Private cloud traffic scheduling platform certificate management method, device and equipment and storage medium

Abstract

The application discloses a private cloud traffic scheduling platform certificate management method and device, equipment and a storage medium, relates to the technical field of certificate management, and comprises the following steps: obtaining certificate information detected by a detector on a load balancing server, determining domain names with corresponding certificates and https access traffic on the load balancing server according to the certificate information, detecting the domain names with corresponding certificates and https access traffic, obtaining detection information, wherein the detection information comprises the health status of a TLS connection between the load balancing server and the certificate and certificate chain information, matching an associated user corresponding to the certificate information according to the certificate information, detecting the health detection information, generating alarm information when the health detection information meets a preset alarm condition, and sending the alarm information to the associated user. The application can ensure the accuracy of the certificate information, reduce the distortion, and reduce resource consumption.

Description

Technical Field

[0001] This application relates to the field of certificate management technology, and in particular to certificate management methods, apparatus, devices and storage media for private cloud traffic scheduling platforms. Background Technology

[0002] Current certificate management platforms or services support the entire lifecycle management process of certificates, including application, renewal, and destruction, and provide API support for one-click deployment of certificates to load balancing products. They also record the certificate update time and the validity period obtained from the certificate authority at each stage of the process. While this provides a convenient solution for cloud users, such certificate management tools are strongly coupled with their corresponding commercial platforms, resulting in limited versatility. Furthermore, for some certificates that do not support automatic renewal or load balancing devices that do not provide a self-service API for certificate updates, relying on manual entry of update times by certificate update personnel can easily lead to data distortion and potentially cause production incidents.

[0003] The above content is only used to help understand the technical solution of this application and does not represent an admission that the above content is prior art. Summary of the Invention

[0004] The main purpose of this application is to provide a certificate management method, device, equipment and storage medium for a private cloud traffic scheduling platform, which aims to solve the technical problems in the prior art where certificates rely on manual processing, data is easily distorted, and production accidents are easily caused.

[0005] To achieve the above objectives, this application proposes a certificate management method for a private cloud traffic scheduling platform, the method comprising:

[0006] Obtain the certificate information detected by the detector on the load balancer server, and determine the domain name that uses the corresponding certificate and has HTTPS access traffic on the load balancer server based on the certificate information;

[0007] The domain name using the corresponding certificate and having HTTPS access traffic is probed to obtain probe information, which includes the health status of the TLS connection between the load balancer server and the certificate and the certificate chain information;

[0008] Match the associated user corresponding to the certificate information based on the certificate information;

[0009] The health status and certificate chain information of the TLS connection between the load balancer and the certificate are stored in the certificate configuration management database for the domains that use the corresponding certificates and have HTTPS access traffic on the load balancer server.

[0010] The health detection information is detected, and when the health detection information meets the preset alarm conditions, an alarm message is generated and sent to the associated user.

[0011] In one embodiment, the step of obtaining certificate information detected by the detector on the load balancer server and determining, based on the certificate information, the domain names using the corresponding certificates and having HTTPS access traffic on the load balancer server includes:

[0012] Retrieve the certificate files detected by the detector on the load balancer server;

[0013] The certificate information is determined based on the certificate file;

[0014] Based on the certificate information, identify the domains that use the corresponding certificates and have HTTPS access traffic on the load balancer server.

[0015] In one embodiment, the step of probing the domain name using the corresponding certificate and having HTTPS access traffic to obtain probe information, the probe information including the health status of the TLS connection between the load balancer server and the certificate and certificate chain information, includes:

[0016] The TLS connection between the load balancer server and the certificate CN was tested using testing tools, and the test results were obtained.

[0017] When the detection result is normal, the detector performs a health check on the domain name that uses the corresponding certificate and has HTTPS access traffic based on a preset detection strategy, and feeds back the connection health status and certificate chain information.

[0018] Health check information is obtained based on the connection health status and the certificate chain information.

[0019] In one embodiment, the step of matching the associated user corresponding to the certificate information based on the certificate information includes:

[0020] Obtain private cloud configuration management information, and determine a user mapping table based on the private cloud configuration management information. The user mapping table includes the mapping relationship between certificate information and associated users.

[0021] Traverse the user mapping table based on the certificate information;

[0022] When the certificate information matches the certificate information in the user mapping table, the associated user corresponding to the certificate information is determined.

[0023] In one embodiment, the step of detecting the health detection information, generating alarm information when the health detection information meets preset alarm conditions, and sending the alarm information to the associated user includes:

[0024] The health detection information is compared with preset health information to obtain the comparison result;

[0025] When the comparison result indicates that the health detection information meets the preset alarm information, abnormal information is determined;

[0026] An alarm message is generated based on the abnormal information and the associated user, and the alarm message is sent to the associated user.

[0027] In one embodiment, the step of detecting the health detection information, generating alarm information when the health detection information meets preset alarm conditions, and sending the alarm information to the associated user includes:

[0028] The health detection information is compared with preset health information to obtain the comparison result;

[0029] When the comparison result indicates that the health detection information meets the preset alarm information, abnormal information is determined;

[0030] An alarm message is generated based on the abnormal information and the associated user, and the alarm message is sent to the associated user.

[0031] In one embodiment, the step of determining the storage directory of the certificate file and matching the storage directory with a preset storage directory to obtain a matching result includes:

[0032] Determine the directory where the certificate will be stored;

[0033] A connection is established between the server IP information and the certificate domain name, and the certificate domain name information of the server is obtained;

[0034] When the server IP information and the certificate domain name are successfully connected, the certificate CN name is matched to obtain the matching information for the certificate CN name;

[0035] The matching result is obtained based on the matching information of the certificate CN name.

[0036] Furthermore, to achieve the above objectives, this application also proposes a certificate management device for a private cloud traffic scheduling platform, the certificate management device comprising:

[0037] The certificate discovery module is used to obtain certificate information detected by the detector on the load balancer server, and determine the domain name that uses the corresponding certificate and has HTTPS access traffic on the load balancer server based on the certificate information.

[0038] The health check module is used to probe the domain name that uses the corresponding certificate and has HTTPS access traffic, and obtain probe information, including the health status of the TLS connection between the load balancer server and the certificate and the certificate chain information;

[0039] The configuration management module is used to match the associated users corresponding to the certificate information based on the certificate information;

[0040] The information storage module is used to store the domain names on the load balancer server that use the corresponding certificates and have HTTPS access traffic, as well as the health status and certificate chain information of the TLS connection between the load balancer server and the certificate, into the certificate configuration management database.

[0041] The data monitoring module is used to detect the health detection information, generate alarm information when the health detection information meets the preset alarm conditions, and send the alarm information to the associated user.

[0042] In addition, to achieve the above objectives, this application also proposes a certificate management device for a private cloud traffic scheduling platform, the device comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the certificate management method for a private cloud traffic scheduling platform as described above.

[0043] In addition, to achieve the above objectives, this application also proposes a storage medium, which is a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, it implements the steps of the private cloud traffic scheduling platform certificate management method described above.

[0044] In addition, to achieve the above objectives, this application also provides a computer program product, which includes a computer program that, when executed by a processor, implements the steps of the private cloud traffic scheduling platform certificate management method described above.

[0045] One or more technical solutions proposed in this application have at least the following technical effects: obtaining certificate information detected by a detector on a load balancer server; determining, based on the certificate information, domain names using the corresponding certificate and having HTTPS access traffic on the load balancer server; probing the domain names using the corresponding certificate and having HTTPS access traffic to obtain detection information, the detection information including the health status of the TLS connection between the load balancer server and the certificate and certificate chain information; matching the associated user corresponding to the certificate information based on the certificate information; detecting the health detection information; generating alarm information when the health detection information meets preset alarm conditions; and sending the alarm information to the associated user. This ensures that the certificate information is accurate and not easily distorted, while also reducing resource consumption. Attached Figure Description

[0046] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0047] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0048] Figure 1 This is a flowchart illustrating an embodiment of the certificate management method for a private cloud traffic scheduling platform in this application.

[0049] Figure 2 This is a flowchart illustrating Embodiment 2 of the certificate management method for the private cloud traffic scheduling platform in this application.

[0050] Figure 3 A flowchart of the certificate self-verification module provided in an embodiment of the certificate management method for the private cloud traffic scheduling platform of this application;

[0051] Figure 4 A simplified flowchart illustrating the certificate management method for a private cloud traffic scheduling platform provided in Embodiment 2 of this application;

[0052] Figure 5 This is a schematic diagram of the module structure of the certificate management device for the private cloud traffic scheduling platform in an embodiment of this application;

[0053] Figure 6 This is a schematic diagram of the device structure of the hardware operating environment involved in the certificate management method of the private cloud traffic scheduling platform in this application embodiment.

[0054] The purpose, features, and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0055] It should be understood that the specific embodiments described herein are merely illustrative of the technical solutions of this application and are not intended to limit this application.

[0056] To better understand the technical solution of this application, a detailed description will be provided below in conjunction with the accompanying drawings and specific implementation methods.

[0057] The main solution of this application embodiment is as follows: obtain the certificate information detected by the detector on the load balancer server, determine the domain name that uses the corresponding certificate and has HTTPS access traffic on the load balancer server according to the certificate information, detect the domain name that uses the corresponding certificate and has HTTPS access traffic, obtain detection information, the detection information includes the health status of the TLS connection between the load balancer server and the certificate and certificate chain information, match the associated user corresponding to the certificate information according to the certificate information, detect the health detection information, generate alarm information when the health detection information meets the preset alarm conditions, and send the alarm information to the associated user.

[0058] In this embodiment, for ease of description, the following description will focus on the certificate management device of the private cloud traffic scheduling platform.

[0059] Because existing certificate management tools are strongly coupled with their corresponding commercial platforms and have weak versatility, and because some certificates do not support automatic renewal or load balancing devices do not provide a certificate update self-service API, the reliance on certificate update personnel to manually enter the update time can easily lead to data distortion and thus cause production accidents.

[0060] This application provides a solution that obtains certificate information detected by a detector on a load balancer server, identifies domains using the corresponding certificates and having HTTPS access traffic on the load balancer server based on the certificate information, probes the domains using the corresponding certificates and having HTTPS access traffic to obtain probe information, the probe information including the health status of the TLS connection between the load balancer server and the certificate and certificate chain information, matches the associated users corresponding to the certificate information based on the certificate information, checks the health detection information, and generates alarm information when the health detection information meets preset alarm conditions, and sends the alarm information to the associated users. This can ensure the accuracy of certificate information, prevent it from being easily distorted, and also reduce resource consumption.

[0061] As can be seen from the above embodiments, this application obtains certificate information detected by a detector on a load balancer server, determines the domain name using the corresponding certificate and having HTTPS access traffic on the load balancer server based on the certificate information, probes the domain name using the corresponding certificate and having HTTPS access traffic to obtain probe information, the probe information includes the health status of the TLS connection between the load balancer server and the certificate and certificate chain information, matches the associated user corresponding to the certificate information based on the certificate information, detects the health detection information, generates alarm information when the health detection information meets preset alarm conditions, and sends the alarm information to the associated user, which can ensure the accuracy of certificate information, prevent distortion, and reduce resource consumption.

[0062] It should be noted that the executing entity in this embodiment can be a computing service device with data processing, network communication, and program execution functions, such as a tablet computer, personal computer, or mobile phone, or an electronic device capable of performing the above functions, such as a private cloud traffic scheduling platform certificate management device. The following description uses a private cloud traffic scheduling platform certificate management device as an example to illustrate this embodiment and the subsequent embodiments.

[0063] Based on this, embodiments of this application provide a certificate management method for a private cloud traffic scheduling platform, referring to... Figure 1 , Figure 1 This is a flowchart illustrating the first embodiment of the certificate management method for the private cloud traffic scheduling platform of this application.

[0064] In this embodiment, the private cloud traffic scheduling platform certificate management method includes steps S10 to S40:

[0065] Step S10: Obtain the certificate information detected by the detector on the load balancer server, and determine the domain name that uses the corresponding certificate and has HTTPS access traffic on the load balancer server based on the certificate information.

[0066] It should be noted that a load balancer server refers to a server that balances and distributes the load across multiple operating units to collaboratively complete tasks, improving application availability and responsiveness while ensuring no single point of failure. Load balancers are characterized by traffic distribution, high availability, scalability, security, and performance optimization. Certificate information includes the certificate's effective date, expiration date, and deployment location.

[0067] In practice, current certificate management systems record the certificate update time and the validity period obtained from the certificate issuing authority at each stage of the process. However, these certificate management tools are strongly coupled with their corresponding commercial platforms, have weak versatility, and rely heavily on manual input of update times by update personnel for certificates that do not support automatic renewal or load balancing devices that do not provide a certificate update self-service API. This can easily lead to data distortion and potentially cause production accidents.

[0068] Deploy a probe (Agent) on each load balancer server. This probe supports load balancers running all Linux operating systems. The probe on the load balancer server can detect certificate information and send receipts of the detected certificates, thereby identifying the domains on the load balancer server that use the corresponding certificates and have HTTPS access traffic from the certificate information.

[0069] In one feasible implementation, the step of obtaining certificate information detected by the detector on the load balancer server and determining the domain name using the corresponding certificate and having HTTPS access traffic on the load balancer server based on the certificate information includes:

[0070] Retrieve the certificate files detected by the detector on the load balancer server;

[0071] The certificate information is determined based on the certificate file;

[0072] Based on the certificate information, identify the domains that use the corresponding certificates and have HTTPS access traffic on the load balancer server.

[0073] In the specific implementation, the Agent on each load balancer server enters the standard directory where certificates are stored to scan the certificate files and uses the files to obtain information such as the certificate CN, certificate effective time, and certificate expiration time. It also records the location where the certificate is deployed and reports this data to the certificate management information observation platform. At the same time, it extracts some domains that use the corresponding certificates on this load balancer and have HTTPS access traffic for use by the TLS (Transport Layer Security) connection health check module for detection.

[0074] Step S20: Probe the domain name that uses the corresponding certificate and has HTTPS access traffic to obtain probe information. The probe information includes the health status of the TLS connection between the load balancer server and the certificate and the certificate chain information.

[0075] It should be noted that health check information refers to the results of health checks performed on domains that use the corresponding certificates and have HTTPS access traffic. It can describe whether the connection between the load balancer server and the certificate CN is normal, as well as the health status of each level in this connection link.

[0076] In practical implementation, when performing health checks on domains that use the corresponding certificates and have HTTPS access traffic, testing tools can be used to detect these domains. Since the data link is the pathway during the detection process, health checks can be performed on each link node involved in the pathway to determine the health check information of each level in the certificate link.

[0077] In one feasible implementation, the step of probing the domain name using the corresponding certificate and having HTTPS access traffic to obtain probing information, wherein the probing information includes the health status of the TLS connection between the load balancer server and the certificate and certificate chain information, includes:

[0078] The TLS connection between the load balancer server and the certificate CN was tested using testing tools, and the test results were obtained.

[0079] When the detection result is normal, the detector performs a health check on the domain name that uses the corresponding certificate and has HTTPS access traffic based on a preset detection strategy, and feeds back the connection health status and certificate chain information.

[0080] Health check information is obtained based on the connection health status and the certificate chain information.

[0081] In its implementation, OpenSSL's TLS protocol sits between the TCP and HTTPS layers. The `openssls_client` tool can be used to check the TLS connection between the server and the certificate discovery domain (CN). The agent deployed on the server uses the OpenSSL `s_client` method to perform a health check on the HTTPS access domain passed to the certificate discovery module, returning the connection's health status and certificate chain information, including the issuer and expiration date of each certificate level.

[0082] Step S30: Match the associated user corresponding to the certificate information based on the certificate information.

[0083] It should be noted that associated users refer to the certificate applicants, application developers, operations managers, and other parties involved in certificate operations currently recorded in the private cloud.

[0084] In a specific implementation, the private cloud configuration management data center can contain a mapping relationship between certificates and users. For a certain certificate, a corresponding user can be associated with each link in the certificate. Similarly, for a certain user, multiple certificates can be associated with it. When matching the associated user corresponding to the certificate information based on the certificate information, the current certificate number ID can be determined based on the certificate information. The database can be traversed based on the number ID to lock the certificate mapping relationship table corresponding to the number ID, and the associated user can be determined by exiting the mapping relationship table.

[0085] In one feasible implementation, the step of matching the associated user corresponding to the certificate information based on the certificate information includes:

[0086] Obtain private cloud configuration management information, and determine a user mapping table based on the private cloud configuration management information. The user mapping table includes the mapping relationship between certificate information and associated users.

[0087] Traverse the user mapping table based on the certificate information;

[0088] When the certificate information matches the certificate information in the user mapping table, the associated user corresponding to the certificate information is determined.

[0089] It should be noted that the user mapping table includes the mapping relationship between certificate information and associated users. In other words, it can determine the user information associated with the certificate information, and similarly, it can determine the certificate information based on the associated users.

[0090] In its implementation, the Certificate CMDB (Configuration Management Database), as a sub-item of the Private Cloud CMDB, stores and records all associated information about private cloud TLS certificates. It is linked with other related data items in the CMDB to form a complete certificate data management system. The Certificate CMDB module records certificate information collected by the certificate discovery module and the TLS connection monitoring and detection module. It also associates this information with records in the Private Cloud CMDB related to certificate applicants, application developers, operations managers, load balancing facilities, and other relevant information, ensuring that certificate alarms and monitoring information are sent to relevant certificate operations parties in a timely and accurate manner.

[0091] Step S40: Store the domains on the load balancer server that use the corresponding certificates and have HTTPS access traffic, including the health status of the TLS connection between the load balancer server and the certificate and the certificate chain information, into the certificate configuration management database.

[0092] It should be noted that the Configuration Management Database (CMDB) is an important component of IT Service Management (ITSM). The CMDB stores detailed information about all configuration items in the IT environment.

[0093] In a specific implementation, the health status and certificate chain information of the domains using the corresponding certificates and having HTTPS access traffic on the load balancer server, as well as the TLS connection between the load balancer server and the certificate, can be stored in the certificate configuration management database.

[0094] Step S50: Detect the health detection information, generate alarm information when the health detection information meets the preset alarm conditions, and send the alarm information to the associated user.

[0095] It should be noted that the preset alarm conditions refer to the thresholds for determining whether the remaining validity period of the current certificate has reached a preset threshold, indicating a potential risk that may affect the use of the certificate; the alarm information refers to the corresponding alarm information generated when the current health detection information meets the preset alarm conditions, in order to indicate that there is an abnormality in the current certificate.

[0096] In the specific implementation, the health detection information is detected, each sub-item of the health detection information is determined, and the health detection information of each sub-item is determined. At the same time, preset alarm conditions are determined according to the item type of the sub-item, and each preset alarm condition is compared with the health detection information of the sub-item. When it is determined that the health detection information of the sub-item meets the preset alarm conditions, it indicates that the current sub-item is abnormal, the item type of the current sub-item is output, and an alarm message is generated based on this and sent to the corresponding associated user.

[0097] In one feasible implementation, the step of detecting the health detection information, generating alarm information when the health detection information meets preset alarm conditions, and sending the alarm information to the associated user includes:

[0098] The health detection information is compared with preset health information to obtain the comparison result;

[0099] When the comparison result indicates that the health detection information meets the preset alarm information, abnormal information is determined;

[0100] An alarm message is generated based on the abnormal information and the associated user, and the alarm message is sent to the associated user.

[0101] It should be noted that the comparison result refers to the comparison result between the health detection information and the preset health information. In this case, the health detection information is compared with the preset alarm information. Abnormal information refers to the information corresponding to the health detection information when the preset alarm information is met.

[0102] In its implementation, the alarm and data monitoring module reads the information required for certificate management and operation from the Certificate Management Database (CMDB), forming an observable certificate operation monitoring dashboard. This dashboard provides a visual display and query of the distribution of each certificate across different load balancing systems, facilitating an intuitive understanding of the certificate distribution range and allowing users to self-service query certificate-related information. Simultaneously, it issues alarms for certificates nearing expiration, accurately matches the relevant certificate administrators in the CMDB, and promptly pushes certificate update reminders.

[0103] This embodiment provides a certificate management method for a private cloud traffic scheduling platform. It obtains certificate information detected by a detector on a load balancer server, identifies domains using the corresponding certificates and exhibiting HTTPS traffic on the load balancer server based on this certificate information, and probes these domains to obtain probe information. This probe information includes the health status of the TLS connection between the load balancer server and the certificate, as well as certificate chain information. The method matches the associated users corresponding to the certificate information, checks the health information, and generates and sends alarm information to the associated users when the health information meets preset alarm conditions. This method ensures the accuracy and integrity of certificate information while reducing resource consumption.

[0104] Based on the first embodiment of this application, in the second embodiment of this application, the content that is the same as or similar to that in the first embodiment described above can be referred to the above description, and will not be repeated hereafter. Based on this, please refer to... Figure 2 Before step S10, the private cloud traffic scheduling platform certificate management method further includes steps S01 to S04:

[0105] Step S01: Determine the storage directory of the certificate file, and match the storage directory with the preset storage directory to obtain the matching result.

[0106] Step S02: When the matching result is the first matching result, obtain the IP information passed by the user, and determine the target query certificate CN name based on the IP information, so that the detector on the load balancing server can determine the validity of the load balancing device corresponding to the IP information based on the target query certificate CN name.

[0107] Step S03: When the validity is valid, determine the health check information between the load balancer server and the certificate CN.

[0108] Step S04: When the matching result is the second matching result, execute the step of obtaining the certificate information detected by the detector on the load balancer server, and determining the domain name that uses the corresponding certificate and has HTTPS access traffic on the load balancer server based on the certificate information.

[0109] It should be noted that the first matching result and the second matching result correspond to the matching results of failure and success when the storage directory is matched with the preset storage directory, respectively.

[0110] In practice, certificate files are typically stored in the certificate storage directory specified by the certificate uninstallation program on the load balancer. To avoid special cases or non-standard configurations that could cause the certificate discovery module to malfunction (e.g., a certificate stored in a non-standard directory but still valid), a self-verification certificate module allows users to input the IP address of any load balancer and specify the certificate name (CN) to query. The agent deployed on the load balancer can then verify whether the certificate (CN) is valid on the user-specified load balancer based on the user-input information and check the health of the TLS connection between the server and the certificate CN.

[0111] In one feasible implementation, the step of determining the storage directory of the certificate file and matching the storage directory with a preset storage directory to obtain a matching result includes:

[0112] Determine the directory where the certificate will be stored;

[0113] A connection is established between the server IP information and the certificate domain name, and the certificate domain name information of the server is obtained;

[0114] When the server IP information and the certificate domain name are successfully connected, the certificate CN name is matched to obtain the matching information for the certificate CN name;

[0115] The matching result is obtained based on the matching information of the certificate CN name.

[0116] In the specific implementation, refer to Figure 3 , Figure 3 The flowchart for the certificate self-verification module shows that the openssl command can be used to specify the server IP and establish a connection with the certificate domain name to obtain the certificate domain name information of the server and determine the connection status. If the connection fails, a connection failure message is returned directly. If the connection is successful, it can check whether the CN name of the certificate is matched in the result. If the match is successful, a connection success message is returned, indicating that the server is a certificate offload point. If the match fails, a connection success message is returned, indicating that the server is not a certificate offload point.

[0117] This embodiment provides a solution for situations where the certificate discovery module fails due to non-standard configurations, such as when certificates are stored in non-standard directories but still function. It supports self-service verification of missing certificate configuration files and improves the fault tolerance of certificate discovery.

[0118] For example, to help understand the implementation process of the private cloud traffic scheduling platform certificate management method obtained by combining this embodiment with the above embodiment one, please refer to... Figure 4 , Figure 4 A simplified flowchart illustrating a certificate management method for a private cloud traffic scheduling platform is provided, specifically:

[0119] The overall design can be divided into several modules, such as a certificate discovery module, a TLS connection health check module, a certificate CMDB, an alarm and data monitoring module, and a certificate self-verification module. An agent is deployed on each load balancer server to collect certificate association information from each load balancer and ultimately report it to the certificate information observation platform. First, the certificate discovery module outputs the distribution of all certificates at the offload points and inputs this distribution into the private cloud CMDB and the certificate-corresponding HTTPS access domain identification module. The private cloud CMDB stores the received information, while the certificate-corresponding HTTPS access domain identification module outputs the corresponding domain name of the HTTPS certificate to be verified on each load balancer based on the received data. This information is then input into the TLS connection health check module, which outputs the TLS connection health status of each certificate at its corresponding offload point, certificate expiration time, issuer, certificate chain, and other information of interest to certificate administrators. This information is also input into the private cloud CMDB. The certificate information is stored in the cloud CMDB and saved to the certificate CMDB by the certificate information scanning detector. The alarm and data monitoring module then monitors the data to determine the visualized analysis data, including the visualized distribution of certificates at different load balancer deployment points, TLS connection monitoring status, and the percentage of certificates that need to be updated recently. At the same time, the alarm and data monitoring module can determine whether the certificate has expired and whether it has reached the certificate expiration time alarm threshold (<30 days). If so, a certificate update alarm is triggered. The module also determines whether automatic rotation update is supported. If so, the certificate is automatically rotated for update. If the operation and maintenance personnel respond normally, the certificate alarm is answered. If not, the operation and maintenance personnel receive the alarm and update the certificate in time.

[0120] Deploying a probe tool on the certificate offloading server proactively polls certificate information on the load balancer and reports it uniformly to the certificate management platform, avoiding errors caused by manual intervention. The data originates from the underlying configuration of the load balancer, minimizing distortion. It allows operations personnel to initiate certificate check requests to the underlying load balancer using any cloud application domain to confirm whether a certificate has been offloaded on that load balancer. Deploying a probe (Agent) on each load balancer supports all Linux operating system load balancers and can be used to initiate network probes from the load balancer to HTTPS application domains, verifying the TLS connection's integrity and obtaining certificate expiration information, issuing authority, cross-root information, etc. This method does not rely on the load balancer's certificate management API support capabilities, making it highly versatile.

[0121] It should be noted that the above examples are only for understanding this application and do not constitute a limitation on the certificate management method of the private cloud traffic scheduling platform of this application. Any simple modifications based on this technical concept are within the protection scope of this application.

[0122] This application also provides a certificate management device for a private cloud traffic scheduling platform. Please refer to [link / reference]. Figure 5 The private cloud traffic scheduling platform certificate management device includes:

[0123] The certificate discovery module 10 is used to obtain certificate information detected by the detector on the load balancer server, and determine the domain name that uses the corresponding certificate and has HTTPS access traffic on the load balancer server based on the certificate information.

[0124] The health check module 20 is used to probe the domain name that uses the corresponding certificate and has HTTPS access traffic, and obtain probe information, including the health status of the TLS connection between the load balancer server and the certificate and the certificate chain information.

[0125] The configuration management module 30 is used to match the associated user corresponding to the certificate information based on the certificate information.

[0126] The information storage module 40 is used to store the domain names on the load balancer server that use the corresponding certificates and have HTTPS access traffic, as well as the health status and certificate chain information of the TLS connection between the load balancer server and the certificate, into the certificate configuration management database.

[0127] The data monitoring module 50 is used to detect the health detection information, generate alarm information when the health detection information meets the preset alarm conditions, and send the alarm information to the associated user.

[0128] The private cloud traffic scheduling platform certificate management device provided in this application, employing the private cloud traffic scheduling platform certificate management method described in the above embodiments, can solve the technical problems in the prior art where certificates rely on manual processing, data is prone to distortion, and production accidents are easily caused. Compared with the prior art, the beneficial effects of the private cloud traffic scheduling platform certificate management device provided in this application are the same as those of the private cloud traffic scheduling platform certificate management method provided in the above embodiments, and other technical features in the private cloud traffic scheduling platform certificate management device are the same as those disclosed in the methods of the above embodiments, and will not be repeated here.

[0129] This application provides a certificate management device for a private cloud traffic scheduling platform. The certificate management device includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the certificate management method for the private cloud traffic scheduling platform described in Embodiment 1 above.

[0130] The following is for reference. Figure 6 This document illustrates a structural diagram of a certificate management device suitable for implementing the embodiments of this application for a private cloud traffic scheduling platform. The certificate management device for a private cloud traffic scheduling platform in the embodiments of this application may include, but is not limited to, mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Description), PMPs (Portable Media Players), in-vehicle terminals (e.g., in-vehicle navigation terminals), and fixed terminals such as digital TVs and desktop computers. Figure 6 The certificate management device for the private cloud traffic scheduling platform shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of this application.

[0131] like Figure 6As shown, the private cloud traffic scheduling platform certificate management device may include a processing unit 1001 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in read-only memory (ROM) 1002 or a program loaded from storage device 1003 into random access memory (RAM) 1004. The RAM 1004 also stores various programs and data required for the operation of the private cloud traffic scheduling platform certificate management device. The processing unit 1001, ROM 1002, and RAM 1004 are interconnected via a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Typically, the following systems can be connected to I / O interface 1006: input devices 1007 including, for example, touchscreens, touchpads, keyboards, mice, image sensors, microphones, accelerometers, gyroscopes, etc.; output devices 1008 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 1003 including, for example, magnetic tapes, hard disks, etc.; and communication devices 1009. Communication device 1009 allows the private cloud traffic scheduling platform certificate management device to communicate wirelessly or wiredly with other devices to exchange data. Although the figure shows a private cloud traffic scheduling platform certificate management device with various systems, it should be understood that it is not required to implement or have all the systems shown. More or fewer systems can be implemented alternatively.

[0132] Specifically, according to the embodiments disclosed in this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments disclosed in this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device, or installed from storage device 1003, or installed from ROM 1002. When the computer program is executed by processing device 1001, it performs the functions defined in the methods of the embodiments disclosed in this application.

[0133] The private cloud traffic scheduling platform certificate management device provided in this application, employing the private cloud traffic scheduling platform certificate management method described in the above embodiments, can solve the technical problems in the prior art where certificates rely on manual processing, data is prone to distortion, and production accidents are easily caused. Compared with the prior art, the beneficial effects of the private cloud traffic scheduling platform certificate management device provided in this application are the same as those of the private cloud traffic scheduling platform certificate management method provided in the above embodiments, and other technical features in this private cloud traffic scheduling platform certificate management device are the same as those disclosed in the previous embodiment method, and will not be repeated here.

[0134] It should be understood that the various parts disclosed in this application can be implemented using hardware, software, firmware, or a combination thereof. In the description of the above embodiments, specific features, structures, materials, or characteristics can be combined in any suitable manner in one or more embodiments or examples.

[0135] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0136] This application provides a computer-readable storage medium having computer-readable program instructions (i.e., a computer program) stored thereon, which are used to execute the private cloud traffic scheduling platform certificate management method in the above embodiments.

[0137] The computer-readable storage medium provided in this application may be, for example, a USB flash drive, but is not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to: electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, system, or device. The program code contained on the computer-readable storage medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination thereof.

[0138] The aforementioned computer-readable storage medium may be included in the private cloud traffic scheduling platform certificate management device; or it may exist independently and not be assembled into the private cloud traffic scheduling platform certificate management device.

[0139] The aforementioned computer-readable storage medium carries one or more programs, which, when executed by the private cloud traffic scheduling platform certificate management device, cause the private cloud traffic scheduling platform certificate management device to:

[0140] Obtain the certificate information detected by the detector on the load balancer server, and determine the domain name that uses the corresponding certificate and has HTTPS access traffic on the load balancer server based on the certificate information;

[0141] The domain name using the corresponding certificate and having HTTPS access traffic is probed to obtain probe information, which includes the health status of the TLS connection between the load balancer server and the certificate and the certificate chain information;

[0142] Match the associated user corresponding to the certificate information based on the certificate information;

[0143] The health detection information is detected, and when the health detection information meets the preset alarm conditions, an alarm message is generated and sent to the associated user.

[0144] Computer program code for performing the operations of this application can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a Local Area Network (LAN) or a Wide Area Network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0145] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0146] The modules described in the embodiments of this application can be implemented in software or hardware. The names of the modules do not necessarily limit the functionality of the unit itself.

[0147] The readable storage medium provided in this application is a computer-readable storage medium that stores computer-readable program instructions (i.e., a computer program) for executing the above-described private cloud traffic scheduling platform certificate management method. This solves the technical problems in the prior art where certificates rely on manual processing, data is easily distorted, and production accidents are prone to occur. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided in this application are the same as those of the private cloud traffic scheduling platform certificate management method provided in the above embodiments, and will not be repeated here.

[0148] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the private cloud traffic scheduling platform certificate management method described above.

[0149] The computer program product provided in this application can solve the technical problems in the prior art where certificates rely on manual processing, data is easily distorted, and production accidents are prone to occur. Compared with the prior art, the beneficial effects of the computer program product provided in this application are the same as those of the private cloud traffic scheduling platform certificate management method provided in the above embodiments, and will not be repeated here.

[0150] The above description is only a part of the embodiments of this application and does not limit the patent scope of this application. All equivalent structural transformations made under the technical concept of this application and using the contents of the specification and drawings of this application, or direct / indirect applications in other related technical fields, are included in the patent protection scope of this application.

Claims

1. A certificate management method for a private cloud traffic scheduling platform, characterized in that, The certificate management method for the private cloud traffic scheduling platform includes: Obtain the certificate information detected by the detector on the load balancer server, and determine the domain name that uses the corresponding certificate and has HTTPS access traffic on the load balancer server based on the certificate information; The domain name using the corresponding certificate and having HTTPS access traffic is probed to obtain probe information, which includes the health status of the TLS connection between the load balancer server and the certificate and the certificate chain information; Match the associated user corresponding to the certificate information based on the certificate information; The health status and certificate chain information of the TLS connection between the load balancer and the certificate are stored in the certificate configuration management database for the domains that use the corresponding certificates and have HTTPS access traffic on the load balancer server. The health status and certificate chain information of the TLS connection between the load balancer server and the certificate are detected to obtain health detection information. When the health detection information meets the preset alarm conditions, alarm information is generated and sent to the associated user.

2. The method as described in claim 1, characterized in that, The step of obtaining the certificate information detected by the detector on the load balancer server, and determining the domain names using the corresponding certificates and having HTTPS access traffic on the load balancer server based on the certificate information, includes: Retrieve the certificate files detected by the detector on the load balancer server; The certificate information is determined based on the certificate file; Based on the certificate information, identify the domains that use the corresponding certificates and have HTTPS access traffic on the load balancer server.

3. The method as described in claim 1, characterized in that, The step of probing the domain name that uses the corresponding certificate and has HTTPS access traffic to obtain probe information, the probe information including the health status of the TLS connection between the load balancer server and the certificate and the certificate chain information, includes: The TLS connection between the load balancer server and the certificate CN was tested using testing tools, and the test results were obtained. When the detection result is normal, the detector performs a health check on the domain name that uses the corresponding certificate and has HTTPS access traffic based on a preset detection strategy to obtain detection information.

4. The method as described in claim 1, characterized in that, The step of matching the associated user corresponding to the certificate information based on the certificate information includes: Obtain private cloud configuration management information, and determine a user mapping table based on the private cloud configuration management information. The user mapping table includes the mapping relationship between certificate information and associated users. Traverse the user mapping table based on the certificate information; When the certificate information matches the certificate information in the user mapping table, the associated user corresponding to the certificate information is determined.

5. The method as described in claim 1, characterized in that, The steps of detecting the health information, generating an alarm message when the health information meets preset alarm conditions, and sending the alarm message to the associated user include: The health detection information is compared with preset health information to obtain the comparison result; When the comparison result indicates that the health detection information meets the preset alarm information, abnormal information is determined; An alarm message is generated based on the abnormal information and the associated user, and the alarm message is sent to the associated user.

6. The method according to any one of claims 1-5, characterized in that, Before the step of obtaining the certificate information detected by the detector on the load balancer server and determining the domain name using the corresponding certificate and having HTTPS access traffic on the load balancer server based on the certificate information, the method further includes: Determine the storage directory of the certificate file, and match the storage directory with the preset storage directory to obtain the matching result; When the matching result is the first matching result, the IP information input by the user is obtained, and the target query certificate CN name is determined according to the IP information, so that the detector on the load balancing server can determine the validity of the load balancing device corresponding to the IP information based on the target query certificate CN name; When the validity is valid, determine the health check information between the load balancer server and the certificate CN; When the matching result is the second matching result, the step of obtaining the certificate information detected by the detector on the load balancer server and determining the domain name that uses the corresponding certificate and has HTTPS access traffic on the load balancer server based on the certificate information is executed.

7. The method as described in claim 6, characterized in that, The step of determining the storage directory of the certificate file and matching the storage directory with a preset storage directory to obtain a matching result includes: Determine the directory where the certificate will be stored; A connection is established between the server IP information and the certificate domain name, and the certificate domain name information of the server is obtained; When the server IP information and the certificate domain name are successfully connected, the certificate CN name is matched to obtain the matching information for the certificate CN name; The matching result is obtained based on the matching information of the certificate CN name.

8. A certificate management device for a private cloud traffic scheduling platform, characterized in that, The device includes: The certificate discovery module is used to obtain certificate information detected by the detector on the load balancer server, and determine the domain name that uses the corresponding certificate and has HTTPS access traffic on the load balancer server based on the certificate information. The health check module is used to probe the domain name that uses the corresponding certificate and has HTTPS access traffic, and obtain probe information, including the health status of the TLS connection between the load balancer server and the certificate and the certificate chain information; The configuration management module is used to match the associated users corresponding to the certificate information based on the certificate information; The information storage module is used to store the domain names on the load balancer server that use the corresponding certificates and have HTTPS access traffic, as well as the health status and certificate chain information of the TLS connection between the load balancer server and the certificate, into the certificate configuration management database. The data monitoring module is used to detect the health status and certificate chain information of the TLS connection between the load balancer server and the certificate, obtain health detection information, generate alarm information when the health detection information meets the preset alarm conditions, and send the alarm information to the associated user.

9. A certificate management device for a private cloud traffic scheduling platform, characterized in that, The device includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the private cloud traffic scheduling platform certificate management method as described in any one of claims 1 to 7.

10. A storage medium, characterized in that, The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, it implements the steps of the private cloud traffic scheduling platform certificate management method as described in any one of claims 1 to 7.

Images