Certificate issuing method, device and system, storage medium and computer program product

Abstract

The invention discloses a certificate issuing method, device and system, a storage medium and a computer program product, and belongs to the technical field of information security. According to the scheme, decentralized certificate issuing is realized based on the block chain, the certificate issuing process is more transparent, the certificate issuing process is safer and more reliable, the credibility of the certificate is enhanced, and meanwhile, the process is more in line with the technical specification of an Automated Management Environment (ACME). Besides, according to the scheme, a DPKI (Decentralized Public Key Infrastructure) server is supported to be combined with a plurality of domain name verification nodes to realize multi-channel verification of the target domain name, so that the problem of single-point failure is avoided, and the safety and reliability of the certificate issuing process and the credibility of the certificate are further enhanced.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a certificate issuance method, device, system, storage medium and computer program product. Background Art

[0002] Currently, the Internet carries many services, including commodity trading, finance, government affairs, etc. Various services are mainly implemented through the client-server model. The trust and secure communication between the client and the server mainly rely on X.509 digital certificates and public key infrastructure (PKI). X.509 digital certificates are digital certificate format standards developed by the International Telecommunication Union Telecommunication (ITU-T) in 1988, and the Internet Engineering Task Force (IETF) subsequently formulated related digital certificate management protocols. The technical basis of X.509 digital certificates is public key signature technology, and its main function is to bind a public key and an identifier to prove that an entity owns a name (such as a domain name).

[0003] When a user accesses a service through a client, the domain name corresponding to the service is usually entered on the client. The client obtains the Internet Protocol (IP) address of the server corresponding to the service through domain name resolution, establishes a communication connection with the server based on the IP address, and uses the public key to verify the certificate of the domain name provided by the server during the communication connection establishment process. Once the certificate passes the client's verification, the client and the server can establish trust and establish a secure communication connection through key exchange. Before the server provides services to the client, the relevant technology requires the Certificate Authority (CA) to issue the above certificate to the owner of the domain name. The certificate issuance process is a process of transferring trust. How to ensure the security and reliability of the certificate issuance process and the credibility of the certificate is the focus of research in the industry. Summary of the invention

[0004] The present application provides a certificate issuance method, device, system, storage medium and computer program product, which can enhance the security and reliability of the certificate issuance process and the credibility of the certificate. The technical solution is as follows:

[0005] In a first aspect, a certificate issuance method is provided, which is applied to a DPKI client in a certificate issuance system, wherein the certificate issuance system further includes a website (Web) server, a blockchain-based DPKI server, and at least one domain name verification node; the method includes:

[0006] The DPKI client sends a certificate application request to the DPKI server, the certificate application request carries the target domain name of the certificate to be issued, the certificate application request is used to instruct the DPKI server to obtain challenge information and store the challenge information on the blockchain, the challenge information refers to information used to verify the target domain name; download the challenge information from the blockchain; generate a verification file based on the challenge information, and upload the verification file to the Web server; send a verification request to the DPKI server, the verification request is used to instruct the DPKI server to jointly verify the content of the verification file with the first domain name verification node of the at least one domain name verification node and the Web server; obtain the certificate of the target domain name when it is determined that the DPKI server has passed the verification of the content of the verification file.

[0007] This solution implements decentralized certificate issuance based on blockchain, making the certificate issuance process more transparent, while enhancing the security and reliability of the certificate issuance process and the credibility of the certificates. The certificate issuance process is more in line with ACME technical specifications.

[0008] Optionally, the first domain name verification node is a part of the at least one domain name verification node, and the verification request carries verification node indication information, where the verification node indication information is used to indicate the first domain name verification node.

[0009] This solution supports the DPKI server to work with multiple domain name verification nodes to implement multi-way verification of the target domain name, which can avoid the problem of single point failure, and supports the DPKI client to specify the domain name verification node, further enhancing the security and reliability of the certificate issuance process and the credibility of the certificate.

[0010] Optionally, the verification node indication information includes the number of verification nodes and / or verification node identifiers, the number of verification nodes indicates the number of first domain name verification nodes, and the verification node identifier information indicates the identifier of the first domain name verification node. That is, this solution supports the DPKI client to specify the number and / or identifier of the domain name verification node.

[0011] There are at least two implementation methods for the DPKI client to obtain the certificate of the target domain name. In the first implementation method, the at least one domain name verification node includes a CA; the DPKI client obtains the certificate of the target domain name, including: sending a certificate issuance request to the DPKI server, the certificate issuance request carries the target domain name, the certificate issuance request is used to instruct the DPKI server to jointly generate a certificate of the target domain name and store it on the blockchain; downloading the certificate of the target domain name from the blockchain. In this way, issuing a certificate through a CA can be compatible with the efficiency of a traditional CA.

[0012] The blockchain records the certificate application status of the certificate application request; the DPKI client downloads the certificate of the target domain name from the blockchain, including: when it is determined that the certificate application status is an issued status, downloading the certificate of the target domain name from the blockchain.

[0013] Optionally, the certificate of the target domain name includes the signature information of the CA on the certificate of the target domain name, so as to facilitate the subsequent access to the server corresponding to the target domain name to prove the credibility of the certificate of the target domain name.

[0014] The second implementation method for the DPKI client to obtain the certificate of the target domain name includes: generating a self-signed certificate for the target domain name; uploading the self-signed certificate to the blockchain to instruct the DPKI server to verify the self-signed certificate; and determining the self-signed certificate as the certificate of the target domain name when it is determined that the DPKI server has verified the self-signed certificate. In this way, the certificate issuance process can be simplified while ensuring the security and reliability of the certificate issuance process and the credibility of the certificate.

[0015] Optionally, before the DPKI client sends a certificate application request to the DPKI server, it also includes: generating a public key and a private key for the certificate, the certificate application request also carries a public key, and the challenge information includes a first random number generated by the DPKI server; the DPKI client generates a verification file based on the challenge information, including: generating a second random number; performing a hash operation on the first random number and the second random number to obtain a hash value; using the private key to sign the hash value to obtain the content of the verification file; and generating the verification file based on the content of the verification file. That is, this solution supports the DPKI server to generate challenge information itself.

[0016] Optionally, the first domain name verification node is a CA or an oracle.

[0017] Optionally, the certificate of the target domain name includes the identification information of the blockchain, so that when the server corresponding to the target domain name is subsequently accessed, the certificate provided by the server can be verified based on the records on the blockchain.

[0018] Optionally, the blockchain is deployed with a smart contract, and the DPKI client executes the steps of the above-mentioned certificate issuance method by calling the smart contract, and the certificate of the target domain name includes the address information of the smart contract. In this way, the above-mentioned certificate issuance method is automatically executed, and the certificate provided by the server corresponding to the target domain name is verified based on the smart contract when the server is accessed later.

[0019] In a second aspect, a certificate issuance method is provided, which is applied to a DPKI server based on blockchain in a certificate issuance system, wherein the certificate issuance system further includes a DPKI client, a web server, and at least one domain name verification node; the method includes:

[0020] The method comprises: receiving a certificate application request sent by a DPKI client, wherein the certificate application request carries a target domain name of a certificate to be issued; obtaining challenge information, and storing the challenge information on a blockchain, wherein the challenge information refers to information used to verify and challenge the target domain name; receiving a verification request sent by the DPKI client, and storing the verification request on a blockchain, wherein the verification request is sent after the DPKI client generates a verification file based on the challenge information and uploads the verification file to a Web server; receiving the content of the verification file uploaded by a first domain name verification node among the at least one domain name verification node, wherein the content of the verification file is obtained by the first domain name verification node downloading the verification file from the Web server; verifying the content of the verification file based on the challenge information; and instructing the DPKI client to obtain a certificate for the target domain name after the content of the verification file is verified.

[0021] This solution implements decentralized certificate issuance based on blockchain, making the certificate issuance process more transparent, while enhancing the security and reliability of the certificate issuance process and the credibility of the certificates. The certificate issuance process is more in line with ACME technical specifications.

[0022] There are at least two implementations for the DPKI server to obtain the challenge information. In the first implementation, the DPKI server obtains the challenge information, including: storing the certificate application request on the blockchain; receiving the challenge information sent by the second domain name verification node in the at least one domain name verification node, and the challenge information is generated by the second domain name verification node after downloading the certificate application request from the blockchain. That is, this solution supports the domain name verification node to generate challenge information, and supports the challenger (the second domain name verification node) and the verification party (the first domain name verification node) to be different entities.

[0023] Optionally, the certificate application request also carries the public key of the certificate; the DPKI server obtains the challenge information, including: generating the challenge information, the challenge information includes a first random number; wherein the verification request carries a second random number, and the content of the verification file is signed by the DPKI client using the private key corresponding to the public key to perform a hash operation on the first random number and the second random number to obtain a hash value; accordingly, the DPKI server verifies the content of the verification file based on the challenge information, including: based on the first random number and the second random number, using the public key to verify the content of the verification file. That is, this solution supports the DPKI server to generate challenge information itself.

[0024] The DPKI server generates challenge information, including: performing a hash operation on the target domain name, the identifier of the first block, the public key, and the challenge information recorded in the second block (such as the random number contained in the header of the second block) to obtain a first random number, the first block refers to a block on the blockchain used to record certificate application records about the target domain name, and the second block refers to the previous block of the first block on the blockchain.

[0025] Optionally, the verification request carries verification node indication information, and the verification node indication information is used to indicate the first domain name verification node; the method further includes: the DPKI server selects the first domain name verification node from the at least one domain name verification node based on the verification node indication information. That is, this solution supports the DPKI client to specify the domain name verification node.

[0026] Optionally, the verification node indication information includes the number of verification nodes and / or verification node identification information, the number of verification nodes indicates the number of first domain name verification nodes, and the verification node identification information indicates the identification of the first domain name verification node. That is, this solution supports the DPKI client to specify the number and / or identification of domain name verification nodes.

[0027] There are at least two implementation methods for the DPKI client to obtain the certificate of the target domain name. In the first implementation method, the at least one domain name verification node includes a CA, and the method further includes: the DPKI server receives a certificate issuance request sent by the DPKI client, and the certificate issuance request carries the target domain name; stores the certificate issuance request on the blockchain; receives the certificate of the target domain name uploaded by the CA, and the certificate of the target domain name is generated by the CA after downloading the certificate issuance request from the blockchain; and stores the certificate of the target domain name on the blockchain. In this way, the DPKI client downloads the certificate of the target domain name from the blockchain. Issuing certificates through CA can be compatible with the efficiency of traditional CA.

[0028] Optionally, the DPKI server instructs the DPKI client to obtain a certificate for the target domain name, including: receiving a self-signed certificate about the target domain name uploaded by the DPKI client; verifying the self-signed certificate; and instructing the DPKI client to determine the self-signed certificate as the certificate for the target domain name after the self-signed certificate is verified. That is, the DPKI client can generate a self-signed certificate, thereby simplifying the certificate issuance process while ensuring the security and reliability of the certificate issuance process and the credibility of the certificate.

[0029] Optionally, the first domain name verification node includes an oracle; the method further includes: the DPKI server receives a registration request sent by the oracle; in response to the registration request sent by the oracle, registers the oracle; authenticates the oracle in the first domain name verification node based on the registered oracle; the DPKI server instructs the DPKI client to obtain a certificate for the target domain name after verifying the content of the verification file, including: instructing the DPKI client to obtain a certificate for the target domain name after verifying the content of the verification file and the identity of the oracle in the first domain name verification node. In this way, the security and reliability of the certificate issuance process and the credibility of the certificate can be further enhanced.

[0030] Optionally, the certificate of the target domain name includes the identification information of the above blockchain, so that when accessing the server corresponding to the target domain name in the future, the certificate provided by the server can be verified based on the records on the blockchain.

[0031] Optionally, the blockchain is deployed with a smart contract, and the DPKI server executes the steps of the above-mentioned certificate issuance method by calling the smart contract, and the certificate of the target domain name includes the address information of the smart contract. In this way, the above-mentioned certificate issuance method is automatically executed, and the certificate provided by the server corresponding to the target domain name is verified based on the smart contract when the server is accessed later.

[0032] In a third aspect, a certificate issuance method is provided, the method being applied to a first domain name verification node in at least one domain name verification node included in a certificate issuance system, the certificate issuance system further comprising a DPKI client, a blockchain-based DPKI server, and a Web server; the method comprising:

[0033] Download a verification request from the blockchain, where the verification request is generated after the DPKI client generates a verification file based on challenge information and uploads the verification file to a Web server. The challenge information refers to information used to verify the target domain name. The challenge information is obtained by the DPKI server after receiving the certificate application request sent by the DPKI client and stored on the blockchain. The certificate application request carries the target domain name to be issued a certificate; download the verification file from the Web server based on the verification request; upload the content of the verification file to the DPKI server to instruct the DPKI server to verify the content of the verification file based on the challenge information and instruct the DPKI client to obtain the certificate of the target domain name after the content of the verification file is verified.

[0034] This solution implements decentralized certificate issuance based on blockchain, making the certificate issuance process more transparent, while enhancing the security and reliability of the certificate issuance process and the credibility of the certificates. The certificate issuance process is more in line with ACME technical specifications.

[0035] Optionally, the blockchain stores a certificate application request; the method further includes: downloading the certificate application request from the blockchain; generating the challenge information based on the certificate application request; and sending the challenge information to the DPKI server. That is, this solution supports the domain name verification node to generate challenge information itself.

[0036] Optionally, the first domain name verification node is a part of the at least one domain name verification node, and the first domain name verification node is selected by the DPKI server from the at least one domain name verification node. That is, this solution supports the DPKI server to jointly implement multi-path verification of the target domain name with multiple domain name verification nodes, which can avoid the problem of single point failure.

[0037] Optionally, the first domain name verification node is a CA; the method further includes: downloading the certificate issuance request from the blockchain, the certificate issuance request carries the target domain name, the certificate issuance request is generated by the DPKI client after determining that the DPKI server has passed the content verification of the verification file; generating a certificate for the target domain name based on the certificate issuance request; uploading the certificate for the target domain name to the DPKI server. In this way, issuing certificates through CA can be compatible with the efficiency of traditional CA.

[0038] Optionally, the first domain name verification node is a prophet; the method further includes: sending a registration request to the DPKI server to request registration in the certificate issuance system. Registration is used to ensure the legitimacy of the prophet in the certificate issuance process, enhance the security and reliability of the certificate issuance process, and enhance the credibility of the certificate.

[0039] Optionally, the certificate of the target domain name includes the identification information of the blockchain, so that when the server corresponding to the target domain name is subsequently accessed, the certificate provided by the server can be verified based on the records on the blockchain.

[0040] Optionally, the blockchain is deployed with a smart contract, and the first domain name verification node executes the steps of the above-mentioned certificate issuance method by calling the smart contract, and the certificate of the target domain name includes the address information of the smart contract. In this way, the above-mentioned certificate issuance method is automatically executed, and it is convenient to verify the certificate provided by the server corresponding to the target domain name based on the smart contract when accessing the server corresponding to the target domain name in the future.

[0041] In a fourth aspect, a certificate issuing device is provided, wherein the certificate issuing device has the function of implementing the certificate issuing method provided in any one of the first to third aspects. The certificate issuing device includes one or more modules, wherein the one or more modules are used to implement the certificate issuing method provided in any one of the first to third aspects.

[0042] In a fifth aspect, a certificate issuance system is provided, which includes a DPKI client, a Web server, a blockchain-based DPKI server, and at least one domain name verification node.

[0043] Among them, the DPKI client is used to execute the steps of the certificate issuance method provided by the first aspect above; the DPKI server is used to execute the steps of the certificate issuance method provided by the second aspect above; and the first domain name verification node among the at least one or more domain name verification nodes is used to execute the steps of the certificate issuance method provided by the third aspect above.

[0044] In a sixth aspect, a computing device is provided, the computing device comprising a processor and a memory, the memory being used to store a program for executing the certificate issuance method provided in any one of the first to third aspects, and storing data involved in implementing the certificate issuance method provided in any one of the first to third aspects. The processor is configured to execute the program stored in the memory. The computing device may also include a communication bus, the communication bus being used to establish a connection between the processor and the memory.

[0045] In a seventh aspect, a computer-readable storage medium is provided, wherein instructions are stored in the computer-readable storage medium, and when the computer-readable storage medium is executed on a computer, the computer executes the certificate issuance method described in any one of the first to third aspects.

[0046] In an eighth aspect, a computer program product comprising instructions is provided, which, when executed on a computer, enables the computer to execute the certificate issuing method described in any one of the first to third aspects.

[0047] The technical effects obtained by the above-mentioned fourth, fifth, sixth, seventh and eighth aspects are similar to the technical effects obtained by the corresponding technical means in the first to third aspects, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Figure 1 This is an architecture diagram of a certificate issuance system provided in an embodiment of the present application;

[0049] Figure 2 is a schematic diagram of the structure of a computing device provided in an embodiment of the present application;

[0050] Figure 3 is a flow chart of a certificate issuance method provided in an embodiment of the present application;

[0051] Figure 4 is a flow chart of another certificate issuance method provided in an embodiment of the present application;

[0052] Figure 5 This is a flow chart of another method for issuing a certificate provided in an embodiment of the present application;

[0053] Figure 6 This is a flow chart of another method for issuing a certificate provided in an embodiment of the present application;

[0054] Figure 7 This is a flow chart of another method for issuing a certificate provided in an embodiment of the present application;

[0055] Figure 8 This is a flow chart of another method for issuing a certificate provided in an embodiment of the present application;

[0056] Fig. 9 This is a flow chart of another method for issuing a certificate provided in an embodiment of the present application;

[0057] Fig.10 It is a schematic diagram of a certificate format provided in an embodiment of the present application;

[0058] Fig.11 It is a structural diagram of a certificate issuing device provided in an embodiment of the present application;

[0059] Fig.12 It is a structural diagram of another certificate issuing device provided in an embodiment of the present application;

[0060] Fig.13 It is a structural diagram of another certificate issuing device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0061] In order to make the objectives, technical solutions and advantages of the embodiments of the present application clearer, the implementation methods of the present application will be further described in detail below in conjunction with the accompanying drawings.

[0062] To facilitate understanding, the certificate issuance system provided in the embodiment of the present application is first introduced.

[0063] Figure 1 This is an architecture diagram of a certificate issuance system provided in an embodiment of the present application. Figure 1 The certificate issuance system includes a DPKI client, a Web server, a blockchain-based DPKI server, and at least one domain name verification node. The DPKI client establishes a communication connection with the Web server and the DPKI server, and the DPKI server establishes a communication connection with the Web server and the at least one domain name verification node. The at least one domain name verification node can also establish a communication connection with the Web server.

[0064] Among them, the DPKI client is used to apply for a certificate for the domain name owner. The DPKI server is used to manage certificates, including certificate application, revocation, query, etc. Blockchain is the basis for the DPKI server to achieve decentralization and is used to store data in the certificate application process. At least one domain name verification node is used to verify the ownership of the domain name. Optionally, when the at least one domain name verification node includes a CA, the CA can also be used to endorse the credibility of the certificate (i.e., sign) and issue the certificate after endorsement. The web server is used to provide the domain name verification node with a verification file of the domain name.

[0065] The DPKI client is used to generate the public key and private key of the certificate for the owner of the target domain name, and to generate a certificate application request based on the public key and other information, and to send the certificate application request to the DPKI server. The certificate application request carries the target domain name, public key and other information of the certificate to be issued. The DPKI server is used to obtain challenge information after receiving the certificate application request, and store the challenge information on the blockchain. The challenge information refers to information used to verify the target domain name. The DPKI client is also used to download the challenge information from the blockchain, generate a verification file based on the challenge information, upload the verification file to the Web server, and send a verification request to the DPKI server. The DPKI server is also used to store the verification request on the blockchain after receiving the verification request. The first domain name verification node among the at least one domain name verification node is used to download the verification request from the blockchain, download the above verification file from the Web server based on the verification request, and upload the content of the verification file to the DPKI server. The DPKI server is used to receive the content of the verification file, verify the content of the verification file based on the challenge information, and instruct the DPKI client to obtain the certificate of the target domain name after the content of the verification file is verified. For specific implementation methods, please refer to the following Figures 3 to 10 The method is described in detail in the embodiment shown.

[0066] Among them, the implementation methods for the DPKI server to obtain the above-mentioned challenge information include at least two. In the first implementation method, the DPKI server is used to store the above-mentioned certificate application request on the blockchain, and receive the challenge information sent by the second domain name verification node in the at least one domain name verification node, and the challenge information is generated by the second domain name verification node after downloading the certificate application request from the blockchain. That is, the second domain name verification node is used to download the certificate application request from the blockchain, generate challenge information based on the certificate application request, and send the challenge information to the DPKI server. The second domain name verification node can be the same as or different from the first domain name verification node. Among them, the second domain name verification node is different from the first domain name verification node, indicating that this solution supports the challenger and the verifier as different entities. In the second implementation method, the DPKI server is used to generate challenge information for verifying the target domain name.

[0067] In simple terms, the DPKI server can obtain the challenge information generated by the second domain name verification node, or it can automatically generate challenge information. The specific implementation method can be seen below Figures 3 to 10 The method is described in detail in the embodiment shown.

[0068] There are also at least two implementations for the DPKI client to obtain a certificate for the target domain name. In the first implementation, the at least one domain name verification node includes a CA, and the DPKI client is also used to send a certificate issuance request to the DPKI server, and download the certificate of the target domain name from the blockchain. Among them, the certificate issuance request carries the target domain name, and the certificate issuance request is used to instruct the DPKI server to jointly generate a certificate for the target domain name and store it on the blockchain. That is, the DPKI server is also used to receive the certificate issuance request sent by the DPKI client, and store the certificate issuance request on the blockchain. The CA is used to download the certificate issuance request from the blockchain, and generate a certificate for the target domain name based on the certificate issuance request, and upload the certificate of the target domain name to the DPKI server. The DPKI server is also used to receive the certificate of the target domain name uploaded by the CA, and store the certificate of the target domain name on the blockchain. In the second implementation, the DPKI client is also used to generate a self-signed certificate for the target domain name, upload the self-signed certificate to the blockchain, and instruct the DPKI server to verify the self-signed certificate. The DPKI client is further configured to determine the self-signed certificate as a certificate of the target domain name when it is determined that the DPKI server has successfully verified the self-signed certificate.

[0069] In simple terms, a DPKI client can either obtain a certificate issued by a CA or generate a self-signed certificate. The specific implementation method can be found below. Figures 3 to 10The method is described in detail in the embodiment shown.

[0070] Optionally, the first domain name verification node is part of the domain name verification nodes in the at least one domain name verification node, and the verification request carries verification node indication information, and the verification node indication information is used to indicate the first domain name verification node. In other words, this solution supports the DPKI client to select a domain name verification node. In a specific implementation, the DPKI server is also used to select the first domain name verification node from the at least one domain name verification node based on the verification node indication information.

[0071] The verification node indication information includes the number of verification nodes and / or verification node identifiers. The number of verification nodes indicates the number of verification nodes of the first domain name, and the verification node identifier information indicates the identifier of the first domain name verification node. That is, this solution supports the DPKI client to specify the number and / or identifier of the selected domain name verification node.

[0072] In an embodiment of the present application, when the first domain name verification node includes one domain name verification node, the first domain name verification node is a CA or an oracle. When the first domain name verification node includes multiple domain name verification nodes, the multiple domain name verification nodes include a CA and / or an oracle. It should be understood that the domain name verification node in the certificate issuance system includes at least one CA, or includes at least one oracle, or includes at least one CA and at least one oracle.

[0073] In the case where the certificate issuance system includes an oracle, the oracle in the certificate issuance system is also used to send a registration request to the DPKI server to request registration in the certificate issuance system. The DPKI server is also used to receive the registration request sent by the oracle, and register the oracle requested to register in response to the registration request. In the case where the first domain name verification node includes an oracle, the DPKI server is also used to authenticate the oracle in the first domain name verification node based on the registered oracle, and instruct the DPKI client to obtain the certificate of the target domain name after the content of the above-mentioned verification file and the identity of the oracle are verified.

[0074] In order to automate and manage certificate issuance, the DPKI server is also used to record the certificate application status of the above certificate application request in the blockchain.

[0075] Optionally, the DPKI server is used to: record the certificate application status as the challenge acquisition status after receiving the certificate application request; record the certificate application status as the challenging status after storing the challenge information on the blockchain, for example, changing the certificate application status from the challenge acquisition status to the challenging status; record the certificate application status as the pending verification status after storing the verification request on the blockchain, for example, changing the certificate application status from the challenging status to the pending verification status; record the certificate application status as the verified status after the content of the verification file is verified.

[0076] Corresponding to the above two implementation methods of the DPKI client for obtaining the certificate of the target domain name, the DPKI server is also used to: record the certificate application status as a pending issuance status after storing the certificate issuance request on the blockchain, and record the certificate application status as an issued status after storing the certificate of the target domain name on the blockchain; or, after the self-signed certificate of the DPKI client is verified, record the certificate application status as an issued status.

[0077] The certificate application status recorded on the blockchain supports query by DPKI clients and domain name verification nodes, and executes the corresponding steps in the certificate issuance process based on the queried certificate application status. For example, when the DPKI client determines that the certificate application status is issued by querying the records on the blockchain, it downloads the certificate of the target domain name from the blockchain. For another example, when the first domain name verification node determines that the certificate application status is pending verification by querying the records on the blockchain, it downloads the verification request from the blockchain.

[0078] To put it another way, the DPKI client and the domain name verification node can determine the corresponding steps in the certificate issuance process by self-detecting the certificate application status recorded on the blockchain. Of course, the DPKI client and the domain name verification node can also determine the corresponding steps in the certificate issuance process through the instruction message sent by the DPKI server. For example, after the DPKI server verifies the content of the verification file, it sends a verification pass indication message to the DPKI server. After receiving the verification pass indication message, the DPKI client executes the step of generating a certificate issuance request or generating a self-signed certificate. For another example, after receiving the verification request, the DPKI server sends a verification instruction message to the first domain name verification node. After receiving the verification instruction message, the first domain name verification node executes the step of downloading the verification request from the blockchain.

[0079] Among them, the DPKI server can create a certificate application record about the above-mentioned certificate application request on the blockchain, and the certificate application record is used to record the above-mentioned certificate application status.

[0080] Optionally, the certificate application record is also used to record one or more of the above-mentioned certificate application request, challenge information, content of the verification file, certificate issuance request, certificate of the target domain name, etc.

[0081] It should be understood that the information in the certificate application record is stored in the same block of the blockchain, for example, in the first block, which is convenient for the management of the DPKI server and the query of the DPKI client and the domain name verification node.

[0082] In order to realize the automated execution of the certificate issuance process, ensure the security and reliability of certificate issuance, and manage the domain name verification node, etc., the embodiment of the present application deploys a smart contract on the blockchain. The smart contract stipulates the strategies for the DPKI client, DPKI server, and domain name verification node in the certificate issuance system to execute the corresponding steps in the certificate issuance process, including certificate verification strategy, domain name verification node management strategy, etc. It can also include the strategy for the DPKI client and domain name verification node to automatically detect the certificate application status. For specific implementation methods, please refer to the following Figures 3 to 10 Related introduction in the method embodiment shown.

[0083] In the embodiment of the present application, the DPKI client can be any form of client, such as a laptop, desktop computer or tablet computer. The blockchain and the DPKI server can be a whole, which can include a server cluster, which can include physical servers and / or cloud servers. The domain name verification node can include a CA or an oracle. Among them, the oracle can be a virtual entity or a physical entity.

[0084] It should be understood that the system architecture and business scenarios described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. Ordinary technicians in this field can know that with the evolution of the system architecture and the emergence of new business scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0085] Figure 2 is a schematic diagram of a computing device according to an embodiment of the present application. Optionally, the computing device can become Figure 1 Part or all of the DPKI client, DPKI server, or domain validator shown in . Figure 2 The computing device includes one or more processors 201 , a communication bus 202 , a memory 203 , and one or more communication interfaces 204 .

[0086] The processor 201 is a general-purpose central processing unit (CPU), a network processing (NP), a microprocessor, or one or more integrated circuits for implementing the solution of the present application, such as an application-specific integrated circuit (ASIC), a programmable logic device (PLD) or a combination thereof. Optionally, the PLD is a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL) or any combination thereof.

[0087] The communication bus 202 is used to transmit information between the above components. Optionally, the communication bus 202 is divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0088] Optionally, the memory 203 is a read-only memory (ROM), a random access memory (RAM), an electrically erasable programmable read-only memory (EEPROM), an optical disc (including a compact disc read-only memory (CD-ROM), a compressed optical disc, a laser disc, a digital versatile disc, a Blu-ray disc, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory 203 exists independently and is connected to the processor 201 via the communication bus 202, or the memory 203 is integrated with the processor 201.

[0089] The communication interface 204 uses any transceiver-like device for communicating with other devices or communication networks. The communication interface 204 includes a wired communication interface, and optionally, also includes a wireless communication interface. Among them, the wired communication interface is, for example, an Ethernet interface. Optionally, the Ethernet interface is an optical interface, an electrical interface, or a combination thereof. The wireless communication interface is a wireless local area network (WLAN) interface, a cellular network communication interface, or a combination thereof.

[0090] Optionally, in some embodiments, the computing device includes multiple processors, such as Figure 2 The processor 201 and the processor 205 shown in . Each of these processors is a single-core processor, or a multi-core processor. Optionally, the processor here refers to one or more devices, circuits, and / or processing cores for processing data (such as computer program instructions).

[0091] In a specific implementation, as an embodiment, the computing device further includes an output device 206 and an input device 207. The output device 206 communicates with the processor 201 and can display information in a variety of ways. For example, the output device 206 is a liquid crystal display (LCD), a light emitting diode (LED) display device, a cathode ray tube (CRT) display device or a projector. The input device 207 communicates with the processor 201 and can receive user input in a variety of ways. For example, the input device 207 is a mouse, a keyboard, a touch screen device or a sensor device.

[0092] In some embodiments, the memory 203 is used to store the program code 210 for executing the solution of the present application, and the processor 201 can execute the program code 210 stored in the memory 203. The program code includes one or more software modules, and the computing device can implement the following by the processor 201 and the program code 210 in the memory 203. Figure 3 The certificate issuance method provided by the embodiment.

[0093] Next, please combine Figures 3 to 10 The embodiment introduces the certificate issuance method provided in the embodiment of the present application.

[0094] Figure 3 : is a flow chart of a certificate issuance method provided in an embodiment of the present application, the method is applied to a certificate issuance system, the certificate issuance system includes a DPKI client, a Web server, a blockchain-based DPKI server, and at least one domain name verification node. Figure 2 , the method comprises the following steps.

[0095] Step 301: The DPKI client sends a certificate application request to the DPKI server. The certificate application request carries the target domain name of the certificate to be issued.

[0096] The certificate application request is used to instruct the DPKI server to obtain challenge information and store the challenge information on the blockchain. The challenge information refers to the information used to verify the target domain name.

[0097] Before sending a certificate request to the DPKI server, the DPKI client generates the public key and private key of the certificate. In addition to the target domain name, the certificate request also carries the public key. The public key can be used for information verification in subsequent processes. For specific implementation methods, please refer to the relevant introduction below.

[0098] Optionally, the certificate application request also carries a challenge type. The challenge type refers to the type of verification challenge for the target domain name. The challenge type can be a hypertext transfer protocol (HTTP) type, a domain name system (DNS) type, etc.

[0099] Step 302: The DPKI server receives the certificate application request, obtains challenge information, and stores the challenge information on the blockchain. The challenge information refers to information used to verify the target domain name.

[0100] As can be seen from the foregoing, there are at least two implementation methods for the DPKI server to obtain the challenge information, which will be described in detail below.

[0101] In a first implementation manner in which the DPKI server obtains the challenge information, the DPKI server stores the certificate application request on the blockchain, the second domain name verification node among the at least one domain name verification node downloads the certificate application request from the blockchain, generates the challenge information based on the certificate application request, and sends the challenge information to the DPKI server. The DPKI server receives the challenge information sent by the second domain name verification node. That is, in this implementation manner, the challenge information is generated by the second domain name verification node after downloading the certificate application request from the blockchain and sent to the DPKI server.

[0102] Exemplarily, the DPKI server creates a certificate application record about the certificate application request on the blockchain, and records the certificate application request in the certificate application record. The certificate application record may be stored in the first block of the blockchain.

[0103] Optionally, after receiving the certificate application request, the DPKI client records the certificate application status of the certificate application request on the blockchain as a challenge acquisition status. The second domain name verification node can detect the certificate application status recorded on the blockchain, and download the certificate application request from the blockchain when detecting that the certificate application status recorded on the blockchain is a challenge acquisition status.

[0104] Among them, the certificate application status can be recorded in the certificate application record about the certificate application request created by the DPKI server on the blockchain.

[0105] Alternatively, after storing the certificate application request on the blockchain, the DPKI client sends a challenge indication message to the second domain name verification node, where the challenge indication message is used to instruct the second domain name verification node to download the certificate application request from the blockchain.

[0106] The challenge indication message carries the identifier of the target domain name and / or the first block, and the second domain name verification node searches for the certificate application request on the blockchain based on the identifier of the target domain name and / or the first block, thereby obtaining the certificate application request.

[0107] In an embodiment of the present application, the second domain name verification node is a CA or a prophet. In addition, when the number of the at least one domain name verification node is multiple, the second domain name verification node is a domain name verification node selected by the DPKI server from the at least one domain name verification node. For example, the certificate application request also carries challenge node indication information, and the DPKI server selects a second domain name verification node from the at least one domain name verification node based on the challenge node indication information. The challenge node indication information includes the number of challenge nodes and / or challenge node identifiers, the number of challenge nodes indicates the number of second domain name verification nodes, and the challenge node identification information indicates the identifier of the second domain name verification node. For another example, the DPKI server selects a second domain name verification node from the at least one domain name verification node according to a first strategy. The first strategy may include a load balancing strategy, a sequential selection strategy, a random selection strategy, or the like.

[0108] In a second implementation manner in which the DPKI server obtains the challenge information, the certificate application request also carries the public key of the certificate, and the DPKI server generates challenge information after receiving the certificate application request, and the challenge information includes the first random number. That is, in this implementation manner, the challenge information is automatically generated by the DPKI server.

[0109] One implementation method for the DPKI server to generate challenge information is: the DPKI server performs a hash operation on the target domain name, the identifier of the first block, the public key of the certificate, and the challenge information recorded in the second block to obtain a first random number. The first block refers to a block on the blockchain that is used to record the certificate application record for the target domain name, and the second block refers to the previous block of the first block on the blockchain. The challenge information recorded in the second block is the challenge information obtained by the DPKI server after receiving another certificate application request before receiving the above-mentioned certificate application request. The challenge information recorded in the second block may include a third random number, and the third random number may be generated by the DPKI server.

[0110] In other embodiments, the DPKI server may also generate challenge information in other ways, and the above implementation is not intended to limit the embodiments of the present application.

[0111] Optionally, in the second implementation manner in which the DPKI server obtains the challenge information, the DPKI server may also store the certificate application request on the blockchain, and may also record the certificate application status of the certificate application request as a challenge acquisition status on the blockchain. For example, the DPKI server stores the certificate application record in the first block on the blockchain, creates a certificate application record for the certificate application request, and sets the certificate application status of the certificate application request as a challenge acquisition status in the certificate application record.

[0112] After obtaining the challenge information, the DPKI server can find the certificate application record about the certificate application request from the blockchain based on the domain name, public key and other information carried in the certificate application request, and store the challenge information in the first block where the certificate application record is located. Optionally, the DPKI server stores the challenge information in the certificate application record.

[0113] In addition, after storing the challenge information on the blockchain, the DPKI server records the certificate application status as the challenging status, for example, changing the certificate application status from the challenge obtaining status to the challenging status.

[0114] Step 303: The DPKI client downloads the challenge information from the blockchain.

[0115] In the case where the certificate application status related to the certificate application request is recorded on the blockchain, the DPKI client downloads the challenge information from the blockchain after detecting that the certificate application status is in the challenging state. Alternatively, regardless of whether the certificate application status is recorded on the blockchain, the DPKI server can generate an indication message after storing the challenge information on the blockchain, and send the indication message to the DPKI client, the indication message is used to instruct the DPKI client to download the challenge information from the blockchain, that is, the DPKI client can also download the challenge information from the blockchain after receiving the indication message sent by the DPKI server.

[0116] Step 304: The DPKI client generates a verification file based on the challenge information, and uploads the verification file to the Web server.

[0117] There are many implementations of the DPKI client generating a verification file based on the challenge information, which is not limited in the present embodiment. The following is a method for the DPKI client to generate a verification file based on the challenge information when the challenge information includes a first random number generated by the DPKI server.

[0118] In this implementation, the challenge information includes a first random number generated by the DPKI server, a second random number generated by the DPKI client, a hash value is obtained by performing a hash operation on the first random number and the second random number, the hash value is signed using the private key of the certificate to obtain the content of the verification file, and a verification file is generated based on the content of the verification file. That is, the content of the verification file is signed by the DPKI client using the private key corresponding to the public key of the certificate to perform a hash operation on the first random number and the second random number to obtain the hash value.

[0119] It should be understood that the DPKI client can generate a verification file in a certain format based on the content of the verification file. There are many implementation methods, which are not limited in the embodiments of the present application.

[0120] After generating the verification file, the DPKI server uploads the verification file to the Web server. The Web server is used to provide the verification file to the verifier, which includes the DPKI server and the domain name verification node.

[0121] Step 305: The DPKI client sends a verification request to the DPKI server.

[0122] When the DPKI client uploads the verification file to the Web server, the DPKI client sends a verification request to the DPKI server. That is, the verification request is sent after the DPKI client generates the verification file based on the challenge information and uploads the verification file to the Web server. The verification request is used to instruct the DPKI server to verify the content of the verification file in conjunction with the first domain name verification node of the at least one domain name verification node and the Web server.

[0123] In one implementation, the verification request carries the second random number, and the second random number carried in the verification request can be used by the DPKI server to subsequently verify the content of the verification file. The specific implementation will be described below.

[0124] In some embodiments, the first domain name verification node is part of the at least one domain name verification node, and the verification request carries verification node indication information, and the verification node indication information is used to indicate the first domain name verification node. In other words, this solution supports the DPKI client to select a domain name verification node.

[0125] The verification node indication information includes the number of verification nodes and / or verification node identifiers, the number of verification nodes indicates the number of verification nodes of the first domain name, and the verification node identifier information indicates the identifier of the verification node of the first domain name. That is, this solution supports the DPKI client to specify the number and / or identifier of the selected domain name verification node.

[0126] In an embodiment of the present application, the first domain name verification node is a CA or a oracle. Wherein, in the case where the first domain name verification node includes one domain name verification node, the first domain name verification node is a CA or a oracle. In the case where the first domain name verification node includes multiple domain name verification nodes, the multiple domain name verification nodes include a CA and / or a oracle. It should be understood that the domain name verification node in the certificate issuance system includes at least one CA, or includes at least one oracle, or includes at least one CA and at least one oracle.

[0127] Step 306: The DPKI server receives the verification request and stores the verification request on the blockchain.

[0128] After the DPKI server receives the verification request and stores the verification request on the blockchain, if the verification request carries verification node indication information, the DPKI server also selects a first domain name verification node from the at least one domain name verification node based on the verification node indication information. The DPKI server sends a verification indication message to the selected first domain name verification node to instruct the first domain name verification node to perform step 207. The verification indication message may carry identification information of the target domain name and / or the first block. The first block refers to a block on the blockchain used to record certificate application records about the target domain name.

[0129] As can be seen from the foregoing, the verification node indication information includes the number of verification nodes and / or verification node identifiers. Wherein, in the case where the verification node indication information includes the number of verification nodes, the DPKI server selects domain name verification nodes with the number of verification nodes from the at least one domain name verification node as the first domain name verification node.

[0130] In a case where the verification node indication information includes verification node identification information, the DPKI server selects a domain name verification node corresponding to the verification node identification information from the at least one domain name verification node as the first domain name verification node.

[0131] In the case where the verification node indication information includes the number of verification nodes and the verification node identification information, generally speaking, the total number of domain name verification nodes identified by the verification node identification information is the same as the number of verification nodes, and the DPKI server selects the domain name verification node corresponding to the verification node identification information from the at least one domain name verification node as the first domain name verification node. If there is a situation where the total number of domain name verification nodes identified by the verification node identification information is different from the number of verification nodes, the DPKI server may select the first domain name verification node according to the verification node identification information by default. Optionally, in the case where the total number of domain name verification nodes identified by the verification node identification information is less than the number of verification nodes, the DPKI server may also select some domain name verification nodes from the remaining domain name verification nodes after selecting some domain name verification nodes in the first domain name verification node according to the verification node identification information, so that the total number of selected domain name verification nodes is equal to the number of verification nodes. In short, the DPKI server may select the first domain name verification node based on the number of verification nodes, or may select the first domain name verification node based on the verification node identification information.

[0132] Optionally, the DPKI server records the certificate application status as a pending verification status after storing the verification request in the blockchain, for example, changing the certificate application status from a challenging status to a pending verification status.

[0133] Step 307: The first domain name verification node downloads the verification request from the blockchain.

[0134] The first domain name verification node is part of the at least one domain name verification node, and the first domain name verification node is selected by the DPKI server from the at least one domain name verification node. Of course, the first domain name verification node may also be selected by the DPKI server from the at least one domain name verification node according to the second strategy. The second strategy may include a load balancing strategy, a sequential selection strategy, a random selection strategy, etc.

[0135] The first domain name verification node may download the verification request from the blockchain when it is determined by querying the records on the blockchain that the certificate application status is in a pending verification state. Alternatively, the first domain name verification node downloads the verification request from the blockchain after receiving the verification instruction message sent by the DPKI server. The verification instruction message carries the identification information of the target domain name and / or the first block. The first domain name verification node queries and downloads the verification request from the blockchain based on the identification information of the target domain name and / or the first block.

[0136] The above verification request is generated after the DPKI client generates a verification file based on the challenge information and uploads the verification file to the Web server. The challenge information is obtained by the DPKI server after receiving the certificate application request sent by the DPKI client and stored on the blockchain. The certificate application request carries the target domain name.

[0137] Step 308: The first domain name verification node downloads the verification file from the Web server based on the verification request, and uploads the content of the verification file to the DPKI server.

[0138] Exemplarily, the first domain name verification node sends a download request to the corresponding Web server based on the verification request, and the download request indicates the target domain name. After receiving the download request, the Web server finds the verification file based on the target domain name and sends the found verification file to the first domain name verification node.

[0139] After downloading the verification file, the first domain name verification node uploads the content of the verification file to the DPKI server to instruct the DPKI server to verify the content of the verification file based on the challenge information and instruct the DPKI client to obtain the certificate of the target domain name after the content of the verification file is verified.

[0140] Step 309: The DPKI server receives the content of the verification file uploaded by the first domain name verification node, verifies the content of the verification file based on the challenge information, and instructs the DPKI client to obtain a certificate for the target domain name after the content of the verification file is verified.

[0141] After receiving the content of the verification file, the DPKI server verifies the content of the verification file based on the challenge information, that is, the DPKI server verifies whether the content of the verification file matches the challenge information. There are many specific implementation methods, which are not limited in the embodiments of the present application. The following is an implementation method in which the DPKI server verifies the content of the verification file based on the challenge information when the challenge information includes the first random number generated by the DPKI server.

[0142] In this implementation, the challenge information includes a first random number generated by the DPKI server, the verification request carries a second random number generated by the DPKI client, and the content of the verification file stored on the Web server is signed by the DPKI client using the private key corresponding to the public key of the certificate to obtain a hash value obtained by performing a hash operation on the first random number and the second random number. Based on this, after receiving the content of the verification file uploaded by the first domain name verification node, the DPKI server uses the public key to verify the content of the verification file based on the first random number and the second random number.

[0143] Exemplarily, the DPKI server performs a hash operation on the first random number and the second random number to obtain a hash number, uses the public key to sign the hash number, and compares the information obtained by the signature with the content of the verification file uploaded by the first domain name verification node. If the comparison result indicates that the information obtained by the DPKI server's signature is consistent with the content of the verification file uploaded by the first domain name verification node, the DPKI server determines that the content verification of the verification file uploaded by the first domain name verification node has passed. If the comparison result indicates that the information obtained by the DPKI server's signature is inconsistent with the content of the verification file uploaded by the first domain name verification node, the DPKI server determines that the content verification of the verification file uploaded by the first domain name verification node has failed.

[0144] As can be seen from the foregoing, the first domain name verification node includes a CA and / or an oracle. In the case where the first domain name verification node includes an oracle, the DPKI server can choose to verify the identity of the oracle in the first domain name verification node in addition to verifying the content of the verification file uploaded by the first domain name verification node. In this way, after the content of the verification file and the identity of the oracle are verified, the DPKI server instructs the DPKI client to obtain a certificate for the target domain name.

[0145] Among them, the oracle can be registered in the domain name issuance system, and the DPKI server authenticates the oracle in the first domain name verification node based on the registered oracle.

[0146] The oracle registration process includes: the oracle in the domain name issuance system sends a registration request to the DPKI server, which is used to request registration in the domain name issuance system. The DPKI server receives the registration request sent by the oracle, responds to the registration request sent by the oracle, and registers the corresponding oracle.

[0147] Among them, the registration request may carry the identification information of the oracle. After receiving the registration request, the DPKI server stores the identification information of the oracle on the blockchain to realize the registration of the corresponding oracle. That is, the identification information of the oracle stored on the blockchain is the identification information of the registered oracle. Accordingly, after receiving the content of the verification file uploaded by the first domain name verification node, the DPKI server compares the identification information of the oracle in the first domain name verification node that uploaded the content of the verification file with the identification information of the oracle stored on the blockchain. If the comparison result indicates that the identification information of the oracle stored on the blockchain includes the identification information of the oracle that uploaded the content of the verification file, the DPKI server determines that the identity authentication of the oracle in the first domain name verification node is passed. If the comparison result indicates that the identification information of the oracle stored on the blockchain does not include the identification information of any oracle that uploaded the content of the verification file, the DPKI server determines that the identity authentication of the oracle in the first domain name verification node is not passed.

[0148] In the case that the content of the verification file uploaded by any verification node in the first domain name verification node and / or the identity authentication of any oracle fails, the DPKI server sends a prompt message indicating that the certificate application failed to the DPKI client. When the DPKI client receives the prompt message, it can terminate the certificate application for the target domain name, or choose to re-apply for the certificate for the target domain name.

[0149] Optionally, after the DPKI server verifies the content of the verification file uploaded by the first domain name verification node (or verifies the identity of the oracle in the first domain name verification node), it sends a verification success indication message to the DPKI client to instruct the DPKI client to execute subsequent steps.

[0150] The DPKI server records the certificate application status as verified after verifying the content of the verification file uploaded by the first domain name verification node, for example, changing the certificate application status from pending verification to verified. Alternatively, the DPKI server records the certificate application status as verified after verifying the content of the verification file and the identity of the oracle in the first domain name verification node.

[0151] Step 310: The DPKI client obtains the certificate of the target domain name when it is determined that the DPKI server has successfully verified the content of the verification file uploaded by the first domain name verification node.

[0152] It should be understood that in the case where the DPKI server also verifies the identity of the oracle in the first domain name verification node, the DPKI client obtains the certificate of the target domain name when it is determined that the content of the verification file uploaded by the DPKI server to the first domain name verification node and the identity of the oracle in the first domain name verification node have been verified successfully.

[0153] The DPKI client can determine whether the DPKI server has successfully verified the content of the verification file uploaded by the first domain name verification node by detecting the certificate application status recorded on the blockchain. When the DPKI client detects that the certificate application status recorded on the blockchain is in the verified state, it determines that the DPKI server has successfully verified the content of the verification file uploaded by the first domain name verification node. Alternatively, after receiving the verification success indication message sent by the DPKI server, the DPKI client determines that the DPKI server has successfully verified the content of the verification file uploaded by the first domain name verification node.

[0154] As can be seen from the above, the DPKI client can obtain a certificate issued by a CA or generate a self-signed certificate. That is, there are at least two ways for the DPKI client to obtain a certificate for a target domain name. This will be introduced below.

[0155] In a first implementation manner in which a DPKI client obtains a certificate for a target domain name, the at least one domain name verification node includes a CA. After determining that the DPKI server has successfully verified the content of the verification file uploaded by the first domain name verification node, the DPKI client sends a certificate issuance request to the DPKI server. The certificate issuance request carries the target domain name, and the certificate issuance request is used to instruct the DPKI server to jointly generate a certificate for the target domain name and store it on the blockchain. The DPKI server receives the certificate issuance request and stores the certificate issuance request on the blockchain. The CA downloads the certificate issuance request from the blockchain, generates a certificate for the target domain name based on the certificate issuance request, and uploads the certificate for the target domain name to the DPKI server. The DPKI server receives the certificate for the target domain name uploaded by the CA and stores the certificate for the target domain name on the blockchain. The DPKI client downloads the certificate for the target domain name from the blockchain.

[0156] The CA that generates the certificate of the target domain name is the second domain name verification node or the first domain name verification node. The first domain name verification node and the second domain name verification node may be the same or different.

[0157] It should be understood that the certificate issuance request is a more formal certificate request compared to the above-mentioned certificate application request, and the certificate issuance request can be generated according to the Certificate Management Protocol-version 2 (CMPv2) protocol or other protocols.

[0158] After storing the certificate issuance request on the blockchain, the DPKI server records the certificate application status as pending issuance. When the CA detects that the certificate application status recorded on the blockchain is pending issuance, it downloads the certificate issuance request from the blockchain. Alternatively, after storing the certificate issuance request on the blockchain, the DPKI server sends a certificate issuance instruction message to the CA, and the CA downloads the certificate issuance request from the blockchain after receiving the certificate issuance instruction message.

[0159] It should be understood that the CA generating the certificate of the target domain name includes generating a certificate to be signed and signing the certificate to be signed to obtain the certificate of the target domain name, that is, the certificate of the target domain name includes the signature information of the CA on the certificate.

[0160] In a specific implementation, the certificate of the target domain name includes signature information of the certificate from one or more CAs. That is, the one or more CAs download the certificate issuance request from the blockchain, and generate a certificate for the target domain name based on the certificate issuance request, including signing the certificate. Among them, the first CA among the one or more CAs downloads the certificate issuance request from the blockchain, generates a certificate to be signed based on the certificate issuance request, and signs the certificate and sends it to another CA among the one or more CAs to instruct the other CA to sign the certificate, until the one or more CAs sign the certificate and obtain the certificate for the target domain name. The certificate of the target domain name can be uploaded to the blockchain by the last signing CA, or by the first CA or other CAs.

[0161] After storing the certificate of the target domain name on the blockchain, the DPKI server records the certificate application status as issued. When the DPKI client determines that the certificate application status is issued, it downloads the certificate of the target domain name from the blockchain. Alternatively, after storing the certificate of the target domain name on the blockchain, the DPKI server sends a certificate issued indication message to the DPKI client, and after receiving the certificate issued indication message, the DPKI client downloads the certificate of the target domain name from the blockchain.

[0162] In the first implementation of the DPKI client obtaining the certificate of the target domain name, the DPKI client generates a self-signed certificate for the target domain name, uploads the self-signed certificate to the blockchain, and instructs the DPKI server to verify the self-signed certificate. The DPKI server receives the self-signed certificate for the target domain name uploaded by the DPKI client, verifies the self-signed certificate, and instructs the DPKI client to determine the self-signed certificate as the certificate of the target domain name after the self-signed certificate is verified. That is, the DPKI client determines the self-signed certificate as the certificate of the target domain name when it is determined that the DPKI server has verified the self-signed certificate.

[0163] Optionally, the DPKI client may also generate a self-signed certificate while generating the public key and private key of the certificate, and send the self-signed certificate to the DPKI server. The self-signed certificate may be carried in a certificate application request and sent to the DPKI server, or may be carried in a verification request and sent to the DPKI server, which is not limited in the present embodiment of the application.

[0164] Next, please combine Figures 4 to 9 The embodiment further illustrates the above-mentioned certificate issuance method. Figures 4 to 9 The steps in the embodiment can all be automatically executed based on the smart contract deployed on the blockchain. That is, the DPKI server deploys a smart contract on the blockchain, which can be called by the DPKI client and the domain name verification node. Among them, the smart contract indicates the verification strategy, the management strategy of the domain name verification node, etc.

[0165] Figure 4 is a flow chart of another certificate issuance method provided by an embodiment of the present application. Figure 4 The certificate issuance system includes a DPKI client, a Web server, a DPKI server, and at least one domain name verification node. Figure 4 The main roles of the DPKI client, the Web server, the DPKI server, and at least one domain name verification node in some embodiments of the method are understood. The method mainly includes the following steps 1 to 10.

[0166] Step 1: Generate public and private keys. That is, the DPKI client generates the public key (PK) and secret key (SK) of the certificate.

[0167] Step 2: Submit a certificate application request. That is, the DPKI client sends a certificate application request to the DPKI server by calling the smart contract. The certificate application request carries the challenge type and the target domain name. Optionally, the certificate application request also carries PK, etc. The DPKI server generates a first block on the blockchain and stores the certificate application request in the first block.

[0168] Step 3: Challenge. That is, the domain name verification node obtains the certificate application request by querying the generation information of the block, generates challenge information for verifying the target domain name based on the certificate application request, and calls the smart contract to upload the challenge information to the DPKI server. The DPKI server stores the challenge information on the blockchain. Optionally, the challenge information includes the challenge type, the target domain name, the challenge parameters (such as the first random number), etc.

[0169] Step 4: Verification file generation. That is, the DPKI client downloads the challenge information from the blockchain and generates a verification file based on the challenge information.

[0170] Step 5: Verification file upload. That is, the DPKI client uploads the verification file to the Web server.

[0171] Step 6: Request verification. That is, the DPKI client sends a verification request to the DPKI server, and the DPKI server stores the verification request on the blockchain. The verification request carries the target domain name. Optionally, the verification request also carries a public key, etc.

[0172] Step 7: Domain name verification. After detecting that the verification request is stored on the blockchain, the domain name verification node downloads the verification request from the blockchain and downloads the verification file from the Web server based on the verification request.

[0173] Step 8: Upload the verification content (i.e. the content of the verification file). That is, the domain name verification node uploads the content of the verification file to the DPKI server.

[0174] Step 9: Verification. That is, the DPKI server verifies the content of the received verification file based on the challenge information, and instructs the DPKI client to obtain the certificate of the target domain name after the verification passes.

[0175] Step 10: Obtain the certificate. That is, after detecting that the DPKI server has successfully verified the content of the verification file uploaded by the domain name verification node, the DPKI client obtains the certificate by sending a certificate issuance request, or generates a self-signed certificate.

[0176] Figure 5 This is a flow chart of another certificate issuance method provided in an embodiment of the present application. Figure 5 The certificate issuance system includes a DPKI client, a Web server, a DPKI server, and a CA. The method mainly includes the following steps 1 to 25.

[0177] Step 1: The DPKI client generates the public key (PK) and private key (SK) of the certificate.

[0178] Step 2: The DPKI client sends a certificate request to the DPKI server by calling the smart contract. The certificate request carries the challenge type and target domain name. Optionally, the certificate request also carries PK, etc.

[0179] Step 3: After receiving the certificate application request, the DPKI server generates a first block on the blockchain, creates a certificate application record on the first block, stores the certificate application request in the certificate application record, and sets the certificate application status to the challenge acquisition status.

[0180] Step 4: CA downloads the certificate application request from the blockchain by querying the generation information of the block.

[0181] Step 5: The CA generates challenge information for verifying the target domain name based on the certificate application request. The challenge information includes the challenge type, target domain name, challenge parameters, etc.

[0182] Step 6: CA calls the smart contract to upload the challenge information to the DPKI server.

[0183] Step 7: After receiving the challenge information, the DPKI server searches the blockchain for the certificate application record created in the first block based on the content of the challenge information, stores the challenge information in the certificate application record, and changes the certificate application status to the challenging status.

[0184] Step 8: After detecting that the certificate application status is in the challenging state, the DPKI client downloads the challenge information from the blockchain.

[0185] Step 9: The DPKI client generates a verification file based on the challenge information.

[0186] Step 10: The DPKI client uploads the verification file to the web server.

[0187] Step 11: The DPKI client sends a verification request to the DPKI server, and the verification request carries the target domain name and optionally also carries a public key.

[0188] Step 12: After receiving the verification request, the DPKI server stores the verification request in the first block and changes the certificate application status to a pending verification status.

[0189] Step 13: After detecting that the verification request is stored on the blockchain, the CA downloads the verification request from the blockchain.

[0190] Step 14: The CA downloads the verification file from the Web server based on the verification request.

[0191] Step 15: CA uploads the content of the verification file (referred to as verification content) to the DPKI server.

[0192] Step 16: The DPKI server verifies the content of the received verification file based on the challenge information, and changes the certificate application status to verified status after the verification passes.

[0193] Step 17: The DPKI client obtains the verification result of the DPKI server, such as checking whether the certificate application status recorded on the blockchain is verified.

[0194] Step 18: After determining that the verification result of the DPKI server indicates that the content of the verification file has been verified, the DPKI client sends a certificate issuance request to the DPKI server, and the certificate issuance request carries the target domain name, public key, etc.

[0195] Step 19: After receiving the certificate issuance request, the DPKI server stores the certificate issuance request in the blockchain and changes the certificate application status to pending issuance.

[0196] Step 20: After determining that the certificate application status is pending issuance, the CA downloads the certificate issuance request from the blockchain.

[0197] Step 21: The CA generates an initial certificate based on the certificate issuance request, and signs the initial certificate to obtain a certificate for the target domain name. The certificate for the target domain name includes the signature information of the CA on the certificate.

[0198] Step 22: The CA uploads the certificate of the target domain name to the DPKI server.

[0199] Step 23: The DPKI server stores the certificate of the target domain name in the blockchain and changes the certificate application status to issued.

[0200] Step 24: After confirming that the certificate application status is issued, the DPKI client downloads the certificate of the target domain name from the blockchain.

[0201] Step 25: The DPKI client stores the certificate for the target domain name.

[0202] From the above, we can see that Figure 5 In the illustrated embodiment, the smart contract of the blockchain and the CA are combined to achieve decentralized certificate management and issuance, which enhances the credibility of the certificate while being compatible with the advantages of traditional CA.

[0203] Figure 6 This is a flow chart of another certificate issuance method provided in an embodiment of the present application. Figure 6The certificate issuance system includes a DPKI client, a Web server, a DPKI server, and CA1, and also includes at least one other domain name verification node, and at least one other domain name verification node includes CA2 or a prophet. The method mainly includes the following steps 1 to 25.

[0204] Among them, steps 1 to 11 are Figure 5 Steps 1 to 11 in the illustrated embodiment are the same, but it should be noted that Figure 6 The CA in steps 1 to 11 in the embodiment is CA1.

[0205] Step 12: After receiving the verification request, the DPKI server stores the verification request in the first block and changes the certificate application status to pending verification. In addition, the DPKI server selects CA2 or the oracle from at least one other domain name verification node according to the verification strategy, and instructs CA2 or the oracle to perform verification. The verification strategy may be a responsible balancing strategy, a random selection strategy, or a sequential selection strategy.

[0206] Step 13: After detecting that the verification request is stored on the blockchain, CA2 or the oracle downloads the verification request from the blockchain.

[0207] Step 14: CA2 or the oracle downloads the verification file from the web server based on the verification request.

[0208] Step 15: CA2 or the oracle uploads the content of the verification file to the DPKI server.

[0209] Step 16: The DPKI server verifies the content of the received verification file based on the challenge information, and verifies the identity of the oracle that uploaded the content of the verification file. After the content of the verification file and the identity of the oracle are verified, the certificate application status is changed to verified status.

[0210] Steps 17 to 25 and Figure 5 Steps 17 to 25 in the illustrated embodiment are the same, but it should be noted that Figure 6 The CA in steps 17 to 25 in the embodiment is CA1.

[0211] From the above, we can see that Figure 6 In the illustrated embodiment, the smart contract of blockchain and the distributed CA / oracle are combined to realize decentralized certificate management and issuance, which enhances the credibility of certificates while being compatible with the advantages of traditional CA.

[0212] Figure 7 This is a flow chart of another certificate issuance method provided in an embodiment of the present application. Figure 7The certificate issuance system includes a DPKI client, a Web server, a DPKI server, and multiple oracles. The method mainly includes the following steps 1 to 21.

[0213] Among them, step 1 to step 2 and Figure 5 Steps 1 to 2 in the illustrated embodiment are the same.

[0214] Step 3: After receiving the certificate application request, the DPKI server generates a first block on the blockchain, creates a certificate application record on the first block, stores the certificate application request in the certificate application record, and sets the certificate application status to the challenge acquisition status. In addition, the DPKI server selects Oracle 1 from the multiple oracles and instructs Oracle 1 to perform a verification challenge on the target domain name.

[0215] Step 4: Oracle 1 downloads the certificate application request from the blockchain.

[0216] Step 5: Oracle 1 generates challenge information for verifying the target domain name based on the certificate application request. The challenge information includes challenge type, target domain name, challenge parameters, etc.

[0217] Step 6: Oracle 1 calls the smart contract to upload the challenge information to the DPKI server.

[0218] Steps 7 to 11 and Figure 5 Steps 7 to 11 in the illustrated embodiment are the same. However, it should be noted that Figure 7 The verification request in the illustrated embodiment carries verification node indication information.

[0219] Step 12: After receiving the verification request, the DPKI server stores the verification request in the first block and changes the certificate application status to pending verification. In addition, based on the verification node indication information, the DPKI server selects an oracle from multiple oracles for verification. The oracle selected here may be or may not be the above-mentioned oracle 1. The following takes the oracle selected here as oracle 1 as an example.

[0220] Step 13: After Oracle 1 detects that the verification request is stored on the blockchain, it downloads the verification request from the blockchain.

[0221] Step 14: Oracle 1 downloads the above verification file from the Web server based on the verification request.

[0222] Step 15: Oracle 1 uploads the content of the verification file to the DPKI server.

[0223] Step 16: The DPKI server verifies the content of the received verification file based on the challenge information, and verifies the identity of Oracle 1. After both verifications are passed, the certificate application status is changed to verified status.

[0224] Step 17: The DPKI client obtains the verification result of the DPKI server, such as checking whether the certificate application status recorded on the blockchain is verified.

[0225] Step 18: After the DPKI client determines that the verification result of the DPKI server indicates that the content of the verification file has been verified, it generates a self-signed certificate, where the self-signed certificate includes the name of the blockchain and the address information of the smart contract.

[0226] Step 19: The DPKI client uploads the self-signed certificate to the DPKI server.

[0227] Step 20: The DPKI server verifies the self-signed certificate, including verifying the correspondence between the domain name and the public key, etc. After the verification is passed, the DPKI server changes the certificate application status to issued status.

[0228] Step 21: After determining that the certificate application status is issued, the DPKI client determines the self-signed certificate as the certificate of the target domain name and stores the certificate.

[0229] From the above, we can see that Figure 7 In the illustrated embodiment, the smart contract combined with the blockchain realizes decentralized certificate management and issuance, enhances the credibility of the certificate, and supports the self-signed certificate model.

[0230] Figure 8 This is a flow chart of another certificate issuance method provided in an embodiment of the present application. Figure 8 The certificate issuance system includes a DPKI client, a Web server, a DPKI server, and multiple oracles. The method mainly includes the following steps 1 to 21.

[0231] Steps 1 to 11 and Figure 7 Steps 1 to 11 in the illustrated embodiment are the same.

[0232] Step 12: After receiving the verification request, the DPKI server stores the verification request in the first block and changes the certificate application status to pending verification. In addition, the DPKI server selects multiple oracles from the certificate issuance system for verification based on the verification node indication information. The oracles selected here include oracle 1, oracle 2, and oracle 3. Of course, in other embodiments, the selected oracle may not include oracle 1.

[0233] Step 13.1 and Step 13.2: After detecting that the verification request is stored on the blockchain, the selected Oracle 1, Oracle 2, Oracle 3, etc. download the verification request from the blockchain.

[0234] Step 14.1 and Step 14.2: Oracle 1, Oracle 2, Oracle 3, etc. all download the above verification file from the web server based on the verification request.

[0235] Step 15.1 and Step 15.2: Oracle 1, Oracle 2, Oracle 3, etc. all upload the content of the verification file to the DPKI server.

[0236] Step 16.1 to Step 16.3: The DPKI server verifies the content of each verification file received based on the challenge information, and verifies the identity of each oracle that uploaded the content of the verification file. After the identity of each oracle and the content of the received verification file are verified, the certificate application status is changed to verified status.

[0237] Steps 17 to 21 and Figure 7 Steps 17 to 21 in the illustrated embodiment are the same.

[0238] Fig. 9 This is a flow chart of another certificate issuance method provided in an embodiment of the present application. Fig. 9 The certificate issuance system includes a DPKI client, a Web server, a DPKI server, and multiple oracles. The method mainly includes the following steps 1 to 17.

[0239] Step 1: Oracle 1, Oracle 2, etc. send registration requests to the DPKI server. The registration requests carry registration information, including the identity information of the corresponding oracle.

[0240] Step 2: The DPKI server registers the identity information of the oracle in the request, and after verification, determines to register the corresponding oracle in the certificate issuance system.

[0241] Step 3: The DPKI client generates the certificate's public key (PK), private key (SK), and self-signed certificate.

[0242] Step 4: The DPKI client sends a certificate request to the DPKI server by calling the smart contract. The certificate request carries the challenge type and the target domain name. Optionally, the certificate request also carries PK, etc.

[0243] Step 5: After receiving the certificate application request, the DPKI server generates a first block on the blockchain, creates a certificate application record on the first block, stores the certificate application request in the certificate application record, and sets the certificate application status to the challenge acquisition status. In addition, the DPKI server performs a hash operation (operator H) on the target domain name, the identifier of the first block (block N), the public key, and the challenge information recorded in the second block (block N-1) to obtain a first random number N1, and uses the first random number as the challenge information. The first block refers to the block on the blockchain used to record the certificate application record for the target domain name, and the second block refers to the previous block of the first block on the blockchain.

[0244] Step 6: The DPKI client downloads the challenge information, that is, downloads the random number N1.

[0245] Step 7: The DPKI client generates a random number N2.

[0246] Step 8: The DPKI client uses PK to perform a hash operation on the random numbers N1 and N2 to obtain a hash value to sign a part of the content of the verification file, and generates a verification file based on the content of the verification file.

[0247] Step 9: The DPKI client uploads the verification file to the web server.

[0248] Step 10: The web server stores the verification file.

[0249] Step 11: The DPKI client sends a verification request to the DPKI server. The verification request carries the target domain name, the random number N2, and the number of oracles and / or the oracle list, etc., wherein the oracle list includes the identification information of the oracle.

[0250] Step 12: After receiving the verification request, the DPKI server stores the verification request in the first block and modifies the certificate application status to a pending verification status. In addition, the DPKI server selects an oracle from the certificate issuance system based on the number of oracles and / or the oracle list in the verification request. The selected oracle may be one or more, and the selected oracle includes oracle 1 as an example.

[0251] Step 13: Oracle 1 downloads the verification request from the blockchain, and downloads the above verification file from the web server based on the verification request.

[0252] Step 14: Oracle 1 calls the smart contract to upload the content of the verification file to the DPKI server.

[0253] Step 15: DPKI verifies the content of the received verification file based on the challenge information, and verifies the identity of the oracle that uploaded the content of the verification file. The DPKI server verifies the content of the received verification file using the public key, random number N1, and random number N2.

[0254] Step 16: After verifying the contents of the verification file and the identity of the oracle, the DPKI server changes the certificate application status to verified.

[0255] Step 17: After determining that the certificate application status is verified, the DPKI client determines the self-signed certificate as the certificate of the target domain name and stores the certificate.

[0256] Depend on Fig. 9 As can be seen from the illustrated embodiments, the embodiments of the present application do not limit the timing of the DPKI client generating a self-signed certificate. That is, the DPKI client can generate a self-signed certificate after generating the public and private keys of the certificate, or after confirming that the DPKI client has successfully verified the content of the verification file uploaded by the domain name verification node.

[0257] Fig.10 Schematic diagram of a domain name certificate format provided by an embodiment of the present application. The present application embodiment expands the extension domain of the X.509 digital certificate in the related art to obtain the certificate format in this solution. Fig.10 , the certificate issued in the embodiment of the present application includes the version, serial number, certificate signature algorithm, issuer name, subject name, public key information, issuer unique identifier and subject unique identifier, and also includes the newly added blockchain name in the extension domain, the address information of the smart contract and the CA endorsement extension (including CA name and CA signature information). Optionally, the extension domain also includes the oracle endorsement extension (including oracle name + oracle signature information).

[0258] The CA name in the CA endorsement extension includes the name of one or more CAs that signed the certificate of the target domain name, and the CA signature information includes the signature information obtained by each of the one or more CAs signing the certificate of the target domain name. The oracle name in the oracle endorsement extension includes the name of one or more oracles that challenge the target domain name for verification, and the oracle signature information includes the signature information obtained by the one or more oracles signing the certificate of the target domain name.

[0259] That is, the certificate of the target domain name in the embodiment of the present application may include the identification information of the above-mentioned blockchain and / or the address information of the smart contract. In this way, it is convenient to verify the certificate provided by the server corresponding to the target domain name based on the smart contract and the records on the blockchain when accessing the server corresponding to the target domain name in the future.

[0260] In summary, the embodiment of the present application realizes decentralized certificate issuance based on blockchain, and the certificate issuance process is more transparent. At the same time, the security and reliability of the certificate issuance process and the credibility of the certificate are enhanced, and the certificate issuance process is more in line with ACME technical specifications. In addition, the certificate issuance system in this solution includes at least one domain name verification node, which supports the DPKI server to jointly implement multi-way verification of the target domain name with multiple domain name verification nodes, which can avoid the problem of single point failure and further enhance the security and reliability of the certificate issuance process and the credibility of the certificate.

[0261] Fig.11 1 is a schematic diagram of a certificate issuing device 1100 provided in an embodiment of the present application. The certificate issuing device 1100 may be implemented as part or all of a computing device by software, hardware, or a combination of both. The computing device may include Figure 1 In the embodiment of the present application, the certificate issuing device 1100 is included in the DPKI client in the certificate issuing system, and the certificate issuing system also includes a Web server, a blockchain-based DPKI server, and at least one domain name verification node. Fig.11 The certificate issuing device 1100 includes: a sending module 1101, a downloading module 1102, a processing module 1103 and an obtaining module 1104.

[0262] A sending module 1101 is used to send a certificate application request to a DPKI server, where the certificate application request carries a target domain name for the certificate to be issued, and the certificate application request is used to instruct the DPKI server to obtain challenge information and store the challenge information on the blockchain, where the challenge information refers to information used to verify the target domain name;

[0263] A download module 1102, used to download the challenge information from the blockchain;

[0264] The processing module 1103 is used to generate a verification file based on the challenge information, and upload the verification file to the Web server;

[0265] The sending module 1101 is further used to send a verification request to the DPKI server, where the verification request is used to instruct the DPKI server to jointly verify the content of the verification file with the first domain name verification node in the at least one domain name verification node and the Web server;

[0266] The acquisition module 1104 is used to acquire the certificate of the target domain name when it is determined that the DPKI server has successfully verified the content of the verification file.

[0267] Optionally, the first domain name verification node is some of the at least one domain name verification node, and the verification request carries verification node indication information, where the verification node indication information is used to indicate the first domain name verification node.

[0268] Optionally, the verification node indication information includes the number of verification nodes and / or verification node identifiers, the number of verification nodes indicates the number of first domain name verification nodes, and the verification node identifier information indicates the identifier of the first domain name verification node.

[0269] Optionally, the at least one domain name verification node includes a CA;

[0270] The acquisition module 1104 includes:

[0271] The sending submodule is used to send a certificate issuance request to the DPKI server. The certificate issuance request carries the target domain name. The certificate issuance request is used to instruct the DPKI server to jointly generate a certificate for the target domain name and store it on the blockchain.

[0272] The download submodule is used to download the certificate of the target domain name from the blockchain.

[0273] Optionally, the blockchain records a certificate application status related to the certificate application request;

[0274] Download submodules for:

[0275] When it is determined that the certificate application status is issued, the certificate of the target domain name is downloaded from the blockchain.

[0276] Optionally, the certificate of the target domain name includes signature information of the CA on the certificate of the target domain name.

[0277] Optionally, the acquisition module 1104 includes:

[0278] A first generation submodule, used to generate a self-signed certificate for a target domain name;

[0279] The upload submodule is used to upload the self-signed certificate to the blockchain to instruct the DPKI server to verify the self-signed certificate;

[0280] The determination submodule is used to determine the self-signed certificate as the certificate of the target domain name when it is determined that the DPKI server has successfully verified the self-signed certificate.

[0281] Optionally, the device 1100 further includes:

[0282] A generation module, used to generate a public key and a private key of a certificate, wherein the certificate application request also carries a public key, and the challenge information includes a first random number generated by the DPKI server;

[0283] The processing module 1103 includes:

[0284] A second generating submodule, used for generating a second random number;

[0285] An operation submodule, used for performing a hash operation on the first random number and the second random number to obtain a hash value;

[0286] The signature submodule is used to sign the hash value using the private key to obtain the content of the verification file;

[0287] The third generating submodule is used to generate a verification file based on the content of the verification file.

[0288] Optionally, the first domain name verification node is a CA or an oracle.

[0289] Optionally, the certificate of the target domain name includes identification information of the blockchain.

[0290] Optionally, the blockchain is deployed with a smart contract, and the DPKI client executes the corresponding steps in the above-mentioned certificate issuance method by calling the smart contract, and the certificate of the target domain name includes the address information of the smart contract.

[0291] In the embodiment of the present application, decentralized certificate issuance is implemented based on blockchain, the certificate issuance process is more transparent, and the security and reliability of the certificate issuance process and the credibility of the certificate are enhanced, and the certificate issuance process is more in line with ACME technical specifications. In addition, the certificate issuance system in this solution includes at least one domain name verification node, which supports the DPKI server to combine multiple domain name verification nodes to achieve multi-way verification of the target domain name, thereby avoiding the problem of single point failure, and further enhancing the security and reliability of the certificate issuance process and the credibility of the certificate.

[0292] It should be noted that: the certificate issuing device 1100 provided in the above embodiment only uses the division of the above functional modules as an example when requesting to issue a certificate. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. In addition, the certificate issuing device 1100 provided in the above embodiment and the certificate issuing method embodiment belong to the same concept, and the specific implementation process is detailed in the method embodiment, which will not be repeated here.

[0293] Fig.12 1 is a schematic diagram of a structure of a certificate issuing device 1200 provided in an embodiment of the present application. The certificate issuing device 1200 can be implemented by software, hardware, or a combination of both to form part or all of a computing device. The computing device may include Figure 1In the embodiment of the present application, the certificate issuing device 1200 is included in the DPKI server based on blockchain in the certificate issuing system, and the certificate issuing system also includes a DPKI client, a Web server and at least one domain name verification node. Fig.12 The certificate issuing device 1200 includes: a receiving module 1201, an obtaining module 1202, a storage module 1203, a verification module 1204 and an indication module 1205.

[0294] The receiving module 1201 is used to receive a certificate application request sent by a DPKI client, where the certificate application request carries a target domain name for a certificate to be issued;

[0295] An acquisition module 1202 is used to acquire challenge information, where the challenge information refers to information used to perform a verification challenge on a target domain name;

[0296] Storage module 1203, used to store the challenge information on the blockchain;

[0297] The receiving module 1201 is further configured to receive a verification request sent by the DPKI client, where the verification request is sent after the DPKI client generates a verification file based on the challenge information and uploads the verification file to the Web server;

[0298] The storage module 1203 is further used to store the verification request on the blockchain;

[0299] The receiving module 1201 is further configured to receive the content of a verification file uploaded by a first domain name verification node among the at least one domain name verification node, where the content of the verification file is obtained after the first domain name verification node downloads the verification file from a Web server;

[0300] A verification module 1204, configured to verify the content of the verification file based on the challenge information;

[0301] The instruction module 1205 is used to instruct the DPKI client to obtain the certificate of the target domain name after the content of the verification file is verified.

[0302] Optionally, the acquisition module 1202 includes:

[0303] A storage submodule, used to store the certificate application request on the blockchain;

[0304] The receiving submodule is used to receive challenge information sent by a second domain name verification node among the at least one domain name verification node, where the challenge information is generated after the second domain name verification node downloads the certificate application request from the blockchain.

[0305] Optionally, the certificate application request also carries the public key of the certificate;

[0306] The acquisition module 1202 includes:

[0307] A generating submodule, configured to generate the challenge information, wherein the challenge information includes a first random number;

[0308] The verification request carries the second random number, and the content of the verification file is signed by the DPKI client using the private key corresponding to the public key to obtain a hash value after performing a hash operation on the first random number and the second random number;

[0309] The verification module 1204 includes:

[0310] The content of the verification file is verified using a public key based on the first random number and the second random number.

[0311] Optionally, the generation submodule is specifically used for:

[0312] A first random number is obtained by performing a hash operation on the target domain name, the identifier of the first block, the public key, and the challenge information recorded in the second block, where the first block refers to a block on the blockchain used to record the certificate application record about the target domain name, and the second block refers to a block before the first block on the blockchain.

[0313] Optionally, the verification request carries verification node indication information, and the verification node indication information is used to indicate the first domain name verification node; the device further includes:

[0314] The selection module is configured to select a first domain name verification node from the at least one domain name verification node based on the verification node indication information.

[0315] Optionally, the verification node indication information includes the number of verification nodes and / or verification node identification information, the number of verification nodes indicates the number of first domain name verification nodes, and the verification node identification information indicates the identification of the first domain name verification node.

[0316] Optionally, the at least one domain name verification node includes a CA;

[0317] The receiving module 1201 is further configured to receive a certificate issuance request sent by a DPKI client, where the certificate issuance request carries a target domain name;

[0318] The storage module 1203 is further used to store the certificate issuance request on the blockchain;

[0319] The receiving module 1201 is further used to receive the certificate of the target domain name uploaded by the CA, where the certificate of the target domain name is generated by the CA after downloading the certificate issuance request from the blockchain;

[0320] The storage module 1203 is also used to store the certificate of the target domain name on the blockchain.

[0321] Optionally, the indication module 1205 includes:

[0322] The receiving submodule is used to receive the self-signed certificate about the target domain name uploaded by the DPKI client;

[0323] A verification submodule, used to verify the self-signed certificate;

[0324] The first indication submodule is used to instruct the DPKI client to determine the self-signed certificate as the certificate of the target domain name after the self-signed certificate is verified.

[0325] Optionally, the first domain name verification node includes a oracle;

[0326] The receiving module 1201 is also used to receive a registration request sent by the oracle;

[0327] The apparatus 1200 further includes:

[0328] A registration module, used to register the oracle in response to a registration request sent by the oracle;

[0329] The verification module 1204 is further used to authenticate the oracle in the first domain name verification node based on the registered oracle;

[0330] The indication module 1205 includes:

[0331] The second instruction submodule is used to instruct the DPKI client to obtain the certificate of the target domain name after the content of the verification file and the identity of the oracle are verified.

[0332] Optionally, the certificate of the target domain name includes identification information of the above-mentioned blockchain.

[0333] Optionally, the above-mentioned blockchain is deployed with a smart contract, and the DPKI server executes the corresponding steps in the above-mentioned certificate issuance method by calling the smart contract, and the certificate of the target domain name includes the address information of the smart contract.

[0334] In the embodiment of the present application, decentralized certificate issuance is implemented based on blockchain, the certificate issuance process is more transparent, and the security and reliability of the certificate issuance process and the credibility of the certificate are enhanced, and the certificate issuance process is more in line with ACME technical specifications. In addition, the certificate issuance system in this solution includes at least one domain name verification node, which supports the DPKI server to combine multiple domain name verification nodes to achieve multi-way verification of the target domain name, thereby avoiding the problem of single point failure, and further enhancing the security and reliability of the certificate issuance process and the credibility of the certificate.

[0335] It should be noted that: when the certificate issuing device 1200 provided in the above embodiment executes the steps in the certificate issuing method, only the division of the above functional modules is used as an example. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. In addition, the certificate issuing device 1200 provided in the above embodiment and the certificate issuing method embodiment belong to the same concept, and the specific implementation process is detailed in the method embodiment, which will not be repeated here.

[0336] Fig.13 1 is a schematic diagram of a certificate issuing device 1300 provided in an embodiment of the present application. The certificate issuing device 1300 can be implemented as part or all of a computing device by software, hardware, or a combination of both. The computing device may include Figure 1 In the embodiment of the present application, the certificate issuing device 1300 is included in the first domain name verification node of at least one domain name verification node included in the certificate issuing system, and the certificate issuing system also includes a DPKI client, a Web server, and a DPKI server based on blockchain. Fig.13 The certificate issuing device 1300 includes: a download module 1301 and an upload module 1302 .

[0337] A download module 1301 is used to download a verification request from the blockchain. The verification request is generated after the DPKI client generates a verification file based on challenge information and uploads the verification file to a Web server. The challenge information refers to information used to verify the target domain name. The challenge information is obtained by the DPKI server after receiving the certificate application request sent by the DPKI client and stored on the blockchain. The certificate application request carries the target domain name of the certificate to be issued;

[0338] The download module 1301 is further used to download the verification file from the Web server based on the verification request;

[0339] The upload module 1302 is used to upload the content of the verification file to the DPKI server to instruct the DPKI server to verify the content of the verification file based on the challenge information and instruct the DPKI client to obtain the certificate of the target domain name after the content of the verification file is verified.

[0340] Optionally, the blockchain stores the certificate application request;

[0341] The download module 1301 is also used to download the certificate application request from the blockchain;

[0342] The apparatus 1300 further includes:

[0343] A first generating module, configured to generate the challenge information based on the certificate application request;

[0344] The sending module is used to send the challenge information to the DPKI server.

[0345] Optionally, the first domain name verification node is some of the at least one domain name verification node, and the first domain name verification node is selected by the DPKI server from the at least one domain name verification node.

[0346] Optionally, the first domain name verification node is a CA;

[0347] The download module 1301 is also used to download the certificate issuance request from the blockchain. The certificate issuance request carries the target domain name. The certificate issuance request is generated by the DPKI client after determining that the DPKI server has verified the content of the verification file.

[0348] The apparatus 1300 further includes:

[0349] A second generating module, used to generate a certificate for a target domain name based on the certificate issuance request;

[0350] The upload module 1302 is also used to upload the certificate of the target domain name to the DPKI server.

[0351] Optionally, the first domain name verification node is a oracle;

[0352] The apparatus 1300 further includes:

[0353] The registration module is used to send a registration request to the DPKI server to request registration in the certificate issuance system.

[0354] Optionally, the certificate of the target domain name includes identification information of the above-mentioned blockchain.

[0355] Optionally, the blockchain is deployed with a smart contract, and the first domain name verification node executes corresponding steps in the above-mentioned certificate issuance method by calling the smart contract, and the certificate of the target domain name includes address information of the smart contract.

[0356] In the embodiment of the present application, decentralized certificate issuance is implemented based on blockchain, the certificate issuance process is more transparent, and the security and reliability of the certificate issuance process and the credibility of the certificate are enhanced, and the certificate issuance process is more in line with ACME technical specifications. In addition, the certificate issuance system in this solution includes at least one domain name verification node, which supports the DPKI server to combine multiple domain name verification nodes to achieve multi-way verification of the target domain name, thereby avoiding the problem of single point failure, and further enhancing the security and reliability of the certificate issuance process and the credibility of the certificate.

[0357] It should be noted that: when the certificate issuing device 1300 provided in the above embodiment executes the steps of the certificate issuing method, only the division of the above functional modules is used as an example. In actual application, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. In addition, the certificate issuing device 1300 provided in the above embodiment and the certificate issuing method embodiment belong to the same concept, and the specific implementation process is detailed in the method embodiment, which will not be repeated here.

[0358] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium can be any available medium that a computer can access, or a data storage device such as a server or data center that includes one or more available media integrated. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a magnetic tape), an optical medium (e.g., a digital versatile disc (DVD)), or a semiconductor medium (e.g., a solid state disk (SSD)). It is worth noting that the computer-readable storage medium mentioned in the embodiment of the present application may be a non-volatile storage medium, in other words, a non-transient storage medium.

[0359] It should be understood that the "at least one" mentioned herein refers to one or more, and "multiple" refers to two or more. In the description of the embodiments of the present application, unless otherwise specified, " / " means or, for example, A / B can mean A or B; "and / or" in this article is only a description of the association relationship of the associated objects, indicating that there can be three relationships, for example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, in order to facilitate the clear description of the technical solutions of the embodiments of the present application, in the embodiments of the present application, the words "first", "second" and the like are used to distinguish the same items or similar items with basically the same functions and effects. Those skilled in the art can understand that the words "first", "second" and the like do not limit the quantity and execution order, and the words "first", "second" and the like do not limit them to be necessarily different.

[0360] It should be noted that the information (including but not limited to user device information, user personal information, etc.), data (including but not limited to data used for analysis, stored data, displayed data, etc.) and signals involved in the embodiments of the present application are all authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data need to comply with relevant laws, regulations and standards of relevant countries and regions.

[0361] The above-mentioned embodiments are provided for the present application and are not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included in the protection scope of the present application.

Claims

1. A certificate issuance method, characterized in that: A decentralized public key infrastructure (DPKI) client applied to a certificate issuance system, wherein the certificate issuance system further includes a website Web server, a blockchain-based DPKI server, and at least one domain name verification node; the method includes: Sending a certificate application request to the DPKI server, the certificate application request carrying the target domain name of the certificate to be issued, the certificate application request being used to instruct the DPKI server to obtain challenge information and store the challenge information on the blockchain, the challenge information being information used to verify the target domain name; Downloading the challenge information from the blockchain; Generate a verification file based on the challenge information, and upload the verification file to the Web server; Sending a verification request to the DPKI server, wherein the verification request is used to instruct the DPKI server to verify the content of the verification file in conjunction with a first domain name verification node among the at least one domain name verification node and the Web server; When it is determined that the DPKI server has successfully verified the content of the verification file, a certificate for the target domain name is obtained.

2. The method according to claim 1, characterized in that The first domain name verification node is some of the at least one domain name verification node, the verification request carries verification node indication information, and the verification node indication information is used to indicate the first domain name verification node.

3. The method according to claim 2, characterized in that The verification node indication information includes the number of verification nodes and / or verification node identifiers, the number of verification nodes indicates the number of the first domain name verification nodes, and the verification node identifier information indicates the identifier of the first domain name verification node.

4. The method according to any one of claims 1 to 3, characterized in that: The at least one domain name verification node includes a certificate authority CA; The step of obtaining the certificate of the target domain name includes: Sending a certificate issuance request to the DPKI server, wherein the certificate issuance request carries the target domain name, and the certificate issuance request is used to instruct the DPKI server to jointly generate a certificate for the target domain name and store it on the blockchain; Download the certificate of the target domain name from the blockchain.

5. The method according to claim 4, characterized in that The blockchain records the certificate application status related to the certificate application request; The downloading the certificate of the target domain name from the blockchain includes: When it is determined that the certificate application status is in an issued state, downloading the certificate of the target domain name from the blockchain.

6. The method according to claim 4 or 5, characterized in that The certificate of the target domain name includes signature information of the CA on the certificate of the target domain name.

7. The method according to any one of claims 1 to 3, characterized in that: The step of obtaining the certificate of the target domain name includes: Generate a self-signed certificate for the target domain name; Uploading the self-signed certificate to the blockchain to instruct the DPKI server to verify the self-signed certificate; When it is determined that the DPKI server has successfully verified the self-signed certificate, the self-signed certificate is determined as a certificate of the target domain name.

8. The method according to any one of claims 1 to 7, characterized in that: Before sending the certificate application request to the DPKI server, the method further includes: Generate a public key and a private key of the certificate, wherein the certificate application request also carries the public key, and the challenge information includes a first random number generated by the DPKI server; The generating a verification file based on the challenge information includes: generating a second random number; Performing a hash operation on the first random number and the second random number to obtain a hash value; Sign the hash value using the private key to obtain the content of the verification file; The verification file is generated based on the content of the verification file.

9. The method according to any one of claims 1 to 8, characterized in that: The first domain name verification node is a CA or a oracle.

10. The method according to any one of claims 1 to 9, characterized in that: The certificate of the target domain name includes identification information of the blockchain.

11. The method according to any one of claims 1 to 10, characterized in that: The blockchain is deployed with a smart contract, the DPKI client executes the steps of the method by calling the smart contract, and the certificate of the target domain name includes address information of the smart contract.

12. A certificate issuance method, characterized in that: A decentralized public key infrastructure (DPKI) server based on blockchain applied to a certificate issuance system, wherein the certificate issuance system further comprises a DPKI client, a website Web server, and at least one domain name verification node; the method comprises: Receiving a certificate application request sent by the DPKI client, wherein the certificate application request carries a target domain name for a certificate to be issued; Obtaining challenge information and storing the challenge information on the blockchain, wherein the challenge information refers to information used to verify the target domain name; receiving a verification request sent by the DPKI client, and storing the verification request on the blockchain, wherein the verification request is sent by the DPKI client after generating a verification file based on the challenge information and uploading the verification file to the Web server; Receiving the content of the verification file uploaded by a first domain name verification node among the at least one domain name verification node, where the content of the verification file is obtained by the first domain name verification node downloading the verification file from the Web server; Verifying the content of the verification file based on the challenge information; After the content of the verification file is verified, the DPKI client is instructed to obtain a certificate for the target domain name.

13. The method according to claim 12, characterized in that The obtaining of challenge information includes: Storing the certificate application request on the blockchain; Receive the challenge information sent by a second domain name verification node among the at least one domain name verification node, where the challenge information is generated by the second domain name verification node after downloading the certificate application request from the blockchain.

14. The method according to claim 12, characterized in that The certificate application request also carries the public key of the certificate; The obtaining of challenge information includes: Generate the challenge information, wherein the challenge information includes a first random number; The verification request carries a second random number, and the content of the verification file is obtained by signing a hash value obtained by the DPKI client using a private key corresponding to the public key to perform a hash operation on the first random number and the second random number; The verifying the content of the verification file based on the challenge information includes: Based on the first random number and the second random number, the content of the verification file is verified using the public key.

15. The method according to claim 14, characterized in that The generating the challenge information comprises: The first random number is obtained by performing a hash operation on the target domain name, the identifier of the first block, the public key, and the challenge information recorded in the second block, wherein the first block refers to a block on the blockchain used to record the certificate application record about the target domain name, and the second block refers to a block previous to the first block on the blockchain.

16. The method according to any one of claims 12 to 15, characterized in that: The verification request carries verification node indication information, and the verification node indication information is used to indicate the first domain name verification node; the method further includes: Based on the verification node indication information, the first domain name verification node is selected from the at least one domain name verification node.

17. The method according to claim 16, characterized in that The verification node indication information includes the number of verification nodes and / or verification node identification information, the number of verification nodes indicates the number of the first domain name verification nodes, and the verification node identification information indicates the identification of the first domain name verification node.

18. The method according to any one of claims 12 to 17, characterized in that: The at least one domain name verification node includes a certificate issuing center CA, and the method further includes: receiving a certificate issuance request sent by the DPKI client, wherein the certificate issuance request carries the target domain name; Storing the certificate issuance request on the blockchain; Receive the certificate of the target domain name uploaded by the CA, where the certificate of the target domain name is generated by the CA after downloading the certificate issuance request from the blockchain; The certificate of the target domain name is stored on the blockchain.

19. The method according to any one of claims 12 to 17, characterized in that: The instructing the DPKI client to obtain a certificate for the target domain name includes: Receiving a self-signed certificate about the target domain name uploaded by the DPKI client; Verifying the self-signed certificate; After the self-signed certificate is verified, the DPKI client is instructed to determine the self-signed certificate as the certificate of the target domain name.

20. The method according to any one of claims 12 to 19, characterized in that: The first domain name verification node includes a oracle; the method further includes: Receive a registration request sent by the oracle; In response to the registration request sent by the oracle, register the oracle; Authenticating the oracle in the first domain name verification node based on the registered oracle; The step of instructing the DPKI client to obtain a certificate for the target domain name after verifying the content of the verification file is passed includes: After the content of the verification file and the identity of the oracle are verified, the DPKI client is instructed to obtain a certificate for the target domain name.

21. The method according to any one of claims 12 to 20, characterized in that: The certificate of the target domain name includes identification information of the blockchain.

22. The method according to any one of claims 12 to 21, characterized in that: The blockchain is deployed with a smart contract, the DPKI server executes the steps of the method by calling the smart contract, and the certificate of the target domain name includes address information of the smart contract.

23. A method for issuing a certificate, characterized in that: The method is applied to a first domain name verification node in at least one domain name verification node included in a certificate issuance system, wherein the certificate issuance system further includes a decentralized public key infrastructure DPKI client, a blockchain-based DPKI server, and a website Web server; the method includes: Downloading a verification request from the blockchain, the verification request is generated after the DPKI client generates a verification file based on challenge information and uploads the verification file to the Web server, the challenge information refers to information used to verify and challenge the target domain name to be issued a certificate, the challenge information is obtained by the DPKI server after receiving the certificate application request sent by the DPKI client and stored in the blockchain, the certificate application request carries the target domain name; Downloading the verification file from the Web server based on the verification request; The content of the verification file is uploaded to the DPKI server to instruct the DPKI server to verify the content of the verification file based on the challenge information and to instruct the DPKI client to obtain a certificate for the target domain name after the content of the verification file is verified.

24. The method of claim 23, wherein: The blockchain stores the certificate application request; The method further comprises: Downloading the certificate application request from the blockchain; generating the challenge information based on the certificate application request; Send the challenge information to the DPKI server.

25. The method according to claim 23 or 24, characterized in that The first domain name verification node is a part of the at least one domain name verification node, and the first domain name verification node is selected by the DPKI server from the at least one domain name verification node.

26. The method according to any one of claims 23 to 25, characterized in that: The first domain name verification node is a certificate issuing center CA; The method further comprises: Downloading a certificate issuance request from the blockchain, the certificate issuance request carrying the target domain name, the certificate issuance request being generated by the DPKI client after determining that the DPKI server has successfully verified the content of the verification file; Generate a certificate for the target domain name based on the certificate issuance request; Upload the certificate of the target domain name to the DPKI server.

27. The method according to any one of claims 23 to 25, characterized in that: The first domain name verification node is a oracle; The method further comprises: Send a registration request to the DPKI server to request registration in the certificate issuing system.

28. The method according to any one of claims 23 to 27, characterized in that: The certificate of the target domain name includes identification information of the blockchain.

29. The method according to any one of claims 23 to 28, characterized in that: The blockchain is deployed with a smart contract, the first domain name verification node executes the steps of the method by calling the smart contract, and the certificate of the target domain name includes address information of the smart contract.

30. A certificate issuing device, characterized in that: A decentralized public key infrastructure DPKI client included in a certificate issuance system, wherein the certificate issuance system further includes a website Web server, a blockchain-based DPKI server, and at least one domain name verification node; the device includes: A sending module, configured to send a certificate application request to the DPKI server, wherein the certificate application request carries a target domain name for a certificate to be issued, and the certificate application request is used to instruct the DPKI server to obtain challenge information and store the challenge information on the blockchain, wherein the challenge information refers to information used to verify the target domain name; A download module, used to download the challenge information from the blockchain; A processing module, configured to generate a verification file based on the challenge information, and upload the verification file to the Web server; The sending module is further used to send a verification request to the DPKI server, wherein the verification request is used to instruct the DPKI server to verify the content of the verification file in conjunction with the first domain name verification node of the at least one domain name verification node and the Web server; The acquisition module is used to acquire the certificate of the target domain name when it is determined that the DPKI server has successfully verified the content of the verification file.

31. A certificate issuing device, characterized in that: A decentralized public key infrastructure (DPKI) server based on blockchain included in a certificate issuance system, wherein the certificate issuance system further includes a DPKI client, a website Web server, and at least one domain name verification node; the device includes: A receiving module, configured to receive a certificate application request sent by the DPKI client, wherein the certificate application request carries a target domain name for a certificate to be issued; An acquisition module, used to acquire challenge information, wherein the challenge information refers to information used to perform a verification challenge on the target domain name; A storage module, used to store the challenge information on the blockchain; The receiving module is further configured to receive a verification request sent by the DPKI client, wherein the verification request is sent by the DPKI client after generating a verification file based on the challenge information and uploading the verification file to the Web server; The storage module is further used to store the verification request on the blockchain; The receiving module is further configured to receive the content of the verification file uploaded by a first domain name verification node among the at least one domain name verification node, wherein the content of the verification file is obtained after the first domain name verification node downloads the verification file from the Web server; A verification module, used to verify the content of the verification file based on the challenge information; The instruction module is used to instruct the DPKI client to obtain the certificate of the target domain name after the content of the verification file is verified.

32. A certificate issuing device, characterized in that: A first domain name verification node included in at least one domain name verification node included in a certificate issuance system, wherein the certificate issuance system further includes a decentralized public key infrastructure DPKI client, a blockchain-based DPKI server, and a website Web server; the device includes: a download module, configured to download a verification request from the blockchain, wherein the verification request is generated after the DPKI client generates a verification file based on challenge information and uploads the verification file to the Web server, wherein the challenge information refers to information used to verify and challenge the target domain name to be issued a certificate, and the challenge information is obtained by the DPKI server after receiving the certificate application request sent by the DPKI client and stored in the blockchain, wherein the certificate application request carries the target domain name; The download module is further configured to download the verification file from the Web server based on the verification request; The uploading module is used to upload the content of the verification file to the DPKI server to instruct the DPKI server to verify the content of the verification file based on the challenge information and instruct the DPKI client to obtain the certificate of the target domain name after the content of the verification file is verified.

33. A certificate issuing system, characterized in that: The certificate issuance system includes a decentralized public key infrastructure DPKI client, a website Web server, a blockchain-based DPKI server, and at least one domain name verification node; The DPKI client is used to perform the steps of any method described in claims 1-11; The DPKI server is used to perform the steps of any method described in claims 12-22; The first domain name verification node among the at least one or more domain name verification nodes is used to execute the steps of any one of the methods described in claims 23-29.

34. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, and when the computer program is executed by a processor, it implements the method described in any one of claims 1 to 11, or implements the method described in any one of claims 12 to 22, or implements the method described in any one of claims 23 to 29.

35. A computer program product, characterized in that The computer program product stores computer instructions, and when the computer instructions are executed by a processor, the method described in any one of claims 1 to 11 is implemented, or the method described in any one of claims 12 to 22 is implemented, or the method described in any one of claims 23 to 29 is implemented.

Images