{"id":85822,"date":"2020-06-19T13:42:20","date_gmt":"2020-06-19T11:42:20","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/opyt-primeneniya-tehnologii-rutoken-dlya-registraczii-i-avtorizaczii-polzovatelej-v-sisteme-chast-3"},"modified":"2020-06-19T13:42:20","modified_gmt":"2020-06-19T11:42:20","slug":"opyt-primeneniya-tehnologii-rutoken-dlya-registraczii-i-avtorizaczii-polzovatelej-v-sisteme-chast-3","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/opyt-primeneniya-tehnologii-rutoken-dlya-registraczii-i-avtorizaczii-polzovatelej-v-sisteme-chast-3","title":{"rendered":"P\u00ebrvoja e p\u00ebrdorimit t\u00eb teknologjis\u00eb Rutoken p\u00ebr regjistrimin dhe autentifikimin e p\u00ebrdoruesve n\u00eb sistem (pjesa 3)","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Mir\u00ebm\u00ebngjes!<\/p>\n

N\u00eb pjes\u00ebn e kaluar<\/a><\/noindex> ne kemi krijuar me sukses qendr\u00ebn ton\u00eb t\u00eb besueshm\u00ebris\u00eb. Sa e dobishme mund t\u00eb jet\u00eb ajo p\u00ebr ne? <\/p>\n

Me an\u00eb t\u00eb qendr\u00ebs lokale t\u00eb besueshm\u00ebris\u00eb, mund t\u00eb l\u00ebshojm\u00eb certifikata dhe gjithashtu t\u00eb kryejm\u00eb verifikimin e n\u00ebnshkrimeve p\u00ebr k\u00ebto certifikata.
\n<\/a><\/noindex>
\nGjat\u00eb l\u00ebshimit t\u00eb nj\u00eb certifikate p\u00ebr p\u00ebrdoruesin, qendra e besueshm\u00ebris\u00eb p\u00ebrdor nj\u00eb k\u00ebrkes\u00eb speciale p\u00ebr l\u00ebshimin e certifikat\u00ebs Pkcs#10, q\u00eb ka formatin e skedarit \u2018.csr\u2019. Kjo k\u00ebrkes\u00eb p\u00ebrmban nj\u00eb sekuenc\u00eb t\u00eb koduar, q\u00eb qendra e besueshm\u00ebris\u00eb e di si ta interpretoj\u00eb n\u00eb m\u00ebnyr\u00eb t\u00eb sakt\u00eb. K\u00ebrkesa p\u00ebrmban si \u00e7el\u00ebsin publik t\u00eb p\u00ebrdoruesit ashtu edhe t\u00eb dh\u00ebnat p\u00ebr krijimin e certifikat\u00ebs (nj\u00eb array asociativ me t\u00eb dh\u00ebnat mbi p\u00ebrdoruesin). <\/p>\n

M\u00ebnyra se si t\u00eb marrim k\u00ebrkes\u00ebn p\u00ebr l\u00ebshimin e certifikat\u00ebs do ta shqyrtojm\u00eb n\u00eb artikullin e ardhsh\u00ebm, nd\u00ebrsa n\u00eb k\u00ebt\u00eb artikull d\u00ebshiroj t\u00eb sjell komandat kryesore t\u00eb qendr\u00ebs s\u00eb besueshm\u00ebris\u00eb, q\u00eb do t\u00eb na ndihmojn\u00eb t\u00eb realizojm\u00eb detyr\u00ebn ton\u00eb n\u00eb an\u00ebn e backend-it. <\/p>\n

Pra, fillimisht duhet t\u00eb krijojm\u00eb certifikat\u00ebn. P\u00ebr k\u00ebt\u00eb do t\u00eb p\u00ebrdorim komand\u00ebn:<\/p>\n

openssl ca -batch -in user.csr -out user.crt<\/code><\/pre>\n
\nca \u2014 komanda openSSL q\u00eb i p\u00ebrket qendr\u00ebs s\u00eb besueshm\u00ebris\u00eb,
\n-batch \u2014 anullon k\u00ebrkesat p\u00ebr konfirmim gjat\u00eb formimit t\u00eb certifikat\u00ebs.
\nuser.csr \u2014 k\u00ebrkes\u00eb p\u00ebr krijimin e nj\u00eb certifikate (skedari i formatit .csr).
\nuser.crt \u2014 certifikata (rezultati i marr\u00eb nga komanda).<\/p>\n
P\u00ebr q\u00eb kjo komand\u00eb t\u00eb funksionoj\u00eb, autoriteti i certifikimit duhet t\u00eb jet\u00eb i konfiguruar pik\u00ebrisht si\u00e7 \u00ebsht\u00eb p\u00ebrshkruar n\u00eb pjes\u00ebn e m\u00ebparshme t\u00eb artikullit.<\/a><\/noindex>N\u00eb t\u00eb kund\u00ebrt, do t\u00eb duhet t\u00eb tregoni shtes\u00eb vendndodhjen e certifikat\u00ebs rr\u00ebnj\u00eb t\u00eb autoritetit t\u00eb certifikimit. <\/p>\n
Komanda p\u00ebr verifikimin e certifikat\u00ebs:<\/p>\n
openssl cms -verify -in authenticate.cms -inform PEM -CAfile \/Users\/\u2026\u2026\/demoCA\/ca.crt -out data.file<\/code><\/pre>\n
\ncms \u2014 komand\u00eb e openSSL, q\u00eb p\u00ebrdoret p\u00ebr n\u00ebnshkrimin, verifikimin, enkriptimin e t\u00eb dh\u00ebnave dhe operacione t\u00eb tjera kriptografike me openSSL.<\/p>\n
-verify \u2014 n\u00eb k\u00ebt\u00eb rast po verifikojm\u00eb certifikat\u00ebn.<\/p>\n
authenticate.cms \u2014 skedari q\u00eb p\u00ebrmban t\u00eb dh\u00ebnat e n\u00ebnshkruara nga certifikata, e cila u dha nga komanda e m\u00ebparshme.<\/p>\n
-inform PEM \u2014 p\u00ebrdoret formati PEM.<\/p>\n
-CAfile \/Users\/\u2026\u2026\/demoCA\/ca.crt \u2014 rruga n\u00eb certifikat\u00ebn rr\u00ebnj\u00eb. (pa k\u00ebt\u00eb komanda nuk funksionoi, megjith\u00ebse jan\u00eb shkruar rrug\u00ebt p\u00ebr ca.crt n\u00eb skedarin openssl.cfg)<\/p>\n
-out data.file \u2014 t\u00eb dh\u00ebnat e dekriptuara i d\u00ebrgoj n\u00eb skedarin data.file.<\/p>\n
Algoritmi i aplikimit t\u00eb autoritetit t\u00eb certifikimit nga ana e backend-it \u00ebsht\u00eb si m\u00eb posht\u00eb:<\/p>\n