{"id":38686,"date":"2019-10-31T22:25:18","date_gmt":"2019-10-31T19:25:18","guid":{"rendered":"https:\/\/prohoster.info\/blog\/alternativa-tsentru-sertifikatsii-ot-microsoft\/"},"modified":"2019-10-31T22:25:18","modified_gmt":"2019-10-31T19:25:18","slug":"alternativa-tsentru-sertifikatsii-ot-microsoft","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/alternativa-tsentru-sertifikatsii-ot-microsoft","title":{"rendered":"Alternativa e qendr\u00ebs s\u00eb certifikimit nga Microsoft","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

K\u00ebtyre p\u00ebrdoruesve nuk mund t'u besohet. N\u00eb shumic\u00ebn e rasteve, ata jan\u00eb lenxh, dhe p\u00ebr siguri zgjedhin komoditetin. Sipas statistikave, 21% e tyre shkruajn\u00eb me dor\u00eb fjal\u00ebkalimet p\u00ebr llogarit\u00eb e pun\u00ebs, 50% p\u00ebrdorin fjal\u00ebkalime t\u00eb nj\u00ebjta p\u00ebr sh\u00ebrbimet profesionale dhe personale.<\/p>\n

Ambientet gjithashtu jan\u00eb armiq\u00ebsore. 74% e organizatave lejojn\u00eb q\u00eb t\u00eb sjellin pajisje personale n\u00eb pun\u00eb dhe t'i lidhin me rrjetin korporativ. 94% e p\u00ebrdoruesve nuk mund t\u00eb dallojn\u00eb nj\u00eb let\u00ebr autentike nga nj\u00eb phishing, 11% kan\u00eb klikuar n\u00eb skedar\u00eb t\u00eb bashk\u00ebngjitur.<\/p>\n

T\u00eb gjitha k\u00ebto probleme zgjidhen nga infrastruktura korporative e \u00e7el\u00ebseve t\u00eb hapura (PKI), e cila siguron enkriptimin dhe autentikimin e post\u00ebs, duke z\u00ebvend\u00ebsuar fjal\u00ebkalimet me certifikata digjitale. Kjo infrastruktur\u00eb mund t\u00eb ngritet n\u00eb Windows Server. Sipas p\u00ebrshkrimit nga Microsoft<\/a><\/noindex>, sh\u00ebrbimi Active Directory Certificate Services (AD CS) \u00ebsht\u00eb nj\u00eb server q\u00eb lejon krijimin e PKI n\u00eb organizat\u00ebn tuaj dhe p\u00ebrdorimin e kriptografis\u00eb me \u00e7el\u00ebsa t\u00eb hapur, certifikatave digjitale dhe n\u00ebnshkrimeve digjitale.<\/p>\n

Por zgjidhja nga Microsoft \u00ebsht\u00eb mjaft e shtrenjt\u00eb.
\n<\/a><\/noindex><\/p>\n

Kostoja totale e pron\u00ebsis\u00eb p\u00ebr nj\u00eb qend\u00ebr private t\u00eb certifikimit nga Microsoft<\/h1>\n

\n\"Alternativa
\nKrahasoni kostot e pron\u00ebsis\u00eb midis Microsoft CA dhe GlobalSign AEG. Burimi<\/a><\/noindex><\/i><\/p>\n

N\u00eb shum\u00eb situata, \u00ebsht\u00eb m\u00eb e p\u00ebrshtatshme dhe m\u00eb e lir\u00eb t\u00eb krijosh nj\u00eb qend\u00ebr private certifikimi t\u00eb ngjashme, por me menaxhim t\u00eb jasht\u00ebm. Kjo \u00ebsht\u00eb sakt\u00ebsisht problemi q\u00eb zgjidh GlobalSign Auto Enrollment Gateway (AEG). Kostoja totale e pron\u00ebsis\u00eb p\u00ebrjashton menj\u00ebher\u00eb disa rreshta shpenzimesh (blerja e pajisjeve, shpenzimet p\u00ebr mb\u00ebshtetje, trajnimi i personelit, etj.). Kursimi mund t\u00eb kaloj\u00eb 50% t\u00eb kostos totale t\u00eb pron\u00ebsis\u00eb<\/a><\/noindex>.<\/p>\n

\u00c7far\u00eb \u00ebsht\u00eb AEG<\/h1>\n

\n\"Alternativa
\n
\nAuto Enrollment Gateway<\/a><\/noindex> (AEG) \u00ebsht\u00eb nj\u00eb sh\u00ebrbim softuerik q\u00eb vepron si kalim mes sh\u00ebrbimeve t\u00eb sertifikatave SaaS GlobalSign dhe mjedisit korporativ Windows.<\/p>\n

AEG integron me Active Directory, duke lejuar organizatat t\u00eb automatizojn\u00eb regjistrimin, p\u00ebrgatitjen dhe menaxhimin e sertifikatave digjitale GlobalSign n\u00eb mjedisin Windows. Duke z\u00ebvend\u00ebsuar qendrat e brendshme t\u00eb certifikimit me sh\u00ebrbimet e GlobalSign, nd\u00ebrmarrjet rrisin sigurin\u00eb dhe ulin kostot e menaxhimit t\u00eb nj\u00eb qendre t\u00eb brendshme t\u00eb komplikuar dhe t\u00eb shtrenjt\u00eb t\u00eb certifikimit Microsoft.<\/p>\n

Sh\u00ebrbimet e certifikimit GlobalSign SaaS jan\u00eb nj\u00eb alternativ\u00eb m\u00eb e besueshme krahasuar me certifikatat e dob\u00ebta dhe t\u00eb pakontrolluara n\u00eb infrastruktur\u00ebn tuaj. Eliminimi i nevoj\u00ebs p\u00ebr t\u00eb menaxhuar nj\u00eb autoritet t\u00eb brendsh\u00ebm t\u00eb certifikimit t\u00eb r\u00ebnd\u00eb e ul gjithashtu kostoja totale t\u00eb pron\u00ebsis\u00eb s\u00eb PKI-s\u00eb, si dhe rrezikun e d\u00ebshtimeve n\u00eb sistem.<\/p>\n

Mb\u00ebshtetje p\u00ebr protokollet SCEP dhe ACME zgjeron mund\u00ebsit\u00eb e mb\u00ebshtetjes p\u00ebrtej Windows, duke p\u00ebrfshir\u00eb l\u00ebshimin automatizuar t\u00eb certifikatave p\u00ebr serverat Linux, pajisjet mobile, rrjetore dhe t\u00eb tjera, si dhe kompjuter\u00ebt Apple OSX q\u00eb jan\u00eb regjistruar n\u00eb Active Directory.<\/p>\n

Siguri e avancuar<\/h3>\n

\nP\u00ebrve\u00e7 kursimeve buxhetore, menaxhimi i jasht\u00ebm i PKI-s\u00eb rrit sigurin\u00eb e sistemit. Si\u00e7 tregohet n\u00eb studimin e grupit Aberdeen, certifikatat po b\u00ebhen gjithnj\u00eb e m\u00eb shum\u00eb objektiv i sulmuesve: ata shfryt\u00ebzojn\u00eb me sukses dob\u00ebsit\u00eb e njohura, si\u00e7 jan\u00eb certifikatat vet\u00eb-n\u00ebnshkruese t\u00eb pasigurta, enkriptimi i dob\u00ebt dhe mekanizmat e nd\u00ebrlikuar t\u00eb revokimit. P\u00ebr m\u00eb tep\u00ebr, sulmuesit kan\u00eb zotuar metoda marramend\u00ebse, t\u00eb tilla si l\u00ebshimin mashtrues t\u00eb certifikatave nga autoritetet e besueshme dhe falsifikimin e certifikatave p\u00ebr n\u00ebnshkrimin e kodit.<\/p>\n

\u00abShumica e nd\u00ebrmarrjeve nuk menaxhojn\u00eb mjaft aktive rreziqet e lidhura me k\u00ebto sulme dhe nuk jan\u00eb t\u00eb gatshme t\u00eb reagojn\u00eb shpejt ndaj kompromisit, \u2014 shkrova<\/a><\/noindex> Derek E. Brink, n\u00ebnkryetar dhe k\u00ebrkues p\u00ebr sigurin\u00eb IT n\u00eb Aberdeen Group. \u2014 Duke u ofruar nd\u00ebrmarrjeve mund\u00ebsin\u00eb p\u00ebr t\u00eb transferuar aspektet operative t\u00eb menaxhimit t\u00eb certifikatave n\u00eb duar ekspert\u00ebsh, nd\u00ebrsa ruajn\u00eb kontrollin korporativ mbi politikat grupore n\u00eb Active Directory, GlobalSign synon t\u00eb siguroj\u00eb rritjen e ardhshme t\u00eb p\u00ebrdorimit t\u00eb certifikatave, duke adresuar \u00e7\u00ebshtjet praktike t\u00eb siguris\u00eb dhe besueshm\u00ebris\u00eb n\u00eb nj\u00eb model t\u00eb efektsh\u00ebm dhe ekonomik t\u00eb zbatimit\u00bb.<\/p>\n

Si funksionon AEG<\/h1>\n

\n\"Alternativa
\n
\nNj\u00eb sistem tipik me AEG p\u00ebrfshin kat\u00ebr komponent\u00eb ky\u00e7 p\u00ebr t\u00eb garantuar transferimin e certifikatave t\u00eb duhura n\u00eb pikat e aksesit t\u00eb duhura:<\/p>\n

    \n
  1. Software AEG n\u00eb serverin Windows.\n<\/li>\n
  2. Server\u00ebt Active Directory ose kontrolluesit e domenit, q\u00eb lejojn\u00eb administrator\u00ebt t\u00eb menaxhojn\u00eb dhe ruajn\u00eb informacionin p\u00ebr burimet.\n<\/li>\n
  3. Pikat e fundit: p\u00ebrdoruesit, pajisjet, server\u00ebt dhe stacionet e pun\u00ebs \u2014 praktikisht \u00e7do objekt q\u00eb \u00ebsht\u00eb \u2018konsumator\u2019 i certifikatave dixhitale.\n<\/li>\n
  4. Qendra e Certifikimit GlobalSign ose GCC, e cila ndodhet n\u00eb krye t\u00eb nj\u00eb platforme t\u00eb besueshme p\u00ebr l\u00ebshimin dhe menaxhimin e certifikatave. K\u00ebtu krijohen certifikatat.<\/li>\n<\/ol>\n

    \nTre nga kat\u00ebr komponent\u00ebt e treguar ndodhen n\u00eb mjedisin lokal t\u00eb klientit, nd\u00ebrsa i kat\u00ebrti ndodhet n\u00eb cloud.<\/p>\n

    Fillimisht, pik\u00ebt e fundit konfigurohen paraprakisht p\u00ebrmes politikave grupore: p\u00ebr shembull, lidhur me verifikimin e certifikat\u00ebs p\u00ebr autentifikimin e p\u00ebrdoruesit, k\u00ebrkesa S\/MIME p\u00ebr certifikat\u00ebn dhe k\u00ebshtu me radh\u00eb \u2014 p\u00ebr t\u2019u lidhur m\u00eb pas me serverin AEG. Lidhja kryhet n\u00eb m\u00ebnyr\u00eb t\u00eb sigurt p\u00ebrmes HTTPS.<\/p>\n

    Serveri AEG d\u00ebrgon nj\u00eb k\u00ebrkes\u00eb n\u00eb Active Directory p\u00ebrmes LDAP p\u00ebr t\u00eb marr\u00eb nj\u00eb list\u00eb t\u00eb shablloneve t\u00eb certifikatave p\u00ebr k\u00ebto pik\u00eb t\u00eb fundit dhe u d\u00ebrgon klient\u00ebve k\u00ebt\u00eb list\u00eb s\u00eb bashku me vendndodhjen e qendr\u00ebs s\u00eb certifikimit. Pas pranimit t\u00eb k\u00ebtyre rregullave, pik\u00ebt e fundit lidhen p\u00ebrs\u00ebri me serverin AEG, k\u00ebt\u00eb her\u00eb p\u00ebr t\u00eb k\u00ebrkuar certifikatat reale. AEG, nga ana e tij, krijon nj\u00eb thirrje API me parametrat e caktuar dhe e d\u00ebrgon at\u00eb n\u00eb Qendr\u00ebn e Certifikimit GlobalSign ose GCC p\u00ebr p\u00ebrpunim.<\/p>\n

    S\u00eb fundi, pjesa server GCC \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043e\u0432\u0443\u0435\u0442 \u0437\u0430\u043f\u0440\u043e\u0441et, zakonisht p\u00ebr disa sekonda, dhe d\u00ebrgon p\u00ebrgjigjen API bashk\u00eb me certifikat\u00ebn q\u00eb do t\u00eb instalohet n\u00eb pik\u00ebt fundore sipas k\u00ebrkes\u00ebs.<\/p>\n

    E gjith\u00eb kjo proces merr disa sekonda dhe mund t\u00eb automatizohet plot\u00ebsisht duke konfiguruar pik\u00ebt fundore p\u00ebr t\u00eb marr\u00eb automatikisht certifikatat p\u00ebrmes politikave t\u00eb grupit.<\/p>\n

    Ve\u00e7orit\u00eb unike t\u00eb AEG<\/h4>\n

    <\/p>\n