Private cloud traffic scheduling platform certificate management method and device, equipment and storage medium

Abstract

The invention discloses a private cloud traffic scheduling platform certificate management method and device, equipment and a storage medium, and relates to the technical field of certificate management, and the method comprises the steps: obtaining certificate information detected by a detector on a load balancing server, determining a domain name using a corresponding certificate and having https access traffic on the load balancing server according to the certificate information, detecting the domain name using the corresponding certificate and having https access traffic to obtain detection information, the detection information comprising a health state of a TLS connection between the load balancing server and the certificate and certificate chain information, and sending the detection information to the load balancing server; and matching an associated user corresponding to the certificate information according to the certificate information, detecting the health detection information, generating alarm information when the health detection information meets a preset alarm condition, and sending the alarm information to the associated user, so that the information of the certificate can be ensured to be accurate and not easy to distort, and the user experience is improved. Meanwhile, the resource consumption is also reduced.

Description

Technical Field

[0001] The present application relates to the technical field of certificate management, and in particular to a certificate management method, device, equipment and storage medium for a private cloud traffic scheduling platform. Background Art

[0002] The current certificate management platform or certificate management service supports the full life cycle management process of certificate application, renewal, and destruction, and provides API support for one-click deployment of certificates to load balancing products. At the same time, the certificate update time obtained at each circulation link is recorded, as well as the validity period obtained from the certificate issuing authority. Although this provides a convenient solution for cloud users, such certificate management tools are strongly coupled with their corresponding commercial platforms and have weak versatility. In addition, for some load balancing devices that cannot support automatic renewal of certificates or do not provide a self-service API for certificate renewal, it is necessary to rely on certificate renewal personnel to manually fill in the renewal time, which can easily lead to data distortion and cause production accidents.

[0003] The above contents are only used to assist in understanding the technical solution of the present application and do not constitute an admission that the above contents are prior art. Summary of the invention

[0004] The main purpose of this application is to provide a private cloud traffic scheduling platform certificate management method, device, equipment and storage medium, aiming to solve the technical problems in the prior art that certificates rely on manual processing, data is easily distorted, and production accidents are easily caused.

[0005] To achieve the above purpose, the present application proposes a private cloud traffic scheduling platform certificate management method, the private cloud traffic scheduling platform certificate management method comprising:

[0006] Obtaining certificate information detected by a detector on the load balancing server, and determining a domain name on the load balancing server that uses a corresponding certificate and has https access traffic according to the certificate information;

[0007] Probe the domain name that uses the corresponding certificate and has https access traffic to obtain detection information, wherein the detection information includes the health status of the TLS connection between the load balancing server and the certificate and the certificate chain information;

[0008] Matching the associated user corresponding to the certificate information according to the certificate information;

[0009] The domain name on the load balancing server that uses the corresponding certificate and has https access traffic, the health status of the TLS connection between the load balancing server and the certificate, and the certificate chain information are stored in the certificate configuration management database;

[0010] The health detection information is detected, and when the health detection information meets a preset alarm condition, an alarm information is generated, and the alarm information is sent to the associated user.

[0011] In one embodiment, the step of obtaining the certificate information detected by the detector on the load balancing server and determining the domain name on the load balancing server that uses the corresponding certificate and has https access traffic according to the certificate information includes:

[0012] Get the certificate file detected by the detector on the load balancing server;

[0013] Determine the certificate information of the certificate according to the certificate file;

[0014] A domain name that uses a corresponding certificate and has https access traffic is determined on the load balancing server according to the certificate information.

[0015] In one embodiment, the step of detecting the domain name that uses the corresponding certificate and has https access traffic to obtain detection information, wherein the detection information includes the health status of the TLS connection between the load balancing server and the certificate and the certificate chain information includes:

[0016] Using a test tool to test the TLS connection between the load balancing server and the certificate CN, and obtaining a test result;

[0017] When the detection result is normal, the detector performs health detection on the domain name that uses the corresponding certificate and has https access traffic based on a preset detection strategy, and feeds back the connection health status and certificate chain information;

[0018] Health check information is obtained according to the connection health status and the certificate chain information.

[0019] In one embodiment, the step of matching the associated user corresponding to the certificate information according to the certificate information includes:

[0020] Acquire private cloud configuration management information, and determine a user mapping table according to the private cloud configuration management information, wherein the user mapping table includes a mapping relationship between certificate information and associated users;

[0021] Traversing the user mapping table based on the certificate information;

[0022] When the certificate information successfully matches the certificate information in the user mapping table, an associated user corresponding to the certificate information is determined.

[0023] In one embodiment, the step of detecting the health detection information, generating alarm information when the health detection information meets a preset alarm condition, and sending the alarm information to the associated user includes:

[0024] Comparing the health detection information with preset health information to obtain a comparison result;

[0025] When the comparison result is that the health detection information meets the preset alarm information, determining abnormal information;

[0026] Generate warning information according to the abnormal information and the associated user, and send the warning information to the associated user.

[0027] In one embodiment, the step of detecting the health detection information, generating alarm information when the health detection information meets a preset alarm condition, and sending the alarm information to the associated user includes:

[0028] Comparing the health detection information with preset health information to obtain a comparison result;

[0029] When the comparison result is that the health detection information meets the preset alarm information, determining abnormal information;

[0030] Generate warning information according to the abnormal information and the associated user, and send the warning information to the associated user.

[0031] In one embodiment, the step of determining a storage directory for the certificate file, matching the storage directory with a preset storage directory, and obtaining a matching result includes:

[0032] Determine the storage directory of the certificates;

[0033] Establish a connection with the certificate domain name through the server IP information, and obtain the certificate domain name information of the server;

[0034] When the server IP information successfully establishes a connection with the certificate domain name, the certificate CN name is matched to obtain matching information of the certificate CN name;

[0035] A matching result is obtained according to the matching information of the certificate CN name.

[0036] In addition, to achieve the above purpose, the present application also proposes a private cloud traffic scheduling platform certificate management device, the private cloud traffic scheduling platform certificate management device comprising:

[0037] The certificate discovery module is used to obtain the certificate information detected by the detector on the load balancing server, and determine the domain name on the load balancing server that uses the corresponding certificate and has https access traffic according to the certificate information;

[0038] A health check module is used to detect the domain name that uses the corresponding certificate and has https access traffic to obtain detection information, wherein the detection information includes the health status of the TLS connection between the load balancing server and the certificate and the certificate chain information;

[0039] A configuration management module, used to match the associated user corresponding to the certificate information according to the certificate information;

[0040] An information storage module is used to store the domain name on the load balancing server that uses the corresponding certificate and has https access traffic, the health status of the TLS connection between the load balancing server and the certificate, and the certificate chain information into a certificate configuration management database;

[0041] The data monitoring module is used to detect the health detection information, generate alarm information when the health detection information meets the preset alarm condition, and send the alarm information to the associated user.

[0042] In addition, to achieve the above-mentioned purpose, the present application also proposes a private cloud traffic scheduling platform certificate management device, which includes: a memory, a processor, and a computer program stored on the memory and executable on the processor, and the computer program is configured to implement the steps of the private cloud traffic scheduling platform certificate management method as described above.

[0043] In addition, to achieve the above-mentioned purpose, the present application also proposes a storage medium, which is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by the processor, the steps of the private cloud traffic scheduling platform certificate management method as described above are implemented.

[0044] In addition, to achieve the above-mentioned purpose, the present application also provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, it implements the steps of the private cloud traffic scheduling platform certificate management method as described above.

[0045] One or more technical solutions proposed in the present application have at least the following technical effects: obtaining certificate information detected by a detector on a load balancing server, determining a domain name on the load balancing server that uses a corresponding certificate and has https access traffic based on the certificate information, detecting the domain name that uses a corresponding certificate and has https access traffic to obtain detection information, wherein the detection information includes the health status and certificate chain information of the TLS connection between the load balancing server and the certificate, matching an associated user corresponding to the certificate information based on the certificate information, detecting the health detection information, generating an alarm message when the health detection information meets a preset alarm condition, and sending the alarm message to the associated user, thereby ensuring that the certificate information is accurate and not easily distorted, and also reducing resource consumption. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0047] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0048] Figure 1 A flow chart of the first embodiment of the certificate management method for a private cloud traffic scheduling platform provided in this application;

[0049] Figure 2 A flow chart of the second embodiment of the certificate management method for a private cloud traffic scheduling platform provided in this application;

[0050] Figure 3 A flow chart of a self-service certificate verification module provided for an embodiment of a certificate management method for a private cloud traffic scheduling platform of this application;

[0051] Figure 4 A brief flow chart of the private cloud traffic scheduling platform certificate management method provided in Example 2 of the present application;

[0052] Figure 5 This is a schematic diagram of the module structure of the certificate management device for the private cloud traffic scheduling platform according to an embodiment of the present application;

[0053] Figure 6 This is a schematic diagram of the device structure of the hardware operating environment involved in the private cloud traffic scheduling platform certificate management method in the embodiment of the present application.

[0054] The purpose, features and advantages of this application will be further described in conjunction with the embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0055] It should be understood that the specific embodiments described herein are only used to explain the technical solutions of the present application and are not used to limit the present application.

[0056] In order to better understand the technical solution of the present application, a detailed description will be given below in conjunction with the accompanying drawings and specific implementation methods.

[0057] The main solution of the embodiment of the present application is: obtaining the certificate information detected by the detector on the load balancing server, determining the domain name on the load balancing server that uses the corresponding certificate and has https access traffic based on the certificate information, detecting the domain name that uses the corresponding certificate and has https access traffic to obtain detection information, wherein the detection information includes the health status and certificate chain information of the TLS connection between the load balancing server and the certificate, matching the associated user corresponding to the certificate information based on the certificate information, detecting the health detection information, and generating an alarm message when the health detection information meets the preset alarm condition, and sending the alarm message to the associated user.

[0058] In this embodiment, for ease of description, the following description is made by identifying a private cloud traffic scheduling platform certificate management device as the execution entity.

[0059] Since the certificate management tools in the existing technology are strongly coupled with their corresponding commercial platforms and have weak versatility, and for some certificates that cannot support automatic renewal or load balancing devices that do not provide a self-service API for certificate renewal, they rely on certificate renewal personnel to manually fill in the renewal time, which can easily lead to data distortion and cause production accidents.

[0060] The present application provides a solution, by obtaining certificate information detected by a detector on a load balancing server, determining the domain name on the load balancing server that uses the corresponding certificate and has https access traffic based on the certificate information, detecting the domain name that uses the corresponding certificate and has https access traffic, and obtaining detection information, the detection information including the health status and certificate chain information of the TLS connection between the load balancing server and the certificate, matching the associated user corresponding to the certificate information based on the certificate information, detecting the health detection information, generating an alarm message when the health detection information meets a preset alarm condition, and sending the alarm message to the associated user, which can ensure that the certificate information is accurate and not easily distorted, and also reduce resource consumption.

[0061] It can be seen from the above embodiments that the present application obtains the certificate information detected by the detector on the load balancing server, determines the domain name on the load balancing server that uses the corresponding certificate and has https access traffic according to the certificate information, and detects the domain name that uses the corresponding certificate and has https access traffic to obtain detection information. The detection information includes the health status and certificate chain information of the TLS connection between the load balancing server and the certificate, matches the associated user corresponding to the certificate information according to the certificate information, detects the health detection information, and generates an alarm message when the health detection information meets the preset alarm condition, and sends the alarm message to the associated user, which can ensure that the certificate information is accurate and not easily distorted, and also reduces resource consumption.

[0062] It should be noted that the execution subject of this embodiment can be a computing service device with data processing, network communication and program running functions, such as a tablet computer, a personal computer, a mobile phone, etc., or an electronic device capable of realizing the above functions, a private cloud traffic scheduling platform certificate management device, etc. The following takes the private cloud traffic scheduling platform certificate management device as an example to illustrate this embodiment and the following embodiments.

[0063] Based on this, the embodiment of the present application provides a private cloud traffic scheduling platform certificate management method, referring to Figure 1 , Figure 1 This is a flow chart of the first embodiment of the certificate management method for the private cloud traffic scheduling platform of this application.

[0064] In this embodiment, the private cloud traffic scheduling platform certificate management method includes steps S10 to S40:

[0065] Step S10, obtaining certificate information detected by the detector on the load balancing server, and determining the domain name on the load balancing server that uses the corresponding certificate and has https access traffic according to the certificate information.

[0066] It should be noted that a load balancing server refers to a server that balances and distributes the load to multiple operating units to collaboratively complete work tasks, improve the availability and response speed of applications, and ensure that there is no single point of failure. The load balancing server has the characteristics of traffic distribution, high availability, scalability, security, performance optimization, etc. Certificate information includes information such as the certificate's effective time, certificate expiration time, and certificate deployment location.

[0067] In the specific implementation, the current certificate management records the certificate renewal time in each circulation link and obtains the validity period from the certificate issuing authority. However, this type of certificate management tool is strongly coupled with its corresponding commercial platform and has weak versatility. In addition, for certificates that cannot support automatic renewal or load balancing devices that do not provide a self-service API for certificate renewal, it is heavily dependent on the renewal personnel to manually fill in the renewal time, which can easily lead to data distortion and cause production accidents.

[0068] A detector (Agent) is deployed on each load balancing server, which can support all Linux operating system load balancing devices. The detector on the load balancing server can detect the certificate information and send a receipt for the detected certificate, thereby determining the domain name on the load balancing server that uses the corresponding certificate and has https access traffic from the certificate information.

[0069] In a feasible implementation manner, the step of obtaining the certificate information detected by the detector on the load balancing server and determining the domain name on the load balancing server that uses the corresponding certificate and has https access traffic according to the certificate information includes:

[0070] Get the certificate file detected by the detector on the load balancing server;

[0071] Determine the certificate information of the certificate according to the certificate file;

[0072] A domain name that uses a corresponding certificate and has https access traffic is determined on the load balancing server according to the certificate information.

[0073] In the specific implementation, the Agent on each load balancing server enters the standard directory where the certificate is stored to scan the certificate file, and uses the file to obtain the certificate CN, certificate validity time, certificate expiration time and other information, and records the location where the certificate is deployed, and reports this data to the certificate management information observation platform; at the same time, some certificates are extracted on this load balancing. The domain name that uses the corresponding certificate and has https access traffic is used for TLS (Transport Layer Security) connection health check module detection.

[0074] Step S20, detecting the domain name that uses the corresponding certificate and has https access traffic to obtain detection information, wherein the detection information includes the health status and certificate chain information of the TLS connection between the load balancing server and the certificate.

[0075] It should be noted that the health check information refers to the health check results of the domain name that uses the corresponding certificate and has https access traffic. It can describe whether the connection between the load balancing server and the certificate CN is normal, as well as the health status of each level in this connection link.

[0076] In a specific implementation, when performing a health check on a domain name that uses a corresponding certificate and has https access traffic, the domain name that uses a corresponding certificate and has https access traffic can be detected through a testing tool. Since the data link is a path during the detection, a health check can be performed on each link node involved in the path during the detection to determine the health check information of each level in the certificate link.

[0077] In a feasible implementation manner, the step of detecting the domain name that uses the corresponding certificate and has https access traffic to obtain detection information, wherein the detection information includes the health status of the TLS connection between the load balancing server and the certificate and the certificate chain information includes:

[0078] Using a test tool to test the TLS connection between the load balancing server and the certificate CN, and obtaining a test result;

[0079] When the detection result is normal, the detector performs health detection on the domain name that uses the corresponding certificate and has https access traffic based on a preset detection strategy, and feeds back the connection health status and certificate chain information;

[0080] Health check information is obtained according to the connection health status and the certificate chain information.

[0081] In the specific implementation, the tls protocol provided by OpenSSL is located between the tcp layer and the https layer. The openssls_client tool can be used to check whether the TLS link between the server and the certificate CN is normal. The Agent deployed on the server uses the OpenSSL s_client method to perform health detection on the https access domain name passed in by the certificate discovery module, and returns the health status of the connection and certificate chain information, including the issuer of each level of certificate, expiration time, etc.

[0082] Step S30: matching the associated user corresponding to the certificate information according to the certificate information.

[0083] It should be noted that associated users refer to the certificate applicants, application developers, operation managers, and parties related to certificate operations recorded in the current private cloud.

[0084] In a specific implementation, the mapping relationship between certificates and users can be included in the private cloud configuration management data center. For a certain certificate, each link in the certificate can be associated with the corresponding user. Similarly, for a certain user, it can be associated with multiple certificates. When matching the associated user corresponding to the certificate information according to the certificate information, the number ID of the current certificate can be determined according to the certificate information, and the database can be traversed based on the number ID to lock the certificate mapping relationship table corresponding to the number ID, and determine the associated user from the mapping relationship table.

[0085] In a feasible implementation manner, the step of matching the associated user corresponding to the certificate information according to the certificate information includes:

[0086] Acquire private cloud configuration management information, and determine a user mapping table according to the private cloud configuration management information, wherein the user mapping table includes a mapping relationship between certificate information and associated users;

[0087] Traversing the user mapping table based on the certificate information;

[0088] When the certificate information successfully matches the certificate information in the user mapping table, an associated user corresponding to the certificate information is determined.

[0089] It should be noted that the user mapping table includes a mapping relationship between certificate information and associated users, that is, the user information associated with the certificate information can be determined, and similarly, the certificate information can be determined according to the associated user.

[0090] In the specific implementation, the certificate CMDB (Configuration Management Database) is a sub-item in the private cloud CMDB, which is used to store and record all related information of the private cloud TLS certificate, and is associated with other related data items in the CMDB, thereby forming a complete certificate data management system. The certificate CMDB module records the certificate information collected by the certificate discovery module and the TLS connection monitoring and detection module; at the same time, this part of information is associated with the relevant information such as the certificate applicant, application developer, operation manager, load balancing facility, etc. in the private cloud CMDB, so that the certificate alarm and monitoring information can be sent to the parties related to the certificate operation in a timely and accurate manner.

[0091] Step S40: The domain name on the load balancing server that uses the corresponding certificate and has https access traffic, and the detection information including the health status of the TLS connection between the load balancing server and the certificate and the certificate chain information are stored in the certificate configuration management database.

[0092] It should be noted that the configuration management database, referred to as CMDB, is an important part of IT service management ITSM. CMDB stores detailed information of all configuration items in the IT environment.

[0093] In a specific implementation, the domain name on the load balancing server that uses the corresponding certificate and has https access traffic and the health status and certificate chain information of the TLS connection between the load balancing server and the certificate can be stored in the certificate configuration management database.

[0094] Step S50, detecting the health detection information, generating alarm information when the health detection information meets a preset alarm condition, and sending the alarm information to the associated user.

[0095] It should be noted that the preset alarm condition refers to whether the remaining term of the current certificate has reached a preset threshold, and there is a threshold for potential risks that affect the use of the certificate; the alarm information refers to the generation of corresponding alarm information when the current health check information meets the preset alarm condition, to prompt that there is an abnormality in the current certificate.

[0096] In a specific implementation, the health detection information is detected to determine each sub-item information in the health detection information, and the health detection information of each sub-item is determined. At the same time, the preset alarm condition is determined according to the project type of the sub-item, and each preset alarm condition is compared with the health detection information of the sub-item. When it is determined that the health detection information of the sub-item meets the preset alarm condition, it indicates that there is an abnormality in the current sub-item, and the project type of the current sub-item is output, and an alarm message is generated based on this, and the alarm message is sent to the corresponding associated user.

[0097] In a feasible implementation manner, the step of detecting the health detection information, generating alarm information when the health detection information meets a preset alarm condition, and sending the alarm information to the associated user includes:

[0098] Comparing the health detection information with preset health information to obtain a comparison result;

[0099] When the comparison result is that the health detection information meets the preset alarm information, determining abnormal information;

[0100] Generate warning information according to the abnormal information and the associated user, and send the warning information to the associated user.

[0101] It should be noted that the comparison result refers to the comparison result between the health detection information and the preset health information. At this time, the health detection information is compared with the preset alarm information. The abnormal information refers to the corresponding information when the health detection information meets the preset alarm information.

[0102] In the specific implementation, the alarm and data monitoring module reads the information required for certificate management and operation from the certificate CMDB, forming an observable certificate operation monitoring screen, supporting the visual display and query of the distribution of each certificate in different load balancing systems, so as to intuitively understand the distribution range of the certificate and support users to query certificate-related information by themselves. At the same time, it issues an alarm for certificates that are about to expire, accurately matches the relevant person in charge of the certificate in the CMDB, and pushes certificate update message reminders in a timely manner.

[0103] The present embodiment provides a certificate management method for a private cloud traffic scheduling platform, which obtains certificate information detected by a detector on a load balancing server, determines the domain name on the load balancing server that uses a corresponding certificate and has https access traffic based on the certificate information, detects the domain name that uses the corresponding certificate and has https access traffic, and obtains detection information, wherein the detection information includes the health status and certificate chain information of the TLS connection between the load balancing server and the certificate, matches the associated user corresponding to the certificate information based on the certificate information, detects the health detection information, generates alarm information when the health detection information meets the preset alarm condition, and sends the alarm information to the associated user, which can ensure that the certificate information is accurate and not easily distorted, and also reduces resource consumption.

[0104] Based on the first embodiment of the present application, in the second embodiment of the present application, the same or similar contents as those in the above-mentioned embodiment 1 can be referred to the above introduction, and will not be repeated in the following. Figure 2 Before step S10, the private cloud traffic scheduling platform certificate management method further includes steps S01 to S04:

[0105] Step S01: Determine a storage directory for the certificate file, match the storage directory with a preset storage directory, and obtain a matching result.

[0106] Step S02: When the matching result is the first matching result, obtain the IP information passed in by the user, and determine the target query certificate CN name based on the IP information, so that the detector on the load balancing server determines the validity on the load balancing device corresponding to the IP information based on the target query certificate CN name.

[0107] Step S03: When the validity is valid, determine the health check information between the load balancing server and the certificate CN.

[0108] Step S04: When the matching result is the second matching result, the step of obtaining the certificate information detected by the detector on the load balancing server and determining the domain name on the load balancing server that uses the corresponding certificate and has https access traffic according to the certificate information is executed.

[0109] It should be noted that the first matching result and the second matching result respectively correspond to the matching results of failed matching and successful matching obtained when the storage directory is matched with the preset storage directory.

[0110] In the specific implementation, the certificate file is usually stored in the certificate storage directory specified by the certificate uninstaller on the load balancer, in order to avoid special circumstances or some non-standard configurations that cause the certificate discovery module to fail, such as the certificate stored in a non-standard directory but valid. The certificate self-service verification module allows users to pass in the IP address of any load balancing device and specify the CN name of the certificate to be queried. The Agent deployed on the load balancer can verify whether the certificate (CN) is valid on the load balancing device specified by the user based on the information passed in by the user, and check the health status of the TLS connection between the server and the certificate CN.

[0111] In a feasible implementation manner, the step of determining a storage directory for the certificate file, matching the storage directory with a preset storage directory, and obtaining a matching result includes:

[0112] Determine the storage directory of the certificates;

[0113] Establish a connection with the certificate domain name through the server IP information, and obtain the certificate domain name information of the server;

[0114] When the server IP information successfully establishes a connection with the certificate domain name, the certificate CN name is matched to obtain matching information of the certificate CN name;

[0115] A matching result is obtained according to the matching information of the certificate CN name.

[0116] In the specific implementation, refer to Figure 3 , Figure 3 This is the flow chart of the certificate self-service verification module. You can use the openssl command to specify the server IP to establish a connection with the certificate domain name, obtain the server's certificate domain name information, and determine the connection status. If the connection fails, it will directly return the connection failure information. When the connection is successful, it can check whether the result matches the CN name of the certificate. If the match is successful, it will return a successful connection and the server is a certificate uninstall point. If the match fails, it will return a successful connection but the server is not a certificate uninstall point.

[0117] This embodiment provides a method for supporting self-service verification of certificate configuration file scanning omissions in the event that some non-standard configurations cause the certificate discovery module to fail, such as when the certificate is stored in a non-standard directory but is still valid, thereby improving the fault tolerance of certificate discovery.

[0118] For example, in order to help understand the implementation process of the private cloud traffic scheduling platform certificate management method obtained by combining this embodiment with the above-mentioned embodiment 1, please refer to Figure 4 , Figure 4 A brief flow chart of a private cloud traffic scheduling platform certificate management method is provided, specifically:

[0119] The entire design concept can be divided into multiple modules, such as certificate discovery module, TLS connection health check module, certificate CMDB, alarm and data monitoring module and certificate self-service verification module. An Agent is deployed on each load balancing server to collect certificate-related information on each load balancer, and finally report it to the certificate information observation platform. First, the certificate discovery module outputs the distribution of the full certificate at the unloading point, and inputs the distribution of the full certificate at the unloading point into the private cloud CMDB and the https access domain name identification module corresponding to the certificate. The private cloud CMDB can save the received information, and the https access domain name identification module corresponding to the certificate can output the corresponding domain name of the https certificate that needs to be verified on each load balancer based on the received data, and input it into the TLS connection health check module, and output the TLS link health status of each certificate at its corresponding unloading point, certificate expiration time, issuer, certificate chain and other information that the certificate manager is concerned about, and this information is also input into the private It is saved in the cloud CMDB and saved to the certificate CMDB. It is completed by the certificate information scanning detector and then monitored by the alarm and data monitoring module to determine the visual analysis data, including the visual distribution of certificates at different load balancing deployment points, TLS connection monitoring status, the proportion of certificates that need to be updated in the near future, etc. At the same time, the alarm and data monitoring module can judge the expiration of the certificate and determine whether the certificate expiration time alarm threshold is reached, such as (<30 days). If so, the certificate update alarm is triggered to determine whether automatic rotation update is supported. If so, the certificate is automatically rotated and updated, and the operation and maintenance personnel meet the requirements normally, and the certificate alarm responds. If not, the operation and maintenance personnel receive the alarm and update the certificate in time.

[0120] Deploy a detection tool on the certificate unloading server, actively poll the certificate information on the load balancing device, and uniformly report it to the certificate management platform to avoid situations where manual intervention leads to misoperation; the data comes from the underlying configuration of the load balancing device and is not easily distorted; support operation and maintenance personnel to use any cloud application domain name to initiate a certificate check request to the underlying load balancing device to confirm whether the certificate is uninstalled on the load balancing device. A detector (Agent) is deployed on each load balancing device. It supports all Linux operating system load balancing devices and can be used to initiate network detection from the load balancing device to the https application domain name to verify whether the TLS link is normal, and obtain certificate expiration information, issuing agency, cross root and other information. This method does not rely on the support capabilities of APIs such as load balancing device certificate management, and has strong versatility.

[0121] It should be noted that the above examples are only used to understand the present application and do not constitute a limitation on the certificate management method of the private cloud traffic scheduling platform of the present application. More simple transformations based on this technical concept are all within the scope of protection of the present application.

[0122] This application also provides a private cloud traffic scheduling platform certificate management device, please refer to Figure 5 , the private cloud traffic scheduling platform certificate management device includes:

[0123] The certificate discovery module 10 is used to obtain the certificate information detected by the detector on the load balancing server, and determine the domain name on the load balancing server that uses the corresponding certificate and has https access traffic according to the certificate information.

[0124] The health check module 20 is used to detect the domain name that uses the corresponding certificate and has https access traffic to obtain detection information, which includes the health status and certificate chain information of the TLS connection between the load balancing server and the certificate.

[0125] The configuration management module 30 is used to match the associated user corresponding to the certificate information according to the certificate information.

[0126] The information storage module 40 is used to store the domain name on the load balancing server that uses the corresponding certificate and has https access traffic, the health status of the TLS connection between the load balancing server and the certificate, and the certificate chain information into the certificate configuration management database.

[0127] The data monitoring module 50 is used to detect the health detection information, generate alarm information when the health detection information meets the preset alarm condition, and send the alarm information to the associated user.

[0128] The private cloud traffic scheduling platform certificate management device provided by the present application adopts the private cloud traffic scheduling platform certificate management method in the above-mentioned embodiment, which can solve the technical problems in the prior art that certificates rely on manual processing, data is easily distorted, and production accidents are easily caused. Compared with the prior art, the beneficial effects of the private cloud traffic scheduling platform certificate management device provided by the present application are the same as the beneficial effects of the private cloud traffic scheduling platform certificate management method provided by the above-mentioned embodiment, and other technical features in the private cloud traffic scheduling platform certificate management device are the same as the features disclosed in the above-mentioned embodiment method, which will not be repeated here.

[0129] The present application provides a private cloud traffic scheduling platform certificate management device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the private cloud traffic scheduling platform certificate management method in the above-mentioned embodiment one.

[0130] Reference below Figure 6 , which shows a schematic diagram of the structure of a private cloud traffic scheduling platform certificate management device suitable for implementing the embodiment of the present application. The private cloud traffic scheduling platform certificate management device in the embodiment of the present application may include but is not limited to mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Descriptions), PMPs (Portable Media Players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 6 The private cloud traffic scheduling platform certificate management device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0131] like Figure 6As shown, the private cloud traffic scheduling platform certificate management device may include a processing device 1001 (such as a central processing unit, a graphics processor, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM: Read Only Memory) 1002 or a program loaded from a storage device 1003 to a random access memory (RAM: Random Access Memory) 1004. In RAM1004, various programs and data required for the operation of the private cloud traffic scheduling platform certificate management device are also stored. The processing device 1001, ROM1002 and RAM1004 are connected to each other via a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Typically, the following systems can be connected to the I / O interface 1006: input devices 1007 including, for example, a touch screen, a touchpad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; output devices 1008 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; storage devices 1003 including, for example, a magnetic tape, a hard disk, etc.; and communication devices 1009. The communication device 1009 can allow the private cloud traffic scheduling platform certificate management device to communicate wirelessly or wired with other devices to exchange data. Although the private cloud traffic scheduling platform certificate management device with various systems is shown in the figure, it should be understood that it is not required to implement or have all the systems shown. More or fewer systems may be implemented or have alternatively.

[0132] In particular, according to the embodiments disclosed in the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present application include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device, or installed from a storage device 1003, or installed from a ROM 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the method of the embodiment disclosed in the present application are executed.

[0133] The private cloud traffic scheduling platform certificate management device provided by the present application adopts the private cloud traffic scheduling platform certificate management method in the above embodiment, which can solve the technical problems in the prior art that certificates rely on manual processing, data is easily distorted, and production accidents are easily caused. Compared with the prior art, the beneficial effects of the private cloud traffic scheduling platform certificate management device provided by the present application are the same as the beneficial effects of the private cloud traffic scheduling platform certificate management method provided by the above embodiment, and other technical features in the private cloud traffic scheduling platform certificate management device are the same as the features disclosed in the method of the previous embodiment, which will not be repeated here.

[0134] It should be understood that the various parts disclosed in this application can be implemented by hardware, software, firmware or a combination thereof. In the description of the above embodiments, specific features, structures, materials or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0135] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0136] The present application provides a computer-readable storage medium having computer-readable program instructions (ie, computer programs) stored thereon, and the computer-readable program instructions are used to execute the private cloud traffic scheduling platform certificate management method in the above-mentioned embodiment.

[0137] The computer-readable storage medium provided in the present application may be, for example, a USB flash drive, but is not limited to electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, systems or devices, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, system or device. The program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination of the above.

[0138] The above-mentioned computer-readable storage medium may be included in the private cloud traffic scheduling platform certificate management device; or it may exist independently without being assembled into the private cloud traffic scheduling platform certificate management device.

[0139] The computer-readable storage medium carries one or more programs. When the one or more programs are executed by the private cloud traffic scheduling platform certificate management device, the private cloud traffic scheduling platform certificate management device:

[0140] Obtaining certificate information detected by a detector on the load balancing server, and determining a domain name on the load balancing server that uses a corresponding certificate and has https access traffic according to the certificate information;

[0141] Probe the domain name that uses the corresponding certificate and has https access traffic to obtain detection information, wherein the detection information includes the health status of the TLS connection between the load balancing server and the certificate and the certificate chain information;

[0142] Matching the associated user corresponding to the certificate information according to the certificate information;

[0143] The health detection information is detected, and when the health detection information meets a preset alarm condition, an alarm information is generated, and the alarm information is sent to the associated user.

[0144] Computer program code for performing the operations of the present application may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0145] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0146] The modules involved in the embodiments described in this application may be implemented by software or hardware, wherein the name of the module does not constitute a limitation on the unit itself in some cases.

[0147] The readable storage medium provided by the present application is a computer-readable storage medium, which stores computer-readable program instructions (i.e., computer programs) for executing the above-mentioned private cloud traffic scheduling platform certificate management method, and can solve the technical problems in the prior art that certificates rely on manual processing, data is easily distorted, and production accidents are easily caused. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided by the present application are the same as the beneficial effects of the private cloud traffic scheduling platform certificate management method provided by the above-mentioned embodiment, and will not be repeated here.

[0148] The present application also provides a computer program product, including a computer program, which, when executed by a processor, implements the steps of the private cloud traffic scheduling platform certificate management method as described above.

[0149] The computer program product provided by this application can solve the technical problems in the prior art that certificates rely on manual processing, data is easily distorted, and production accidents are easily caused. Compared with the prior art, the beneficial effects of the computer program product provided by this application are the same as the beneficial effects of the private cloud traffic scheduling platform certificate management method provided in the above embodiment, and will not be repeated here.

[0150] The above descriptions are only some embodiments of the present application, and are not intended to limit the patent scope of the present application. All equivalent structural changes made using the contents of the present application specification and drawings under the technical concept of the present application, or direct / indirect applications in other related technical fields are included in the patent protection scope of the present application.

Claims

1. A private cloud traffic scheduling platform certificate management method, characterized in that: The private cloud traffic scheduling platform certificate management method includes: Obtaining certificate information detected by a detector on the load balancing server, and determining a domain name on the load balancing server that uses a corresponding certificate and has https access traffic according to the certificate information; Probe the domain name that uses the corresponding certificate and has https access traffic to obtain detection information, wherein the detection information includes the health status of the TLS connection between the load balancing server and the certificate and the certificate chain information; Matching the associated user corresponding to the certificate information according to the certificate information; The domain name on the load balancing server that uses the corresponding certificate and has https access traffic, the health status of the TLS connection between the load balancing server and the certificate, and the certificate chain information are stored in the certificate configuration management database; The health detection information is detected, and when the health detection information meets a preset alarm condition, an alarm information is generated, and the alarm information is sent to the associated user.

2. The method according to claim 1, characterized in that The step of obtaining the certificate information detected by the detector on the load balancing server and determining the domain name on the load balancing server that uses the corresponding certificate and has https access traffic according to the certificate information comprises: Get the certificate file detected by the detector on the load balancing server; Determine the certificate information of the certificate according to the certificate file; A domain name that uses a corresponding certificate and has https access traffic is determined on the load balancing server according to the certificate information.

3. The method according to claim 1, characterized in that The step of detecting the domain name that uses the corresponding certificate and has https access traffic to obtain detection information, wherein the detection information includes the health status of the TLS connection between the load balancing server and the certificate and the certificate chain information comprises: Using a test tool to test the TLS connection between the load balancing server and the certificate CN, and obtaining a test result; When the detection result is normal, the detector performs health detection on the domain name that uses the corresponding certificate and has https access traffic based on a preset detection strategy, and feeds back the connection health status and certificate chain information; Health check information is obtained according to the connection health status and the certificate chain information.

4. The method according to claim 1, characterized in that The step of matching the associated user corresponding to the certificate information according to the certificate information comprises: Acquire private cloud configuration management information, and determine a user mapping table according to the private cloud configuration management information, wherein the user mapping table includes a mapping relationship between certificate information and associated users; Traversing the user mapping table based on the certificate information; When the certificate information successfully matches the certificate information in the user mapping table, an associated user corresponding to the certificate information is determined.

5. The method according to claim 1, characterized in that The step of detecting the health detection information, generating alarm information when the health detection information meets a preset alarm condition, and sending the alarm information to the associated user includes: Comparing the health detection information with preset health information to obtain a comparison result; When the comparison result is that the health detection information meets the preset alarm information, determining abnormal information; Generate warning information according to the abnormal information and the associated user, and send the warning information to the associated user.

6. The method according to any one of claims 1 to 5, characterized in that Before the step of obtaining the certificate information detected by the detector on the load balancing server and determining the domain name on the load balancing server that uses the corresponding certificate and has https access traffic according to the certificate information, the step further includes: Determine a storage directory for the certificate file, match the storage directory with a preset storage directory, and obtain a matching result; When the matching result is the first matching result, the IP information input by the user is obtained, and the target query certificate CN name is determined according to the IP information, so that the detector on the load balancing server determines the validity on the load balancing device corresponding to the IP information based on the target query certificate CN name; When the validity is valid, determining health check information between the load balancing server and the certificate CN; When the matching result is the second matching result, the step of obtaining the certificate information detected by the detector on the load balancing server and determining the domain name on the load balancing server that uses the corresponding certificate and has https access traffic according to the certificate information is executed.

7. The method according to claim 6, characterized in that The step of determining a storage directory for the certificate file, matching the storage directory with a preset storage directory, and obtaining a matching result comprises: Determine the storage directory of the certificate; Establish a connection with the certificate domain name through the server IP information, and obtain the certificate domain name information of the server; When the server IP information successfully establishes a connection with the certificate domain name, the certificate CN name is matched to obtain matching information of the certificate CN name; A matching result is obtained according to the matching information of the certificate CN name.

8. A private cloud traffic scheduling platform certificate management device, characterized in that: The device comprises: The certificate discovery module is used to obtain the certificate information detected by the detector on the load balancing server, and determine the domain name on the load balancing server that uses the corresponding certificate and has https access traffic according to the certificate information; A health check module is used to detect the domain name that uses the corresponding certificate and has https access traffic to obtain detection information, wherein the detection information includes the health status of the TLS connection between the load balancing server and the certificate and the certificate chain information; A configuration management module, used to match the associated user corresponding to the certificate information according to the certificate information; An information storage module is used to store the domain name on the load balancing server that uses the corresponding certificate and has https access traffic, the health status of the TLS connection between the load balancing server and the certificate, and the certificate chain information into a certificate configuration management database; The data monitoring module is used to detect the health detection information, generate alarm information when the health detection information meets the preset alarm condition, and send the alarm information to the associated user.

9. A private cloud traffic scheduling platform certificate management device, characterized in that: The device includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the private cloud traffic scheduling platform certificate management method as described in any one of claims 1 to 7.

10. A storage medium, characterized in that: The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the private cloud traffic scheduling platform certificate management method as described in any one of claims 1 to 7 are implemented.

Images