Domain name certificate automatic issuing method and device, computer equipment and storage medium

Abstract

The invention relates to a method for automatically signing and issuing a domain name certificate, which comprises the following steps that: after a user binds a domain name through a user interface, a certificate signing and issuing server receives a request; the certificate issuing server sends the received domain name binding request sent by the user to a certificate issuing mechanism for verification; the certificate signing and issuing mechanism verifies the domain name information to be signed and issued according to a preset domain name verification rule, and when the verification result is that verification is passed, the certificate signing and issuing mechanism generates a domain name certificate and sends the domain name certificate to the certificate signing and issuing server; and the certificate issuing server caches the domain name certificate to the cloud storage server and returns the domain name certificate to the client. The whole certificate signing and issuing process is automatically triggered through the message, and when the user accesses the domain name, the system directly obtains the certificate from the Redis cache to ensure the responsiveness of the user interface and realize the core function of automatic certificate management, so that the whole certificate signing and issuing process does not need manual intervention, and the efficiency and the safety are improved.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of network security technology, and in particular to a method, apparatus, computer equipment and storage medium for automatically issuing a domain name certificate. Background Art

[0002] With the development of the Internet, network security is becoming increasingly important. SSL / TLS certificates are an important means to ensure the security of network communications. However, the traditional SSL / TLS certificate management process is cumbersome, requires manual intervention, is inefficient, and has security risks. Therefore, the ACME (Automated Certificate Management Environment) protocol, a standardized solution based on automated management of SSL / TLS certificates, has been widely used.

[0003] Therefore, it is urgent to provide an efficient, secure and easy-to-use method for automatic issuance and caching of domain name certificates by combining the ACME protocol, cloud storage and caching technology. Summary of the invention

[0004] The embodiment of the present invention proposes a method, apparatus, computer equipment and storage medium for automatic issuance of domain name certificates, so as to combine the ACME protocol, cloud storage and cache technology to realize an efficient, secure and easy-to-use method for automatic issuance and caching of domain name certificates.

[0005] In a first aspect, an embodiment of the present invention provides a method for automatically issuing a domain name certificate, which is applied to a system for automatically issuing a domain name certificate, wherein the system includes a client, a certificate issuing server, a certificate issuing authority, and a cloud storage server; the certificate issuing server is respectively connected to the client, the certificate issuing authority, and the cloud storage server, and the method includes:

[0006] The certificate issuing server sends the domain name binding request received from the client to the certificate issuing authority for verification;

[0007] The certificate issuing authority verifies the domain name information to be issued according to a preset domain name verification rule, and returns the verification result to the certificate issuing server;

[0008] If the verification result received by the certificate issuing server is that the verification is passed, a certificate issuing request is sent to the certificate issuing authority; the certificate issuing request includes a domain name;

[0009] The certificate issuing authority generates a domain name certificate after receiving the certificate issuing request, and sends the domain name certificate to the certificate issuing server;

[0010] The certificate issuing server caches the domain name certificate to the cloud storage server, and returns the domain name certificate to the client.

[0011] In a second aspect, an embodiment of the present invention further provides a device for automatically issuing a domain name certificate, which is applied to a system for automatically issuing a domain name certificate. The system includes a client, a certificate issuing server, a certificate issuing authority, and a cloud storage server; the certificate issuing server is respectively connected to the client, the certificate issuing authority, and the cloud storage server, and the device includes:

[0012] A domain name verification module, used for the certificate issuing server to send the domain name binding request received from the client to the certificate issuing authority for verification;

[0013] A verification result returning module is used for the certificate issuing authority to verify the domain name information to be issued according to a preset domain name verification rule, and return the verification result to the certificate issuing server;

[0014] A certificate issuing module, configured to send a certificate issuing request to the certificate issuing authority if the verification result received by the certificate issuing server is that the verification is passed; the certificate issuing request includes a domain name;

[0015] The certificate sending module is used for the certificate issuing authority to generate a domain name certificate after receiving the certificate issuing request, and send the domain name certificate to the certificate issuing server;

[0016] The certificate caching module is used for the certificate issuing server to cache the domain name certificate to the cloud storage server and return the domain name certificate to the client.

[0017] In a third aspect, an embodiment of the present invention further provides a computer device, the computer device comprising:

[0018] one or more processors;

[0019] a memory for storing one or more programs,

[0020] When the one or more programs are executed by the one or more processors, the one or more processors implement the method for automatically issuing a domain name certificate as described in any one of the first aspects.

[0021] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the method for automatically issuing a domain name certificate as described in any one of the first aspects is implemented.

[0022] In this embodiment, after the user binds the domain name through the user interface, the certificate issuing server receives the request. The certificate issuing server sends the domain name binding request sent by the user to the certificate issuing agency for verification; the certificate issuing agency verifies the domain name information to be issued according to the preset domain name verification rules. When the verification result is passed, the certificate issuing agency generates a domain name certificate and sends the domain name certificate to the certificate issuing server; the certificate issuing server caches the domain name certificate to the cloud storage server and returns the domain name certificate to the client. The entire certificate issuance process is automatically triggered by a message, and when the user accesses the domain name, the system directly obtains the certificate from the Redis cache to ensure the responsiveness of the user interface, and realizes the core function of automated certificate management, so that the entire certificate issuance process does not require manual intervention, improving efficiency and security. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 A flowchart of a method for automatically issuing a domain name certificate provided in Embodiment 1 of the present invention;

[0024] Figure 2 This is an example diagram of the real-time certificate issuance process provided in the first embodiment of the present invention;

[0025] Figure 3 An example diagram of the certificate loading process provided in the first embodiment of the present invention;

[0026] Figure 4 A schematic diagram of the structure of a device for automatically issuing domain name certificates provided in Embodiment 2 of the present invention;

[0027] Figure 5 A schematic diagram of the structure of a computer device provided in Embodiment 3 of the present invention. DETAILED DESCRIPTION

[0028] The present invention will be further described in detail below in conjunction with the accompanying drawings and embodiments. It is to be understood that the specific embodiments described herein are only used to explain the present invention, rather than to limit the present invention. It should also be noted that, for ease of description, only parts related to the present invention, rather than all structures, are shown in the accompanying drawings.

[0029] Embodiment 1

[0030] Figure 1 A flowchart of a method for automatically issuing a domain name certificate provided in Embodiment 1 of the present invention is provided. The method is applied to a system for automatically issuing a domain name certificate. The system includes a client, a certificate issuing server, a certificate issuing authority, and a cloud storage server. The certificate issuing server is connected to the client, the certificate issuing authority, and the cloud storage server, respectively. The method specifically includes the following steps:

[0031] Step 101: The certificate issuing server sends the domain name binding request received from the client to the certificate issuing authority for verification.

[0032] In the embodiment of the present invention, when using the domain name certificate automatic issuance system, the user logs in to the user interface of the domain name certificate automatic issuance system, selects the "bind domain name" option, and enters the domain name to be bound. After the user submits the binding request, the user interface sends the request to the backend server, that is, the certificate issuance server.

[0033] After receiving the domain name binding request, the certificate issuing server sends the domain name binding request to the certificate issuing authority for preliminary verification, such as checking whether the domain name format is correct.

[0034] Preferably, in another embodiment of the present invention, step 101 may further include:

[0035] Sub-step B1: The certificate issuing server receives a domain name binding request sent by the client.

[0036] Specifically, when a user issues a domain name binding request through a domain name certificate automatic issuance system client, the request is sent to a certificate issuance server.

[0037] Sub-step B2: The certificate issuing server obtains the domain name to be issued in the domain name binding request.

[0038] Specifically, the certificate issuing server obtains information such as the domain name in the domain name request.

[0039] Sub-step B3: The certificate issuing server sends the domain name to be issued to the certificate issuing authority for verification.

[0040] Specifically, the certificate issuing server sends the acquired domain name and other information to the certificate issuing authority for preliminary verification.

[0041] Step 102: The certificate issuing authority verifies the domain name information to be issued according to a preset domain name verification rule, and returns the verification result to the certificate issuing server.

[0042] Preferably, in another embodiment of the present invention, the preset domain name verification rule includes an Automated Certificate Management Environment protocol ACME.

[0043] In the embodiment of the present invention, after the certificate issuing authority verifies the domain name information according to the preset verification rules, it returns the result to the certificate issuing server.

[0044] Specifically, the preset verification rule is the Automated Certificate Management Environment protocol ACME. ACME (Automated Certificate Management Environment) is a protocol for automatically managing TLS / SSL certificates. It allows software systems to automatically verify domain name ownership and obtain certificates without manual intervention. One of the core functions of the ACME protocol is the domain name verification mechanism. If the certificate issuing authority verifies the domain name based on ACME, then generally, there are three ways for the certificate issuing authority to verify the domain name:

[0045] One is through HTTP verification, that is, the certificate issuing server places a verification file in the specified path under the domain name. The client needs to place this string in the specified path under the domain name. The certificate issuing agency will access and obtain this file. If it is successfully obtained, the domain name verification is passed.

[0046] The second is through DNS verification, that is, the domain name issuing server will add a specific TXT record to the DNS record of the domain name, and the certificate issuing agency will query this record. If the corresponding TXT record can be found and the string is matched, the domain name verification is passed.

[0047] The third is TLS-SNI verification (TLS Server Name Indication). The client needs to provide a special certificate on the specified TLS port, which contains a verification token provided by the certificate issuing authority. The certificate issuing authority attempts to connect to the client through SNI and requests the domain name containing the token. If the connection is successful, the domain name verification is successful.

[0048] It is understandable that the way in which the certificate issuing authority verifies the domain name is set by relevant technical personnel according to actual usage, and the embodiment of the present invention does not limit this.

[0049] Step 103: If the verification result received by the certificate issuing server is that the verification is passed, a certificate issuing request is sent to the certificate issuing authority; the certificate issuing request includes a domain name.

[0050] In the embodiment of the present invention, once the certificate issuing authority successfully verifies the domain name, it will confirm the verification result to the client through the certificate issuing server. The client can use this confirmation to request the issuance of a certificate, that is, the certificate issuing server submits a certificate issuance request to the certificate issuing authority through the Acme Java client. The request includes the domain name, domain validity period, and domain encryption information.

[0051] Specifically, the encrypted information includes a new pair of public and private keys. The private key is used for confidentiality, while the public key will be used to generate the certificate. The client uses the private key to generate a certificate request and sends it to the certificate issuing authority through the certificate issuing server. After receiving the certificate issuing request, the certificate issuing authority verifies the identity information of the requester.

[0052] Step 104: After receiving the certificate issuance request, the certificate issuing authority generates a domain name certificate and sends the domain name certificate to the certificate issuing server.

[0053] In the embodiment of the present invention, after the certificate issuing authority verifies the domain name identity information, it generates a certificate and sends it to the certificate issuing server.

[0054] Specifically, for security reasons, the certificate issuing authority may encrypt the certificate content so that it can only be decrypted by the client that has the corresponding key. The certificate issuing authority sends the generated certificate back to the client. This is usually done in a secure way, such as using HTTPS.

[0055] Preferably, in another embodiment of the present invention, the certificate issuance request also includes a domain name validity period and domain name encryption information, and step 104 may include:

[0056] Sub-step A1: The certificate issuing authority receives the certificate issuance request, verifies that the domain name is consistent with the verified domain name to be issued, and generates a domain name certificate according to the domain name validity period and the domain name encryption information.

[0057] Specifically, when the certificate issuing authority verifies the domain name identity information, that is, the domain name is consistent with the verified domain name to be issued, it uses its own private key to digitally sign the public key and identity information in the certificate issuance request to generate a certificate.

[0058] In actual applications, the generated certificate may contain the public key, identity information of the certificate owner, validity period, issuer information, serial number and other extensions.

[0059] It can be understood that the information involved in generating the domain name certificate is not limited to the above description, and is set by relevant technical personnel according to actual applications, and the embodiments of the present invention are not limited to this.

[0060] Sub-step A2: The certificate issuing authority sends the domain name certificate to the certificate issuing server.

[0061] Specifically, after the certificate is generated, the certificate issuing authority sends the domain name certificate to the client through the certificate issuing server.

[0062] Step 105: The certificate issuing server caches the domain name certificate to the cloud storage server, and returns the domain name certificate to the client.

[0063] In the embodiment of the present invention, the certificate issuing server caches the received domain name certificate to the cloud storage server, pairs it with the private key, and configures the certificate so as to provide it to the client during the TLS handshake process.

[0064] Specifically, once the server is configured with a new certificate, the certificate becomes effective and communications between the client and the server will be encrypted using the certificate.

[0065] In practical applications, such as Figure 3 As shown, when a user accesses the bound domain name for the first time, the system loads the corresponding domain name certificate from the cloud storage of the certificate issuing server and stores it in the Redis cache. When the user subsequently accesses the domain name, the system directly obtains the certificate from the Redis cache to improve access efficiency.

[0066] Preferably, in another embodiment of the present invention, the domain name certificate is stored in a domain name certificate database on the cloud storage server, and the embodiment further includes:

[0067] Step S1: If the certificate issuing server receives an expiration reminder of the domain name certificate from the domain name certificate database, it re-issues a certificate issuing request to the certificate issuing authority and executes step 104.

[0068] Specifically, the domain name certificate is stored in a domain name certificate database on the cloud storage server. The certificate database monitors the validity period of the certificate and issues an early warning before the certificate expires to remind the user to reapply for a new certificate from the certificate issuing authority.

[0069] In practical applications, such as Figure 2 The following is an example of a real-time certificate issuance process. The system will periodically check the status of the domain name. Based on the test results, the system determines whether the domain name needs to be issued or updated. If the test results show that the domain name certificate needs to be issued or updated, the system will send the corresponding task to the message queue for processing. At the same time, the certificate issuance system monitors the message queue and starts processing the certificate issuance after receiving the task. Among them, the system may also need to perform DNS resolution verification to ensure that the domain name resolution is correct, and the status and information of all issuance tasks are recorded in the issuance task table for monitoring and auditing.

[0070] Specifically, the system uses an account in a pre-configured account pool to log in to a certificate provider, such as Let'sEncrypt, Zero SSL, Free SSL, etc. The certificate authority (CA) requires verification of domain name ownership, usually through HTTP verification (placing a verification file) or DNS verification (adding a TXT record). The system generates a pair of public and private keys, and uses this pair of keys to create a certificate order with the CA, poll the certificate provider, check the certificate issuance status, and once the verification is passed, the CA issues the certificate.

[0071] The issued certificate is then downloaded and stored in Google Cloud Storage, and the system downloads the certificate from Google Cloud Storage for use on the server. If an exception is encountered in any step, the system will retry until it succeeds.

[0072] Specifically, Figure 3 As shown below, the process of automatically loading domain name certificates in this system is described in detail:

[0073] First, the renewal problem processor triggers a reminder 3 hours before the certificate expires. After receiving the expiration reminder, the distributed task scheduling platform XXL-JOB schedules the renewal task for all extended certificate tasks. After retrieving the expiring certificate information from the MySQL database, the domain name ownership is verified using DNS verification or HTTP challenge. After the verification is passed, the distributed messaging middleware Rocket MQ is used to process asynchronous messages to the certificate issuing server and the certificate issuing authority, and the renewal task is added to the queue. The client interacts with the certificate issuing authority through the certificate issuing server. After the renewal is completed, the renewed new certificate is stored in the cloud storage.

[0074] HTTPS access process of Google Cloud Storage and Redis cache, where Nginx is a high-performance HTTP and reverse proxy server used to process inbound HTTPS requests, and Google Cloud Storage is used to store the public and private keys of the certificate. When a user visits a domain name for the first time, Nginx will load the SSL / TLS certificate from Google Cloud Storage. Once the certificate is loaded, it will be cached in Redis. When the user visits the domain name again, the certificate can be obtained directly from the Redis cache without having to load it from Google Cloud Storage again, which significantly improves the efficiency of user access to the domain name.

[0075] Preferably, in another embodiment of the present invention, it also includes:

[0076] Step S2: If the certificate issuing server receives the domain name certificate revocation request sent by the client, it sends a domain name certificate cancellation application to the certificate issuing authority.

[0077] In actual applications, if the private key of the certificate is leaked or the certificate needs to be revoked in advance, the client can apply to the certificate issuing authority to cancel the certificate through the certificate issuing server.

[0078] Step S3: After receiving the domain name certificate cancellation application, the certificate issuing authority cancels the domain name certificate.

[0079] In actual applications, the certificate issuing authority cancels the corresponding certificate based on the cancellation application.

[0080] In this embodiment, after the user binds the domain name through the user interface, the certificate issuing server receives the request. The certificate issuing server sends the domain name binding request sent by the user to the certificate issuing agency for verification; the certificate issuing agency verifies the domain name information to be issued according to the preset domain name verification rules. When the verification result is passed, the certificate issuing agency generates a domain name certificate and sends the domain name certificate to the certificate issuing server; the certificate issuing server caches the domain name certificate to the cloud storage server and returns the domain name certificate to the client. The entire certificate issuance process is automatically triggered by a message, and when the user accesses the domain name, the system directly obtains the certificate from the Redis cache to ensure the responsiveness of the user interface, and realizes the core function of automated certificate management, so that the entire certificate issuance process does not require manual intervention, improving efficiency and security.

[0081] It should be noted that, for the sake of simplicity, the method embodiments are described as a series of action combinations, but those skilled in the art should be aware that the embodiments of the present invention are not limited by the order of the actions described, because according to the embodiments of the present invention, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present invention.

[0082] Embodiment 2

[0083] Figure 4 A structural block diagram of a device for automatically issuing a domain name certificate provided in Embodiment 2 of the present invention is applied to a system for automatically issuing a domain name certificate. The system includes a client, a certificate issuing server, a certificate issuing authority, and a cloud storage server; the certificate issuing server is interconnected with the client, the certificate issuing authority, and the cloud storage server, respectively, and may specifically include the following modules:

[0084] Domain name verification module 201, used for the certificate issuing server to send the domain name binding request received from the client to the certificate issuing authority for verification;

[0085] A verification result returning module 202 is used for the certificate issuing authority to verify the domain name information to be issued according to a preset domain name verification rule, and return the verification result to the certificate issuing server;

[0086] The certificate issuing module 203 is used to send a certificate issuing request to the certificate issuing authority if the verification result received by the certificate issuing server is verified; the certificate issuing request includes a domain name;

[0087] The certificate sending module 204 is used for the certificate issuing authority to generate a domain name certificate after receiving the certificate issuing request, and send the domain name certificate to the certificate issuing server;

[0088] The certificate caching module 205 is used for the certificate issuing server to cache the domain name certificate to the cloud storage server and return the domain name certificate to the client.

[0089] Preferably, in another embodiment of the present invention, the certificate issuance request also includes a domain name validity period and domain name encryption information, and the certificate sending module 204 is further used to:

[0090] The certificate issuing authority receives the certificate issuance request, verifies that the domain name is consistent with the verified domain name to be issued, and generates a domain name certificate according to the domain name validity period and the domain name encryption information;

[0091] The certificate issuing authority sends the domain name certificate to the certificate issuing server.

[0092] Preferably, in another embodiment of the present invention, the domain name verification module 201 is further used for:

[0093] The certificate issuing server receives the domain name binding request sent by the client;

[0094] The certificate issuing server obtains the domain name to be issued in the domain name binding request;

[0095] The certificate issuing server sends the domain name to be issued to the certificate issuing authority for verification.

[0096] Preferably, in another embodiment of the present invention, the domain name certificate is stored in a domain name certificate database on the cloud storage server, further comprising:

[0097] The automatic update module is used to re-issue a certificate issuance request to the certificate issuing authority and call the certificate sending module 204 if the certificate issuing server receives an expiration reminder of the domain name certificate from the domain name certificate database.

[0098] Preferably, in another embodiment of the present invention, a certificate cancellation module is further included, which is used to:

[0099] If the certificate issuing server receives the domain name certificate revocation request issued by the client, it sends a domain name certificate cancellation application to the certificate issuing authority;

[0100] After receiving the domain name certificate cancellation application, the certificate issuing authority cancels the domain name certificate.

[0101] Preferably, in another embodiment of the present invention, the preset domain name verification rule includes an Automated Certificate Management Environment protocol ACME.

[0102] The device for automatically issuing a domain name certificate provided in the embodiment of the present invention can execute the method for automatically issuing a domain name certificate provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0103] Embodiment 3

[0104] Figure 5 A schematic diagram of the structure of a computer device provided in Embodiment 3 of the present invention. Figure 5 A block diagram of an exemplary computer device 12 suitable for use in implementing embodiments of the present invention is shown. Figure 5 The computer device 12 shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0105] like Figure 5 As shown, the computer device 12 is in the form of a general-purpose computing device. The components of the computer device 12 may include, but are not limited to: one or more processors or processing units 16, a system memory 28, and a bus 18 that connects various system components (including the system memory 28 and the processing unit 16).

[0106] Bus 18 represents one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, a processor or a local bus using any of a variety of bus architectures. By way of example, these architectures include, but are not limited to, an Industry Standard Architecture (ISA) bus, a Micro Channel Architecture (MAC) bus, an Enhanced ISA bus, a Video Electronics Standards Association (VESA) local bus, and a Peripheral Component Interconnect (PCI) bus.

[0107] The computer device 12 typically includes a variety of computer system readable media. These media can be any available media that can be accessed by the computer device 12, including volatile and non-volatile media, removable and non-removable media.

[0108] The system memory 28 may include computer system readable media in the form of volatile memory, such as random access memory (RAM) 30 and / or cache memory 32. The computer device 12 may further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, the storage system 34 may be used to read and write non-removable, non-volatile magnetic media ( Figure 5 not shown, usually called a "hard drive"). Although Figure 5 Not shown, a disk drive for reading and writing to a removable non-volatile disk (e.g., a "floppy disk"), and an optical disk drive for reading and writing to a removable non-volatile optical disk (e.g., a CD-ROM, DVD-ROM, or other optical medium) may be provided. In these cases, each drive may be connected to the bus 18 via one or more data medium interfaces. The memory 28 may include at least one program product having a set (e.g., at least one) of program modules that are configured to perform the functions of the various embodiments of the present invention.

[0109] A program / utility 40 having a set (at least one) of program modules 42 may be stored, for example, in the memory 28, such program modules 42 including but not limited to an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment. The program modules 42 generally perform the functions and / or methods of the embodiments described herein.

[0110] The computer device 12 may also communicate with one or more external devices 14 (e.g., keyboards, pointing devices, displays 24, etc.), may communicate with one or more devices that enable a user to interact with the computer device 12, and / or may communicate with any device that enables the computer device 12 to communicate with one or more other computing devices (e.g., network cards, modems, etc.). Such communication may be performed via an input / output (I / O) interface 22. Furthermore, the computer device 12 may also communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) via a network adapter 20. As shown, the network adapter 20 communicates with other modules of the computer device 12 via a bus 18. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the computer device 12, including, but not limited to, microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0111] The processing unit 16 executes various functional applications and data processing by running the programs stored in the system memory 28, such as implementing the method for automatically issuing a domain name certificate provided in an embodiment of the present invention.

[0112] Embodiment 4

[0113] Embodiment 4 of the present invention further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the various processes of the method for automatic issuance of the above-mentioned domain name certificate are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0114] Among them, computer-readable storage media may include, for example, but are not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or devices, or any combination of the above. More specific examples of computer-readable storage media (a non-exhaustive list) include: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this document, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, device or device.

[0115] Note that the above are only preferred embodiments of the present invention and the technical principles used. Those skilled in the art will understand that the present invention is not limited to the specific embodiments described herein, and that various obvious changes, readjustments and substitutions can be made by those skilled in the art without departing from the scope of protection of the present invention. Therefore, although the present invention has been described in more detail through the above embodiments, the present invention is not limited to the above embodiments, and may include more other equivalent embodiments without departing from the concept of the present invention, and the scope of the present invention is determined by the scope of the appended claims.

Claims

1. A method for automatically issuing a domain name certificate, applied to a system for automatically issuing a domain name certificate, the system comprising a client, a certificate issuing server, a certificate issuing authority and a cloud storage server; The certificate issuing server is connected to the client, the certificate issuing authority and the cloud storage server respectively, and is characterized in that: The method comprises: The certificate issuing server sends the domain name binding request received from the client to the certificate issuing authority for verification; The certificate issuing authority verifies the domain name information to be issued according to a preset domain name verification rule, and returns the verification result to the certificate issuing server; If the verification result received by the certificate issuing server is that the verification is passed, a certificate issuing request is sent to the certificate issuing authority; the certificate issuing request includes a domain name; The certificate issuing authority generates a domain name certificate after receiving the certificate issuing request, and sends the domain name certificate to the certificate issuing server; The certificate issuing server caches the domain name certificate to the cloud storage server, and returns the domain name certificate to the client.

2. The method according to claim 1, characterized in that: The certificate issuance request also includes the domain name validity period and domain name encryption information. After receiving the certificate issuance request, the certificate issuing authority generates a domain name certificate and sends the domain name certificate to the certificate issuance server, including: The certificate issuing authority receives the certificate issuance request, verifies that the domain name is consistent with the verified domain name to be issued, and generates a domain name certificate according to the domain name validity period and the domain name encryption information; The certificate issuing authority sends the domain name certificate to the certificate issuing server.

3. The method according to claim 1, characterized in that The domain name certificate is stored in a domain name certificate database on the cloud storage server, and the method further includes: If the certificate issuing server receives an expiration reminder of the domain name certificate from the domain name certificate database, it re-issues a certificate issuing request to the certificate issuing authority; After receiving the certificate issuance request, the certificate issuing authority generates a domain name certificate and sends the domain name certificate to the certificate issuing server.

4. The method according to claim 1, characterized in that: Also includes: If the certificate issuing server receives the domain name certificate revocation request issued by the client, it sends a domain name certificate cancellation application to the certificate issuing authority; After receiving the domain name certificate cancellation application, the certificate issuing authority cancels the domain name certificate.

5. The method according to claim 1, characterized in that The preset domain name verification rule includes the automated certificate management environment protocol ACME.

6. The method according to claim 1, characterized in that The step of the certificate issuing server sending the domain name binding request received from the client to the certificate issuing authority for verification includes: The certificate issuing server receives the domain name binding request sent by the client; The certificate issuing server obtains the domain name to be issued in the domain name binding request; The certificate issuing server sends the domain name to be issued to the certificate issuing authority for verification.

7. A device for automatically issuing domain name certificates, applied to a system for automatically issuing domain name certificates, the system comprising a client, a certificate issuing server, a certificate issuing authority and a cloud storage server; The certificate issuing server is connected to the client, the certificate issuing authority and the cloud storage server respectively, and is characterized in that: The device comprises: A domain name verification module, used for the certificate issuing server to send the domain name binding request received from the client to the certificate issuing authority for verification; A verification result returning module is used for the certificate issuing authority to verify the domain name information to be issued according to a preset domain name verification rule, and return the verification result to the certificate issuing server; A certificate issuing module, configured to send a certificate issuing request to the certificate issuing authority if the verification result received by the certificate issuing server is that the verification is passed; the certificate issuing request includes a domain name; The certificate sending module is used for the certificate issuing authority to generate a domain name certificate after receiving the certificate issuing request, and send the domain name certificate to the certificate issuing server; The certificate caching module is used for the certificate issuing server to cache the domain name certificate to the cloud storage server and return the domain name certificate to the client.

8. The device according to claim 7, characterized in that The certificate issuance request also includes the domain name validity period and domain name encryption information, and the certificate sending module is further used to: The certificate issuing authority receives the certificate issuance request, verifies that the domain name is consistent with the verified domain name to be issued, and generates a domain name certificate according to the domain name validity period and the domain name encryption information; The certificate issuing authority sends the domain name certificate to the certificate issuing server.

9. A computer device, characterized in that: The computer device comprises: one or more processors; a memory for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors implement the method for automatically issuing a domain name certificate as described in any one of claims 1 to 6.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method for automatically issuing a domain name certificate according to any one of claims 1 to 6 is implemented.

Images