokusayina wesiphathimandla sezitifiketi, okhiye bezitifiketi zeseva abakhiwe, izimfihlo zethrafikhi ye-TLS ebukhoma, izinto zokuqhubeka kweseshini kanye nombhalo ocacile ememori noma kumalohi ayo. Lezi yizimpahla ezahlukene.
Ukhiye we-CA unikeza amandla okulingisa omunye
Amaklayenti alungiselelwe ukuthemba i-CA ehlolayo angamukela izitifiketi ezikhishwe ngaphansi kwayo, ngokwemikhawulo yochungechunge lwezitifiketi kanye nokuhlola kweklayenti. Lowo oweba ukhiye wokusayina ohambisanayo angase akwazi ukudala ezinye izitifiketi ezamukelekayo ngaphakathi kwaleyo mikhawulo.
Lokho kubi, kodwa ukhiye uwodwa awuguquli uxhumano lomsebenzisi. Umhlaseli udinga futhi isikhundla sokungena esisebenzisekayo noma enye indlela yokwenza iklayenti lixhumane nendawo yokugcina elingisiwe. Izinhlelo ezinokuhlola okwengeziwe kwezitifiketi zingakwenqaba.
Ukhiye wokusayina awuwona ukhiye wokunquma umbhalo
Ekuxoxisaneni kwe-TLS 1.3 okuqinisekiswa isitifiketi ngokusebenzisa i-Diffie–Hellman yesikhashana, isitifiketi siqinisekisa ukushintshana. Okhiye bethrafikhi batholakala kwezinye izimfihlo zokuxoxisana. Ukuthola ukhiye wokusayina we-CA kamuva akwakhi kabusha lezo zimfihlo zesikhashana zangaphambili ezivela ekurekhodweni.
Ngisho nokweba ukhiye oyimfihlo wesitifiketi seseva akulingani nokuthola izimfihlo zethrafikhi zalolo hlobo lweshini eliqoshiwe. Ungakwandisi lokhu kuyo yonke imodi ye-TLS yomlando noma kukho konke ukulungiselelwa kokuqhubeka; ukushintshana kokhiye okuxoxiwe kanye nezinto eziphazamisekile yikho okubalulekile.
Ukuphazamiseka kwedivayisi yokuhlola esebenzayo kungaba banzi kakhulu kunokwebiwa kokhiye wayo we-CA. Idivayisi isebenza ngombhalo ocacile ngenkathi ihlola ithrafikhi futhi ingase igcine izimfihlo zaseshini noma igcine okuqukethwe okunqunyiwe. Lokho kwembulwa kudinga uphenyo lwakho futhi akunakushaywa indiva ngokusho ngobumfihlo obuya phambili.
Chaza isigameko ngokunemba
Rekhoda ukuthi izinto ezilahlekile kwakuwukhiye wokusayina, okhiye bamaphoyinti okugcina, izimfihlo ezibukhoma, umbhalo ocacile ogciniwe noma ukulawula idivayisi uqobo. Ukushintsha i-CA ehlolayo nokubuyekeza ukuthembela kwamaklayenti kubhekana nekhono elilodwa; akususi amalohi akhophiwe futhi akunqumi ukuthi ithrafikhi ebukhoma ifundiwe yini. Amagama okhiye anembile aholela ekuphenduleni okusiza kakhulu kunokubiza yonke imfihlo ngokuthi “ukhiye we-SSL”.