A method and device for detecting SSL certificate

Abstract

The embodiment of the present application provides a method and device for detecting an SSL certificate, the method comprising: sending a certificate acquisition request to the server corresponding to the test address; obtaining the SSL server certificate returned by the server corresponding to the test address; detecting whether the SSL server certificate corresponds to a complete SSL certificate chain, and obtaining a detection result; and displaying the detection result in a detection interface. The user does not need to perform complicated operations, but can enter the test address in the detection interface, and the detection of whether the SSL server certificate corresponds to a complete SSL certificate chain can be completed, and the detection result can be returned to the user. When the detection result is that the SSL certificate chain is incomplete, the missing SSL certificate chain can be supplemented according to actual needs, so that the mobile terminal can communicate with the server normally.

Description

Technical Field

[0001] The present application relates to the field of network technology, and in particular to a method for detecting an SSL certificate and a device for detecting an SSL certificate. Background Art

[0002] In the prior art, when using HTTPS (HyperText Transfer Protocol Secure) to access the network, the client usually performs SSL (Secure Sockets Layer) certificate verification to ensure that the server communicating with the client is safe and reliable.

[0003] Existing SSL certificates can usually contain multiple levels of certificate chain structures. In this case, during the SSL certificate verification process of the client, the SSL certificate chain corresponding to the server needs to remain intact in order to pass the SSL certificate verification and allow the client to access the server normally.

[0004] However, for mobile terminals, it is easy to fail to obtain the SSL certificate chain corresponding to the server during the SSL certificate verification process, resulting in the failure of SSL certificate verification in the mobile terminal and the inability to access the server normally. In this case, the mobile terminal usually needs to use super user privileges to capture data packets for data analysis to confirm whether the SSL certificate chain is complete, which makes the verification of SSL certificates more complicated. Summary of the invention

[0005] In view of the above problems, embodiments of the present application are proposed to provide a method for detecting an SSL certificate and a device for detecting an SSL certificate that overcome the above problems or at least partially solve the above problems.

[0006] In order to solve the above problems, an embodiment of the present application discloses a method for detecting an SSL certificate, which is applied to a mobile terminal. The method includes:

[0007] Send a certificate acquisition request to the server corresponding to the test address;

[0008] Obtain the SSL server certificate returned by the server corresponding to the test address;

[0009] Detecting whether the SSL server certificate corresponds to a complete SSL certificate chain based on network communication to obtain a detection result;

[0010] The detection results are displayed on the detection interface.

[0011] Optionally, the step of detecting whether the SSL server certificate corresponds to a complete SSL certificate chain based on network communication and obtaining a detection result includes:

[0012] Searching for a superior certificate corresponding to a superior issuing authority of the SSL server certificate based on network communication;

[0013] Verify whether the superior certificate is credible, and use the public key recorded in the superior certificate to verify whether the SSL server certificate is credible to obtain a test result.

[0014] Optionally, the step of searching for a superior certificate corresponding to a superior issuing authority of the SSL server certificate based on network communication includes:

[0015] Determine whether the superior issuing authority of the SSL server certificate is a root certificate issuing authority;

[0016] If the superior issuing authority of the SSL server certificate is not a root certificate issuing authority, the superior certificate corresponding to the superior issuing authority of the SSL server certificate is searched based on network communication.

[0017] Optionally, the step of searching for a superior certificate corresponding to a superior issuing authority of the SSL server certificate based on network communication includes:

[0018] Obtaining an intermediate certificate corresponding to the issuing authority of the SSL server certificate based on network communication;

[0019] Determining whether the issuing authority of the intermediate certificate is a root certificate issuing authority;

[0020] If the issuing authority of the intermediate certificate is not the root certificate issuing authority, obtain the certificate corresponding to the superior issuing authority of the intermediate certificate.

[0021] Optionally, the step of verifying whether the superior certificate is credible and using the public key recorded in the superior certificate to verify whether the SSL server certificate is credible to obtain a detection result includes:

[0022] If the issuing authority corresponding to the superior certificate is a root certificate issuing authority, the public key recorded in the preset root certificate list is used to verify whether the superior certificate is credible;

[0023] If the issuing authority corresponding to the superior certificate is not the root certificate issuing authority, use the public key of the issuing authority corresponding to the superior certificate to verify whether the superior certificate is credible;

[0024] If the superior certificate is credible, the public key recorded in the superior certificate is used to verify whether the SSL server certificate is credible to obtain a detection result.

[0025] Optionally, the step of sending a certificate acquisition request to a server corresponding to the test address includes:

[0026] Turn off the SSL verification function preset in the mobile terminal;

[0027] Establishing a communication connection between the servers corresponding to the test address;

[0028] A certificate acquisition request is issued to the server corresponding to the test address.

[0029] Optionally, the step of disabling a preset SSL verification function of the mobile terminal includes:

[0030] Set up a custom hostname verification object and SSL socket factory object;

[0031] The customized host name verification object and the SSL socket factory object are set to ignore the SSL verification process to disable the SSL verification function preset in the mobile terminal.

[0032] In an embodiment of the present application, a device for detecting an SSL certificate is also provided, which is applied to a mobile terminal, and the device includes:

[0033] A request issuing module, used for issuing a certificate acquisition request to the server corresponding to the test address;

[0034] A certificate acquisition module, used to obtain the SSL server certificate returned by the server corresponding to the test address;

[0035] A verification module is used to detect whether the SSL server certificate corresponds to a complete SSL certificate chain based on network communication to obtain a detection result;

[0036] The display module is used to display the detection results on the detection interface.

[0037] Optionally, the verification module includes:

[0038] The certificate search submodule is used to search for the superior certificate corresponding to the superior issuing authority of the SSL server certificate based on network communication;

[0039] The verification submodule is used to verify whether the superior certificate is credible, and use the public key recorded in the superior certificate to verify whether the SSL server certificate is credible to obtain a detection result.

[0040] Optionally, the certificate search submodule includes:

[0041] A first issuing authority determining unit, used to determine whether the superior issuing authority of the SSL server certificate is a root certificate issuing authority;

[0042] The first searching unit is used to search for a superior certificate corresponding to the superior issuing authority of the SSL server certificate based on network communication if the superior issuing authority of the SSL server certificate is not a root certificate issuing authority.

[0043] Optionally, the certificate search submodule includes:

[0044] An intermediate certificate obtaining unit, used for obtaining an intermediate certificate corresponding to the issuing authority of the SSL server certificate based on network communication;

[0045] A second issuing authority determining unit, used to determine whether the issuing authority of the intermediate certificate is a root certificate issuing authority;

[0046] The second searching unit is used for obtaining a certificate corresponding to a superior issuing authority of the intermediate certificate if the issuing authority of the intermediate certificate is not a root certificate issuing authority.

[0047] Optionally, the verification module includes:

[0048] The first upper-level certificate verification submodule is used to verify whether the upper-level certificate is credible by using the public key recorded in the preset root certificate list if the issuing authority corresponding to the upper-level certificate is a root certificate issuing authority;

[0049] A second superior certificate verification submodule, for verifying whether the superior certificate is credible by using the public key of the issuing authority corresponding to the superior certificate if the issuing authority corresponding to the superior certificate is not a root certificate issuing authority;

[0050] The server certificate verification submodule is used to verify whether the SSL server certificate is credible by using the public key recorded in the superior certificate if the superior certificate is credible, and obtain a detection result.

[0051] Optionally, the request issuing module includes:

[0052] A function closing submodule, used to close the SSL verification function preset in the mobile terminal;

[0053] A connection establishment submodule, used to establish a communication connection between the servers corresponding to the test address;

[0054] The request issuing submodule is used to issue a certificate acquisition request to the server corresponding to the test address.

[0055] Optionally, the function shutdown submodule includes:

[0056] Object setup unit, used to set up custom hostname verification objects and SSL socket factory objects;

[0057] The function closing unit is used to set the customized host name verification object and the SSL socket factory object to ignore the SSL verification process to close the SSL verification function preset in the mobile terminal.

[0058] Optionally, the device further comprises:

[0059] The address display module is used to access the extension node through permission information to find the missing certificate address information in the SSL certificate chain if it is detected that the SSL server certificate does not correspond to a complete SSL certificate chain, and display it on the detection interface.

[0060] The present application also discloses an electronic device, including:

[0061] one or more processors; and

[0062] One or more machine-readable media having instructions stored thereon, when executed by the one or more processors, enable the electronic device to perform any one of the methods described in the embodiments of the present application.

[0063] The embodiments of the present application also disclose one or more machine-readable media on which instructions are stored, which, when executed by one or more processors, enable the processors to perform any one of the methods described in the embodiments of the present application.

[0064] The embodiments of the present application include the following advantages:

[0065] Through the SSL certificate detection method of the embodiment of the present application, a certificate acquisition request is sent to the server corresponding to the test address; the SSL server certificate returned by the server corresponding to the test address is obtained; the SSL server certificate is detected whether it corresponds to a complete SSL certificate chain, and the detection result is obtained; the detection result is displayed on the detection interface. There is no need for the user to perform complicated operations, and the test address can be entered in the detection interface, that is, the detection of whether the SSL server certificate corresponds to a complete SSL certificate chain can be completed, and the detection result is returned to the user. When the detection result is that the SSL certificate chain is incomplete, the missing SSL certificate chain can be supplemented according to actual needs, so that the mobile terminal can communicate with the server normally. In the SSL certificate detection method, the SSL server certificate and its corresponding SSL certificate chain are obtained through network communication, ensuring the credibility of the SSL server certificate of the test address and its corresponding SSL certificate chain, and the detection result is true and reliable. At the same time, compared with the traditional detection method, the detection method does not need to obtain the super user authority of the mobile terminal, the detection process is simple, and it is convenient for the tester to quickly verify, and the verification time is fast, which is suitable for large-scale SSL certificate detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0066] Figure 1It is a flowchart of the steps of an embodiment of a method for detecting an SSL certificate in an embodiment of the present application;

[0067] Figure 2 is a schematic diagram of a detection interface of an embodiment of the present application;

[0068] Figure 3 is a schematic diagram of a detection method of an embodiment of the present application;

[0069] Figure 4 It is a flowchart of the steps of an embodiment of a method for detecting an SSL certificate in an embodiment of the present application;

[0070] Figure 5 It is a structural block diagram of an embodiment of an SSL certificate detection device embodiment of the present application. DETAILED DESCRIPTION

[0071] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, the present application is further described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0072] In the embodiment of the present application, the mobile terminal may be an electronic device that a user can carry with him / her during movement, for example, a mobile phone, a laptop computer, a tablet computer, a car computer, a smart watch, etc.

[0073] During the verification process of the SSL certificate on the mobile terminal, if the SSL certificate chain is incomplete, the mobile terminal may not be able to actively download the missing certificate in the SSL certificate chain, but may directly notify the SSL certificate abnormality. In addition, to detect whether the SSL certificate chain is incomplete in the mobile terminal, it is usually necessary to first obtain the super user privileges of the mobile terminal, then obtain the data packets generated by the communication with the server, and analyze the data packets to know whether the SSL certificate chain is complete, which is difficult to operate.

[0074] In an embodiment of the present application, faced with the situation where it is difficult to verify the SSL certificate chain corresponding to the SSL certificate, the SSL server certificate returned by the server corresponding to the test address is obtained through a mobile terminal, and the SSL certificate chain corresponding to the SSL server certificate is tested to see whether it is complete. The test result is obtained and displayed to the user through a test interface, so that the user can easily complete the test of the SSL certificate chain.

[0075] Reference Figure 1 , shows a flowchart of a method for detecting an SSL certificate according to an embodiment of the present application, which is applied to a mobile terminal. The method may specifically include the following steps:

[0076] Step 101: Send a certificate acquisition request to the server corresponding to the test address.

[0077] In an embodiment of the present application, the mobile terminal can provide a detection interface for the user. The detection interface can be used to detect whether the server corresponding to the network address has a complete SSL certificate chain. When the user needs to test a certain network address, the network address can be entered in the detection interface, so that the mobile terminal can obtain the network address that needs to be tested, that is, the test address.

[0078] In a specific implementation, when a user needs to visit a certain website, the user can directly enter the network address of the website, or obtain the network address of the website by querying the relevant information of the website in a network search engine. Thereafter, if the user needs to detect whether the network address may have an incomplete SSL certificate chain, the network address can be entered as a test address in the detection interface. For example, if the user needs to visit website A, the network address of website A is www.xxx.com, and if the user needs to detect whether the network address may have an incomplete SSL certificate chain, www.xxx.com can be entered as a test address in the detection interface.

[0079] Users can also access the Internet through applications in mobile terminals to view information. When users access the Internet, if a website page cannot be displayed normally, users can obtain the website address by copying the network address recorded in the address bar in the application, or by operating the control that provides the function of copying the network address, and enter it in the detection page as a test address.

[0080] Thereafter, the mobile terminal may send a certificate acquisition request to the server corresponding to the test address based on the test address, so as to request to acquire the SSL server certificate corresponding to the server.

[0081] In a specific implementation, during the HTTPS data transmission process, the server needs to send an SSL server certificate to the mobile terminal in order to meet the encryption requirements of the HTTPS data transmission process. Therefore, the mobile terminal can send an access request to the server corresponding to the test address based on the HTTPS (HyperText Transfer Protocol Secure) protocol as a certificate acquisition request.

[0082] In a specific implementation, the test address may correspond to one or more SSL server certificates. At this time, according to actual needs, some of the multiple SSL server certificates may be tested, and all SSL server certificates may be tested at the same time, and this application does not limit this.

[0083] Step 102, obtaining the SSL server certificate returned by the server corresponding to the test address;

[0084] In an embodiment of the present application, the server can respond to the certificate acquisition request of the mobile terminal and return the SSL server certificate to the mobile terminal, so that the mobile terminal can obtain the SSL server certificate provided by the server.

[0085] In a specific implementation, after obtaining an HTTPS-based access request, in order to meet the encryption requirements of the HTTPS data transmission process, the server can return the SSL server certificate to the mobile terminal, so that the mobile terminal can obtain the SSL server certificate.

[0086] Among them, the SSL server certificate (end-user certificates) can be the certificate used by the server to record the public key (public key) used to encrypt the transmitted data. It can ensure that the public key used to encrypt the transmitted data is not tampered with during the data transmission process based on the HTTPS protocol.

[0087] In order to improve the security of the website, the SSL server certificate used by the server of the website can usually be issued by a superior issuing agency. The SSL server certificate can record a signature value, which needs to be verified by the public key recorded in the superior certificate of the superior issuing agency. At the same time, the superior certificate of the superior issuing agency needs to be verified by the certificates of other superior issuing agencies with a higher level than the superior issuing agency. Thus, an SSL certificate chain corresponding to the SSL server certificate can be formed. The SSL certificate chain can include superior certificates of multiple levels. The superior certificate of the lowest level can be used to authenticate the SSL server certificate. The superior certificates of each level are authenticated by other superior certificates with a level higher than itself. The superior certificate of the highest level is pre-stored in the mobile terminal and is trusted by default. Only when the SSL server certificate and the superior certificates of each level in the SSL certificate chain are authenticated as trusted, can the SSL certificate verification be passed, so that the mobile terminal can normally access the server corresponding to the test address.

[0088] Step 103, based on network communication, detecting whether the SSL server certificate corresponds to a complete SSL certificate chain, and obtaining a detection result;

[0089] In an embodiment of the present application, in order to ensure that the SSL server certificate has not been tampered with, the mobile terminal needs to detect whether the SSL server certificate corresponds to a complete SSL certificate chain to determine whether the SSL server certificate is credible and obtain a detection result.

[0090] The process of the mobile terminal detecting whether the SSL server certificate corresponds to a complete SSL certificate chain can be as follows: based on the issuing agency information recorded in the SSL server certificate, determine the superior issuing agency that issued the SSL server certificate, and then request the superior issuing agency to obtain its superior certificate through network communication. After the superior certificate is used to verify the credibility of the SSL server certificate, determine the other superior issuing agencies at the upper level that issued the superior certificate of the current level, obtain their superior certificates through network communication, and verify the superior certificate of the current level through the superior certificate of the upper level, and so on, until the other superior issuing agencies at the upper level are the superior issuing agencies of the highest level that are trusted by default, and the superior certificate of the next level can be authenticated through the superior certificate of the superior issuing agency of the highest level. Because the superior certificates of each level can be obtained through network communication, the authenticity and credibility of the superior certificates in the SSL certificate chain can be ensured, and the detection results can be ensured to be true and reliable.

[0091] In the process of verifying whether the SSL server certificate corresponds to a complete SSL certificate chain, if the superior certificate cannot be obtained, or the SSL server certificate is untrustworthy, or the superior certificate is untrustworthy, it can be considered that the SSL server certificate does not have a complete SSL certificate chain and the SSL server certificate is unreliable. At this time, since it can be considered that the server cannot pass the SSL verification, the mobile terminal cannot establish a communication connection with the server in order to ensure communication security.

[0092] If the superior certificate of the SSL server certificate can be obtained, and the SSL server certificate and the superior certificate of the SSL server certificate are both credible, then it can be considered that the SSL server certificate has a complete SSL certificate chain and the SSL server certificate is reliable. At this point, it can be considered that the server can pass the SSL verification and the mobile terminal can safely establish a communication connection with the server.

[0093] Step 104, displaying the detection result on the detection interface.

[0094] In an embodiment of the present application, after obtaining the test result, the test result can be displayed in the test interface, so that the user can determine whether the SSL server certificate of the server corresponds to a complete SSL certificate chain according to the result of the test interface feedback. Whether the mobile terminal can normally establish a communication connection with the server.

[0095] Specifically, the test result may record the SSL certificate chain corresponding to the SSL server certificate, and may feed back the test results of the SSL server certificate and its superior certificate in the SSL certificate chain. Thus, the user can determine whether the SSL server certificate corresponds to a complete SSL certificate chain based on the test result. If there is no complete SSL certificate chain, the missing certificate in the SSL certificate chain may be further determined based on the test result. When the test result shows that the SSL certificate chain is incomplete, the missing certificate may be supplemented based on the test result, and the SSL certificate chain may be improved so that the mobile terminal can establish a connection with the server normally. For example, the missing superior certificate may be determined based on the test result, and then the superior issuing authority corresponding to the superior certificate may be requested to obtain the superior certificate to supplement the missing certificate and improve the SSL certificate chain.

[0096] In a specific implementation, the detection method of the present application can complete the detection of SSL certificates relatively quickly. Therefore, in practical applications, multiple test addresses can be detected at the same time to achieve efficient batch detection. Specifically, an SSL certificate detection can be performed on a test address each time. After the detection is completed, another detection address can be input for SSL certificate detection. Since the time required for each detection is short, the detection of multiple detection addresses can be completed within a short time, thereby achieving batch detection. It is also possible to input multiple detection addresses each time for SSL certificate detection, and return the detection results of multiple detection addresses at the same time, thereby achieving batch detection.

[0097] As an example of this application, Figure 2 This is a schematic diagram of a detection interface in an embodiment of the present application. The user can enter the test address to be detected in the test address input box 201 in the detection interface 200, and click the detection button 202. The mobile terminal can respond to the test address entered by the user in the detection interface, send a certificate acquisition request to the server corresponding to the test address, obtain the SSL server certificate returned by the server corresponding to the test address, detect whether the SSL server certificate corresponds to a complete SSL certificate chain, and after obtaining the detection result, display the detection result in the detection interface 200. Therefore, the user can easily obtain whether the server of the test address has a complete SSL certificate chain in the detection interface through the SSL certificate detection method provided by the present application, without the user having to perform complicated operations.

[0098] As another example of this application, Figure 3It is a schematic diagram of a detection method in an embodiment of the present application. When the user needs to detect the test address, the test address can be input into the detection interface, so that the mobile terminal 301 can obtain the test address and send a certificate acquisition request to the server 302 corresponding to the test address. The server can respond to the certificate acquisition request and return the SSL server certificate. Thereafter, the mobile terminal can detect whether the SSL certificate chain is complete. Specifically, the mobile terminal can request the server corresponding to the superior issuing agency to obtain the superior certificate according to the information of the superior issuing agency recorded in the SSL server certificate, and use the superior certificate to verify whether the SSL server certificate is credible. In the case where the SSL server certificate is credible, the superior issuing agency of the upper level corresponding to the superior certificate of the current level is determined, and the server 302 of the superior issuing agency of the upper level is requested to obtain the superior certificate of the upper level, and the superior certificate of the current level is verified by the superior certificate of the upper level, and so on, until the authentication of the superior certificate of each level is completed. Thereafter, the detection result can be displayed in the detection interface in the mobile terminal 301, so that the user can know whether the SSL certificate chain is complete.

[0099] Through the SSL certificate detection method of the embodiment of the present application, a certificate acquisition request is sent to the server corresponding to the test address; the SSL server certificate returned by the server corresponding to the test address is obtained; the SSL server certificate is detected whether it corresponds to a complete SSL certificate chain, and the detection result is obtained; the detection result is displayed on the detection interface. There is no need for the user to perform complicated operations, and the test address can be entered in the detection interface, that is, the detection of whether the SSL server certificate corresponds to a complete SSL certificate chain can be completed, and the detection result is returned to the user. It is convenient to supplement the missing SSL certificate chain according to actual needs in the future, so that the mobile terminal can communicate with the server normally. In the SSL certificate detection method, the SSL server certificate and its corresponding SSL certificate chain are obtained through network communication, ensuring the credibility of the SSL server certificate of the test address and its corresponding SSL certificate chain, and the detection result is true and reliable. At the same time, compared with the traditional detection method, the detection method does not need to obtain the super user authority of the mobile terminal, the detection process is simple, and it is convenient for the tester to quickly verify, and the verification time is fast, which is suitable for large-scale SSL certificate detection.

[0100] Reference Figure 4 , shows a flowchart of a method for detecting an SSL certificate according to an embodiment of the present application, which is applied to a mobile terminal. The method may specifically include the following steps:

[0101] Step 401, sending a certificate acquisition request to the server corresponding to the test address;

[0102] In an embodiment of the present application, the mobile terminal can provide a detection interface for the user. The detection interface can be used to detect whether the server corresponding to the network address has a complete SSL certificate chain. When the user needs to test a certain network address, the network address can be entered in the detection interface, so that the mobile terminal can obtain the network address that needs to be tested, that is, the test address.

[0103] Thereafter, the mobile terminal may send a certificate acquisition request to the server corresponding to the test address based on the test address, so as to request to acquire the SSL server certificate corresponding to the server.

[0104] The step of responding to the test address input by the user on the detection interface and sending a certificate acquisition request to the server corresponding to the test address includes:

[0105] S11, in response to a test address input by a user in a detection interface, disabling a preset SSL verification function of the mobile terminal;

[0106] In the embodiment of the present application, the mobile terminal may be preset with an SSL verification function. In the case where a communication connection needs to be established with a server based on the HTTPS protocol, the mobile terminal may use the SSL verification function to verify the SSL certificate of the server. However, the SSL verification function of the mobile terminal may only return whether the SSL certificate is normal, and in the case of an incomplete SSL certificate chain, the missing SSL certificate will not be supplemented, and a communication connection will not be established with the server.

[0107] In order to prevent the preset SSL verification function of the mobile terminal from affecting the SSL certificate detection method of the present application, after obtaining the test address entered by the user in the detection interface and determining that the user needs to detect the SSL certificate chain, it is necessary to first turn off the preset SSL verification function of the mobile terminal.

[0108] In one embodiment of the present application, the step of disabling the SSL verification function preset by the mobile terminal includes:

[0109] S21, set a custom host name verification object and SSL socket factory object;

[0110] In the embodiment of the present application, the two classes of hostname verification object (HostnameVerifier) ​​and SSL socket factory object (SSLSocketFactory) are the core of implementing HTTPS requests. By configuring these two classes, the process of SSL layer verification of domain name / IP and server certificate verification can be affected.

[0111] Specifically, the hostname verification object can be used to verify the hostname, and the SSL socket factory object is used to verify the hostname and SSL server certificate at the SSL level. In order to prevent the mobile terminal from performing SSL certificate verification when establishing a communication connection with the server based on the HTTPS protocol, a custom hostname verification object and SSL socket factory object can be set to customize the functions of the two.

[0112] S22, setting the customized host name verification object and the SSL socket factory object to ignore the SSL verification process to disable the SSL verification function preset in the mobile terminal.

[0113] In an embodiment of the present application, the custom host name verification object and the SSL socket factory object can be set to ignore the SSL verification process and not verify the SSL server certificate, thereby turning off the preset SSL verification function of the mobile terminal.

[0114] S12, establishing a communication connection between the servers corresponding to the test address;

[0115] In an embodiment of the present application, after turning off the SSL verification function preset by the mobile terminal, the mobile terminal can establish a communication connection with the server regardless of whether the SSL verification is normal. Thus, a communication connection between the server corresponding to the test address can be established to further verify the SSL certificate chain corresponding to the SSL server certificate. As an example of the present application, the mobile terminal can call a connection establishment object (openConnection) to establish a communication connection between the server corresponding to the test address.

[0116] S13, sending a certificate acquisition request to the server corresponding to the test address.

[0117] In an embodiment of the present application, after establishing a communication connection with a server corresponding to a test address, the mobile terminal may send a certificate acquisition request to the server corresponding to the test address to request the acquisition of an SSL server certificate corresponding to the server. As an example of the present application, the mobile terminal may call an SSL server certificate acquisition object (connection.getServerCertificates) to acquire an SSL server certificate corresponding to the server.

[0118] Step 402, obtaining the SSL server certificate returned by the server corresponding to the test address;

[0119] In an embodiment of the present application, the server can respond to the certificate acquisition request of the mobile terminal and return the SSL server certificate to the mobile terminal, so that the mobile terminal can obtain the SSL server certificate provided by the server.

[0120] Specifically, an SSL server certificate (end-user certificates) can be a certificate used by the server to record the public key used to encrypt the transmitted data. It can ensure that the public key used to encrypt the transmitted data is not tampered with during the data transmission process based on the HTTPS protocol.

[0121] In order to improve the security of the website, it can usually be issued by a superior issuing agency. The SSL server certificate can record a signature value, which needs to be verified by the public key recorded in the superior certificate of the superior issuing agency. At the same time, the superior certificate of the superior issuing agency needs to be verified by the certificates of other superior issuing agencies with a higher level than the superior issuing agency. In this way, an SSL certificate chain corresponding to the SSL server certificate can be formed. The SSL certificate chain can include superior certificates of multiple levels. The superior certificate of the lowest level can be used to authenticate the SSL server certificate. The superior certificates of each level are authenticated by other superior certificates of one level higher than itself. The superior certificate of the highest level is pre-stored in the mobile terminal and is trusted by default. Only when the SSL server certificate and the superior certificates of each level in the SSL certificate chain are authenticated as trusted, can the SSL certificate verification be passed, so that the mobile terminal can normally access the server corresponding to the test address.

[0122] Step 403, searching for a superior certificate corresponding to the superior issuing authority of the SSL server certificate based on network communication;

[0123] In an embodiment of the present application, in order to ensure that the SSL server certificate has not been tampered with, the mobile terminal needs to detect whether the SSL server certificate corresponds to a complete SSL certificate chain to determine whether the SSL server certificate is credible and obtain a detection result.

[0124] Therefore, it is necessary to find the superior certificate corresponding to the superior issuing authority of the SSL server certificate in the SSL certificate chain based on network communication, so as to find all the certificates in the SSL certificate chain and verify them.

[0125] Specifically, the SSL server certificate of the server can be issued to the server by a superior issuing agency to authenticate that the server is credible. However, the superior issuing agency that issues the SSL server certificate also needs to be credible, so that the SSL server certificate it issues can be considered a credible certificate.

[0126] Therefore, generally speaking, a superior issuing authority can be authenticated by an issuing authority at a higher level to determine whether it is trustworthy, and thus a superior issuing authority can have a superior certificate issued by an issuing authority at a higher level to authenticate that the superior issuing authority is trustworthy.

[0127] Therefore, there can be multiple levels in the SSL certificate chain, and the certificates at each level need to be trusted. In the absence of missing certificates, it can be assumed that the SSL server certificate corresponds to a complete SSL certificate chain.

[0128] In order to confirm whether the SSL server certificate corresponds to a complete SSL certificate chain, it is necessary to find the superior certificate corresponding to the superior issuing authority of the SSL server certificate. Specifically, the SSL server certificate may record its superior issuing authority, and a request may be sent to the server of the superior issuing authority to obtain the superior certificate of the superior issuing authority.

[0129] The step of searching for a superior certificate corresponding to a superior issuing authority of the SSL server certificate based on network communication includes:

[0130] S31, determining whether the superior issuing authority of the SSL server certificate is a root certificate issuing authority;

[0131] In the embodiment of the present application, the root certificate issuing authority may be the starting point of the trust chain in the public key infrastructure. The root certificate issuing authority may have a root certificate, which is a certificate issued by the root certificate issuing authority for itself. A trusted root certificate may usually be pre-installed in the mobile terminal.

[0132] Thus, it can be determined whether the superior issuing authority of the SSL server certificate is a root certificate issuing authority. If the superior issuing authority of the SSL server certificate is a root certificate issuing authority, the mobile terminal can directly use the preset root certificate to verify whether the SSL server certificate is credible, without having to separately search for the superior certificate corresponding to the superior issuing authority of the SSL server certificate.

[0133] S32: If the superior issuing authority of the SSL server certificate is not a root certificate issuing authority, search for a superior certificate corresponding to the superior issuing authority of the SSL server certificate based on network communication.

[0134] In an embodiment of the present application, if the superior issuing authority of the SSL server certificate is not a root certificate issuing authority, the mobile terminal does not have a pre-installed superior certificate corresponding to the superior issuing authority. At this time, it is still necessary to search for the superior certificate corresponding to the superior issuing authority of the SSL server certificate based on network communication.

[0135] The step of searching for a superior certificate corresponding to a superior issuing authority of the SSL server certificate based on network communication includes:

[0136] S41, obtaining an intermediate certificate corresponding to the issuing authority of the SSL server certificate based on network communication;

[0137] In the embodiment of the present application, if the superior issuing authority of the SSL server certificate is not the root certificate issuing authority, the issuing authority of the SSL server certificate can be considered as an intermediate issuing authority, and its corresponding certificate is an intermediate certificate. At this time, the superior certificate corresponding to the superior issuing authority of the SSL server certificate can be found based on network communication to obtain the intermediate certificate.

[0138] S42, determining whether the issuing authority of the intermediate certificate is a root certificate issuing authority;

[0139] In an embodiment of the present application, the intermediate certificate of the intermediate issuing agency may be issued by a root certificate issuing agency, or may be issued to the intermediate issuing agency by another intermediate issuing agency at a higher level than the intermediate issuing agency.

[0140] It can be determined whether the issuing authority of the intermediate certificate is a root certificate issuing authority. If the issuing authority of the intermediate certificate is a root certificate issuing authority, the mobile terminal can directly use the preset root certificate to verify whether the intermediate certificate is credible, thereby eliminating the need to further obtain the certificate corresponding to the higher-level issuing authority of the intermediate issuing authority.

[0141] S43: If the issuing authority of the intermediate certificate is not the root certificate issuing authority, obtain a certificate corresponding to the superior issuing authority of the intermediate certificate based on network communication.

[0142] If the issuing authority of the intermediate certificate is not the root certificate issuing authority, it is still necessary to further obtain the certificate corresponding to the higher-level superior issuing authority of the intermediate issuing authority based on network communication to verify whether the intermediate issuing authority is trustworthy.

[0143] Step 404, verifying whether the superior certificate is credible, and using the public key recorded in the superior certificate to verify whether the SSL server certificate is credible, to obtain a test result;

[0144] In an embodiment of the present application, in order to ensure that the SSL server certificate has not been tampered with, the mobile terminal needs to detect whether the SSL server certificate corresponds to a complete SSL certificate chain to determine whether the SSL server certificate is credible and obtain a detection result.

[0145] In order to detect whether the SSL server certificate corresponds to a complete SSL certificate chain, it is necessary to detect in turn whether the SSL server certificate in the SSL certificate chain and the superior certificate corresponding to the superior issuing authority that issued the SSL server certificate are credible. If the superior certificate of the SSL server certificate can be obtained, and the SSL server certificate and the superior certificate of the SSL server certificate are both credible, it can be considered that the SSL server certificate has a complete SSL certificate chain and the SSL server certificate is reliable.

[0146] Specifically, whether a certificate is credible can be determined based on the public key recorded in the superior certificate corresponding to the superior issuing authority of the certificate. In this way, it is possible to verify whether the superior certificate is credible. If the superior certificate is credible, the public key recorded in the superior certificate can be used to verify whether the SSL server certificate is credible, thereby obtaining the test result

[0147] Verify whether the superior certificate is credible, and use the public key recorded in the superior certificate to verify whether the SSL server certificate is credible, and obtain a test result of whether the SSL server certificate has a complete SSL certificate chain.

[0148] In one embodiment of the present application, the step of verifying whether the superior certificate is credible and using the public key recorded in the superior certificate to verify whether the SSL server certificate is credible to obtain the detection result includes:

[0149] S51, if the issuing authority corresponding to the superior certificate is a root certificate issuing authority, use the public key recorded in the preset root certificate list to verify whether the superior certificate is credible;

[0150] In the embodiment of the present application, the public key can be used to verify whether the certificate is issued by the issuing authority corresponding to the public key. A root certificate list can be used in the mobile terminal, which pre-stores the public key corresponding to the trusted root certificate. Thus, a root certificate list with the public key recorded can be obtained.

[0151] The superior issuing authority that issues the SSL server certificate is a root certificate issuing authority, or it can be an intermediate issuing authority certified by a root certificate issuing authority or other intermediate issuing authorities. If the issuing authority corresponding to the superior certificate is a root certificate issuing authority, then there is no need to find a public key to verify the superior certificate, but the public key recorded in the preset root certificate list can be directly used to verify whether the superior certificate is credible.

[0152] S52, if the issuing authority corresponding to the superior certificate is not a root certificate issuing authority, using the public key of the issuing authority corresponding to the superior certificate to verify whether the superior certificate is credible;

[0153] In an embodiment of the present application, if the issuing authority corresponding to the superior certificate is not the root certificate issuing authority, it is necessary to find the issuing authority corresponding to the superior certificate and further find the public key of the issuing authority to verify whether the superior certificate is credible.

[0154] S53, if the superior certificate is credible, use the public key recorded in the superior certificate to verify whether the SSL server certificate is credible, and obtain a detection result.

[0155] In an embodiment of the present application, if the superior certificate is credible, then it can be confirmed that the superior issuing authority corresponding to the SSL server certificate is a trusted issuing authority. At this time, the public key recorded in the superior certificate can be used to verify whether the SSL server certificate is credible to determine whether the SSL server certificate is a certificate issued by the superior issuing authority.

[0156] Thereafter, after completing the verification of the superior certificate and the SSL server certificate, it is possible to determine whether the SSL server certificate has a complete SSL certificate chain and obtain a test result.

[0157] Step 405: Display the detection result on the detection interface.

[0158] In an embodiment of the present application, after obtaining the test result, the test result can be displayed in the test interface, so that the user can determine whether the SSL server certificate of the server corresponds to a complete SSL certificate chain according to the result of the test interface feedback. Whether the mobile terminal can normally establish a communication connection with the server.

[0159] Specifically, the test result may record the SSL certificate chain corresponding to the SSL server certificate, and may feedback the test results of the SSL server certificate and its superior certificate in the SSL certificate chain. Thus, the user can determine whether the SSL server certificate corresponds to a complete SSL certificate chain based on the test result. If there is no complete SSL certificate chain, the missing certificates in the SSL certificate chain may be further determined based on the test result. In order to supplement the missing certificates based on the test result, the SSL certificate chain may be improved, so that the mobile terminal can establish a normal connection with the server.

[0160] In one embodiment of the present application, the method further includes:

[0161] S61, if it is detected that the SSL server certificate does not correspond to a complete SSL certificate chain, the certificate address information missing from the SSL certificate chain is searched in the extension node through the permission information, and displayed on the detection interface.

[0162] Specifically, the SSL server certificate may contain an authority information access extension node, which may record the certificate address information of all levels of the corresponding superior certificates in the SSL certificate chain. In the case that the SSL certificate chain is missing, the missing superior certificate can be determined, and the certificate address information of the superior certificate recorded in the authority information access extension node can be used to determine the missing superior certificate and display it in the detection interface so that the user can know the missing certificate in the current certificate chain.

[0163] Through the SSL certificate detection method of the embodiment of the present application, a certificate acquisition request is sent to the server corresponding to the test address; the SSL server certificate returned by the server corresponding to the test address is obtained; the superior certificate corresponding to the superior issuing authority of the SSL server certificate is searched; whether the superior certificate is credible is verified, and the public key recorded in the superior certificate is used to verify whether the SSL server certificate is credible, and the detection result is obtained; the detection result is displayed on the detection interface. There is no need for the user to perform complicated operations, and the test address can be entered in the detection interface, that is, the detection of whether the SSL server certificate corresponds to a complete SSL certificate chain can be completed, and the detection result is returned to the user. It is convenient to supplement the missing SSL certificate chain according to actual needs in the future, so that the mobile terminal can communicate with the server normally.

[0164] It should be noted that, for the method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the embodiments of the present application are not limited by the described order of actions, because according to the embodiments of the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present application.

[0165] Reference Figure 5 , shows a structural block diagram of an embodiment of a detection device for an SSL certificate according to an embodiment of the present application, which may specifically include the following modules:

[0166] A request issuing module 501 is used to issue a certificate acquisition request to the server corresponding to the test address;

[0167] The certificate acquisition module 502 is used to obtain the SSL server certificate returned by the server corresponding to the test address;

[0168] A verification module 503 is used to detect whether the SSL server certificate corresponds to a complete SSL certificate chain based on network communication, and obtain a detection result;

[0169] The display module 504 is used to display the detection result on the detection interface.

[0170] Optionally, the verification module includes:

[0171] The certificate search submodule is used to search for the superior certificate corresponding to the superior issuing authority of the SSL server certificate based on network communication;

[0172] The verification submodule is used to verify whether the superior certificate is credible, and use the public key recorded in the superior certificate to verify whether the SSL server certificate is credible to obtain a detection result.

[0173] Optionally, the certificate search submodule includes:

[0174] A first issuing authority determining unit, used to determine whether the superior issuing authority of the SSL server certificate is a root certificate issuing authority;

[0175] The first searching unit is used to search for a superior certificate corresponding to the superior issuing authority of the SSL server certificate based on network communication if the superior issuing authority of the SSL server certificate is not a root certificate issuing authority.

[0176] Optionally, the certificate search submodule includes:

[0177] An intermediate certificate obtaining unit, used for obtaining an intermediate certificate corresponding to the issuing authority of the SSL server certificate based on network communication;

[0178] A second issuing authority determining unit, used to determine whether the issuing authority of the intermediate certificate is a root certificate issuing authority;

[0179] The second searching unit is used for obtaining a certificate corresponding to a superior issuing authority of the intermediate certificate if the issuing authority of the intermediate certificate is not a root certificate issuing authority.

[0180] Optionally, the verification module includes:

[0181] The first upper-level certificate verification submodule is used to verify whether the upper-level certificate is credible by using the public key recorded in the preset root certificate list if the issuing authority corresponding to the upper-level certificate is a root certificate issuing authority;

[0182] A second superior certificate verification submodule, for verifying whether the superior certificate is credible by using the public key of the issuing authority corresponding to the superior certificate if the issuing authority corresponding to the superior certificate is not a root certificate issuing authority;

[0183] The server certificate verification submodule is used to verify whether the SSL server certificate is credible by using the public key recorded in the superior certificate if the superior certificate is credible, and obtain a detection result.

[0184] Optionally, the request issuing module includes:

[0185] A function closing submodule, used to close the SSL verification function preset in the mobile terminal;

[0186] A connection establishment submodule, used to establish a communication connection between the servers corresponding to the test address;

[0187] The request issuing submodule is used to issue a certificate acquisition request to the server corresponding to the test address.

[0188] Optionally, the function shutdown submodule includes:

[0189] Object setup unit, used to set up custom hostname verification objects and SSL socket factory objects;

[0190] The function closing unit is used to set the customized host name verification object and the SSL socket factory object to ignore the SSL verification process to close the SSL verification function preset in the mobile terminal.

[0191] Optionally, the device further comprises:

[0192] The address display module is used to access the extension node through permission information to find the missing certificate address information in the SSL certificate chain if it is detected that the SSL server certificate does not correspond to a complete SSL certificate chain, and display it on the detection interface.

[0193] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0194] The present application also provides an electronic device, including:

[0195] one or more processors; and

[0196] One or more machine-readable media having instructions stored thereon, when executed by the one or more processors, enable the electronic device to execute the method described in the embodiments of the present application.

[0197] The embodiments of the present application also provide one or more machine-readable media on which instructions are stored, which, when executed by one or more processors, enable the processors to execute the methods described in the embodiments of the present application.

[0198] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0199] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, devices, or computer program products. Therefore, the present application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0200] The embodiments of the present application are described with reference to the flowcharts and / or block diagrams of the methods, terminal devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0201] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0202] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable terminal device to implement the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0203] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present application.

[0204] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or terminal device including the elements.

[0205] The above is a detailed introduction to the SSL certificate detection method and device provided by the present application. This article uses specific examples to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea; at the same time, for general technical personnel in this field, according to the idea of ​​the present application, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A method for detecting an SSL certificate, characterized in that: The method is applied to a mobile terminal and comprises: Send a certificate acquisition request to the server corresponding to the test address; Obtain the SSL server certificate returned by the server corresponding to the test address; Detecting whether the SSL server certificate corresponds to a complete SSL certificate chain based on network communication to obtain a detection result; Displaying the test results on a test interface; The step of detecting whether the SSL server certificate corresponds to a complete SSL certificate chain based on network communication and obtaining the detection result includes: Searching for a superior certificate corresponding to a superior issuing authority of the SSL server certificate based on network communication; Verify whether the superior certificate is credible, and use the public key recorded in the superior certificate to verify whether the SSL server certificate is credible to obtain a test result; Wherein, the method further comprises: If it is detected that the SSL server certificate does not correspond to a complete SSL certificate chain, the extension node is accessed through permission information to search for the missing certificate address information in the SSL certificate chain and displayed on the detection interface to supplement the missing SSL server certificate according to the displayed detection results.

2. The method according to claim 1, characterized in that The step of searching for a superior certificate corresponding to a superior issuing authority of the SSL server certificate based on network communication includes: Determine whether the superior issuing authority of the SSL server certificate is a root certificate issuing authority; If the superior issuing authority of the SSL server certificate is not a root certificate issuing authority, the superior certificate corresponding to the superior issuing authority of the SSL server certificate is searched based on network communication.

3. The method according to claim 2, characterized in that The step of searching for a superior certificate corresponding to a superior issuing authority of the SSL server certificate based on network communication includes: Obtaining an intermediate certificate corresponding to the issuing authority of the SSL server certificate based on network communication; Determining whether the issuing authority of the intermediate certificate is a root certificate issuing authority; If the issuing authority of the intermediate certificate is not the root certificate issuing authority, obtain the certificate corresponding to the superior issuing authority of the intermediate certificate.

4. The method according to claim 1, characterized in that: The step of verifying whether the superior certificate is credible and using the public key recorded in the superior certificate to verify whether the SSL server certificate is credible to obtain a detection result includes: If the issuing authority corresponding to the superior certificate is a root certificate issuing authority, the public key recorded in the preset root certificate list is used to verify whether the superior certificate is credible; If the issuing authority corresponding to the superior certificate is not the root certificate issuing authority, use the public key of the issuing authority corresponding to the superior certificate to verify whether the superior certificate is credible; If the superior certificate is credible, the public key recorded in the superior certificate is used to verify whether the SSL server certificate is credible to obtain a detection result.

5. The method according to claim 1, characterized in that The step of sending a certificate acquisition request to the server corresponding to the test address includes: Turn off the SSL verification function preset in the mobile terminal; Establishing a communication connection between the servers corresponding to the test address; A certificate acquisition request is issued to the server corresponding to the test address.

6. The method according to claim 5, characterized in that The step of disabling the SSL verification function preset by the mobile terminal includes: Set up a custom hostname verification object and SSL socket factory object; The customized host name verification object and the SSL socket factory object are set to ignore the SSL verification process to disable the SSL verification function preset in the mobile terminal.

7. A detection device for an SSL certificate, characterized in that: The device is applied to a mobile terminal, and comprises: A request issuing module is used to issue a certificate acquisition request to the server corresponding to the test address; A certificate acquisition module, used to obtain the SSL server certificate returned by the server corresponding to the test address; A verification module is used to detect whether the SSL server certificate corresponds to a complete SSL certificate chain based on network communication to obtain a detection result; A display module, used to display the detection results on a detection interface; Wherein, the verification module includes: The certificate search submodule is used to search for the superior certificate corresponding to the superior issuing authority of the SSL server certificate based on network communication; The verification submodule is used to verify whether the superior certificate is credible, and use the public key recorded in the superior certificate to verify whether the SSL server certificate is credible to obtain a detection result; Wherein, the device further comprises: The address display module is used to access the extension node through authority information to find the missing certificate address information in the SSL certificate chain if it is detected that the SSL server certificate does not correspond to a complete SSL certificate chain, and display it on the detection interface to supplement the missing SSL server certificate according to the displayed detection results.

8. An electronic device, characterized in that: include: one or more processors; and One or more machine-readable media having instructions stored thereon, when executed by the one or more processors, cause the electronic device to perform any one of the methods of claims 1-6.

9. One or more machine-readable media having instructions stored thereon, which when executed by one or more processors cause the processors to perform the method of any one of claims 1-6.

Images