A dynamic TLS authentication method, device and storage medium in a local area network

Abstract

The present invention provides a dynamic TLS authentication method, device and storage medium in a local area network. The method includes: a deployment step, issuing an IP certificate for a web server based on a unified self-issued root certificate Root CA; an accessing step, the web server loading For the corresponding IP certificate, the client establishes a network connection based on TLS to access the web server; the re-signing step, when detecting that the IP address of the device port connected to the web server changes, the service program is the web server Automatically issue a new IP certificate, and do not need to restart the service program and web server when re-issuing, so that the web service will not be interrupted. The invention unifies the self-signed CA root certificate of the local area network, introduces the intermediate certificate, and reduces the leakage risk of the root certificate; the change of the port IP address automatically triggers the issuance and loading of the certificate, without restarting the system and the web server, and will not cause service interruption. The whole process It is not perceived by the client, which improves the user experience.

Description

technical field [0001] The invention relates to the technical field of data security, in particular to a dynamic TLS authentication method, device and storage medium in a local area network. Background technique [0002] Web services in intranet environments (local area networks) such as enterprises and families often use non-encrypted network connection communications, which have low security. However, according to the specification: 1. Public CAs will not issue security certificates for private IP address segments; 2. Enterprises can issue self-signed certificates for private IP addresses; 3. Because it is not a public CA, clients (such as browsers) The self-signed certificate cannot be trusted directly, and the client user needs to forcefully trust the self-signed certificate to continue using it. [0003] Effective November 1, 2015, the industry-standard CA / browser form used to manage Baseline Requirements (BR) and set up SSL certificate usage no longer allows publicly ...

AI Technical Summary

Problems solved by technology

[0004] Therefore, in the existing technology, enterprises generally issue self-signed certificates for private network IP addresses. The technical defects are: self-signed certificates require considerable professional knowledge, professional and technical personnel are required in the enterprise for configuration management, and issuance process management. And the issuing period is long, and the operation is inconvenient; more importantly, if the IP address of the web server changes, such as server migration, reconfiguration, etc., then a new security certificate needs to be issued to continue using TLS encrypted data connection, otherwise the IP address If it is inconsistent with the content of the certificate, the client will deny access. Issuing a new security certificate will cause service interruption and affect the user experience

Images