Uyini umehluko phakathi kwe-http vs https? Incazelo enemininingwane yenqubo yokubethela ye-SSL

Ngokuthuthuka okusheshayo kwe-Intanethi, abanye abantu benza abakufunayoWechat marketing,Ukukhushulwa kwe-akhawunti yomphakathi, kodwa ekhonondaI-Internet Marketingakusebenzi, empeleniimidiya entshaIndlela engcono kakhulu yokuthi abantu benze ukumaketha nge-inthanethi ngokusebenzisa izinjini zokuseshaamanziinani.

Ngakho-ke, izinjini zokusesha zithandwa kakhulu namuhlaUkukhuthazwa Kwewebhuenye yezindlela.

Ngaphezu kwalokho, izinjini zokusesha i-Google ne-Baidu ziveze esidlangalaleni ukuthi i-https ifakiwe kumshini wokulinganisa injini yokusesha.

ikakhulukaziE-commerceKumawebhusayithi, kunconyelwa ukusebenzisa i-https encryption protocol, engasizi nje ukuthuthukisa amazinga, kodwa futhi esiza abasebenzisi ukuzwa iwebhusayithi ngokuphepha.

Iphrothokholi ye-Hypertext Transfer Protocol HTTP isetshenziselwa ukudlulisa ulwazi phakathi kwesiphequluli sewebhu neseva yewebhu. Iphrothokholi ye-HTTP ithumela okuqukethwe ngombhalo ocacile futhi ayinikezi nganoma yiluphi uhlobo lokubethela kwedatha. Uma umhlaseli ehlasela ukuxhumana phakathi kwesiphequluli sewebhu neseva yewebhu Ngakho-ke, i-HTTP Iphrothokholi ayikulungele ukudlulisa ulwazi oluthile olubucayi, njengenombolo yekhadi lesikweletu, iphasiwedi kanye nolunye ulwazi lokukhokha.

Ukuze kuxazululwe leli phutha lephrothokholi ye-HTTP, enye iphrothokholi idinga ukusetshenziswa: ungqimba oluvikelekile lwe-hypertext transfer protocol HTTPS. Ukuze kuvikelwe ukudluliswa kwedatha, i-HTTPS yengeza iphrothokholi ye-SSL ku-HTTP, futhi i-SSL incike ezitifiketini ukuze iqinisekise iseva. , futhi ubethele ukuxhumana phakathi kwesiphequluli neseva.

XNUMX. Imiqondo eyisisekelo ye-HTTP ne-HTTPS

I-HTTP: iyiphrothokholi yenethiwekhi esetshenziswa kakhulu ku-inthanethi. Iwuhlangothi lweklayenti kanye nesicelo sohlangothi lweseva kanye nezinga lokuphendula (TCP), elisetshenziselwa ukudlulisa umbhalo ongaphezulu usuka kuseva ye-WWW ukuya kusiphequluli sendawo. Iseva ingaphezulu kahle, okuholela ekudlulisweni kwenethiwekhi okumbalwa.

I-HTTPS: Isiteshi se-HTTP esivikelekile. Ngamafuphi, inguqulo evikelekile ye-HTTP, okungukuthi, ukwengeza isendlalelo se-SSL ku-HTTP. Isisekelo sokuvikeleka se-HTTPS yi-SSL, ngakho okuqukethwe okunemininingwane yokubethela kudinga i-SSL.

Imisebenzi esemqoka yephrothokholi ye-HTTPS ingahlukaniswa ngezinhlobo ezimbili: eyodwa iwukusungula isiteshi sokuvikela imininingwane ukuze kuqinisekiswe ukuphepha kokudluliswa kwedatha; enye iwukuqinisekisa ubuqiniso bewebhusayithi.

XNUMX. Uyini umehluko phakathi kwe-HTTP ne-HTTPS?

Idatha edluliselwa ngephrothokholi ye-HTTP ayibetheliwe, okungukuthi, embhalweni ongenalutho. Ngakho-ke, akuvikeleki kakhulu ukusebenzisa umthetho olandelwayo we-HTTP ukudlulisa ulwazi oluyimfihlo. Ukuze uqinisekise ukuthi le datha eyimfihlo ingabethelwa futhi idluliselwe, i-Netscape idizayine Iphrothokholi ye-SSL (Secure Sockets Layer) ye-HTTPS yazalelwa ukuze ibethele idatha edluliswa iphrothokholi ye-HTTP.

Kalula nje, iphrothokholi ye-HTTPS iyiphrothokholi yenethiwekhi eyakhiwe iphrothokholi ye-SSL+HTTP engakwazi ukudlulisa ngokubethela kanye nokuqinisekisa ubuwena, futhi ivikeleke kakhulu kunephrothokholi ye-http.

Umehluko omkhulu phakathi kwe-HTTPS ne-HTTP umi kanje:

• 1. Iphrothokholi ye-https idinga ukuya ku-ca ukuze ufake isicelo sesitifiketi. Ngokuvamile, zimbalwa izitifiketi zamahhala, ngakho-ke kudingeka inkokhelo ethile.
• 2. I-http iyiphrothokholi yokudlulisa umbhalo ophezulu, imininingwane idluliselwa ngombhalo osobala, futhi i-https iyiphrothokholi yokudlulisa evikelekile ye-ssl.
• 3. I-http kanye ne-https zisebenzisa izindlela zokuxhuma ezihluke ngokuphelele nezimbobo ezihlukile. Eyangaphambili ingu-80 futhi yokugcina ingu-443.
• 4. Ukuxhumana kwe-http kulula kakhulu futhi akunasimo, umthetho olandelwayo we-HTTPS iphrothokholi yenethiwekhi eyakhiwe iphrothokholi ye-SSL+HTTP engakwazi ukudluliswa okubethelwe kanye nokuqinisekisa ubuwena, okuphephe kakhudlwana kunephrothokholi ye-http.

XNUMX. Incazelo enemininingwane yenqubo yokubethela ye-HTTPS ne-SSL

Sonke siyazi ukuthi i-HTTPS ingabhala ngemfihlo ulwazi ukuze ivimbele ulwazi olubucayi ukuthi lungatholwa izinkampani zangaphandle, ngakho-ke amawebhusayithi amaningi amabhange noma ama-imeyili nezinye izinsizakalo ezinamaleveli aphezulu okuphepha azosebenzisa iphrothokholi ye-HTTPS.

1. Iklayenti liqala isicelo se-HTTPS

Lokhu akusho lutho, okungukuthi, umsebenzisi ufaka i-URL ye-https esipheqululini, bese exhuma embobeni ye-443 yeseva.

2. Ukucushwa kweseva

Iseva esebenzisa iphrothokholi ye-HTTPS kufanele ibe nesethi yezitifiketi zedijithali, ezingenziwa uwena noma zisetshenziswe enhlanganweni. Umehluko ukuthi isitifiketi esikhishwe uwena sidinga ukuqinisekiswa iklayenti ngaphambi kokuthi uqhubeke nokufinyelela, kuyilapho. isitifiketi esisetshenziswe inkampani ethembekile asikho. Kuzovela ikhasi lomyalo.

Lesi sitifiketi empeleni siwukhiye wasesidlangalaleni kanye nokhiye oyimfihlo. Uma ungaqondi ukhiye wasesidlangalaleni nokhiye oyimfihlo, ungacabanga ukuthi uwukhiye nesihluthulelo, kodwa uwena kuphela umuntu emhlabeni onokhiye. , ungakwazi ukukhiya iNhloko yokukhiya kwabanye, abanye bangasebenzisa lesi sikhiye ukukhiya izinto ezibalulekile, bese bethumela kuwe, ngoba nguwe kuphela onalo khiye, ngakho-ke nguwe kuphela ongabona izinto ezikhiywe yilo khiye.

3. Thumela isitifiketi

Lesi sitifiketi siwukhiye wasesidlangalaleni empeleni, kodwa siqukethe ulwazi oluningi, njengesiphathimandla sesitifiketi, isikhathi sokuphelelwa yisikhathi, nokunye.

4. Isitifiketi sokuhlukanisa iklayenti

Le ngxenye yomsebenzi yenziwa i-TLS yeklayenti. Okokuqala, izoqinisekisa ukuthi ukhiye womphakathi uvumelekile yini, njengesiphathimandla esikhiphayo, isikhathi sokuphelelwa yisikhathi, njll. Uma okuhlukile kutholwa, kuzovela ibhokisi lesixwayiso, elibonisa ukuthi kunenkinga ngesitifiketi.

Uma ingekho inkinga ngesitifiketi, bese udala inani elingahleliwe, bese usebenzisa isitifiketi ukubethela inani elingahleliwe, njengoba kushiwo ngenhla, khiya inani elingahleliwe ngokhiye, ukuze ngaphandle kokuthi kukhona ukhiye, awukwazi ukubona okuqukethwe kwenani elikhiyiwe.

5. Ukudluliselwa kolwazi olubethelwe

Le ngxenye idlulisela inani elingahleliwe elibethelwe ngesitifiketi. Injongo iwukuvumela iseva ukuthi ithole leli nani elingahleliwe, bese ukuxhumana phakathi kweklayenti neseva kungabethelwa futhi kususwe ukubethela ngaleli nani elingahleliwe.

6. Ulwazi lokuqanjwa kwengxenye yesevisi

Ngemva kokuba iseva isuse ukubethela ngokhiye oyimfihlo, ithola inani elingahleliwe (ukhiye oyimfihlo) othunyelwe iklayenti, bese ibhala ngemfihlo okuqukethwe ngokulinganayo ngevelu. Ngale ndlela, ngaphandle uma ukhiye oyimfihlo waziwa, okuqukethwe akukwazi ukutholwa, futhi kokubili iklayenti neseva ziyawazi ukhiye oyimfihlo, inqobo nje uma i-algorithm yokubethela iqine ngokwanele futhi ukhiye oyimfihlo uyinkimbinkimbi ngokwanele, idatha iphephe ngokwanele.

7. Ukudluliselwa kolwazi olubethelwe

Le ngxenye yolwazi iwulwazi olubethelwe ukhiye oyimfihlo wengxenye yesevisi futhi lungabuyiselwa ohlangothini lweklayenti.

8. Ulwazi lokuqanjwa kweklayenti

Iklayenti lisusa ukubethela kolwazi oluthunyelwe kusukela engxenyeni yesevisi ngokhiye oyimfihlo owakhelwe ngaphambilini, futhi ngaleyo ndlela ithola okuqukethwe okususwe ukubethela. Ngisho noma inkampani yangaphandle iqapha idatha phakathi nayo yonke inqubo, ayinakuzisiza.

Okwesine, isimo sengqondo sezinjini zokusesha ku-HTTPS

I-Baidu iqalise isevisi yokusesha ebethelwe ye-HTTPS egcwele yesayithi ukuze ixazulule ukuhogela "kwenkampani yangaphandle" kanye nokudunwa ubumfihlo babasebenzisi. Eqinisweni, ngoMeyi 2010, i-Google yaqala ukunikeza isevisi yokusesha ebethelwe ye-HTTPS, inyakaza amakhasi ewebhu e-HTTPS. ukukhishwa, u-Baidu washo esimemezelweni sango-September 5 ukuthi "i-Baidu ngeke ikwazi ukucaca amakhasi ewebhu e-HTTPS", kuyilapho i-Google yasho kusibuyekezo se-algorithm ukuthi "ngaphansi kwezimo ezifanayo, amasayithi asebenzisa ubuchwepheshe bokubethela be-HTTPS azoba nezinga elingcono lokusesha. Inzuzo".

Ngakho-ke, kule ndawo enkulu, ingabe abaphathi bewebhu kufanele basebenzise iphrothokholi ye-HTTPS "eyingozi"? I-HTTPS yezinjini zokuseshaSEOKuthiwani ngomthelela?

1. Isimo sengqondo se-Google

Isimo sengqondo se-Google mayelana nokufakwa kwamasayithi e-HTTPS asehlukile kuleso samasayithi e-HTTP, futhi sithatha "ukuthi ukusebenzisa ukubethela okuvikelekile" (HTTPS) njengesithenjwa ku-algorithm yezinga lokusesha. Amawebhusayithi asebenzisa ubuchwepheshe bokubethela be-HTTPS angathola imiphumela engcono. Kunamathuba amaningi okubonisa, futhi izinga liphinde lizuzisa kakhulu kunamasayithi e-HTTP amasayithi afanayo.

Futhi i-Google ikwenze kwacaca ukuthi "ithemba ukuthi bonke abaphathi bewebhu bazokwazi ukusebenzisa iphrothokholi ye-HTTPS esikhundleni se-HTTP", okubonisa ukuzimisela kwayo ukufeza umgomo "we-HTTPS yonke indawo".

2. Isimo sengqondo sika-Baidu

Esikhathini esedlule, ubuchwepheshe be-Baidu babusemuva ngokuqhathaniswa, bethi "ngeke buzikhase ngokuqhubekayo amakhasi e-https", kodwa futhi "yayikhathazekile" ngokuthi "amakhasi amaningi e-https awakwazi ukufakwa". Kuze kube uSepthemba 2014, 9, u-Baidu uxoxisane ngokuthi "Ukwenziwa kanjani yakha amasayithi we-https ukuze ufinyelele umgomo". Isihloko sashicilelwa endabeni ethi "Obungani ku-Baidu", sinikeza iziphakamiso ezine nezenzo ezithile "zokuthuthukisa ubungane be-Baidu kumasayithi we-https":

1. Yenza izinguqulo zifinyeleleke ku-http kumakhasi we-https adinga ukukhonjwa injini yokusesha ye-Baidu.

2. Yahlulela isivakashi nge-ejenti yomsebenzisi, bese usetha u-BaiI-duspider iqondiswe ekhasini le-http. Uma abasebenzisi abajwayelekile bevakashela ikhasi ngenjini yokusesha ye-Baidu, bazoqondiswa kabusha ekhasini elihambisanayo le-https ukuya ku-301.Njengoba kuboniswe esithombeni, isithombe esingenhla sibonisa inguqulo ye-http efakwe ku-Baidu, futhi isithombe esingezansi sibonisa ukuthi abasebenzisi bazogxumela enguqulweni ye-https ngokuzenzakalelayo ngemva kokuchofoza.

3. Inguqulo ye-http ayenzelwanga kuphela ikhasi eliyisiqalo, amanye amakhasi abalulekile nawo adinga ukwenziwa ngenguqulo ye-http futhi axhunywe komunye nomunye.Ungakwenzi lokhu: isixhumanisi ekhasini eliyisiqalo le-http sisaxhunyaniswa nekhasi le-https. , okwenza i-Baiduspider ingakwazi ukuqhubeka nokukhasa—— Sihlangabezane nesimo esinjalo kangangokuthi singafaka ikhasi lasekhaya elilodwa kuphela kuyo yonke isayithi.

4. Ingxenye yokuqukethwe okungadingi ukubethelwa, njengolwazi, ingathwalwa igama lesizinda sesibili.NgokwesiboneloAlipayIsayithi, okuqukethwe okubethelwe okuyisisekelo kubekwe ku-https, okuqukethwe okungabanjwa ngokuqondile yi-Baiduspider kubekwa egameni lesizinda sezinga lesibili.

Ngokusho kokuhlolwa kwe-Computer Science House kusixhumanisi esingezansi, kuthatha ama-millisecond angu-114 ukusungula uxhumano ne-HTTP; kuthatha ama-millisecond angu-436 ukusungula uxhumano ne-HTTPS, kanye nama-milliseconds angu-322 engxenyeni ye-ssl, okuhlanganisa ukubambezeleka kwenethiwekhi kanye ne-overhead. yokubethela kanye nokukhishwa kwemfihlo kwe-ssl ngokwayo (iseva ngokolwazi lweklayenti Thola ukuthi ingabe ukhiye omkhulu omusha udinga ukwenziwa; iseva iphendula ukhiye omkhulu bese ibuyisela umlayezo ogunyazwe ngokhiye omkhulu kuklayenti; iseva icela iklayenti isiginesha yedijithali nokhiye womphakathi).

XNUMX. Zingakanani izinsiza ezisetshenziswa i-HTTPS kune-HTTP?

I-HTTPS empeleni iyiphrothokholi ye-HTTP eyakhelwe phezu kwe-SSL/TLS. Ngakho-ke, ukuqhathanisa ukuthi zingakanani izinsiza zeseva ezisetshenziswa i-HTTPS kune-HTTP,U-Chen WeiliangNgicabanga ukuthi kuncike kakhulu ekutheni zingakanani izinsiza zeseva ezidliwa yi-SSL/TLS uqobo.

I-HTTP isebenzisa ukuxhawula kwe-TCP kwezindlela ezintathu ukuze kusungulwe uxhumano, futhi iklayenti neseva badinga ukushintshanisa amaphakethe angu-3;

Ngaphezu kwamaphakethe amathathu e-TCP, i-HTTPS idinga futhi ukungeza amaphakethe ayi-9 adingekayo ekuxhawulaneni kwesandla kwe-ssl, ngakho-ke kukhona amaphakethe ayi-12 esewonke.

Ngemuva kokuthi kusungulwe uxhumo lwe-SSL, indlela yokubethela elandelayo iba indlela yokubethela ye-symmetric efana ne-3DES, enomthwalo we-CPU olula. Uma kuqhathaniswa nendlela yokubethela ye-asymmetric lapho uxhumo lwe-SSL lusungulwa, umthwalo wendlela yokubethela ye-symmetric ku-CPU ingashaywa indiva. , ngakho-ke inkinga iyeza. Uma wakha kabusha iseshini ye-ssl njalo, umthelela ekusebenzeni kweseva uzoba yingozi. Nakuba ukuvula i-HTTPS keep-alive kungadambisa inkinga yokusebenza yokuxhumeka okukodwa, ayifaneleki amawebhusayithi amakhulu anenani elikhulu labasebenzisi ngasikhathi sinye noma kungase kusekelwe软件Yebo, ngokwesibonelo, iWikipedia isebenzisa iNginx.

Ngemva kokwamukela i-HTTPS, zingakanani izinsiza zeseva ezizosetshenziswa, ngoJanuwari 2010GmailUkushintshela ekusetshenzisweni ngokugcwele kwe-HTTPS, umthwalo we-CPU womshini we-SSL ocutshungulwayo ongaphambili ngeke ukhuphuke ngaphezu kuka-1%, ukusetshenziswa kwememori kokuxhumeka ngakunye kuzoba ngaphansi kuka-20KB, futhi ithrafikhi yenethiwekhi izokwenyuka ngaphansi kuka-2% . Njengoba i-Gmail kufanele isebenzise amaseva angu-N ekucubunguleni ukusatshalaliswa, ngakho-ke idatha yokulayisha i-CPU ayinakho ukubaluleka kwereferensi okuningi. Ukusetshenziswa kwenkumbulo nedatha yethrafikhi yenethiwekhi yoxhumo ngalunye ibalulekile njengereferensi. Lesi sihloko siphinde sibonisa ukuthi umongo owodwa uphatha ukuxhawula izandla okungaba ngu-1500. ngomzuzwana (ku-1024-bit RSA). ), le datha ifundisa kakhulu.

XNUMX. Izinzuzo ze-HTTPS

Kungenxa yokuthi i-HTTPS ivikeleke kakhulu abahlaseli abakwazi ukuthola indawo yokuqala. Ngokombono wabaphathi bewebhu, izinzuzo ze-HTTPS zimi kanje:

1. Izici ze-SEO

I-Google yalungisa i-algorithm yenjini yokusesha ngo-Agasti 2014, yathi "isayithi elibethelwe nge-HTTPS lizoba phezulu emiphumeleni yosesho kunesayithi elilinganayo le-HTTP".

2. Ezokuphepha

Yize i-HTTPS ingavikelekile ngokuphelele, izinhlangano eziphethe izitifiketi zezimpande nezinhlangano ezenza ngobuhlakani ama-algorithms wokubethela zingaphinda zihlasele umuntu ophakathi nendawo, kodwa i-HTTPS iseyisixazululo esivikeleke kakhulu ngaphansi kwesakhiwo samanje, esinezinzuzo ezilandelayo:

(1) Sebenzisa iphrothokholi ye-HTTPS ukuze uqinisekise abasebenzisi namaseva ukuze uqinisekise ukuthi idatha ithunyelwa kuklayenti neseva efanele;

(2) Iphrothokholi ye-HTTPS iyiphrothokholi yenethiwekhi eyakhiwe iphrothokholi ye-SSL+HTTP ekwazi ukwenza ukudluliswa okubethelwe kanye nokuqinisekisa ubuwena. Iphephe kakhudlwana kunephrothokholi ye-http, engavimbela idatha ukuthi ingantshontshwa futhi ishintshwe phakathi nenqubo yokudlulisela kanye nokuqinisekisa ukuthi ubuqotho bedatha.

(3) I-HTTPS iyisixazululo esivikeleke kakhulu ngaphansi kwesakhiwo samanje. Nakuba ingavikelekile ngokuphelele, inyusa kakhulu izindleko zokuhlasela komuntu ophakathi nendawo.

XNUMX. Okubi kwe-HTTPS

Nakuba i-HTTPS inezinzuzo ezinhle, isenakho ukushiyeka okuthile. Ngokukhethekile, kukhona amaphuzu amabili alandelayo:

1. Izici ze-SEO

Ngokusho kwedatha ye-ACM CoNEXT, ukusebenzisa iphrothokholi ye-HTTPS kuzokwandisa isikhathi sokulayisha ikhasi cishe ngo-50% futhi kwandise ukusetshenziswa kwamandla ngo-10% kuya ku-20%. Ngaphezu kwalokho, iphrothokholi ye-HTTPS izophinde ithinte inqolobane, ikhulise idatha engaphezulu namandla ukusetshenziswa, kanye nezinyathelo ezikhona zokuphepha nazo zizothinteka futhi zizothinteka ngokufanele.

Ngaphezu kwalokho, ububanzi bokubethela bephrothokholi ye-HTTPS bulinganiselwe, futhi ayidlali indima ekuhlaselweni kwezigebengu, ukunqatshelwa kokuhlaselwa kwesevisi, kanye nokudunwa kweseva.

Okubaluleke kakhulu, uhlelo lochungechunge lwezikweletu lwezitifiketi ze-SSL aluvikelekile, ikakhulukazi uma amanye amazwe ekwazi ukulawula isitifiketi sempande ye-CA, ukuhlasela komuntu ophakathi nendawo kuyenzeka.

2. Izici zomnotho

(1) Izitifiketi ze-SSL zidinga imali. Uma isitifiketi sinamandla kakhulu, izindleko ziphezulu. Amawebhusayithi omuntu siqu angasebenzisa izitifiketi ze-SSL zamahhala.

(2) Izitifiketi ze-SSL ngokuvamile zidinga ukuboshelwa ku-IP, futhi amagama amaningi wesizinda awakwazi ukuboshelwa ku-IP efanayo. Izinsiza ze-IPv4 azikwazi ukusekela lokhu kusetshenziswa (i-SSL inezandiso ezingaxazulula le nkinga ngokwengxenye, kodwa inzima futhi idinga iziphequluli, ukusebenza Ukusekelwa kwesistimu, iWindows XP ayisekeli lesi sandiso, uma kucatshangelwa isisekelo esifakiwe se-XP, lesi sici cishe asisebenzi).

(3) Ukugcinwa kwesikhashana kokuxhumeka kwe-HTTPS akusebenzi kahle njenge-HTTP, futhi amawebhusayithi anethrafikhi ephezulu ngeke ayisebenzise ngaphandle uma kunesidingo, futhi izindleko zethrafikhi ziphezulu kakhulu.

4 phezulu.

(5) Isigaba sokuxhawula sephrothokholi ye-HTTPS sidla isikhathi futhi sinomthelela ongemuhle esivinini esihambisanayo sewebhusayithi. Uma kungenasidingo, asikho isizathu sokudela ulwazi lomsebenzisi.

XNUMX. Ingabe iwebhusayithi idinga ukusebenzisa ukubethela kwe-HTTPS?

Nakuba i-Google ne-Baidu bobabili "bebheka i-HTTPS ngokuhlukile", lokhu akusho ukuthi abaphathi bewebhu kufanele baguqule umthetho olandelwayo wewebhusayithi ube yi-HTTPS!

Okokuqala, ake sikhulume nge-Google. Nakuba i-Google ilokhu igcizelela ukuthi "amawebhusayithi asebenzisa ubuchwepheshe bokubethela be-HTTPS angathola amazinga angcono", ngeke kukhishwe ukuthi lokhu "inhloso ehlukile".

Abahlaziyi bangaphandle bashilo ekuphenduleni lolu daba: isizathu esenza i-Google yenze lesi sinyathelo (buyekeza i-algorithm, noma isebenzise ubuchwepheshe bokubethela be-HTTPS njengesithenjwa sokulinganisa injini yokusesha) kungenzeka kungabi ukuthuthukisa ulwazi lomsebenzisi losesho ne-inthanethi. Indaba yezokuphepha iwukuthola nje "ukulahlekelwa" ehlazweni elithi "Prism Gate". Lesi isenzo esivamile sokuzicabangela wena ngaphansi kwesibhengezo esithi "sacrifice the ego", ephakamisa isibhengezo esithi "Security Impact Ranking" futhi sicula "HTTPS yonke indawo" ” isiqubulo, bese uvumela ngokukhululekile iningi labaphathi bewebhu ukuthi bajoyine ikamu lephrothokholi ye-HTTPS.

Uma iwebhusayithi yakho ingeyeEzentengiselwano/I-WechatEzinkundla, ezezimali, izinkundla zokuxhumana kanye nezinye izinkambu, kungcono kakhulu ukusebenzisa umthetho olandelwayo we-HTTPS; uma kuyisizindalwazi sebhulogi, isayithi lokuphromotha, isayithi lolwazi elihlukanisiwe, noma isayithi lezindaba, ungasebenzisa isitifiketi samahhala se-SSL.

XNUMX. Umphathi wewebhusayithi ulakha kanjani isayithi le-HTTPS?

Uma kuziwa ekwakhiweni kwamasayithi e-HTTPS, kufanele sikhulume ngephrothokholi ye-SSL. I-SSL iyiphrothokholi yokuqala yokuphepha yenethiwekhi eyamukelwa yi-Netscape. Iphrothokholi yokuvikela esetshenziswa ku-Transmission Communication Protocol (TCP/IP). , i-SSL isekela kakhulu izinhlobo ezahlukahlukene zamanethiwekhi, ngenkathi ehlinzeka ngezinsizakalo ezintathu zokuphepha eziyisisekelo, zonke zisebenzisa ubuchwepheshe bokhiye womphakathi.

Uma kuziwa ekwakhiweni kwamasayithi e-HTTPS, kufanele sikhulume ngephrothokholi ye-SSL. I-SSL iyiphrothokholi yokuqala yokuphepha yenethiwekhi eyamukelwa yi-Netscape. Iphrothokholi yokuvikela esetshenziswa ku-Transmission Communication Protocol (TCP/IP). , i-SSL isekela kakhulu izinhlobo ezahlukahlukene zamanethiwekhi, ngenkathi ehlinzeka ngezinsizakalo ezintathu zokuphepha eziyisisekelo, zonke zisebenzisa ubuchwepheshe bokhiye womphakathi.

1. Indima ye-SSL

(1) Qinisekisa abasebenzisi namaseva ukuze uqinisekise ukuthi idatha ithunyelwa kuklayenti neseva efanele;

(2) Bethela idatha ukuze uvimbele idatha ukuthi ingantshontshwa phakathi nendawo;

(3) Gcina ubuqotho bedatha futhi uqinisekise ukuthi idatha ayishintshiwe phakathi nenqubo yokudlulisela.

Isitifiketi se-SSL sisho ifayela ledijithali eliqinisekisa ubunikazi bazo zombili izinhlangothi ekuxhumaneni kwe-SSL. Ngokuvamile ihlukaniswa yaba isitifiketi seseva nesitifiketi seklayenti. Isitifiketi se-SSL sivame ukusho ukuthi sibhekisela kusitifiketi seseva. Isitifiketi se-SSL sithi ekhishwe isiphathimandla esithenjwayo sesitifiketi sedijithali i-CA. (efana ne-VeriSign, GlobalSign, WoSign, njll.), ekhishwe ngemva kokuqinisekisa ubunikazi beseva, enokuqinisekiswa kweseva nemisebenzi yokubethela yokudlulisa idatha, ihlukaniswe yaba Isitifiketi Se-SSL Sokuqinisekisa Okunwetshiwe (EV), Ukuqinisekiswa Kwenhlangano (OV) Isitifiketi se-SSL, kanye nohlobo lokuqinisekisa igama lesizinda (DV) isitifiketi se-SSL.

2. Izinyathelo ezi-3 ezibalulekile zokufaka isicelo sesitifiketi se-SSL

Kunezinyathelo ezintathu ezibalulekile zokufaka isicelo sesitifiketi se-SSL:

(1), yenza ifayela le-CSR

Okubizwa nge-CSR yifayela lesitifiketi Sesicelo Sesitifiketi Sezokuphepha elikhiqizwe ngumfakisicelo. Phakathi nenqubo yokukhiqiza, uhlelo luzokhiqiza okhiye ababili, oyedwa ukhiye womphakathi, okuyifayela le-CSR, kanti omunye ukhiye oyimfihlo, egcinwa kuseva.

Ukwenza amafayela e-CSR, abafakizicelo bangabhekisela kumadokhumenti e-WEB SERVER, i-APACHE evamile, njll., sebenzisa umugqa womyalo we-OPENSSL ukuze ukhiqize amafayela angu-KEY+CSR2, i-Tomcat, i-JBoss, i-Resin, njll. sebenzisa i-KEYTOOL ukuze ukhiqize amafayela e-JKS ne-CSR, i-IIS idala eyodwa ngokusebenzisa izicelo ezilindile zewizadi kanye nefayela le-CSR.

(2), isitifiketi se-CA

Thumela i-CSR ku-CA, futhi i-CA ngokuvamile inezindlela ezimbili zokuqinisekisa:

① Ukuqinisekiswa kwegama lesizinda: Ngokuvamile, ibhokisi leposi lomlawuli liqinisekisiwe. Le ndlela yokuqinisekisa iyashesha, kodwa isitifiketi esikhishiwe asiqukethe igama lenkampani.

②, Isitifiketi sombhalo webhizinisi: Ilayisensi yebhizinisi yebhizinisi idinga ukuhlinzekwa, okuvame ukuthatha izinsuku zokusebenza ezi-3-5.

Kukhona nezitifiketi ezidinga ukufakazela ubuqiniso bezindlela ezimbili ezingenhla ngesikhathi esisodwa, ezibizwa ngesitifiketi se-EV. Lesi sitifiketi singenza ibha yekheli leziphequluli ezingaphezulu kwe-IE2 zibe luhlaza, ngakho ukuqinisekiswa nakho kuqine kakhulu.

(3), ukufakwa kwesitifiketi

Ngemva kokuthola isitifiketi esivela ku-CA, ungakwazi ukuphakela isitifiketi kuseva. Ngokuvamile, ifayela le-APACHE likopisha ngokuqondile i-KEY+CER kufayela, bese lilungisa ifayela le-HTTPD.CONF; i-TOMCAT, njll., idinga ukungenisa isitifiketi se-CER ifayela elikhishwe yi-CA kufayela le-JKS. , likopishele kuseva, bese ulungisa i-SERVER.XML; I-IIS idinga ukucubungula isicelo esilindile futhi ingenise ifayela le-CER.

XNUMX. Isincomo sesitifiketi se-SSL samahhala

Ukusetshenziswa kwezitifiketi ze-SSL akukwazi kuphela ukuqinisekisa ukuphepha kolwazi, kodwa futhi kuthuthukisa ukwethenjwa komsebenzisi kuwebhusayithi.yakha iwebhusayithiUma kucatshangelwa izindleko, abaphathi bewebhu abaningi badikibele kukho. Okumahhala ku-inthanethi kuhlale kuyimakethe engasoze yaphuma esitayelani. Kunezindawo zokusingatha mahhala, futhi ngokwemvelo kunezitifiketi ze-SSL zamahhala. Ngaphambilini, kubikwe ukuthi i-Mozilla, Cisco , Akamai , IdenTrust, EFF, kanye nabacwaningi baseNyuvesi yaseMichigan bazoqala iphrojekthi ye-Let's Encrypt CA, ehlela ukuhlinzeka ngezitifiketi ze-SSL zamahhala kanye nezinsizakalo zokuphatha izitifiketi kumawebhusayithi aqala kuleli hlobo (qaphela: uma udinga izitifiketi eziyinkimbinkimbi ezithuthukisiwe, uzodinga izitifiketi ze-SSL zamahhala kanye nezinsizakalo zokuphatha isitifiketi. uzodinga ukukhokha), futhi ngesikhathi esifanayo , futhi kunciphisa inkimbinkimbi yokufakwa kwesitifiketi, isikhathi sokufaka singamasekhondi angu-20-30 kuphela.

Ngokuvamile amawebhusayithi amakhulu naphakathi nendawo adinga izitifiketi eziyinkimbinkimbi, futhi amasayithi amancane njengamabhulogi omuntu siqu angazama izitifiketi ze-SSL zamahhala kuqala.

Ngezansi kukhonaU-Chen WeiliangIbhulogi izokwethula ezitifiketini ezimbalwa zamahhala ze-SSL, njenge: CloudFlare SSL, NameCheap, njll.

1. CloudFlare SSL

I-CloudFlare yisizindalwazi ese-United States esihlinzeka ngamasevisi e-CDN. Inama-node ayo eseva ye-CDN emhlabeni wonke. Izinkampani eziningi ezinkulu noma amawebhusayithi ekhaya naphesheya asebenzisa amasevisi e-CDN ye-CloudFlare. Kunjalo, esetshenziswa kakhulu abaphathi bewebhu basekhaya iyi-CDN yamahhala ye-CloudFlare. Futhi yinhle kakhulu. Isitifiketi samahhala se-SSL esinikezwe i-CloudFlare yi-UniversalSSL, okusho ukuthi, i-SSL yendawo yonke. Abasebenzisi bangasebenzisa isitifiketi se-SSL ngaphandle kokufaka isicelo nokulungisa isitifiketi esivela kwabaphethe isitifiketi. I-CloudFlare inikeza ukubethela kwe-SSL ku-SSL bonke abasebenzisi (kuhlanganise nabasebenzisi bamahhala), isixhumi esibonakalayo sewebhu Isitifiketi simiswa phakathi nemizuzu engu-5, futhi ukuthunyelwa okuzenzakalelayo kuqedwa phakathi namahora angu-24, kuhlinzeka ngesevisi yokubethela ye-TLS esekelwe ku-Elliptic Curve Digital Signature Algorithm (ECDSA) yethrafikhi yewebhusayithi.

2. IgamaCheap

I-NameCheap iyinkampani ehamba phambili yokubhaliswa kwegama lesizinda eligunyazwe yi-ICANN kanye nenkampani yokubamba iwebhusayithi, eyasungulwa ngo-2000, inkampani inikeza isixazululo samahhala se-DNS, ukudlulisa i-URL (ingafihla i-URL yasekuqaleni, isekele ukuqondisa kabusha kwe-301) nezinye izinsizakalo, ngaphezu kwalokho, i-NameCheap inikeza Iminyaka yesitifiketi se-SSL yesevisi yamahhala.

3. Masibhale Ngemfihlo

I-Let's Encrypt iphrojekthi edumile yokukhishwa kwesitifiketi se-SSL yamahhala muva nje. I-Let's Encrypt iphrojekthi yezenhlalakahle yamahhala nemahhala ehlinzekwa yi-ISRG, ekhipha izitifiketi ngokuzenzakalelayo, kodwa isitifiketi sisebenza izinsuku ezingu-90 kuphela.Sifanele ukusetshenziswa komuntu siqu noma ukusetshenziswa kwesikhashana, futhi akusadingeki ukuba ubekezelele ukwaziswa kokuthi isitifiketi esizisayinele ngokwaso asethenjwa isiphequluli.

Empeleni,U-Chen WeiliangIbhulogi futhi ihlela ukusebenzisa Masibhale Ngemfihlo muva nje ^_^

Masibethele okokufundisa kwamahhala kwesitifiketi se-SSL, sicela ubheke lesi sihloko ukuze uthole imininingwane:"Usifaka kanjani isicelo se-Let Encrypt"