Certificate management method and device

Abstract

The invention discloses a certificate management method and device, and the method comprises the steps: receiving a certificate obtaining request from a certificate demander, and enabling the certificate obtaining request to carry certificate application information; generating a certificate holder unique identifier DN based on the certificate application information, and feeding back the DN to the certificate demander; a certificate making request submitted by the certificate demander is received, and the certificate making request carries a secret key file generated by the certificate demander based on the DN; submitting the certificate application information, the DN and the secret key file to a certificate management platform, so that the certificate management platform performs certificate production to obtain a target certificate; and providing a certificate downloading entrance for the certificate demander, so that the certificate demander downloads the target certificate. According to the method and the device, the automation degree of the certificate application process can be improved, the time consumption in the certificate issuing process can be reduced, and the certificate issuing efficiency is improved.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a certificate management method and device. Background Art

[0002] A digital certificate (hereinafter referred to as a certificate) is a digital credential issued by a certificate authority (CA) to a user to verify the user's identity in the digital field. A certificate is an identity certificate for various entities (cardholders / individuals, merchants / enterprises, gateways / banks, etc.) to exchange information and conduct business activities online. In each link of an electronic transaction, all parties to the transaction need to verify the validity of the other party's certificate to solve the problem of mutual trust.

[0003] In actual applications, the certificate issued by one party to another party usually has an expiration date, and a new certificate needs to be replaced after the expiration date to continue identity authentication. For example, the non-bank payment institution network payment clearing platform (hereinafter referred to as the UnionPay platform) needs to issue certificates to its member institutions to authenticate the identity of the member institutions in business processing. When the certificate issued by the UnionPay platform to a member institution is about to expire, the member institution needs to apply for a new certificate from the UnionPay platform and replace the old certificate.

[0004] Currently, certificate demanders submit certificate applications and related supporting materials to the certificate issuing platform via email. After receiving the certificate application, the certificate issuing platform manually completes the issuance through collaboration of multiple business teams. The entire process is time-consuming, labor-intensive, and very inefficient. Summary of the invention

[0005] The embodiments of the present application provide a certificate management method and device to improve the efficiency of certificate issuance.

[0006] In a first aspect, an embodiment of the present application provides a certificate management method, including:

[0007] Receiving a certificate acquisition request from a certificate requester, wherein the certificate acquisition request carries certificate application information;

[0008] Generate a certificate holder unique identifier DN based on the certificate application information, and feed back the DN to the certificate requester;

[0009] Receiving a certificate production request submitted by the certificate demander, wherein the certificate production request carries a key file generated by the certificate demander based on the DN;

[0010] Submit the certificate application information, the DN and the key file to the certificate management platform so that the certificate management platform can produce the target certificate;

[0011] A certificate download portal is provided to the certificate demander so that the certificate demander can download the target certificate.

[0012] In a second aspect, an embodiment of the present application further provides a certificate management device, including:

[0013] The certificate application module is used to receive a certificate acquisition request from a certificate demander, wherein the certificate acquisition request carries certificate application information;

[0014] A DN generation module, used to generate a certificate holder unique identifier DN based on the certificate application information, and feed back the DN to the certificate requester;

[0015] A production request receiving module, used to receive a certificate production request submitted by the certificate demander, wherein the certificate production request carries a key file generated by the certificate demander based on the DN;

[0016] A production request submission module, used to submit the certificate application information, the DN and the key file to the certificate management platform, so that the certificate management platform can produce the target certificate;

[0017] The download entry providing module is used to provide the certificate demander with a certificate download entry so that the certificate demander can download the target certificate.

[0018] In a third aspect, an embodiment of the present application further provides an electronic device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the computer program is executed by the processor, the steps of the method described in the first aspect are implemented.

[0019] In a fourth aspect, an embodiment of the present application further provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the steps of the method described in the first aspect are implemented.

[0020] At least one of the above-mentioned technical solutions adopted in the embodiments of the present application can automatically receive a certificate acquisition request, automatically generate a DN based on the certificate application information carried in the certificate acquisition request and feed it back to the certificate demander, and then automatically produce a target certificate based on the certificate production request and DN submitted by the certificate demander, and provide a download portal for the certificate demander to download without excessive manual participation, thereby reducing time consumption in the certificate issuance process and improving the efficiency of certificate issuance. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0022] Figure 1 It is a schematic diagram of the process for member institutions in related technologies to apply for certificates from the UnionPay platform.

[0023] Figure 2 It is a flowchart of the member institutions in the relevant technology applying to the UnionPay platform for certificate replacement.

[0024] Figure 3A It is a flowchart of a certificate management method provided in one embodiment of the present application.

[0025] Figure 3B This is a schematic diagram of the structure of a digital certificate.

[0026] Figure 4 It is a flow chart of applying for a certificate on the UnionPay platform using a certificate management method provided in an embodiment of the present application.

[0027] Figure 5 It is a flowchart of a certificate management method provided by another embodiment of the present application.

[0028] Figure 6 It is a flow chart of collecting expired certificate information on the UnionPay platform using a certificate management method provided in an embodiment of the present application.

[0029] Figure 7 It is a flowchart of a certificate management method provided by another embodiment of the present application.

[0030] Figure 8 It is a flow chart of replacing certificates on the UnionPay platform using a certificate management method provided in an embodiment of the present application.

[0031] Fig. 9 It is a schematic diagram of the replacement process provided in an embodiment of the present application.

[0032] Fig.10 It is a structural diagram of a certificate management device provided in one embodiment of the present application.

[0033] Fig.11 It is a structural diagram of a certificate management device provided in another embodiment of the present application.

[0034] Fig.12 This is a schematic diagram of the structure of a certificate management device provided by another embodiment of the present application.

[0035] Fig.13 It is a structural schematic diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0036] In order to make the purpose, technical solution and advantages of the present application clearer, the technical solution of the present application will be clearly and completely described below in combination with the specific embodiments of the present application and the corresponding drawings. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present application.

[0037] At present, the certificate demander submits the application for a new certificate and related certification materials to the certificate issuer via email. After receiving the application, the certificate issuer manually completes the issuance through the collaboration of multiple business teams. The whole process is time-consuming and labor-intensive, and the efficiency is very low. Taking the issuance of certificates by the UnionPay platform to its member institutions as an example, the issuance of a certificate requires the cooperation of the business operation team, security team, channel team, and reconciliation team to complete the entire issuance operation, which takes 3-5 hours and occupies a lot of human resources.

[0038] Figure 1 The figure shows the process of member institutions applying for certificates from the UnionPay platform in related technologies. Figure 1 As shown, the process includes: step 101, the member institution 11 submits a certificate application to the UnionPay platform 12; step 102, the relevant personnel of the UnionPay platform 12 reviews and records the certificate issuance application, and generates a unique identifier (Distinguished Name, DN) of the certificate holder; step 103, the relevant personnel of the UnionPay platform 12 sends the certificate DN to the member institution 11; step 104, the member institution 11 verifies the certificate DN and generates a key file of the certificate (such as PKCS#10); step 105, the member institution 11 submits the key file of the certificate to the UnionPay platform 12; step 106, the relevant personnel of the UnionPay platform 12 reviews the key file of the submitted certificate, and generates a certificate after the review is passed; step 107, the UnionPay platform 12 issues a certificate to the member institution 11.

[0039] Figure 2 The figure shows the process of member institutions applying to the UnionPay platform for certificate replacement in related technologies. Figure 2 As shown, the process includes two stages: preparation stage and effectiveness stage.

[0040] like Figure 2As shown, the preparation stage includes: step 201, the business operation team 22 of the UnionPay platform 20 updates the certificate expiration list every month according to the certificate usage of the member institutions; step 202, the business operation team 22 sends a certificate update reminder email to the member institution 21; step 203, the member institution 21 fills in the certificate application form and feedbacks the certificate application form and the preliminary scheduled certificate replacement date to the business operation team 22; step 204, the business operation team 22 synchronizes the preliminary scheduled certificate replacement time of the member institution 21 with the application team (channel, reconciliation and barcode business side team) 24 every month; step 205, the business operation team 22 submits an internal work order to the security management team 23, which The member institution 21 shall make a note of the certificate replacement time preliminarily arranged by the member institution 21; in step 206, the security management team 23 shall complete the certificate production and deliver the certificate file to the business operation team 22; in step 207, the business operation team 22 shall issue a new certificate to the member institution 21; in step 208, the member institution 21 shall verify the validity of the new certificate, and after the verification is valid, feedback the verification result to the business operation team 22; in step 209, the business operation team 22 shall make a note of the internal work order and fill in the feedback result of the member institution and send it to the security management team 23; in step 210, the security management team 23 shall complete the certificate import, and make a note of the NI work order certificate number and its validity period information, and then enter the effective stage.

[0041] like Figure 2 As shown, the effectiveness stage includes: step 211, member institution 21 submits a test report of the new certificate and submits a certificate change application to the business operation team 22; step 212, the business operation team 22 transfers the test report and the certificate change application to the application team 24; step 213, the application team 24 returns the note information of the original NI work order to the business operation team 22 for the business operation team 22 to confirm the certificate replacement time; step 214, the business operation team 22 sends an email to remind the member institution 21 to confirm the change time; step 215, after confirming the change time, the member institution 21 submits a certificate change application to the application team 24; step 216, after completing the certificate change, the application team 24 feedbacks the change result to the member institution.

[0042] pass Figure 1 and Figure 2 It is not difficult to see that when a member institution of the UnionPay platform replaces a certificate, it requires the coordinated cooperation of the business operation team, security team, channel team, and reconciliation team to complete the entire issuance operation, which takes 3-5 hours, occupies a large amount of human resources, and is very inefficient.

[0043] In order to solve the above problems, the embodiments of the present application provide a certificate management method, device and system, wherein the method and device can be executed by an electronic device, or can be executed by software installed in an electronic device. The electronic device includes but is not limited to any one of smart devices such as a smart phone, a personal computer (PC), a laptop, a tablet computer, an e-reader, an Internet TV, a wearable device, etc. More specifically, the method and device can be executed by a certificate management application provided by a certificate issuance platform, and the certificate management application can be regarded as a portal for obtaining certificate management services opened by the certificate issuance platform to users. Taking the certificate issuance platform as the UnionPay platform as an example, the certificate management application can be a portal for obtaining certificate management services opened by the UnionPay platform to its member institutions. The certificate management service here can include but is not limited to any certificate management-related service such as certificate information management, certificate application and certificate replacement.

[0044] The following first describes a certificate management method provided in an embodiment of the present application.

[0045] like Figure 3A As shown, a certificate management method provided in an embodiment of the present application may include:

[0046] Step 301: Receive a certificate acquisition request from a certificate requester, wherein the certificate acquisition request carries certificate application information.

[0047] The certificate demander can be a user of the certificate issuing platform. For example, when the certificate issuing platform is an e-commerce platform, the certificate demander can be a merchant on the e-commerce platform. When the certificate issuing platform is the UnionPay platform, the certificate demander can be a member institution such as a bank or a third-party payment platform that is connected to the UnionPay platform.

[0048] For the certificate demander, the certificates they need generally include server certificates and enterprise certificates. Among them, the server certificate is also called the link encryption certificate. The server certificate is mainly used for encryption during transmission and is stored in the system that provides https encryption. Common systems include F5, SSL gateway equipment, Nginx or the application system itself; the enterprise certificate is also called the signature certificate. The enterprise certificate is used to verify the digital signature and is stored in the system that provides application layer encryption and decryption. Common systems include signature verification equipment, encryption equipment, self-developed application systems that provide algorithm processing capabilities, etc. This specification mainly introduces a certificate management method provided by this application by taking the enterprise certificate as an example.

[0049] The certificate acquisition request from the certificate demander may be a certificate application, which may be a first application or a reapplication before the expiration of an existing certificate (old certificate).

[0050] The certificate application information carried in the certificate acquisition request may include not only the certificate information used to generate the certificate and the relevant identification information of the certificate demander, but also pictures or scanned copies of the relevant certification materials of the certificate application. The certificate demander can submit this information on the page of the certificate management application. Taking the enterprise certificate as an example, its certificate information may include: application date, certificate period, business system, signature algorithm, application type and certificate DN-CN serial number, etc., where DN (Distinguished Name) is the unique identifier of the certificate holder; the relevant information of the certificate demander includes: the Chinese name of the certificate demander, the full English name of the certificate demander, the English abbreviation of the certificate demander (within 20 characters), and the unified social credit code certificate number (additional instructions: please fill in "certificate type + certificate number", where "N" can be used to represent the unified social credit code in the certificate type, and "Z" can be used to represent other; if there is no special reason, the unified social credit code is used uniformly); the relevant certification materials of the certificate application may include the certificate application form with the official seal, which supports text box or PDF format.

[0051] After receiving the above certificate application information, the certificate management application records or stores it for later use in making a certificate.

[0052] Step 302: Generate a certificate holder unique identifier DN based on the certificate application information, and feed back the DN to the certificate requester.

[0053] For example, the DN may be generated according to the DN-CN sequence in the certificate application information.

[0054] Optionally, after executing step 301 and before executing step 302, the method may further include: reviewing the certificate acquisition request based on the certificate application information; if the review result of the certificate acquisition request is passed, executing step 301.

[0055] Optionally, the method may further include: displaying the progress of the certificate application.

[0056] Taking the UnionPay platform as an example, after a member institution submits the certificate application information through the certificate management application, the certificate application progress is changed to "pending review", and users with corresponding permissions on the UnionPay platform can review the certificate application information. The review content may include checking whether the certificate application form information is consistent with the certificate application information submitted on the page of the certificate management application, whether the certificate application form is stamped, etc. The review result may be passed or failed. If the review result is failed, the above-mentioned certificate acquisition request may be rejected. Optionally, the reason for rejection may be fed back to the certificate demander, and the certificate application process ends; if the review result is passed, the certificate application progress may be changed to "review passed" and proceed to step 303.

[0057] After the DN is generated, the certificate application progress changes to "DN generated".

[0058] Step 303: Receive a certificate production request submitted by the certificate demander, wherein the certificate production request carries a key file generated by the certificate demander based on the DN.

[0059] After receiving the DN fed back by the certificate management application and generating a key file based on the DN, the certificate demander can submit a certificate production request on the page of the certificate management application and submit the key file generated based on the DN. The key file contains the public key of the certificate demander, and the key can be generated based on the Public-Key Cryptography Standards (PKCS).

[0060] For example, a user of a member institution can click a certificate creation control (such as a button) on the page of the certificate management application, and then the page of the certificate management application will echo the certificate application information and DN data submitted by the member institution. After entering the P10 (PKCS#10) information in the key file, it is submitted to the certificate management platform to create the certificate.

[0061] Step 304: Submit the certificate application information, the DN and the key file to the certificate management platform so that the certificate management platform can produce the target certificate.

[0062] When the certificate issuing platform is the UnionPay platform and the certificate demander is a member institution of the UnionPay platform, the certificate management platform can be the UnionPay platform's certificate management platform, and the certificate management platform of the UnionPay platform produces the certificate. The structure of the certificate is as follows: Figure 3B shown.

[0063] like Figure 3B As shown, a certificate is a piece of data that includes version information, certificate serial number, signature algorithm, issuer name, validity period, subject name, subject public key, and extended domains 1 to MAX. This data can be called certificate information. The certificate management platform can sign the certificate information based on the private key of the root certificate issued by the CA and the signature algorithm to obtain a signature value, and then encode the certificate information, signature algorithm, and signature value to obtain a certificate.

[0064] When the certificate is produced, the certificate application progress can be changed to "Certificate produced".

[0065] Step 305: Provide a certificate download portal to the certificate demander so that the certificate demander can download the target certificate.

[0066] The certificate demander can download the target certificate based on the certificate download portal provided by the certificate management application. The target certificate is a new certificate. If the certificate demander is applying for a certificate for the first time, the new certificate can be directly enabled. If the certificate demander is still using the old certificate, the old certificate can be replaced with the new certificate. The specific replacement process will be introduced below and will not be repeated here.

[0067] The certificate management method provided in the embodiment of the present application can automatically receive a certificate acquisition request, automatically generate a DN based on the certificate application information carried in the certificate acquisition request and feedback it to the certificate demander, and then automatically produce a target certificate based on the certificate production request and DN submitted by the certificate demander, and provide a download portal for the certificate demander to download, without excessive manual participation, thereby reducing time consumption in the certificate issuance process and improving the efficiency of certificate issuance. In other words, through the certificate management application provided in the embodiment of the present application, the certificate demander can efficiently complete the certificate application and issuance by itself.

[0068] Optionally, a certificate management method provided by an embodiment of the present application may also include: receiving the validity verification result of the target certificate fed back by the certificate demander; if the validity verification result of the target certificate is passed, importing the target certificate into the certificate management platform to authenticate the identity of the certificate demander when receiving business from the certificate demander.

[0069] After downloading the target certificate, the certificate demander can verify the certificate validity on the page of the certificate management application and submit the verification result. After the certificate demander downloads the target certificate, the page of the certificate management application can also actively prompt the certificate validity verification method for the certificate demander to use. It can be understood that actively displaying the certificate validity verification method on the page of the certificate management application can improve the efficiency of certificate validity verification.

[0070] Optionally, when the validity verification result of the target certificate passes, the certificate application progress can be changed to "confirmed valid"; when the validity verification result of the target certificate fails, the certificate application progress can be changed to "confirmed invalid".

[0071] Figure 4 The following is a flow chart showing how to apply for a certificate on the UnionPay platform using a certificate management method provided in an embodiment of the present application. Figure 4 As shown, the process may include:

[0072] Step 401: Member institution 21 applies for a certificate.

[0073] Step 402 , the member institution 21 fills in the certificate application information on the page of the certificate management application 25 of the UnionPay platform 20 , and submits it to the certificate management application 25 .

[0074] Step 403 : The certificate management application 25 generates a DN based on the certificate application information and feeds it back to the member institution 21 .

[0075] Step 404: The member institution 21 generates a key file according to the DN, fills in the public key in the key file and applies for a certificate.

[0076] Step 405 : The certificate management application 25 submits a certificate production request to the certificate management platform 26 of the UnionPay platform 20 .

[0077] Step 406 : The certificate management platform 26 generates a certificate and feeds it back to the certificate management application 25 .

[0078] Step 407: The certificate management application 25 feeds back the certificate production result to the member institution 21 and provides a download service.

[0079] Step 408: The member institution 21 downloads the certificate.

[0080] Step 409: The member institution 21 verifies the validity of the certificate and feeds back the certificate validity verification result to the certificate management application.

[0081] Step 410 : The certificate management application 25 determines whether the validity verification of the certificate has passed. If so, step 411 is executed; otherwise, step 412 is executed.

[0082] Step 411: The certificate management platform 26 imports the certificate for subsequent use.

[0083] Step 412: Transfer to manual processing.

[0084] pass Figure 4 It can be seen that after the UnionPay platform 20 opens the certificate management application 25 to its member institutions 21, its member institutions 21 can complete the certificate application by themselves and efficiently through the certificate management application 25, without the need to interact with the various team members of the UnionPay platform via email, thereby greatly improving efficiency.

[0085] Alternatively, if Figure 5 As shown, a certificate management method provided by another embodiment of the present application may also include:

[0086] Step 306: Scan the target system to determine the certificates that are about to expire within a preset period of time in the future, and obtain a certificate list, wherein the target system includes the certificate management platform.

[0087] Specifically, the target system may be scanned at a specified time or according to a preset period (such as the first day of each month) to determine the certificates that are about to expire within a preset period of time in the future and obtain a certificate list, wherein the preset period of time may be 90 days, 45 days, etc.

[0088] Taking the UnionPay platform as an example, the target system can also include the channel front-end system and the barcode collection side system.

[0089] Step 307: Send a certificate expiration reminder to the holders of the certificates in the certificate list, wherein the holders of the certificates in the certificate list include the certificate demander.

[0090] Specifically, the certificate expiration reminder may be sent to the holders of the certificates in the certificate list in a preset manner at a specified time or at a preset period (such as every week), wherein the preset manner may be a manner of sending an email, sending a text message or pushing other messages.

[0091] Optionally, the method may further include: receiving a certificate replacement time fed back by the certificate demander; reviewing the certificate replacement time, and feeding back the review result of the certificate replacement time to the certificate demander.

[0092] After receiving the certificate expiration reminder sent by the certificate management application, the certificate demander can feedback the certificate replacement time arranged by the certificate management application. After receiving the certificate replacement time, the certificate management application will review it to confirm whether the certificate replacement time is feasible. If feasible, it will be recorded and the certificate demander will be reminded to replace the certificate when the time arrives; if not feasible, the certificate demander will be reminded to re-determine the certificate replacement time.

[0093] Figure 6 The following is a flow chart showing the process of collecting expired certificate information on the UnionPay platform using a certificate management method provided by an embodiment of the present application. Figure 6 As shown, the process may include:

[0094] Step 604, the certificate management application 25 regularly scans the certificate management platform 26, the channel front-end system 27 and the barcode receiving system 28, obtains certificates that are about to expire within the next 90 days and / or 45 days, and obtains a certificate list.

[0095] The certificate management application 25 can automatically collect information about certificates that are about to expire. For example, the certificate information table of member institutions with certificates that expire within 90 days (inclusive) and are in the "enabled" state is summarized daily, and if there are qualified certificates, an email is sent to the mailbox of the relevant personnel of the certificate demander.

[0096] Optionally, the expired certificate list may also include the sending status of expiration reminder emails to users of member institutions.

[0097] Step 601: The certificate management platform 26 feeds back basic certificate information and certificate expiration date to the certificate management application 25.

[0098] Step 602 : The channel front-end system 27 feeds back the certificate information of the network connection service to the certificate management application 25 .

[0099] Step 603 : The barcode receiving system 28 feeds back the certificate information of the barcode service to the certificate management application 25 .

[0100] Step 605: For certificates that are about to expire within the next 90 days, the certificate management application 25 notifies the member institution 21 of certificate expiration reminders via email every week.

[0101] Step 606: For certificates that are about to expire within the next 45 days, the certificate management application 25 switches to a manual exit process.

[0102] For example, the certificate expiration reminder rule is: 90 days (inclusive) before the certificate expires, the certificate management application sends an email reminder to the member institution certificate operator, member institution administrator and corresponding interface person every 7 days until the new certificate is activated (that is, the portal detects that the validity period of the enterprise certificate activated by the current business system of the member institution exceeds 90 days). In addition, different expiration reminder emails can be sent separately for different business systems of different member institutions with different expiration certificates.

[0103] It is understandable that for certificates with a relatively short expiration date, in order to speed up the certificate replacement process and avoid affecting the smooth progress of the business, they can be directly transferred to the manual processing process.

[0104] Step 607: The member institution 21 starts the certificate replacement process.

[0105] Step 608: Member institution 21 completes the test environment certificate replacement verification on the UnionPay platform self-service verification platform.

[0106] Step 609, the member institution 21 feeds back the certificate replacement date arrangement to the certificate management application 25.

[0107] Step 610: The certificate management application 25 synchronizes the certificate replacement date schedule to the relevant team via email.

[0108] pass Figure 6 It can be seen that the certificate management application 25 on the UnionPay platform 20 can automatically collect information about expiring certificates, remind member institutions by email, and collect replacement date schedule information through the member institution service portal, which is very efficient.

[0109] Alternatively, if Figure 7 As shown, a certificate management method provided by another embodiment of the present application may also include:

[0110] Step 308: In response to the certificate replacement request submitted by the certificate demander, guide the certificate demander to replace the old certificate with the target certificate according to a preset replacement process.

[0111] It can be understood that the target certificate here is the new certificate.

[0112] Optionally, a certificate management method provided in an embodiment of the present application may further include: displaying a certificate replacement method to the certificate demander. Exemplarily, the certificate switching method may include a grayscale replacement method and a full replacement method.

[0113] Correspondingly, step 308 may include: in response to the target replacement method selected by the certificate demander, guiding the certificate demander to replace the old certificate with the target certificate according to the replacement process corresponding to the target replacement method, wherein the target replacement method is one of the grayscale replacement method and the full replacement method.

[0114] In specific implementation, the self-service replacement function of various business certificates (such as the two types of certificates for UnionPay business and barcode business of the UnionPay platform) can be set on the page of the certificate management application to enable the certificate demander to self-operate and self-verify the certificate replacement. In addition, in order to meet the system capabilities of different certificate demanders, the "grayscale replacement method" and "full replacement method" are set.

[0115] Among them, the idea of ​​grayscale replacement is similar to grayscale release. The certificate issuance platform supports the certificate demander to use two versions of certificates (new certificate and old certificate) at the same time. Based on the principle of ensuring business continuity, the certificate demander can adopt the idea of ​​"grayscale release" and realize the support of the use of two versions of certificates at the application layer, so as to complete the certificate replacement without interrupting the business. The certificate demander dynamically adjusts the use weight of the new certificate and the old certificate in the business processing process based on the function switch provided by the page of the certificate management application. Taking the NetsUnion platform as an example, its member institutions can support the use of two versions of certificates at the same time, that is, during the transaction process, the new signing certificate and the old signing certificate can be used at the same time, and can support the simultaneous use of the new encryption certificate and the old encryption certificate. It should be noted that the signing certificate and the encryption certificate are two types of use of the above-mentioned target certificates.

[0116] For example, for a certificate replacement application that has been approved, a change operation can be initiated at the change time when the application is approved. If the selected change method is "grayscale change method", the certificate replacement process can include the following steps:

[0117] The first step is to enable the new certificate;

[0118] Step 2: Set the proportion of business encrypted with the new certificate to 1%;

[0119] Step 3: Set the proportion of business encrypted with the new certificate to 30%;

[0120] Step 4: Set the proportion of business encrypted with the new certificate to 50%;

[0121] Step 5: Set the percentage of business encrypted with the new certificate to 100%;

[0122] Step 6: Deactivate the old certificate.

[0123] After each of the second, third, fourth and fifth steps is completed, the certificate issuance platform can verify whether there is a corresponding proportion of business sent using the new certificate and the system success rate is normal. If so, the next step can be executed. If not, when executing the next step, the certificate demander is reminded that "the proportion of business encrypted using the new certificate does not meet the standard, and the business is sent according to the operating steps." The second, third, fourth, fifth and sixth steps support rollback operations, which can be rolled back to the previous step or the first step.

[0124] For the UnionPay platform, the real-time transaction processing process divides the member institution certificate replacement into the signature verification stage and the encryption stage. The member institution actively controls the signing logic. When some transactions are processed normally using the new certificate, all signed transactions will be gradually switched to the new certificate. The UnionPay platform uses the new certificate for encrypted transactions through weight configuration. When some transactions are processed normally using the new certificate, all encrypted transactions will be gradually switched to the new certificate.

[0125] The grayscale replacement method has little impact on business processing. The certificate demander can replace the new certificate with the old certificate without downtime, and the rollback is fast. If there is a problem with the new certificate, just stop using the new certificate to process the business.

[0126] Among them, the full replacement method refers to directly setting the usage weight of the new certificate to 1 (100%), and all newly received services are processed using the new certificate (the above-mentioned target certificate). For this replacement method, the certificate demander cannot use the old certificate while using the new certificate, and the new certificate and the old certificate are mutually exclusive. This replacement method requires the certificate demander to shut down for replacement, that is, stop business processing, replace the old certificate with the new certificate, and then start business processing.

[0127] It can be understood that by guiding the certificate demander to trigger the preset certificate replacement process, users can complete the replacement of new certificates and old certificates by themselves through the certificate management application. The whole process is time-saving and efficient.

[0128] Figure 8 The following is a flow chart showing how to replace a certificate on a network connection platform using a certificate management method provided by an embodiment of the present application. Figure 8 As shown, the process may include:

[0129] Step 801: Member institution 21 activates a new certificate.

[0130] The new certificates here include signing certificates and encryption certificates.

[0131] Step 802, the certificate management application 25 of the UnionPay platform 20 performs interface forwarding, so that the certificate data service 29 of the UnionPay platform 20 initializes the certificate data and enables the new certificate. When the new certificate is just enabled, its usage weight is 0.

[0132] Step 803: The certificate data service 29 of the UnionPay platform 20 initializes the certificate data and activates the new certificate.

[0133] Step 804: Member institution 21 replaces the signature certificate.

[0134] Step 805, the log monitor 30 queries the ratio of successful transactions after using the new certificate, and queries the system success rate of the member institution.

[0135] The purpose of querying the ratio of successful transactions after using the new certificate and the system success rate of the member institution is to confirm whether the transaction is normal after the signature certificate is replaced. If it is normal, execute step 806. Generally speaking, if the system success rate is lower than the preset ratio and / or if the transaction using the new certificate is found to be abnormal, the increase of the certificate replacement ratio is blocked and rolled back.

[0136] Step 806: The member institution 21 checks whether all signature certificates have been replaced; if so, execute step 807; otherwise, return to execute step 805.

[0137] Step 807: Member institution 21 increases the weight of the new certificate.

[0138] Step 808: The certificate management application 25 performs interface forwarding.

[0139] Step 809: The certificate data service 29 activates the new certificate and sets the usage weight of the new certificate.

[0140] If the grayscale replacement method is used, the usage weight of the new certificate can be set to x i , x i Greater than 0 and less than or equal to 1, x i The weight set for the i-th time; if the replacement is a full replacement, the usage weight of the new certificate can be set to 1.

[0141] Step 810 , member institution 21 determines whether the encrypted transaction using the new certificate is normal; if so, execute step 814 , otherwise, execute step 811 .

[0142] Step 811: Member institution 21 performs certificate replacement rollback.

[0143] Step 812: The certificate management application 25 performs interface forwarding.

[0144] Step 813: The certificate data service 29 performs certificate replacement rollback.

[0145] If the grayscale replacement method is used, after rolling back, the usage weight of the new certificate is set to x i-1 , is the weight set for the i-1th time, x i-1 Less than x i , x i Greater than 0; if the full replacement method is used, after the rollback, the usage weight of the new certificate is set to 0.

[0146] Step 814: The member institution 21 confirms whether the usage weight of the new certificate is 1, and whether the encrypted transaction using the new certificate is normal when the usage weight is 1. If normal, execute step 815; otherwise, return to execute step 807.

[0147] Step 815: Replacement is completed, and this process ends.

[0148] pass Figure 8 It is not difficult to see that during the certificate replacement process, the availability of the new certificate is also monitored and bypass verified. If the system success rate is lower than the preset ratio (such as 99%) and / or if transactions using the new certificate are found to be abnormal and not in line with expectations, the increase in the certificate replacement ratio will be blocked and rolled back. Member institutions can click the rollback button; if the bypass verification passes, member institutions can click the continue flow button.

[0149] Fig. 9 FIG. 1 shows a schematic diagram of a replacement process provided in an embodiment of the present application, which is an example of the above-mentioned preset replacement process. Fig. 9 As shown, the replacement process may include:

[0150] Step 900, start.

[0151] Step 901: In response to a selection operation by a certificate requester, a certificate replacement module is selected.

[0152] If the certificate demander chooses the grayscale replacement method, execute step 902; if the certificate demander chooses the full replacement method, execute step 903.

[0153] Step 902: Enable the target certificate.

[0154] Step 904: Set the usage weight of the target certificate to a first value.

[0155] For example, the first value may be 1%.

[0156] Step 905: Determine whether the preset indicator value when the certificate demander uses the target certificate to process business meets the preset conditions. If yes, execute step 906; otherwise, execute step 904.

[0157] The preset indicators may include but are not limited to business success rate, business quantity within a preset time, system success rate and business abnormality rate, etc. For example, for member institutions of the NetsUnion platform, the preset indicators here may include transaction success rate and the number of transactions encrypted using the target certificate in the last 30 minutes. Correspondingly, the preset condition corresponding to the transaction success rate is that the transaction success rate is greater than a preset value (such as 99%), and the preset condition corresponding to the number of transactions encrypted using the target certificate within 30 minutes is that the number is greater than 1.

[0158] It can be understood that if the preset indicator value when the certificate demander uses the target certificate to process business meets the preset conditions, the usage weight of the target certificate will continue to be increased, otherwise it will roll back to the last set usage weight.

[0159] Step 906: Set the usage weight of the target certificate to a second value.

[0160] For example, the second value may be 30%.

[0161] Step 907: Determine whether the preset indicator value when the certificate demander uses the target certificate to process business meets the preset conditions. If yes, execute step 908; otherwise, execute step 906.

[0162] It can be understood that if the preset indicator value when the certificate demander uses the target certificate to process business meets the preset conditions, the usage weight of the target certificate will continue to be increased, otherwise it will roll back to the last set usage weight.

[0163] Step 908: Set the usage weight of the target certificate to a third value.

[0164] Step 909: Determine whether the preset indicator value when the certificate demander uses the target certificate to process business meets the preset conditions. If yes, execute step 910; otherwise, execute step 908.

[0165] The preset indicators here may also include but are not limited to business success rate, business quantity within a preset time period, system success rate and business abnormality rate, etc.

[0166] In this way, the usage weight of the target certificate is continuously improved, and when the preset indicator value when the certificate demander uses the target certificate to process business meets the preset conditions, the usage weight of the target certificate continues to be improved, otherwise, it is rolled back to the last set usage weight.

[0167] Step 910: Set the usage weight of the target certificate to 1 (ie, 100%).

[0168] Step 911: determine whether the preset indicator value when the certificate demander uses the target certificate to process business meets the preset conditions. If yes, execute step 914; otherwise, execute step 910.

[0169] The preset indicators here may also include but are not limited to business success rate, the number of businesses using old certificates within a preset period of time, system success rate and business abnormality rate, etc. For example, for member institutions of the China UnionPay platform, the preset indicators here may include transaction success rate and the number of transactions encrypted using old certificates in the last 10 minutes. Correspondingly, the preset condition corresponding to the former is that the transaction success rate is greater than a preset value (such as 99%), and the preset condition corresponding to the latter is that the number is 0 (no transactions using old certificates can be found in the last 10 minutes).

[0170] Step 912: Set the weight of the old certificate to 0, and set the usage weight of the target certificate to 1.

[0171] Step 913: determine whether the preset indicator value when the certificate demander uses the target certificate to process business meets the preset conditions. If yes, execute step 914; otherwise, execute step 903.

[0172] The preset indicators here may include but are not limited to business success rate, the number of businesses using old certificates within a preset period of time, system success rate and business abnormality rate, etc. For example, for member institutions of the China UnionPay platform, the preset indicators here may include transaction success rate and the number of transactions encrypted using old certificates in the last 10 minutes. Correspondingly, the preset condition corresponding to the former is that the transaction success rate is greater than the preset value (such as 99%), and the preset condition corresponding to the latter is that the number is 0 (no transactions using old certificates can be found in the last 10 minutes).

[0173] Step 914: Set the usage status of the old certificate to disabled.

[0174] Optionally, for the UnionPay platform, if step 914 is executed successfully, the reconciliation interface can also be called to regenerate the reconciliation encryption key file; if step 914 fails, an error is reported, and manual intervention is notified, or the process rolls back to step 902 or step 903. It can be understood that for certificate demanders who choose the "grayscale replacement method", the process rolls back to step 902, and for certificate demanders who choose the "full replacement method", the process rolls back to step 903.

[0175] Step 915, end.

[0176] It is not difficult to understand that by guiding the certificate demander to trigger the above-mentioned certificate replacement process, users can complete the replacement of new certificates and old certificates by themselves through the certificate management application. The whole process is time-saving and efficient.

[0177] Corresponding to the above method embodiment, the embodiment of the present application also provides a certificate management device, which is introduced below.

[0178] like Fig.10As shown, a certificate management device 1000 provided in an embodiment of the present application may include: a certificate application module 1001, a DN generation module 1002, a production request receiving module 1003, a production request submission module 1004 and a download entry providing module 1005.

[0179] The certificate application module 1001 is used to receive a certificate acquisition request from a certificate demander, wherein the certificate acquisition request carries certificate application information.

[0180] The DN generation module 1002 is used to generate a certificate holder unique identifier DN based on the certificate application information, and feed back the DN to the certificate requester.

[0181] The production request receiving module 1003 is used to receive a certificate production request submitted by the certificate demander, wherein the certificate production request carries a key file generated by the certificate demander based on the DN.

[0182] The production request submission module 1004 is used to submit the certificate application information, the DN and the key file to the certificate management platform so that the certificate management platform can produce the target certificate.

[0183] The download entry providing module 1005 is used to provide the certificate demander with a certificate download entry so that the certificate demander can download the target certificate.

[0184] A certificate management device provided in an embodiment of the present application can automatically receive a certificate acquisition request, automatically generate a DN based on the certificate application information carried in the certificate acquisition request and feed it back to the certificate requester, and then automatically produce a target certificate based on the certificate production request and DN submitted by the certificate demander, and provide a download portal for the certificate demander to download without excessive manual participation, thereby reducing time consumption in the certificate issuance process and improving the efficiency of certificate issuance.

[0185] Optionally, the device 1000 may also include: a validity verification result receiving module and a certificate importing module, wherein the validity verification result receiving module is used to receive the validity verification result of the target certificate fed back by the certificate demander; the certificate importing module is used to import the target certificate into the certificate management platform if the validity verification result of the target certificate is passed, so as to authenticate the identity of the certificate demander when receiving the business from the certificate demander.

[0186] After downloading the target certificate, the certificate demander can verify the certificate validity on the page of the certificate management application and submit the verification result. After the certificate demander downloads the target certificate, the page of the certificate management application can also actively prompt the certificate validity verification method for the certificate demander to use. It can be understood that actively displaying the certificate validity verification method on the page of the certificate management application can improve the efficiency of certificate validity inflammation.

[0187] Alternatively, if Fig.11 As shown, a certificate management device 1000 provided in an embodiment of the present application may further include: an expired certificate determination module 1006 and an expired certificate reminder module 1007.

[0188] The expired certificate determination module 1006 is used to scan the target system, determine the certificates that are about to expire within a preset period of time in the future, and obtain a certificate list, wherein the target system includes the certificate management platform.

[0189] The expired certificate reminder module 1007 is used to send a certificate expiration reminder to the holders of the certificates in the certificate list, wherein the holders of the certificates in the certificate list include the certificate demander.

[0190] Optionally, the device 1000 may also include: a change time receiving module and a change time review module, wherein the change time receiving module is used to receive the certificate change time fed back by the certificate demander; the change time review module is used to review the certificate change time and feed back the review result of the certificate change time to the certificate demander.

[0191] After receiving the certificate expiration reminder sent by the certificate management application, the certificate demander can feedback the certificate replacement time arranged by the certificate management application. After receiving the certificate replacement time, the certificate management application will review it to confirm whether the certificate replacement time is feasible. If feasible, it will be recorded and the certificate demander will be reminded to replace the certificate when the time arrives.

[0192] Alternatively, if Fig.12 As shown, the device 1000 may further include: a certificate replacement guiding module 1008, which is used to respond to the certificate replacement request submitted by the certificate demander and guide the certificate demander to replace the old certificate with the target certificate according to a preset replacement process.

[0193] Optionally, the device 1000 may further include: a replacement method display module, used to display the certificate replacement method to the certificate demander before guiding the certificate demander to replace the old certificate with the target certificate according to a preset replacement process. Exemplarily, the certificate switching method may include a grayscale replacement method and a full replacement method.

[0194] Correspondingly, the above-mentioned certificate replacement guidance module 1008 can be specifically used to: in response to the target replacement method selected by the certificate demander, guide the certificate demander to replace the old certificate with the target certificate according to the replacement process corresponding to the target replacement method, wherein the target replacement method is one of the grayscale replacement method and the full replacement method.

[0195] It can be understood that by guiding the certificate demander to trigger the preset certificate replacement process, users can complete the replacement of new certificates and old certificates by themselves through the certificate management application. The whole process is time-saving and efficient.

[0196] It should be noted that since the content executed by the device embodiment is similar to that of the method embodiment, the description of the device embodiment part in this document is relatively brief, and please refer to the method embodiment part for relevant details.

[0197] Fig.13 FIG. 1 is a schematic diagram of the structure of an electronic device provided by an embodiment of the present application. Fig.13 At the hardware level, the electronic device includes a processor, and optionally also includes an internal bus, a network interface, and a memory. The memory may include a memory, such as a high-speed random access memory (RAM), and may also include a non-volatile memory (non-volatile memory), such as at least one disk storage. Of course, the electronic device may also include hardware required for other services.

[0198] The processor, network interface and memory can be interconnected through an internal bus, which can be an ISA (Industry Standard Architecture) bus, a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Fig.13 Only one bidirectional arrow is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0199] The memory is used to store the program. Specifically, the program may include a program code, and the program code includes a computer operation instruction. The memory may include a memory and a non-volatile memory, and provides instructions and data to the processor.

[0200] The processor reads the corresponding computer program from the non-volatile memory into the memory and then runs it, forming a certificate management device at the logical level. The processor executes the program stored in the memory and is specifically used to execute the certificate management method provided in the embodiment of the present application.

[0201] The above application Fig.10 The method performed by the certificate management device disclosed in the illustrated embodiment can be applied to a processor or implemented by a processor. The processor may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by an integrated logic circuit of hardware in the processor or an instruction in the form of software. The above processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present application can be implemented or executed. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc. The steps of the method disclosed in the embodiments of the present application can be directly embodied as a hardware decoding processor for execution, or a combination of hardware and software modules in the decoding processor for execution. The software module can be located in a storage medium mature in the art such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory, and the processor reads the information in the memory and completes the steps of the above method in combination with its hardware.

[0202] The present application also provides a computer-readable storage medium, which stores one or more programs, wherein the one or more programs include instructions, which, when executed by an electronic device including multiple application programs, enable the electronic device to execute Fig.10 The method executed by the certificate management device in the illustrated embodiment is specifically used to execute the certificate management method provided in the embodiment of the present application.

[0203] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0204] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0205] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0206] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0207] It should be noted that the various embodiments in this application are described in a related manner, and the same or similar parts between the various embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0208] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0209] The above are only embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included within the scope of the claims of the present application.

Claims

1. A certificate management method, characterized in that: The method comprises: Receiving a certificate acquisition request from a certificate requester, wherein the certificate acquisition request carries certificate application information; Generate a certificate holder unique identifier DN based on the certificate application information, and feed back the DN to the certificate requester; Receiving a certificate production request submitted by the certificate demander, wherein the certificate production request carries a key file generated by the certificate demander based on the DN; Submit the certificate application information, the DN and the key file to the certificate management platform so that the certificate management platform can produce the target certificate; A certificate download portal is provided to the certificate demander so that the certificate demander can download the target certificate.

2. The method according to claim 1, characterized in that The method further comprises: Receive the validity verification result of the target certificate fed back by the certificate demander; If the validity verification result of the target certificate is passed, the target certificate is imported into the certificate management platform, so that when receiving business from the certificate demander, the identity of the certificate demander is authenticated according to the imported target certificate.

3. The method according to claim 1, characterized in that The method further comprises: Reviewing the certificate acquisition request based on the certificate application information; If the audit result of the certificate acquisition request is passed, the step of generating the certificate holder's unique identifier DN based on the certificate application information is executed.

4. The method according to claim 1, characterized in that The certificate acquisition request is sent before the old certificate of the certificate demander expires, and the method further includes: Scan the target system to determine the certificates that are about to expire within a preset period of time in the future, and obtain a certificate list, wherein the target system includes the certificate management platform; Sending a certificate expiration reminder to the holders of the certificates in the certificate list, wherein the holders of the certificates in the certificate list include the certificate demander.

5. The method according to claim 1, characterized in that The method further comprises: In response to the certificate replacement request submitted by the certificate demander, the certificate demander is guided to replace the old certificate with the target certificate according to a preset replacement process.

6. The method according to claim 5, characterized in that The method further comprises: Showing the certificate replacement method to the certificate demander, wherein the certificate switching method includes a grayscale replacement method and a full replacement method; The step of responding to the certificate replacement request submitted by the certificate demander and guiding the certificate demander to replace the old certificate with the target certificate according to a preset replacement process includes: In response to the target certificate replacement method selected by the certificate demander, the certificate demander is guided to replace the old certificate with the target certificate according to a replacement process corresponding to the target certificate replacement method.

7. The method according to claim 6, characterized in that The target change method is a grayscale change method, and the change process corresponding to the target change method includes: enabling the target certificate; When the usage weight of the target certificate is set to a second value, determining whether a preset index value when the certificate demander uses the target certificate to process a business meets a preset condition; If it is in compliance, the usage weight of the target certificate is increased to a third value; If not, rolling back the usage weight of the target certificate to the first value; The second value is greater than the first value, the second value is less than the third value, the first value is greater than or equal to 0, and the third value is less than or equal to 1.

8. The method according to claim 6, characterized in that When the target replacement method is a full replacement method, the replacement process corresponding to the target replacement method includes: Activate the target certificate, set the usage weight of the old certificate to zero, and set the usage weight of the target certificate to 1; Determining whether a preset indicator value when the certificate demander uses the target certificate to process business meets a preset condition; If it is in compliance, the old certificate is set to be inactive; If not, roll back to set the usage weight of the old certificate to 1 and the usage weight of the target certificate to 0.

9. A certificate management device, characterized in that: The device comprises: The certificate application module is used to receive a certificate acquisition request from a certificate demander, wherein the certificate acquisition request carries certificate application information; A DN generation module, used to generate a certificate holder unique identifier DN based on the certificate application information, and feed back the DN to the certificate requester; A production request receiving module, used to receive a certificate production request submitted by the certificate demander, wherein the certificate production request carries a key file generated by the certificate demander based on the DN; A production request submission module, used to submit the certificate application information, the DN and the key file to the certificate management platform, so that the certificate management platform can produce the target certificate; The download entry providing module is used to provide the certificate demander with a certificate download entry so that the certificate demander can download the target certificate.

10. An electronic device comprising: processor; as well as a memory arranged to store computer executable instructions which, when executed, cause the processor to: Receiving a certificate acquisition request from a certificate requester, wherein the certificate acquisition request carries certificate application information; Generate a certificate holder unique identifier DN based on the certificate application information, and feed back the DN to the certificate requester; Receiving a certificate production request submitted by the certificate demander, wherein the certificate production request carries a key file generated by the certificate demander based on the DN; Submit the certificate application information, the DN and the key file to the certificate management platform so that the certificate management platform can produce the target certificate; A certificate download portal is provided to the certificate demander so that the certificate demander can download the target certificate.

Images