labsecuritybaiso10ca-130505214529-phpapp01

02 Bis Dinh Tien Hoang Street, Dakao Ward, District 1, HCMC Tel: (848) 3824 4041 090 78 79 477

E-mail: [email protected] URL: WWW.ATHENA.EDU.VN

Ti liu hng dn thc tp Security+.Trung tm o to An Ninh Mng ATHENA 63

Bi 10: CA ( CERTIFICATE AUTHORITY)

CC KHI NIM V CHNG CH S:

CHNG CH S L G?

Chng ch s l mt tp tin in t dng xc minh danh tnh mt c

nhn, mt my ch, mt cng ty... trn Internet. N ging nh bng li xe, h

chiu, chng minh th hay nhng giy t xc minh c nhn.

c chng minh th, bn phi c c quan Cng An s ti cp.

Chng ch s cng vy, phi do mt t chc ng ra chng nhn nhng thng

tin ca bn l chnh xc, c gi l Nh cung cp chng thc s (Certificate

Authority, vit tt l CA). CA phi m bo v tin cy, chu trch nhim v

chnh xc ca chng ch s m mnh cp.

Trong chng ch s c ba thnh phn chnh:

Thng tin c nhn ca ngi c cp

Kho cng khai (Public key) ca ngi c cp

Ch k s ca CA cp chng ch

Thng tin c nhn: y l cc thng tin ca i tng c cp chng

ch s, gm tn, quc tch, a ch, in thoi, email, tn t chc .v.v. Phn ny

ging nh cc thng tin trn chng minh th ca mi ngi.

LI CH CA CHNG CH S?

M ho: Li ch u tin ca chng ch s l tnh bo mt thng tin.

Khi ngi gi m ho thng tin bng kho cng khai ca bn, chc chn

ch c bn mi gii m c thng tin c. Trong qu trnh truyn thng

tin qua Internet, d c c c cc gi tin m ho ny, k xu cng khng

th bit c trong gi tin c thng tin g. y l mt tnh nng rt quan trng,

gip ngi s dng hon ton tin cy v kh nng bo mt thng tin. Nhng




trao i thng tin cn bo mt cao, chng hn giao dch lin ngn hng, ngn

hng in t, thanh ton bng th tn dng, u cn phi c chng ch s

m bo an ton.

Chng gi mo: Khi bn gi i mt thng tin, c th l mt d liu

hoc mt email, c s dng chng ch s, ngi nhn s kim tra c thng

tin ca bn c b thay i hay khng. Bt k mt s sa i hay thay th ni

dung ca thng ip gc u s b pht hin. a ch mail ca bn, tn

domain... u c th b k xu lm gi nh la ngi nhn ly lan virus,

n cp thng tin quan trng. Tuy nhin, chng ch s th khng th lm gi, nn

vic trao i thng tin c km chng ch s lun m bo an ton.

Xc thc: Khi bn gi mt thng tin km chng ch s, ngi nhn - c

th l i tc kinh doanh, t chc hoc c quan chnh quyn - s xc nh r

c danh tnh ca bn. C ngha l d khng nhn thy bn, nhng qua h

thng chng ch s m bn v ngi nhn cng s dng, ngi nhn s bit

chc chn l bn ch khng phi l mt ngi khc. Xc thc l mt tnh

nng rt quan trng trong vic thc hin cc giao dch in t qua mng, cng

nh cc th tc hnh chnh vi c quan php quyn. Cc hot ng ny cn

phi xc minh r ngi gi thng tin s dng t cch php nhn. y chnh

l nn tng ca mt Chnh ph in t, mi trng cho php cng dn c th

giao tip, thc hin cc cng vic hnh chnh vi c quan nh nc hon ton

qua mng. C th ni, chng ch s l mt phn khng th thiu, l phn ct li

ca Chnh ph in t.

Chng chi ci ngun gc: Khi s dng mt chng ch s, bn phi

chu trch nhim hon ton v nhng thng tin m chng ch s i km. Trong

trng hp ngi gi chi ci, ph nhn mt thng tin no khng phi do




mnh gi (chng hn mt n t hng qua mng), chng ch s m ngi

nhn c c s l bng chng khng nh ngi gi l tc gi ca thng tin

. Trong trng hp chi ci, CA cung cp chng ch s cho hai bn s chu

trch nhim xc minh ngun gc thng tin, chng t ngun gc thng tin c

gi.

Ch k in t: Email ng mt vai tr kh quan trng trong trao i

thng tin hng ngy ca chng ta v u im nhanh, r v d s dng. Nhng

thng ip c th gi i nhanh chng, qua Internet, n nhng khch hng,

ng nghip, nh cung cp v cc i tc. Tuy nhin, email rt d b tn

thng bi cc hacker. Nhng thng ip c th b c hay b gi mo trc

khi n ngi nhn. Bng vic s dng chng ch s c nhn, bn s ngn

nga c cc nguy c ny m vn khng lm gim nhng li th ca email.

Vi chng ch s c nhn, bn c th to thm mt ch k in t vo email

nh mt bng chng xc nhn ca mnh. Ch k in t cng c cc tnh nng

xc thc thng tin, ton vn d liu v chng chi ci ngun gc. Ngoi ra,

chng ch s c nhn cn cho php ngi dng c th chng thc mnh vi

mt web server thng qua giao thc bo mt SSL. Phng php chng thc

da trn chng ch s c nh gi l tt, an ton v bo mt hn phng

php chng thc truyn thng da trn mt khu.

Bo mt Website:Khi Website ca bn s dng cho mc ch thng

mi in t hay cho nhng mc ch quan trng khc, nhng thng tin trao i

gia bn v khch hng ca bn c th b l. trnh nguy c ny, bn c th

dng chng ch s SSL Server bo mt cho Website ca mnh. Chng ch

s SSL Server s cho php bn lp cu hnh Website ca mnh theo giao thc

bo mt SSL (Secure Sockets Layer). Loi chng ch s ny s cung cp cho




Website ca bn mt nh danh duy nht nhm m bo vi khch hng ca

bn v tnh xc thc v tnh hp php ca Website. Chng ch s SSL Server

cng cho php trao i thng tin an ton v bo mt gia Website vi khch

hng, nhn vin v i tc ca bn thng qua cng ngh SSL m ni bt l cc

tnh nng:

+ Thc hin mua bn bng th tn dng

+ Bo v nhng thng tin c nhn nhy cm ca khch hng

+ m bo hacker khng th d tm c mt khu

m bo phn mm:Nu bn l mt nh sn xut phn mm, chc

chn bn s cn nhng ''con tem chng hng gi'' cho sn phm ca mnh. y

l mt cng c khng th thiu trong vic p dng hnh thc s hu bn quyn.

Chng ch s Nh pht trin phn mm s cho php bn k vo cc applet,

script, Java software, ActiveX control, cc file dng EXE, CAB, DLL... Nh

vy, thng qua chng ch s, bn s m bo tnh hp php cng nh ngun

gc xut x ca sn phm. Hn na ngi dng sn phm c th xc thc

c bn l nh cung cp, pht hin c s thay i ca chng trnh (do v

tnh hng hay do virus ph, b crack v bn lu...).

NH CUNG CP CHNG THC S CA

Trong cc h thng qun l chng thc s ang hot ng trn th gii,

nh cung cp chng thc s (Certificate authority - CA) l mt t chc chuyn

a ra v qun l cc ni dung xc thc bo mt trn mt mng my tnh, cng

cc kho cng khai m ho thng tin. L mt phn trong C s h tng kho

cng khai (public key infrastructure - PKI), mt CA s kim sot cng vi mt

nh qun l ng k (Registration authority - RA) xc minh thng tin v




mt chng ch s m ngi yu cu xc thc a ra. Nu RA xc nhn thng

tin ca ngi cn xc thc, CA sau s a ra mt chng ch.

Tu thuc vo vic trin khai c s h tng kho cng khai, chng ch

s s bao gm kho cng khai ca ngi s hu, thi hn ht hiu lc ca

chng ch, tn ch s hu v cc thng tin khc v ch kho cng khai.

1. CC THNH PHN TRONG M HNH

CA server: 26.0.0.2

Client v webserver: 26.0.0.3

2. CI T V CU HNH CERTIFICATE AUTHORITY CA

Click Start Setting Control Panel Add or Remove Programs Add or

Remove Windows Component




Check vo Certificate Services. Chn Next.

Chng trnh s hin bng Warning Nu sau khi ci Certificate Services

th nhng thng tin cc thnh vin trong domain s khng c thay i nh

quyn c hng v CA c lu tr trong Active Directory, cho nn bn

phi chc chn rng nhng thng tin cc thnh vin trong Domain c

Configured & Install trc khi ci Certificate Services.Chng ta chp nhn v

Click Yes




Chng ta chn Enterprise Root CA

Click Next

Hon thnh cc thng tin yu cu:

Common name for this CA : Server1 (Computer Name CA Server)

Distinguished name suffix : DC=vt04c1,DC=com

Preview of Distinguished name : CN=server1,DC=vt04c1,CN=com

Expiration date : 5 nm

Click Next tip tc qu trnh ci t Certificate Services




Information Certificate Database & Certificate Database Log c lu tr

C:\WINDOWS\system32\CertLog

Click Browse thay i ni lu tr

Nu mun Share Information Configuration th Store onfiguration

information

Sau Click Next




Chng trnh xut hin bng Warning:Chng trnh s STOP Service IIS

Click Yes tip tc

Chng trnh yu cu Source Win2k3 C:\source win2k3\I386\Certsrv




Click File Certsrv.exe Click Open

Chng trnh ang cu hnh Certificate Services




Click Finish han thnh qu trnh ci t Certificate Services




3. USER NG K CA

Sau khi ci xong CA server .Trn my client ta s ng k 1 Certificate cho

User Test

Ta m trnh duyt Web Internet Explorer trn my client ng k

Nhp c thng tin sau:

Address : 26.0.0.2/certsrv

Hoc :http://localhost/certsrv

Trang Web ng k xut hin

Sau Click Request a Certificate




Mn hnh sau xut hin : Click Advanced Certificate Request

Click Create and Submit a request to this CA




in cc thng tin ca client:




Trong mc Certifcate Template chn User

Store Certificate ...

Click Submit




Sau khi ng k xong th trn CA server s xc nhn cung cp

Certificate.Sau t client vo li http://26.0.0.2/certsrv ---> chn View the

status of a pending certificate request ---> Client Authentication Certificate

(Tuesday August 29 2006 5:20:48 PM) ,Click Install this Cerificate




Click Yes

Chng trnh thng bo Certificate c Install




Sau khi install han tt quay tr li trang http://26.0.0.2/certsrv chn Download a CA

certificate, certificate chain, or CRL Download CA certificate

Ngoi Desktop c 1 file certnew.cer l file m chng ta va ng k trn CA

Server

kim tra li Certificate c hiu lc cha ta s vo CA Server kim tra




Click Start Programs Administrative Tools Click Certificate

Authority

Click Issue Certificates ta thy Certifiacte User Test c cp v Certifiacte

User Test c hiu lc.

Documents

labsecuritybaiso10ca-130505214529-phpapp01