OpenAI Mutual TLS wuxuu ururrada u oggolaanayaa inay habeeyaan lakab amni oo dheeraad ah oo loogu talagalay taraafikada OpenAI API. Marka la habeeyo, codsiyada API waa in loo diraa https://mtls.api.openai.com (ama https://mtls-eu.api.openai.com macaamiisha Hoyga Xogta ee EU) waxaana taraafikada la aqbali doonaa oo keliya haddii furaha API ee saxda ah iyo shahaadada macmiilka la bixiyo. mTLS kuma dabaqmo Dashboard-ka https://platform.openai.com. Astaantan hadda waxay ku jirtaa beta.
Sideen u dejiyaa isdhexgalka mTLS?
Barta hagista dejimaha, waxaad ku arki doontaa tab “Mutual TLS”.
Soo geli Shahaado
Hawl geli Shahaado
Ka dib markaad soo geliso shahaadadaada, tallaabada xigta waa inaad hawlgeliso shahaadadaada. Marka shahaado loo hawlgeliyo mashruuc, dhammaan codsiyada API ee u socda mashruucaas waxay sidoo kale bilaabi doonaan inay u baahdaan shahaado macmiil oo u dhiganta. Haddii mashruuc uu leeyahay shahaadooyin badan oo la hawlgeliya, waxaad gudbin kartaa shahaado macmiil oo kasta oo u dhiganta. Haddii shahaado loo hawlgeliyo ururka, waxay khusayn doontaa dhammaan codsiyada API waxaana “dhaxli” doona dhammaan mashruucyada.
Shuruudaha shahaadada CA
Waxaad soo gelin kartaa shahaado X.509 CA kasta oo qaab PEM ah oo buuxisa shuruudahan:
si toos ah u saxeexda shahaadooyinka macmiilka ee aad qorshaynayso inaad isticmaasho, ama tiir u noqota silsilad shahaado oo ansax ah oo macmiilkaagu soo bandhigo.
leedahay fidinnada Certificate Authority, Subject Key Identifier, iyo Authority Key Identifier (qaabka KeyIdentifier)
leedahay oggolaanshaha Key Usage: “Certificate Sign, CRL Sign”
aan dhicin 1 maalin gudaheed
cabbirka guud ee shahaadadu waa inuu ka yaraadaa 16kb.
Shuruudaha shahaadada macmiilka
Haddii taageerada silsiladda shahaadooyinka loo hawlgeliyey ururkaaga, macmiilkaagu wuxuu soo bandhigi karaa shahaadada leaf ee macmiilka iyo shahaadooyinka dhexe ee loo baahan yahay si loo dhiso silsilad ansax ah ilaa shahaado la soo geliyey oo firfircoon. Haddii kale, shahaadooyinka macmiilka waa in si toos ah ay u saxeexeen shahaadooyinka aad hore u soo gelisay. Taas marka laga reebo, shahaadooyinkaaga macmiil waa inay buuxiyaan shuruudahan:
leedahay fidinnada Subject Key Identifier iyo Authority Key Identifier (qaabka KeyIdentifier)
leedahay oggolaanshaha Key Usage: “Digital Signature, Key Encipherment”
leedahay oggolaanshaha Extended Key Usage: “TLS Web Client Authentication”
leedahay fidinta Subject Alternate Name
Taageerada silsiladda shahaadooyinka ee API mTLS
Taageerada silsiladda shahaadooyinku waxay macmiilkaaga u oggolaanaysaa inuu soo bandhigo shahaadada leaf ee macmiilka iyo shahaadooyinka dhexe ee loo baahan yahay si loo dhiso silsilad ansax ah ilaa shahaado la soo geliyey oo firfircoon.
Tani waxay kuu oggolaan kartaa inaad wareejiso shahaadooyinka dhexe adigoon soo gelin mid kasta oo cusub, inta shahaadada la soo geliyey ee firfircoon ee loo isticmaalo tiirka kalsoonidu ay weli ansax tahay.
Taageerada silsiladda shahaadooyinka hadda waxaa lagu heli karaa codsi. La xidhiidh Agaasimaha Koontadaada ama fur tikidh taageero si aad u codsato helitaan.
Macmiilkaagu waa inuu soo bandhigaa dhammaan shahaadooyinka dhexe ee loo baahan yahay. OpenAI kama soo qaado shahaadooyinka dhexe ee maqan AIA. Hubinnada CRL iyo OCSP weli lama taageero.
Su’aalaha Badanaa La Isweydiiyo
Ma ku habayn karaa mTLS API?
Haa — waxaad ka arki kartaa Tixraaca API-ga https://platform.openai.com/docs/api-reference/ si aad u hesho macluumaad dheeraad ah.
Bar-dhammaadkee taageera mTLS?
Inta lagu jiro muddadan beta, mTLS si rasmi ah ayaa looga taageeraa
/v1/chat/completions (with all supported extensions e.g. image, audio, streaming, etc.)/v1/completions/v1/embeddings/v1/audio/transcriptions/v1/audio/speech/v1/files/v1/batches/v1/responses/v1/images/v1/moderations/v1/realtime (via server-side web sockets)/v1/fine_tuning/v1/tunnels
Sideen shahaadooyinka macmiilka ugu diraa codsigayga?
Codsiga cURL, waxaad adeegsan kartaa ikhtiyaarrada --cert iyo --key (eeg bogga man-ka halkan). Inta badan macmiillada kale ee HTTP, sidoo kale waxaa jira siyaabo loogu gudbiyo shahaadooyinka macmiilka. Tusaalooyin: requests ee Python, fetch ee JS. SDK-yadayada rasmiga ah, waxaan sidoo kale taageernaa in la beddelo macmiilka HTTP — eeg halkan tusaale Python ah.
Marka taageerada silsiladda shahaadooyinka la hawlgeliyo, u habeey macmiilkaaga HTTP inuu soo bandhigo shahaadada leaf ee macmiilka iyo dhammaan shahaadooyinka dhexe ee loo baahan yahay. Habaynta saxda ahi waxay ku xidhan tahay macmiilkaaga HTTP.
Ka hor inta aanad mTLS ku khasbin taraafikada wax-soo-saarka, hubi in macmiilka HTTP ee aad isticmaalayso uu si fiican ula dhaqmo codsiyada shahaadada macmiilka (qaar, sida WebSockets ee biraawsarrada qaarkood, sidaas ma sameeyaan). Ogow in seerfarkayagu aanu bixin liiska certificate_authorities ee liiska codsiga shahaadada macmiilka.
Yaa geli kara oo wax ka beddeli kara shahaadooyinka?
Iyada oo loo marayo Dashboard UI-ga https://platform.openai.com/settings/organization/mtls, milkiilayaasha ururku way geli karaan oo wax ka beddeli karaan shahaadooyinka. Qof kasta oo leh Admin API Key (https://platform.openai.com/settings/organization/admin-keys) sidoo kale wuu geli/kala beddeli karaa shahaadooyinka, inkastoo ka digtoonow — haddii aad Mutual TLS ka hawlgeliso heerka ururka, waxaad shahaadooyinka ku khasbi doontaa codsiyadan API sidoo kale. Dhammaan isbeddellada mTLS waxay ka muuqdaan diiwaannada audit-ka.
Immisa shahaado ayaan yeelan karaa?
Urur kasta wuxuu soo gelin karaa ilaa 50 shahaado, kuwaas oo lagu wadaagi karo mashruucyada, balse aan lala wadaagi karin ururro kale. Waxaad shahaado si hal-mar ah ugu hawlgelin/dami kartaa 10 mashruuc markiiba. Sidoo kale, waxaad 10 shahaado markiiba ugu hawlgelin/dami kartaa ururkaaga ama 1 mashruuc oo gaar ah.
Ma cusboonaysiin ama tirtiri karaa shahaadooyinka?
Waxaad cusboonaysiin kartaa magacyada shahaadooyinkaaga, balse ma cusboonaysiin kartid waxa ku jira. Sidoo kale waad tirtiri kartaa shahaadooyinka haddii aysan hadda ka hawlgalsanayn wax baaxad ah.
Sidee bay u shaqaysaa ka noqoshada shahaadadu?
Waqtigan xaadirka ah, ma taageerno hubinnada CRL ama OCSP. Beddelka lagu taliyey waa inaad tirtirto ama wareejiso furahaaga API. Waxaad sidoo kale beddeli kartaa shahaadooyinkaaga CA ama isticmaali kartaa shahaadooyin macmiil oo leh muddo ansaxnimo ka gaaban.
Ma isticmaali karaa silsilado shahaado oo ka dheer?
Haa, haddii taageerada silsiladda shahaadooyinka loo hawlgeliyey ururkaaga. Macmiilkaagu waa inuu soo bandhigaa shahaadada leaf ee macmiilka iyo shahaado kasta oo dhexe oo loo baahan yahay si OpenAI u xaqiijiso silsiladda ilaa shahaado la soo geliyey oo firfircoon. La xidhiidh Agaasimaha Koontadaada ama fur tikidh taageero si aad u codsato helitaan.
Waa maxay dejinta lagu taliyey?
Marka hore ee astaantan la dejinayo, waxaan ku talinaynaa in lagu bilaabo mashruuc staging ah oo aan u adeegayn taraafikada production-ka rasmiga ah. Ka faa’iidayso fursaddan si aad u hubiso in shahaadooyinkaaga si habboon loogu dejiyay mashiinnadaada iyo inaad si guul leh u diri karto taraafikada API-ga. Intaas ka sokow, waxaan ku talinaynaa inaad la tashato kooxda amniga ee ururkaaga si aad si fiican ugu fahanto baahiyahaaga.
Taageero Dheeraad ah
Waxaad si buuxda adigu uga maamuli kartaa astaanta mTLS dashboard-ka iyo API-ga. Si kastaba ha ahaatee, haddii aad rabto inaad mTLS marka hore ku shido qaab shadow ah, fadlan la xiriir Agaasimaha Akoonkaaga ama fur tigidh taageero adigoo wada-sheekeysi cusub ka bilaabaya geeska hoose ee midig ee boggan.
Lifaaq: Eray-bixin
Shahaadada CA: Mid ka mid ah shahaadooyinka aad ku kalsoon tahay ee loo isticmaalo xaqiijinta shahaadooyinka macmiilka. Waxay si toos ah u saxeexi kartaa shahaadooyinka macmiilka ee aad la dirto codsiyada, ama waxay noqotaa tiir lagu xidho silsilad shahaado oo macmiilkaagu soo bandhigo. Waxaad isticmaali kartaa shahaadooyin CA oo is-saxeexan.
Soo geli shahaado: ku darista shahaado CA koontadaada. Weli meelna looguma khasbin mTLS, laakiin waad bilaabi kartaa inaad habayso.
Baaxad: mashruuc gaar ah ama ururkaaga oo dhan.
Ku hawlgeli shahaado CA baaxad gaar ah: waxay mTLS u hawlgelisaa baaxaddaas si gaar ah, dhammaan codsiyada ku salaysan furaha API-gana waa inay ku jiraan shahaado macmiil oo lagu xaqiijin karo shahaadada CA ee firfircoon.
Ka hawl-jooji shahaado CA baaxad gaar ah: waxay joojisaa isticmaalka shahaadadan si codsiyada loogu xaqiijiyo baaxaddan. Haddii aanay jirin shahaadooyin kuu hadhay baaxaddaas, mTLS si dhab ah wuu u dansan yahay.
Dhaxlidda shahaado: Haddii aad shahaado u hawlgeliso ururkaaga, waxaa sidoo kale loo hawlgelin doonaa dhammaan mashaariicda.