Cluster certificate management method, device and equipment and computer storage medium

Abstract

This application discloses a cluster certificate management method, apparatus, device, and computer storage medium. The method includes: a configuration center receiving a certificate update request from a client and updating the database; detecting the existence of a first certificate node corresponding to a first certificate; and adjusting the certificate node information based on the detection result. A server listens for changes in the certificate node information, determines the first certificate node based on the changes, obtains the corresponding first identifier, and then retrieves the first certificate from the database. In this embodiment, each certificate corresponds to one certificate node. When a certificate is updated, the configuration center adjusts the certificate node information. Since each server learns about changes in certificate node information by listening, parallel updates can be achieved, improving certificate update efficiency. Furthermore, when the cluster is horizontally scaled up or down, there is no need to modify the server node IP and other information on the configuration center side, thereby reducing the cost of horizontal scaling up or down the cluster.

Description

Technical Field

[0001] This application belongs to the field of big data edge computing technology, and in particular relates to a cluster certificate management method, device, equipment and computer storage medium. Background Technology

[0002] Nginx is a lightweight, high-performance web server / reverse proxy server and email (IMAP / POP3) proxy server. It is characterized by low memory consumption, high concurrency, and high reliability. Many IT software applications choose Nginx as the entry point for business access and also as a load balancer. When configuring HTTPS with Nginx, you need to specify the SSL certificate directory information, and the SSL certificate needs to be renewed after it expires.

[0003] For SSL certificate updates, manual replacement of certificates on each server can be done, but this is inconvenient and prone to errors. One existing solution involves transmitting configuration files to each node in the Nginx cluster via SSH or RPC protocols, and then remotely triggering Nginx to reload the configuration. However, the inventors discovered during the implementation of this solution that this serial transmission of configuration files to each node results in excessively long transmission times and low efficiency when the cluster is large. Furthermore, it requires pre-configuring the IP addresses of each Nginx node in the configuration management center, and any changes to Nginx cluster nodes necessitate revisiting the configuration management center to update the Nginx node information, making maintenance inconvenient and hindering horizontal scaling of the cluster. Summary of the Invention

[0004] This application provides a cluster certificate management method, apparatus, device, and computer storage medium to solve the problems of low efficiency and difficulty in expanding cluster certificate updates.

[0005] In a first aspect, embodiments of this application provide a cluster certificate management method, including:

[0006] The configuration center receives a certificate update request from the client and updates the database according to the certificate update request. The certificate update request includes the first certificate to be updated and the first identifier corresponding to the first certificate.

[0007] The configuration center checks whether the first certificate node corresponding to the first certificate exists, and adjusts the certificate node information according to the detection result.

[0008] The server monitors changes in certificate node information, determines the first certificate node based on the changes, and obtains the first identifier based on the first certificate node.

[0009] The server retrieves the first certificate from the database based on the first identifier, and then reloads the first certificate.

[0010] Secondly, embodiments of this application provide a cluster certificate management method applied to a configuration center, the method comprising:

[0011] Receive a certificate update request from the client, wherein the certificate update request includes the first certificate to be updated and the first identifier corresponding to the first certificate;

[0012] Update the database according to the certificate renewal request;

[0013] The system checks whether the first certificate node corresponding to the first certificate exists, and adjusts the certificate node information according to the detection result, so that the server listening to the certificate node information can determine the first certificate node based on the change in the certificate node information and then obtain the first certificate from the database.

[0014] Thirdly, embodiments of this application provide a cluster certificate management method applied to a server, the method comprising:

[0015] Monitor changes in certificate node information;

[0016] The first certificate node was determined based on the changes;

[0017] Based on the first certificate node, obtain the first identifier corresponding to the first certificate node;

[0018] Based on the first identifier, retrieve the first certificate corresponding to the first identifier from the database;

[0019] Reload the first certificate.

[0020] Fourthly, embodiments of this application provide a cluster certificate management device applied in a configuration center, the device comprising:

[0021] The certificate update request receiving module is used to receive certificate update requests sent by the client. The certificate update request includes the first certificate to be updated and the first identifier corresponding to the first certificate.

[0022] The database update module is used to update the database based on certificate update requests;

[0023] The certificate node information adjustment module is used to detect whether the first certificate node corresponding to the first certificate exists, and adjust the certificate node information according to the detection result, so that the server listening to the certificate node information can determine the first certificate node based on the change in the certificate node information and then obtain the first certificate from the database.

[0024] Fifthly, embodiments of this application provide a cluster certificate management device applied to a server, the device comprising:

[0025] The monitoring module is used to monitor changes in certificate node information;

[0026] The certificate node determination module is used to determine the first certificate node based on changes.

[0027] The identifier acquisition module is used to obtain the first identifier corresponding to the first certificate node based on the first certificate node;

[0028] The certificate acquisition module is used to retrieve the first certificate corresponding to the first identifier from the database based on the first identifier, and to reload the first certificate.

[0029] In a sixth aspect, embodiments of this application provide an apparatus, the apparatus comprising: a processor and a memory storing computer program instructions;

[0030] When the processor executes computer program instructions, it implements either the cluster certificate management method of the second aspect or the cluster certificate management method of the third aspect.

[0031] In a seventh aspect, embodiments of this application provide a computer storage medium storing computer program instructions, which, when executed by a processor, implement the cluster certificate management method as described in the second aspect, or implement the cluster certificate management method as described in the third aspect.

[0032] Eighthly, embodiments of this application provide a computer program product in which instructions, when executed by a processor of an electronic device, cause the electronic device to perform a cluster certificate management method as described in the second aspect, or to implement a cluster certificate management method as described in the third aspect.

[0033] This application provides a cluster certificate management method, apparatus, device, and computer storage medium. The method may include: a configuration center receiving a certificate update request from a client and updating a database according to the certificate update request, wherein the certificate update request includes a first certificate to be updated and a first identifier corresponding to the first certificate; the configuration center detecting whether the first certificate node corresponding to the first certificate exists and adjusting the certificate node information according to the detection result; a server monitoring changes in the certificate node information, determining the first certificate node based on the changes, and obtaining the first identifier based on the first certificate node; the server retrieving the first certificate from the database based on the first identifier, and reloading the first certificate. In this embodiment, each certificate corresponds to a certificate node. When a certificate is updated, the configuration center adjusts the certificate node information (specifically, the Zookeeper node tree). Each server in the cluster (specifically, the certificate management service on the server) listens for changes in the certificate node information, identifies the changed certificate node based on the changes, and then obtains the certificate corresponding to the certificate node from the database to complete the certificate update. Since each server learns about changes in the certificate node information by listening, parallel updates can be achieved, improving certificate update efficiency. Furthermore, when the cluster is horizontally scaled up or down, there is no need to modify the server node IP and other information on the configuration center side, thereby reducing the cost of horizontal scaling up or down of the cluster. Attached Figure Description

[0034] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0035] Figure 1 This is a flowchart illustrating a cluster certificate management method provided in an embodiment of this application;

[0036] Figure 2 This is a flowchart illustrating the cluster certificate management method applied to a configuration center provided in an embodiment of this application;

[0037] Figure 3 This is a flowchart illustrating a cluster certificate management method for servers provided in an embodiment of this application;

[0038] Figure 4 This is a system block diagram of a cluster certificate management system in a specific application example;

[0039] Figure 5 This is a signaling interaction diagram of a cluster certificate management method in a specific application example;

[0040] Figure 6This is a schematic diagram of the structure of a cluster certificate management device applied to a configuration center, as provided in an embodiment of this application.

[0041] Figure 7 This is a schematic diagram of the structure of a cluster certificate management device for servers provided in an embodiment of this application;

[0042] Figure 8 A schematic diagram of the hardware structure of the hardware device involved in the embodiments of this application is shown. Detailed Implementation

[0043] The features and exemplary embodiments of various aspects of this application will be described in detail below. To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only intended to explain this application and not to limit it. For those skilled in the art, this application can be implemented without some of these specific details. The following description of the embodiments is merely to provide a better understanding of this application by illustrating examples.

[0044] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising..." does not exclude the presence of additional identical elements in the process, method, article, or apparatus that includes the element.

[0045] To address the problems in the prior art, this application provides a cluster certificate management method that can be applied to a cluster certificate management system. The cluster certificate management system may include, for example, a configuration center, a database for storing certificates, and a cluster consisting of one or more servers.

[0046] Figure 1 This is a flowchart illustrating a cluster certificate management method provided in an embodiment of this application. See also... Figure 1 As shown, the method may include:

[0047] In step S101, the configuration center receives a certificate update request from the client and updates the database according to the certificate update request. The certificate update request includes the first certificate to be updated and the first identifier corresponding to the first certificate.

[0048] As an example, the configuration center can be a server or an application. When the configuration center is an application, it can be a single-machine deployment or a multi-node cluster deployment.

[0049] In some application scenarios, a server can be an Nginx server, that is, a server running the Nginx program, or an Nginx node. A certificate management service application can be bound one-to-one with the Nginx program. When an Nginx node is added, a certificate management service program will also be deployed on the server where the Nginx resides; when an Nginx node is removed, the corresponding certificate management service program will also be removed.

[0050] This embodiment does not limit the specific type of server. Those skilled in the art can choose and design according to different needs and scenarios. None of these choices and designs used here depart from the spirit and scope of protection of this application.

[0051] As an example, the client can be a browser or other applications. This embodiment does not limit this. Those skilled in the art can choose and design according to different needs and scenarios. None of these choices and designs used herein depart from the spirit and scope of protection of this application.

[0052] In this embodiment or other embodiments of this application, the certificate may specifically be a domain name SSL certificate, and correspondingly, the identifier may be a domain name. When a client initiates a certificate update, the message it carries may include the specific domain name and the corresponding certificate for that domain name.

[0053] As an example, when the configuration center receives a certificate update request, it can first check the validity of the certificate before storing it in the database.

[0054] It should be noted that in this embodiment, a dedicated database is used to store the certificates. This is because some distributed coordination service programs (such as those with management, coordination, load balancing, and / or listening functions, like Zookeeper) store data in the program or nodes. However, each node itself is not suitable for storing more than 1MB of data. In complex business scenarios, Nginx configurations are numerous, and there are also SSL certificates. Therefore, it is not suitable to store this data (configuration files, certificates, etc.) directly in the Zookeeper node.

[0055] In step S102, the configuration center checks whether the first certificate node corresponding to the first certificate exists, and adjusts the certificate node information according to the detection result.

[0056] As an example, certificate node information can be managed using a Zookeeper node tree.

[0057] Accordingly, the certificate node information can be adjusted based on the test results, which may include:

[0058] If the first certificate node already exists in the node tree, modify the first certificate node; if the first certificate node does not exist in the node tree, create the first certificate node.

[0059] For example, if the first certificate node already exists in the node tree, then the first certificate node can be deleted or updated.

[0060] Taking the ZooKeeper node tree as an example, each node in the ZooKeeper node tree corresponds to a certificate. When the configuration center receives a certificate update request from the client, it can first check the validity of the certificate, then store it in the database, and then update the ZooKeeper node. When updating a ZooKeeper node, one domain name corresponds to one node, such as the domain name dahai.com corresponding to the node / cert / dahai.com. First, it checks if the node exists; if it exists, it is deleted; otherwise, it is created.

[0061] In step S103, the server listens for changes in certificate node information, determines the first certificate node based on the changes, and obtains the first identifier based on the first certificate node.

[0062] All servers (specifically, the certificate management service on the server) will receive notifications from Zookeeper that the nodes under / cert have changed. The certificate management service will then read all the nodes under / cert again and compare them with the nodes read last time to find the added or removed nodes, and then extract the corresponding domain name from the changed node names.

[0063] In step S104, the server retrieves the first certificate from the database based on the first identifier, and reloads the first certificate.

[0064] In this embodiment or some other embodiments of this application, reloading the specified certificate may specifically include:

[0065] The server updates the certificate directory corresponding to the first certificate, replaces the old certificate with the first certificate, and executes a reload command to reload the first certificate.

[0066] As an example, considering some application scenarios, after the server's certificate management service receives a certificate update notification message, it can read the certificate from the database based on the domain name, and then update Nginx. For example, it can update the certificate directory corresponding to Nginx, replace the old certificate for the domain name with the new certificate, and then execute the Nginx command "nginx -s reload" to make Nginx reload the certificate.

[0067] In this embodiment, each certificate corresponds to a certificate node. When a certificate is updated, the configuration center adjusts the certificate node information (specifically, the Zookeeper node tree). Each server in the cluster (specifically, the certificate management service on the server) listens for changes in the certificate node information, identifies the changed certificate node based on the changes, and then obtains the certificate corresponding to that certificate node from the database to complete the certificate update. Since each server learns about changes in certificate node information by listening, parallel updates can be achieved, improving certificate update efficiency. Furthermore, when the cluster is horizontally scaled up or down, there is no need to modify the server node IP and other information on the configuration center side, thereby reducing the cost of horizontal scaling up or down of the cluster.

[0068] Figure 2 This is a flowchart illustrating a cluster certificate management method applied to a configuration center, as provided in an embodiment of this application. The cluster certificate management system involved may specifically include a configuration center, a database for storing certificates, and a cluster consisting of one or more servers.

[0069] See Figure 2 As shown, the method may include:

[0070] In step S201, a certificate update request is received from the client, wherein the certificate update request includes the first certificate to be updated and the first identifier corresponding to the first certificate.

[0071] In step S202, the database is updated according to the certificate update request.

[0072] In step S203, the existence of the first certificate node corresponding to the first certificate is detected, and the certificate node information is adjusted according to the detection result. This enables the server monitoring the certificate node information to determine the first certificate node based on the changes in the certificate node information, and then retrieve the corresponding first certificate from the database.

[0073] For example, the identifier can be a domain name, and the certificate can be a domain name SSL certificate.

[0074] As an example, certificate node information can be managed using a Zookeeper node tree structure.

[0075] Accordingly, the certificate node information can be adjusted based on the test results, which may include:

[0076] If the first certificate node already exists in the node tree, modify the first certificate node; if the first certificate node does not exist in the node tree, create the first certificate node.

[0077] In this embodiment, each certificate corresponds to a certificate node. When a certificate is updated, the configuration center adjusts the certificate node information (specifically, the Zookeeper node tree). Each server in the cluster (specifically, the certificate management service on the server) listens for changes in the certificate node information, identifies the changed certificate node based on the changes, and then obtains the certificate corresponding to that certificate node from the database to complete the certificate update. Since each server learns about changes in certificate node information by listening, parallel updates can be achieved, improving certificate update efficiency. Furthermore, when the cluster is horizontally scaled up or down, there is no need to modify the server node IP and other information on the configuration center side, thereby reducing the cost of horizontal scaling up or down of the cluster.

[0078] Figure 3 This is a flowchart illustrating a cluster certificate management method for servers provided in this application embodiment. The cluster certificate management system specifically may include a configuration center, a database for storing certificates, and a cluster consisting of one or more servers.

[0079] See Figure 3 As shown, the method may include:

[0080] In step S301, changes in certificate node information are monitored.

[0081] As an example, certificate node information can be managed using a ZooKeeper node tree. Each node in the ZooKeeper node tree corresponds to a certificate. When the configuration center receives a certificate update request from a client, it can first check the validity of the certificate, then store it in the database, and finally update the ZooKeeper node.

[0082] In step S302, the first certificate node is determined based on the changes.

[0083] In step S303, the first identifier corresponding to the first certificate node is obtained based on the first certificate node.

[0084] For example, the identifier can be a domain name, and the certificate can be a domain name SSL certificate.

[0085] As an example, all servers (specifically, the certificate management service on the server) will receive a notification from Zookeeper that the nodes under / cert have changed. The certificate management service will read all the nodes under / cert again and compare them with the nodes read last time to find the added or removed nodes, and then extract the corresponding domain name from the changed node name.

[0086] In step S304, the first certificate corresponding to the first identifier is retrieved from the database according to the first identifier.

[0087] In step S305, the first certificate is reloaded.

[0088] As an example, reloading the first certificate can specifically include:

[0089] Update the certificate directory corresponding to the first certificate, replace the old certificate with the first certificate, and execute the reload command to reload the first certificate.

[0090] In this embodiment, each certificate corresponds to a certificate node. When a certificate is updated, the configuration center adjusts the certificate node information (specifically, the Zookeeper node tree). Each server in the cluster (specifically, the certificate management service on the server) listens for changes in the certificate node information, identifies the changed certificate node based on the changes, and then obtains the certificate corresponding to that certificate node from the database to complete the certificate update. Since each server learns about changes in certificate node information by listening, parallel updates can be achieved, improving certificate update efficiency. Furthermore, when the cluster is horizontally scaled up or down, there is no need to modify the server node IP and other information on the configuration center side, thereby reducing the cost of horizontal scaling up or down of the cluster.

[0091] The following section will use Nginx as an example and further describe the solution in this application scenario. Of course, the following application scenarios are merely illustrative and can be applied to other scenarios in practice.

[0092] Figure 4 This is a system block diagram of a cluster certificate management system in a specific application example.

[0093] In this embodiment, the system mainly consists of five parts: a database, Zookeeper, a configuration center, a certificate management service, and an Nginx server cluster. The main functions of this system are: certificate validity period query and certificate renewal.

[0094] The above functions are mainly accomplished through interfaces provided by the configuration center, and load balancing is achieved through Nginx configuration. Figure 4Clustering is achieved through VIPs. The Nginx configuration includes not only the certificate-related interfaces mentioned above, but also configurations for other business interfaces. In this system, the configuration center can be a standalone application or a multi-node cluster deployment. The Nginx server has the Nginx application installed, along with a certificate management service that is bound one-to-one with the Nginx application; for each Nginx service deployed, a certificate management service is deployed on the same machine.

[0095] After receiving a certificate validity period query request, the certificate management service will first read the certificate for the corresponding domain from the database and then return the validity period of the certificate.

[0096] The following section focuses on the certificate renewal process:

[0097] Figure 5 This is a signaling interaction diagram of a cluster certificate management method in a specific application example.

[0098] After the certificate management service starts, it first reads and caches all nodes under the specified node (such as the / cert node) on Zookeeper, and then listens for changes in the nodes.

[0099] See Figure 5 As shown, it may include the following steps:

[0100] 1) The client initiates a request to update the certificate.

[0101] For example, the message carried may include a specific domain name (such as dahai.com) and the corresponding certificate for the domain name.

[0102] 2) The configuration center updates the certificate to the database.

[0103] After receiving a certificate update request, the configuration center can first check the validity of the certificate before storing it in the database.

[0104] 3) The database returns the results to the configuration center.

[0105] 4) Configure the center to operate Zookeeper and asynchronously notify to start certificate renewal.

[0106] When updating ZooKeeper nodes, one domain name corresponds to one node, such as the domain name dahai.com corresponding to the node / cert / dahai.com. First, check if the node exists; if it exists, delete it; otherwise, create it.

[0107] 5) Zookeeper returns the result to the configuration center.

[0108] 6) Zookeeper asynchronously notifies the certificate management service of changes to the domain node.

[0109] All certificate management services will receive notifications from Zookeeper that nodes under / cert have changed. The certificate management service will then read all nodes under / cert again and compare them with the nodes read last time to find the added or removed nodes and extract the corresponding domain names from the changed node names.

[0110] 7) The certificate management service reads the corresponding certificate from the database based on the domain name.

[0111] 8) The database returns the certificate to the certificate management service.

[0112] 9) The certificate management service updates the Nginx certificate configuration and reloads it.

[0113] Replace the original certificate in the specified directory of Nginx, and notify Nginx to hot-reload the configuration and certificate by executing the command "nginx-sreload". This completes the Nginx certificate update.

[0114] When an Nginx cluster undergoes changes (such as horizontal scaling up or down) and requires certificate updates, each Nginx service relies on a certificate management service. This service updates certificates for specified domains by monitoring ZooKeeper node changes. Therefore, after scaling up or down an Nginx cluster, no additional work is required to complete the certificate update request again.

[0115] In this embodiment, each certificate corresponds to a certificate node. When a certificate is updated, the configuration center adjusts the certificate node information (specifically, the Zookeeper node tree). Each server in the cluster (specifically, the certificate management service on the server) listens for changes in the certificate node information, identifies the changed certificate node based on the changes, and then obtains the certificate corresponding to that certificate node from the database to complete the certificate update. Since each server learns about changes in certificate node information by listening, parallel updates can be achieved, improving certificate update efficiency. Furthermore, when the cluster is horizontally scaled up or down, there is no need to modify the server node IP and other information on the configuration center side, thereby reducing the cost of horizontal scaling up or down of the cluster.

[0116] Figure 6 This is a schematic diagram of the structure of a cluster certificate management device applied to a configuration center, as provided in an embodiment of this application. The cluster certificate management system may include a configuration center, a database for storing certificates, and a cluster consisting of one or more servers;

[0117] See Figure 6 As shown, the device may include:

[0118] The certificate update request receiving module 601 is used to receive a certificate update request sent by the client, wherein the certificate update request includes a first certificate to be updated and a first identifier corresponding to the first certificate;

[0119] Database update module 602 is used to update the database according to certificate update requests;

[0120] The certificate node information adjustment module 603 is used to detect whether the first certificate node corresponding to the first certificate exists, and adjust the certificate node information according to the detection result, so that the server listening to the certificate node information can determine the first certificate node based on the change in the certificate node information and then obtain the first certificate from the database.

[0121] It should be noted that this cluster certificate management device is the same as the cluster certificate management method applied to the configuration center described above. All implementation methods in the above method embodiments are applicable to the embodiments of this device and can achieve the same technical effect.

[0122] Figure 7 This is a schematic diagram of a cluster certificate management device for servers provided in an embodiment of this application. The cluster certificate management system may include a configuration center, a database for storing certificates, and a cluster consisting of one or more servers;

[0123] See Figure 7 As shown, the device may include:

[0124] The monitoring module 701 is used to monitor changes in certificate node information.

[0125] Certificate node determination module 702 is used to determine the first certificate node based on changes;

[0126] The identifier acquisition module 703 is used to acquire the first identifier corresponding to the first certificate node based on the first certificate node;

[0127] The certificate acquisition module 704 is used to retrieve the first certificate corresponding to the first identifier from the database based on the first identifier, and to reload the first certificate.

[0128] It should be noted that this cluster certificate management device is the same as the cluster certificate management method applied to the server described above. All implementation methods in the above method embodiments are applicable to the embodiments of this device and can achieve the same technical effect.

[0129] Figure 8 A schematic diagram of the hardware structure of the hardware device involved in the embodiments of this application is shown.

[0130] The device may include a processor 1001 and a memory 1002 storing computer program instructions.

[0131] Specifically, the processor 1001 may include a central processing unit (CPU), an application-specific integrated circuit (ASIC), or one or more integrated circuits that can be configured to implement the embodiments of this application.

[0132] Memory 1002 may include mass storage for data or instructions. For example, and not limitingly, memory 1002 may include a hard disk drive (HDD), floppy disk drive, flash memory, optical disk, magneto-optical disk, magnetic tape, or Universal Serial Bus (USB) drive, or a combination of two or more of these. Where appropriate, memory 1002 may include removable or non-removable (or fixed) media. Where appropriate, memory 1002 may be internal or external to the integrated gateway disaster recovery device. In a particular embodiment, memory 1002 is non-volatile solid-state memory.

[0133] In a particular embodiment, memory 1002 may include read-only memory (ROM), random access memory (RAM), disk storage media device, optical storage media device, flash memory device, electrical, optical, or other physical / tangible memory storage device. Thus, generally, memory includes one or more tangible (non-transitory) computer-readable storage media (e.g., memory devices) encoded with software including computer-executable instructions, and when the software is executed (e.g., by one or more processors), it is operable to perform the operations described with reference to the methods according to one aspect of this disclosure.

[0134] The processor 1001 reads and executes computer program instructions stored in the memory 1002 to implement any of the cluster certificate management methods in the above embodiments.

[0135] In one example, the device may also include a communication interface 1003 and a bus 1010. Wherein, for example... Figure 8 As shown, the processor 1001, memory 1002, and communication interface 1003 are connected through bus 1010 and complete communication with each other.

[0136] The communication interface 1003 is mainly used to realize communication between various modules, devices, units and / or equipment in the embodiments of this application.

[0137] Bus 1010 includes hardware, software, or both, that couples components of an online data traffic metering device together. For example, and not limitingly, the bus may include an Accelerated Graphics Port (AGP) or other graphics bus, an Enhanced Industry Standard Architecture (EISA) bus, a Front Side Bus (FSB), HyperTransport (HT) interconnect, an Industry Standard Architecture (ISA) bus, an Infinite Bandwidth Interconnect, a Low Pin Count (LPC) bus, a memory bus, a Microchannel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express (PCI-X) bus, a Serial Advanced Technology Attachment (SATA) bus, a Video Electronics Standards Association Local (VLB) bus, or other suitable buses, or combinations of two or more of these. Where appropriate, bus 1010 may include one or more buses. Although specific buses are described and illustrated in embodiments of this application, any suitable bus or interconnect is contemplated herein.

[0138] Furthermore, in conjunction with the cluster certificate management methods in the above embodiments, this application embodiment can provide a computer storage medium for implementation. This computer storage medium stores computer program instructions; when these computer program instructions are executed by a processor, they implement any of the cluster certificate management methods in the above embodiments.

[0139] It should be clarified that this application is not limited to the specific configurations and processes described above and shown in the figures. For the sake of brevity, detailed descriptions of known methods are omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of this application is not limited to the specific steps described and shown. Those skilled in the art can make various changes, modifications, and additions, or change the order of steps, after understanding the spirit of this application.

[0140] The functional blocks shown in the above block diagram can be implemented as hardware, software, firmware, or a combination thereof. When implemented in hardware, they can be, for example, electronic circuits, application-specific integrated circuits (ASICs), appropriate firmware, plug-ins, function cards, etc. When implemented in software, the elements of this application are programs or code segments used to perform the required tasks. Programs or code segments can be stored on a machine-readable medium or transmitted over a transmission medium or communication link via data signals carried on a carrier wave. "Machine-readable medium" can include any medium capable of storing or transmitting information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, ROM, flash memory, erasable ROM (EROM), floppy disks, CD-ROMs, optical disks, hard disks, fiber optic media, radio frequency (RF) links, etc. Code segments can be downloaded via computer networks such as the Internet, intranets, etc.

[0141] It should also be noted that the exemplary embodiments mentioned in this application describe methods or systems based on a series of steps or apparatus. However, this application is not limited to the order of the above steps; that is, the steps can be performed in the order mentioned in the embodiments, or in a different order, or several steps can be performed simultaneously.

[0142] The aspects of this disclosure have been described above with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this disclosure. It should be understood that each block in the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine such that these instructions, executable via the processor of the computer or other programmable data processing apparatus, enable the implementation of the functions / actions specified in one or more blocks of the flowchart illustrations and / or block diagrams. Such a processor can be, but is not limited to, a general-purpose processor, a special-purpose processor, a special application processor, or a field-programmable logic circuit. It is also understood that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can also be implemented by special-purpose hardware performing the specified functions or actions, or can be implemented by a combination of special-purpose hardware and computer instructions.

[0143] The above are merely specific embodiments of this application. Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, modules, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here. It should be understood that the protection scope of this application is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in this application, and these modifications or substitutions should all be covered within the protection scope of this application.

Claims

1. A cluster certificate management method, characterized in that, The method includes: The configuration center receives a certificate update request from the client and updates the database according to the certificate update request. The certificate update request includes a first certificate to be updated and a first identifier corresponding to the first certificate. The configuration center checks whether the first certificate node corresponding to the first certificate exists, and adjusts the certificate node information according to the detection result. The certificate node information is managed in Zookeeper node tree mode. The server monitors changes in the certificate node information, determines the first certificate node based on the changes, and obtains the first identifier based on the first certificate node. The server retrieves the first certificate from the database based on the first identifier, and then reloads the first certificate.

2. The method according to claim 1, characterized in that: The identifier is a domain name, and the certificate is a domain name SSL certificate.

3. The method according to claim 1, characterized in that, Adjust the certificate node information based on the test results, including: If the first certificate node already exists in the node tree, modify the first certificate node; if the first certificate node does not exist in the node tree, create the first certificate node.

4. The method according to claim 1, characterized in that, Reloading the first certificate includes: The server updates the certificate directory corresponding to the first certificate, replaces the old certificate with the first certificate, and executes a reload instruction to reload the first certificate.

5. A cluster certificate management method, characterized in that, Applied to a configuration center, the method includes: Receive a certificate update request from the client, wherein the certificate update request includes a first certificate to be updated and a first identifier corresponding to the first certificate; Update the database according to the certificate update request; The system detects whether a first certificate node corresponding to the first certificate exists, and adjusts the certificate node information according to the detection result, so that the server listening to the certificate node information can determine the first certificate node based on the changes in the certificate node information and then obtain the first certificate from the database. The certificate node information is managed in the form of a Zookeeper node tree.

6. The method according to claim 5, characterized in that: The identifier is a domain name, and the certificate is a domain name SSL certificate.

7. The method according to claim 5, characterized in that, Adjust the certificate node information based on the test results, including: If the first certificate node already exists in the node tree, modify the first certificate node; if the first certificate node does not exist in the node tree, create the first certificate node.

8. A cluster certificate management method, characterized in that, Applied to a server, the method includes: Monitor changes in certificate node information, which is managed using a Zookeeper node tree. The first certificate node is determined based on the changes; Based on the first certificate node, obtain the first identifier corresponding to the first certificate node; Based on the first identifier, retrieve the first certificate corresponding to the first identifier from the database; Reload the first certificate.

9. The method according to claim 8, characterized in that: The identifier is a domain name, and the certificate is a domain name SSL certificate.

10. The method according to claim 8, characterized in that, Reloading the first certificate includes: Update the certificate directory corresponding to the first certificate, replace the old certificate with the first certificate, and execute a reload instruction to reload the first certificate.

11. A cluster certificate management device, characterized in that, Applied to a configuration center, the device includes: The certificate update request receiving module is used to receive a certificate update request sent by the client, wherein the certificate update request includes a first certificate to be updated and a first identifier corresponding to the first certificate; The database update module is used to update the database according to the certificate update request; The certificate node information adjustment module is used to detect whether the first certificate node corresponding to the first certificate exists, and adjust the certificate node information according to the detection result, so that the server listening to the certificate node information can determine the first certificate node based on the change of the certificate node information and then obtain the first certificate from the database. The certificate node information is managed in the form of a Zookeeper node tree.

12. A cluster certificate management device, characterized in that, Applied to a server, the device includes: The monitoring module is used to monitor changes in certificate node information, which is managed in a Zookeeper node tree manner. The certificate node determination module is used to determine the first certificate node based on the changes; The identifier acquisition module is used to acquire a first identifier corresponding to the first certificate node based on the first certificate node; The certificate acquisition module is used to retrieve the first certificate corresponding to the first identifier from the database based on the first identifier, and to reload the first certificate.

13. An electronic device, characterized in that, The electronic device includes: a processor and a memory storing computer program instructions; When the processor executes the computer program instructions, it implements the cluster certificate management method as described in any one of claims 5 to 7, or the cluster certificate management method as described in any one of claims 8 to 10.

14. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer program instructions, which, when executed by a processor, implement the cluster certificate management method as described in any one of claims 5 to 7, or the cluster certificate management method as described in any one of claims 8 to 10.

Images