Inkonzo ithandwa kakhulu eMelika ukuqeshwa kude kwabatywini, iingcali zokufudumeza kunye nezomoya, njalo njalo. ERashiya kukho iindawo ezifanayo: kulungele kakhulu ukukhetha ngokukhawuleza ingcali. Nangona kwiimeko zangoku kungcono ukubethelela le shelf ngokwakho ukuze ungadibanisi nabani na. Ngapha koko, kutsha nje i-USAFact (umboneleli wokuhlola amawaka eenkampani, kubandakanya neeNgcali zeNkonzo) kunye ne-GlobalSign yokuphunyezwa ngokwezifiso kweNkonzo yokuSayina kweDijithali, eyayisetyenziswe kwiinyanga ezine-kwaye ngoku ivumelekile ukuba ihlolwe kwangaphambili kuzo zonke iiNgcali zeNkonzo.
Lo ngumzekelo wendlela onokuthi uququzelele ngayo umsebenzi okude kubasebenzi abaqeshiweyo ngokusetyenziswa ngokuchanekileyo kwamaxwebhu. Efanelekileyo kwimeko yangoku.
Iinkampani zitshintshela kutyikityo lwedijithali ngenxa yeenzuzo zabo ezicacileyo:
- Ukuhamba koxwebhu olunganamaphepha. Ukonga ixesha, imali kunye nezixhobo.
- Iinkqubo ezisebenzayo zoshishino. Ukutyikitya nge-elektroniki kwenza yonke intengiselwano ibe yinkqubo elula.
- Ubunakho beselula. Unxibelelwano phakathi kombutho kunye nabathengi kuba lula.
Isiseko sesiseko soluntu (i-PKI) siqinisekisa ukuthembeka kwaye siqinisekisa ukugunyazwa koxwebhu ngalunye. Izitampu zexesha ziqinisekisa ixesha esasayinwa ngalo uxwebhu, nto leyo eyimfuneko kwiitransekshini ezisekelwe kwixesha, ukungakhatywa, nokugcinwa kwedatha ukulungiselela iinjongo zophicotho. Yonke inkqubo yolawulo lwamaxwebhu kunye neesignesha zedijithali kufuneka ihambelane neemfuno eziyimfuneko ezisebenzayo kwilizwe lolawulo, kunye nakumazwe apho amaqabane kunye nabaxhasi basebenza khona.
(i-DSS) yi-scalable, i-API-enabled platform yokuthunyelwa ngokukhawuleza kweesignesha zedijithali ezibonelela:
- Ngedijithali usayine i-hash yalo naluphi na uxwebhu okanye utshintshiselwano lwedijithali kulungiselelo lwe-PKI
- Ukukhutshwa kwesatifikethi sotyikityo
- I-AATL kunye nenkxaso ye-Microsoft Root
- Ukugcina izitshixo zabucala ezisekelwe kwi-HSM
- Uphononongo lwengxelo efunekayo kuphicotho
- Izitywini ze-elektroniki eziphucukileyo kwaye, xa sele zivunyiwe, iisignesha ezifanelekileyo zithobela umgangatho we-eIDAS
Inkonzo yefu ilula kakhulu ukuthunyelwa kwenkqubo yolawulo lwamaxwebhu kunye nenkxaso yeesignesha zedijithali. Yonke imisebenzi ihamba ngokulula nge-API.
Ukubuyela kwiiNgcali zeNkonzo, kutshanje baqalise umnikelo omtsha owenzelwe ukwenza amava omthengi abe lula. Kodwa oku kwakufuna amandla okwenza izivumelwano ezithembekileyo kumakhaya abaxumi. Iingcali zeNkonzo zisebenze kunye ne-USAFact ukuphuhlisa isicelo sewebhu esahamba umthengisi wenkonzo ngokusebenzisa izibalo ezahlukeneyo, ezivumela ukuba bafake ulwazi olufunekayo ngaphambi kokudala i-PDF enokuthi isayinwe ngekhompyutha kwaye ifakwe. Xa kwacaca ukuba isisombululo sokuqala asithembekanga, i-USAFact yaqala ukukhangela isisombululo esingcono. Ekugqibeleni wakhetha i-GlobalSign kwisicelo sakhe sokutyikitya sedijithali.
Emva kokugqitywa kweprogram yokulinga, iiNgcali zeNkonzo zilindele ukuhambisa i-DSS esekelwe kwifu kuwo onke amasebe angama-94 ase-US kunye neeofisi zentsimi ze-600. Bonke abasebenzisi banokuqiniseka ukuba naluphi na ulwazi oluqokelelweyo luya kuhlala lungoku kwaye lukhuselekile, ngoku nakwixesha elizayo.
Inkonzo yokuSayina yeDijithali ibonelela ngayo yonke into oyifunayo ukuze usebenzise utyikityo lwedijithali ngokudityaniswa kwe-REST API elula. Onke amacandelo e-cryptographic axhasayo, kubandakanywa izatifikethi zokusayina, ulawulo oluphambili, iseva yesitampu sexesha, kunye ne-OCSP okanye inkonzo ye-CRL, zinikezelwa kwifowuni enye ye-API enophuhliso oluncinci kwaye akukho hardware yendawo yokulawula.
umthombo: www.habr.com