Ukhuseleko alusekho ukhetho, kodwa luyimfuneko kubo bonke abasebenzi be-intanethi. I-HTTP, i-HTTPS, i-SSL, i-TLS - Ngaba uyaqonda ngokwenene okwenzekayo ngasemva kweziganeko? Kweli nqaku, siza kuchaza ingqiqo ephambili yeenkqubo zonxibelelwano ezifihliweyo zanamhlanje ngendlela eqhelekileyo neyobungcali, kwaye sikuncede uqonde iimfihlo "ezingasemva kwezitshixo" ngetshathi yokuhamba ebonakalayo.
Kutheni i-HTTP "ingakhuselekanga"? --- Intshayelelo
Uyakhumbula eso silumkiso sesikhangeli esiqhelekileyo?
"Unxibelelwano lwakho aluyonto yabucala."
Xa iwebhusayithi ingasebenzisi i-HTTPS, lonke ulwazi lomsebenzisi lubonakala kwinethiwekhi ngendlela ecacileyo. Amagama akho okugqitha okungena, iinombolo zekhadi lebhanki, kwaneencoko zabucala zonke zinokubanjwa ngumntu osebenzisa i-hacker ofanelekileyo. Unobangela woku kukungabikho kwe-HTTP yokubethela.
Ngoko ke i-HTTPS, kunye "nomlindi-sango" ongasemva kwayo, i-TLS, ivumela njani idatha ukuba ihambe ngokukhuselekileyo kwi-intanethi? Masiyihlalutye ngokwamaleko.
I-HTTPS = HTTP + TLS/SSL --- Ulwakhiwo kunye neeNgcinga eziPhambili
1. Yintoni i-HTTPS ngokwenene?
I-HTTPS (iProtokholi yoThumelo lweHyperText ekhuselekile) = HTTP + umaleko wokubethela (TLS/SSL)
○ HTTP: Oku kunoxanduva lokuthutha idatha, kodwa umxholo ubonakala kumbhalo ocacileyo
○ I-TLS/SSL: Ibonelela "ngokubethela okuvaliweyo" konxibelelwano lwe-HTTP, iguqula idatha ibe yiphazili enokusombulwa ngumthumeli kunye nomamkeli osemthethweni kuphela.
Umfanekiso 1: Ukuhamba kwedatha ye-HTTP vs HTTPS.
"Tshixa" kwibha yedilesi yesikhangeli yiflegi yokhuseleko ye-TLS/SSL.
2. Yintoni ubudlelwane phakathi kwe-TLS kunye ne-SSL?
○ I-SSL (I-Secure Sockets Layer): I-protocol yokuqala ye-cryptographic, efunyenwe ineengxaki ezinkulu.
○ I-TLS (uKhuseleko lweLayer yezoThutho): Ilandela i-SSL, i-TLS 1.2 kunye ne-TLS 1.3 ephucukileyo, enika uphuculo olukhulu kukhuseleko kunye nokusebenza.
Kule mihla, "iisatifikethi ze-SSL" zizinto nje ezisetyenziswayo kwi-TLS protocol, ezibizwa ngokuba zi-extensions.
Nzulu kwi-TLS: Umlingo we-Cryptographic ongasemva kwe-HTTPS
1. Ukuhamba kwesandla kulungisiwe ngokupheleleyo
Isiseko sonxibelelwano olukhuselekileyo lwe-TLS ngumdaniso wokuxhawulana ngexesha lokuseta. Masihlalutye ukuhamba kwe-TLS handshake eqhelekileyo:
Umfanekiso 2: Ukuhamba kwe-TLS handshake eqhelekileyo.
1️⃣ Useto loQhagamshelo lweTCP
Iklayenti (umz., isikhangeli) iqalisa uqhagamshelo lwe-TCP kwiseva (izibuko eliqhelekileyo 443).
Isigaba sokuxhawulana ngesandla se-TLS 2️⃣
○ Molo kuMthengi: Isikhangeli sithumela inguqulelo yeTLS exhaswayo, i-cipher, kunye nenombolo engacwangciswanga kunye neServer Name Indication (SNI), exelela iseva ukuba yeyiphi na igama lenginginya elifuna ukufikelela kuyo (ivumela ukwabelana nge-IP kwiindawo ezininzi).
○ Ingxaki ye-Hello yeSeva kunye neSatifikethi: Iseva ikhetha inguqulelo ye-TLS efanelekileyo kunye ne-cipher, kwaye ithumela isatifiketi sayo (esinesitshixo sikawonke-wonke) kunye neenombolo ezingacwangciswanga.
○ Ukuqinisekiswa kwesatifikethi: Isikhangeli siqinisekisa ikhonkco lesatifikethi seseva ukuya kuthi ga kwi-CA ethembekileyo ukuqinisekisa ukuba ayikagqitywanga.
○ Ukuveliswa kwezitshixo ze-Premaster: Isikhangeli senza isitshixo se-premaster, sisibethele ngesitshixo sikawonke-wonke seseva, size sisithumele kwiseva. Amaqela amabini athetha ngesitshixo seseshoni: Esebenzisa amanani angacwangciswanga omabini amaqela kunye nesitshixo se-premaster, umthengi kunye neseva babala isitshixo seseshoni yokubethela esilinganayo.
○ Ukugqitywa kokuxhawulana: Omabini amaqela athumelana imiyalezo ethi "Igqityiwe" aze angene kwisigaba sokudluliselwa kwedatha efihliweyo.
3️⃣ Ukudluliselwa kwedatha okukhuselekileyo
Yonke idatha yenkonzo ibethelwe ngokulinganayo ngesitshixo seseshoni esixoxiswanayo ngokufanelekileyo, nokuba ibanjwe phakathi, yinqwaba nje "yekhowudi egqwethekileyo".
4️⃣ Ukusetyenziswa kwakhona kweSeshini
I-TLS ixhasa iSession kwakhona, nto leyo enokuphucula kakhulu ukusebenza ngokuvumela umthengi ofanayo ukuba angawusebenzisi umxhawulana odinisayo.
Ukubethela okungalinganiyo (okufana ne-RSA) kukhuselekile kodwa kuhamba kancinci. Ukubethela okulinganayo kuyakhawuleza kodwa ukusasazwa kwezitshixo kunzima. I-TLS isebenzisa icebo "lamanyathelo amabini" - okokuqala i-asymmetric secure key exchange ize emva koko ibe yi-symmetric scheme ukuze ibethele idatha ngokufanelekileyo.
2. Uphuhliso lwe-algorithm kunye nokuphuculwa kokhuseleko
I-RSA kunye neDiffie-Hellman
○ RSA
Yaqala ukusetyenziswa kakhulu ngexesha le-TLS handshake ukusasaza ngokukhuselekileyo izitshixo zeseshoni. Iklayenti ivelisa isitshixo seseshoni, isibethele ngesitshixo sikawonke-wonke seseva, ize isithumele ukuze ibe yiseva kuphela enokuyicima.
○ Diffie-Hellman (DH/ECDH)
Ukususela kwi-TLS 1.3, i-RSA ayisasetyenziswa kutshintshiselwano lwezitshixo ngokuthanda ii-algorithms ze-DH/ECDH ezikhuselekileyo ezixhasa ubumfihlo obuphambili (i-PFS). Nokuba isitshixo sabucala sivuthulukile, idatha yembali ayinakuvulwa.
| Inguqulelo yeTLS | i-Algorithm yokuTshintshiselana kwesitshixo | Ukhuseleko |
| I-TLS 1.2 | I-RSA/DH/ECDH | Phezulu |
| I-TLS 1.3 | kuphela kwi-DH/ECDH | Phezulu Ngakumbi |
Iingcebiso Ezisebenzayo Ekufuneka Zizifunde Iingcali Zothungelwano
○ Uphuculo oluphambili lube yi-TLS 1.3 ukuze ufumane ukubethela okukhawulezayo nokukhuselekileyo.
○ Vula ii-ciphers ezinamandla (AES-GCM, ChaCha20, njl.njl.) kwaye ucime ii-algorithms ezibuthathaka kunye neeprotokholi ezingakhuselekanga (SSLv3, TLS 1.0);
○ Lungiselela i-HSTS, i-OCSP Stapling, njl. ukuphucula ukhuseleko lwe-HTTPS iyonke;
○ Hlaziya kwaye uphonononge rhoqo ikhonkco lesatifikethi ukuqinisekisa ukuba lisebenza kwaye lithembekile ikhonkco letrasti.
Isiphelo kunye neengcinga: Ngaba ishishini lakho likhuselekile ngokwenene?
Ukusuka kwi-HTTP engenanto ukuya kwi-HTTPS efihliweyo ngokupheleleyo, iimfuno zokhuseleko ziye zavela emva kokuphuculwa kweprotocol nganye. Njengesiseko sonxibelelwano olufihliweyo kwiinethiwekhi zanamhlanje, i-TLS ihlala iziphucula ukuze ikwazi ukumelana nemeko yohlaselo eyinkimbinkimbi ngakumbi.
Ngaba ishishini lakho sele lisebenzisa i-HTTPS? Ngaba ulwakhiwo lwakho lwe-crypto luhambelana neendlela ezilungileyo zoshishino?
Ixesha leposi: Julayi-22-2025
