Certificate management method, system and device and computer equipment

Abstract

The invention relates to the technical field of network security, in particular to a certificate management method, system and device and computer equipment. The method is applied to a client, and comprises the following steps: when it is determined that an immediate certificate exists, sending an application information acquisition request to a server based on a service object of the immediate certificate, and receiving an application command line fed back by the server; the application command line is constructed by the server based on application information of a service object pre-stored by a user; an application request is generated based on the application command line, the application request is sent to the CA end, and the application request is used for indicating the CA end to feed back a signing certificate; a configuration information acquisition request is sent to the server side, a configuration command line fed back by the server side is received, and the configuration command line is constructed by the server side based on the pre-stored configuration information of the service object; and processing the signed certificate based on the configuration information, so that the signed certificate replaces the temporary certificate. By adopting the method provided by the invention, the certificate deployment efficiency can be improved.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a certificate management method, system, device, and computer equipment. Background Technology

[0002] SSL (Secure Socket Layer) certificates are digital certificates used to encrypt data during network transmission, ensuring data confidentiality and integrity, and providing authentication functions. In recent years, the CA / B (Certificate Authority / Browser) alliance has taken measures to gradually shorten the validity period of SSL certificates to enhance their security. It is expected that in the near future, the validity period of SSL certificates will be shortened to 3 months. This will generate a large number of certificate registration tasks, and once a certificate expires, it will affect the application of encrypted communication chains, potentially impacting business operations. Therefore, reducing certificate expiration is a significant challenge.

[0003] In related technologies, service providers need to use an ACME protocol client and manually enter registration information each time they deploy a new SSL certificate for their products. The ACME protocol client generates a registration request based on the user-input registration information and sends it to the CA (Certificate Authority). After verifying the registration information, the CA returns the SSL certificate to the ACME (Automated Certificate Management Environment) protocol client, and the service provider then manually enters deployment information to deploy the SSL certificate. However, the ACME protocol client in these technologies only supports command-line input. This means that service providers need to manually enter registration and deployment information via command line during certificate deployment, which undoubtedly leads to low efficiency in SSL certificate deployment.

[0004] Therefore, improving the efficiency of certificate deployment is an urgent problem to be solved. Summary of the Invention

[0005] Therefore, it is necessary to provide a certificate management method, system, device, and computer equipment that can improve the efficiency of deploying SSL certificates, addressing the aforementioned technical issues.

[0006] Firstly, this application provides a certificate management method applied to a client, the method comprising:

[0007] When it is determined that a certificate is about to expire, the service object based on the certificate sends an application information retrieval request to the server and receives an application command line from the server. The application command line is constructed by the server based on the application information of the service object pre-stored by the user. The certificate about to expire is a certificate with a remaining lifespan less than or equal to a time limit.

[0008] An application request is generated based on the application command line and sent to the CA. The application request is used to instruct the CA to provide a signed certificate.

[0009] Send a configuration information retrieval request to the server and receive a configuration command line from the server, wherein the configuration command line is constructed by the server based on the pre-stored configuration information of the service object;

[0010] The signing certificate is processed based on the configuration information, so that the signing certificate replaces the expiring certificate.

[0011] Through the above technical solution, when the client determines that a near-expiration certificate exists, it can automatically send an application information retrieval request to the server based on the service object of the near-expiration certificate. The server generates an application command line based on the application information of the service object pre-stored by the user and sends it back to the client. The client then executes the application command line to generate application information and sends it to the CA to apply for a certificate. After the CA returns the signed certificate, the client sends a configuration information retrieval request to the server. The server generates a configuration command line based on the configuration information pre-stored by the user and sends it back to the client. The client executes the configuration command line to process the signed certificate, thereby replacing the near-expiration certificate. In this process, the user does not need to manually monitor the near-expiration certificate. The user only needs to pre-store the application information and configuration information of each service object in the server. Through information interaction between the client and the server, the registration and configuration of the near-expiration certificate can be automatically realized, thereby reducing the probability of the service object's certificate expiring. Moreover, compared with related technologies, the user no longer needs to enter command lines to realize certificate registration and configuration, thereby reducing the operation of manually entering command lines each time registering and configuring a signed certificate, thus improving the efficiency of certificate configuration.

[0012] In one embodiment, the method further includes:

[0013] Every preset time interval, iterate through the remaining lifespan of each target certificate.

[0014] Determine whether any near-expiration certificates exist based on the remaining lifespan of each target certificate;

[0015] The duration threshold corresponding to any target certificate is determined based on the complete lifetime of the target certificate.

[0016] In one embodiment, the method further includes:

[0017] Send a service purchase order to the server and obtain a verification code from the server; the verification code is sent to the client after the server confirms that the service purchase order is effective.

[0018] When sending any request to the server, the verification code is added to the request; wherein, when the server receives the request, it verifies the validity of the request based on the verification code, and executes the request if the request is valid.

[0019] Secondly, this application also provides a certificate management method applied to a server, the method comprising:

[0020] In response to the application information retrieval request sent by the client, an application command line is constructed based on the pre-stored application information of the service object, and the application command line is fed back to the client; the application information retrieval request is generated by the client based on the service object of the near-expiration certificate when it is determined that there is a near-expiration certificate, and the near-expiration certificate is a certificate with a remaining lifespan less than or equal to the duration threshold;

[0021] In response to the configuration information retrieval request sent by the client, a configuration command line is constructed based on the configuration information of the service object pre-stored by the user, and the configuration command line is fed back to the client so that the client processes the signed certificate based on the configuration command line, and the signed certificate replaces the expiring certificate; the signed certificate is fed back to the client by the CA based on the application request sent by the client, and the application request is generated by the client based on the application command line.

[0022] In one embodiment, the method further includes:

[0023] In response to the user's input application command, the application command line is constructed by retrieving the pre-stored application information of the service object, wherein the application command includes the service object;

[0024] An application request is constructed based on the application command line, and the application request is sent to the CA. The signing certificate is then obtained from the CA.

[0025] The configuration command line is constructed by retrieving the pre-stored configuration information of the service object, and the configuration command line and the signing certificate are fed back to the client, so that the client processes the signing certificate based on the configuration command line and configures the signing certificate for the service object.

[0026] In one embodiment, the method further includes:

[0027] Upon receiving a service purchase order from the client, determine whether the service purchase order is valid, and after confirming that the service purchase order is valid, send a verification code to the server.

[0028] Upon receiving any instruction sent by the client, the system verifies the validity of the instruction based on the verification code in the instruction, and executes the instruction if the instruction is valid; the verification code in the instruction is added by the client based on the verification code fed back by the server.

[0029] Thirdly, this application also provides a certificate management system, which includes a server and a client, wherein:

[0030] The client is used to, upon determining the existence of a near-expiration certificate, send an application information retrieval request to the server based on the service object of the near-expiration certificate, receive an application command line from the server, generate an application request based on the application command line, and send the application request to the CA to obtain a signed certificate from the CA; wherein, the application command line is constructed by the server based on the application information of the service object pre-stored by the user; the near-expiration certificate is a certificate with a remaining lifetime less than or equal to a duration threshold;

[0031] In response to the configuration information retrieval request sent by the client, the client generates a configuration command line based on the configuration information of the service object pre-stored by the user, and feeds back the configuration command line to the client, so that the client processes the signed certificate based on the configuration command line, and the signed certificate replaces the expiring certificate.

[0032] Fourthly, this application also provides a certificate management device, the device comprising an application information acquisition module, an application request generation module, a configuration information acquisition module, and a configuration module, wherein:

[0033] The application information acquisition module is used to send an application information acquisition request to the server based on the service object of the near-expiration certificate when it is determined that there is a near-expiration certificate, and to receive the application command line fed back by the server; the application command line is constructed by the server based on the application information of the service object pre-stored by the user, and the near-expiration certificate is a certificate with a remaining life of less than or equal to a duration threshold.

[0034] The application request generation module is used to generate an application request based on the application command line and send the application request to the CA terminal. The application request is used to instruct the CA terminal to provide a signed certificate.

[0035] The configuration information acquisition module is used to send a configuration information acquisition request to the server and receive a configuration command line from the server. The configuration command line is constructed by the server based on the pre-stored configuration information of the service object.

[0036] The configuration module is used to process the signing certificate based on the configuration information, so that the signing certificate replaces the expiring certificate.

[0037] Fifthly, this application also provides a certificate management device, the device comprising a first response module and a second response module, wherein:

[0038] The first response module is used to respond to the application information retrieval request sent by the client, construct an application command line based on the pre-stored application information of the service object, and feed back the application command line to the client; the application information retrieval request is generated by the client based on the service object of the near-expiration certificate when it is determined that there is a near-expiration certificate, and the near-expiration certificate is a certificate with a remaining lifespan less than or equal to a duration threshold;

[0039] The second response module is used to respond to the configuration information acquisition request sent by the client, construct a configuration command line based on the configuration information of the service object pre-stored by the user, and feed the configuration command line back to the client so that the client processes the signed certificate based on the configuration command line, so that the signed certificate replaces the expiring certificate; the signed certificate is fed back to the client by the CA based on the application request sent by the client, and the application request is generated by the client based on the application command line.

[0040] Sixthly, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the program steps of the certificate management method as described in any one of the first or second aspects above.

[0041] In a seventh aspect, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the program steps of the certificate management method as described in any one of the first or second aspects above.

[0042] Eighthly, this application also provides a computer program product, including a computer program that, when executed by a processor, implements the program steps of the certificate management method as described in any one of the first or second aspects above.

[0043] The aforementioned certificate management method, system, device, and computer equipment allow the client to automatically send an application information retrieval request to the server based on the service object of the near-expiration certificate when the client determines that a certificate is about to expire. The server generates an application command line based on the application information of the service object pre-stored by the user and sends it back to the client. The client then executes the application command line to generate application information and sends it to the CA for certificate application. After the CA issues a signed certificate, the client sends a configuration information retrieval request to the server. The server generates a configuration command line based on the configuration information pre-stored by the user and sends it back to the client. The client executes the configuration command line to process the signed certificate, thereby replacing the near-expiration certificate. In this process, the user does not need to manually monitor the near-expiration certificate. The user only needs to pre-store the application information and configuration information of each service object in the server. Through information interaction between the client and the server, the registration and configuration of the near-expiration certificate can be automatically realized, thereby reducing the probability of the service object's certificate expiring. Furthermore, compared with related technologies, the user no longer needs to enter command lines to register and configure the certificate, thus reducing the manual operation of entering command lines each time a signed certificate is registered and configured, thereby improving the efficiency of certificate configuration. Attached Figure Description

[0044] To more clearly illustrate the technical solutions in the embodiments or related technologies of this application, the accompanying drawings used in the description of the embodiments or related technologies will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0045] Figure 1 This is a schematic diagram of a certificate management system in one embodiment;

[0046] Figure 2 This is a flowchart illustrating a certificate management method in one embodiment;

[0047] Figure 3 This is a flowchart illustrating the steps for determining a near-expiration certificate in one embodiment;

[0048] Figure 4 This is a flowchart illustrating the certificate management method in another embodiment;

[0049] Figure 5 A flowchart illustrating a certificate management method for another scenario;

[0050] Figure 6 This is a schematic diagram of the interaction logic of a certificate management system in one embodiment;

[0051] Figure 7This is a structural block diagram of a certificate management device in one embodiment;

[0052] Figure 8 This is a structural block diagram of the certificate management device in another embodiment;

[0053] Figure 9 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0054] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0055] The certificate management method provided in this application embodiment can be applied to, for example, Figure 1 The application environment is illustrated. The client can communicate with the server, obtaining application and configuration command lines from the server. Based on the application command line, the client sends an application request to the CA and receives a signed certificate from the CA. The client then configures the signed certificate using the configuration command line. Similarly, the server can send application requests to the CA, receive a signed certificate from the CA, and configure the signed certificate. The data storage system stores the data the server needs to process. This system can be integrated on the server or hosted in the cloud or on other network servers. The client can be configured on a computer device, which may include, but is not limited to, various personal computers, laptops, smartphones, tablets, IoT devices, portable wearable devices, and servers. IoT devices may include smart speakers, smart TVs, smart air conditioners, and smart in-vehicle devices. Portable wearable devices may include smartwatches, smart bracelets, and head-mounted devices. The server can be a standalone server or a server cluster. The server is configured on the server itself. Users can communicate and interact with the server through the client or through a visual interface on the server.

[0056] In one exemplary embodiment, such as Figure 2 As shown, a certificate management method is provided, suitable for scenarios where the server and client are configured on different cloud platforms. This method is applied to... Figure 1 Taking the client as an example, the explanation includes steps 110-140, where:

[0057] Step 110: When it is determined that a certificate is about to expire, the service object based on the certificate sends an application information retrieval request to the server and receives the application command line from the server. The application command line is constructed by the server based on the application information of the service object pre-stored by the user. The certificate about to expire is a certificate whose remaining lifespan is less than or equal to the duration threshold.

[0058] In this embodiment, the client configuration and the user's various product (service object) configurations are on the same platform. The client and server configurations can be on different platforms; for example, the server is configured on cloud platform A, and the client and the user's various product (service object) configurations are on cloud platform B. The configuration information for each service object needs to be pre-stored by the user on the server. The user can write the configuration information of each service object to the server storage through the server's visual interface. The configuration information required for a service object includes at least domain name information (main domain and subdomain), organization information (organization name, organization address, organization-related certificates), contact information, payment account, and CA-side API (Application Programming Interface) keys or credentials, etc. This embodiment does not specifically limit the content of the configuration information.

[0059] The client is built on the ACME (Automated Certificate Management Environment) protocol, and the server also supports the ACME protocol; that is, both the server and client support command-line input to execute certificate application or configuration steps. The client can monitor the remaining lifespan of certificates for each user's service objects to determine if any are nearing expiration. When a near-expiration certificate is identified, the service object of the near-expiration certificate is determined, which can be identified by a unique identifier (ID). The client then organizes the ID of the service object of the near-expiration certificate into a request message for obtaining application information and sends the request to the server. Upon receiving the request from the client, the server retrieves the application information for the service object based on the ID of the near-expiration certificate, organizes the application information into a request command line, and then sends the request command line back to the client.

[0060] Step 120: Generate an application request based on the application command line and send the application request to the CA. The application request is used to instruct the CA to provide a signed certificate.

[0061] In this embodiment of the application, after receiving the application command line from the server, the client runs the application command line, generates an application request from the application information carried in the command line, and then sends the application request to the CA (Certificate Authority) to apply for certificate registration. After receiving the application request, the CA verifies the application information carried in the application request, and after successful verification, sends the signed certificate back to the client. The signed certificate sent back to the client by the CA is in a standard format.

[0062] Step 130: Send a configuration information retrieval request to the server and receive the configuration command line from the server. The configuration command line is constructed by the server based on the pre-stored configuration information of the service object.

[0063] In this embodiment, the client may initiate a request to the server for configuration information of the signed certificate upon receiving the certificate from the client. Alternatively, the client may send both the application information request and the configuration information request to the server simultaneously. This embodiment does not specify the timing of the client sending the configuration information request to the server. The configuration information includes at least the service type and configuration address. Each service type corresponds to a certificate format. When configuring a signed certificate for different service types, the standard format signed certificate needs to be converted to the format applicable to the service type.

[0064] After receiving the configuration information retrieval request from the client, the server retrieves the configuration information pre-stored by the user corresponding to the service object ID carried in the configuration information retrieval request, organizes the configuration information into a configuration command line, and then sends the configuration command line back to the client.

[0065] Step 140: Process the signed certificate based on the configuration information so that the signed certificate replaces the expiring certificate.

[0066] In this embodiment of the application, after receiving the configuration command line from the server, the client executes the configuration command line and converts the format of the contract certificate based on the configuration information in the configuration command line to obtain the converted contract certificate. Then, the contract certificate is stored in the configuration address, and the corresponding expiring certificate in the configuration address is deleted. In other words, the expiring certificate is replaced by the contract certificate, thereby realizing the renewal of the certificate of the service object corresponding to the expiring certificate.

[0067] Furthermore, the client can also actively search for the format and configuration address of the expiring certificate, and then configure the signed certificate based on the format and configuration address of the expiring certificate; that is, convert the format of the signed certificate based on the format of the expiring certificate, configure the converted signed certificate at the configuration address corresponding to the expiring certificate, and delete the expiring certificate, thereby realizing the renewal of the certificate of the service object corresponding to the expiring certificate.

[0068] It should be noted that the expiring certificate and the signed certificate in this application embodiment can be SSL (Secure Sockets Layer) certificates or other types of digital certificates, such as TLS (Transport Layer Security) certificates. No specific limitation is made here in this application embodiment.

[0069] In the aforementioned certificate management method, when the client determines that a near-expiration certificate exists, it can automatically send an application information retrieval request to the server based on the service object of the near-expiration certificate. The server generates an application command line based on the application information of the service object pre-stored by the user and sends it back to the client. The client then executes the application command line to generate application information and sends it to the CA to apply for a certificate. After the CA returns a signed certificate, the client sends a configuration information retrieval request to the server. The server generates a configuration command line based on the configuration information pre-stored by the user and sends it back to the client. The client executes the configuration command line to process the signed certificate, thereby replacing the near-expiration certificate. In this process, the user does not need to manually monitor the near-expiration certificate. The user only needs to pre-store the application information and configuration information of each service object in the server. Through information interaction between the client and the server, the registration and configuration of the near-expiration certificate can be automatically realized, thereby reducing the probability of the service object's certificate expiring. Furthermore, compared with related technologies, the user no longer needs to enter command lines to realize certificate registration and configuration, thereby reducing the operation of manually entering command lines each time a signed certificate is registered and configured, thus improving the efficiency of certificate configuration.

[0070] In one embodiment, reference Figure 3 The steps to determine whether a near-expiration certificate exists may specifically include steps 101 and 102, wherein:

[0071] Step 101: Every preset time interval, iterate through the remaining lifespan of each target certificate.

[0072] Step 102: Determine whether there are any near-expiration certificates based on the remaining lifetime of each target certificate.

[0073] Specifically, the server is configured to iterate through the target certificates of each service object at preset intervals to obtain the remaining lifetime of each target certificate. The remaining lifetime of each target certificate is compared with its corresponding duration threshold to determine whether the target certificate is nearing its expiration date, thus identifying any near-expiration certificates among all target certificates. In one possible implementation, the duration threshold for each target certificate can be the same, a fixed value. In another possible implementation, the duration threshold for any target certificate is determined based on its full lifetime; for example, the duration threshold can be set to 20% of the full lifetime of the target certificate, or it could be 10%. The specific duration of the duration threshold is not specifically limited in this embodiment, as long as it facilitates timely detection of near-expiration certificates by the client, reducing the probability of certificate expiration for service objects.

[0074] Furthermore, in scenarios where the server and client are configured on the same cloud platform: the client responds to a user's trigger by sending an application command to the server, which then responds to the user's input by retrieving pre-stored application information of the service object to construct an application command line, which includes the service object; the client receives a signing certificate and a configuration command line from the server; the signing certificate is provided by the CA based on the application request sent by the server, and the application request is constructed by the server retrieving pre-stored configuration information of the service object; the client processes the signing certificate based on the configuration command line to configure the signing certificate for the service object.

[0075] Furthermore, when a user uses the client for the first time, they need to activate the client, which involves registering the client with the server to establish client association within the server. The specific process is as follows: the client sends a service purchase order to the server and receives a credential from the server. This credential can be a verification code or a token. The credential is generated and sent to the client after the server confirms the service purchase order is valid. The service order specifically includes a payment credential and the server's ID or IP address (Internet Protocol Address). After confirming the validity of the purchase order sent by the client, the server stores the client's ID and / or IP address, and based on the client's ID and / or IP address, sends a credential specific to the client to the client.

[0076] After client activation, the client adds credentials to any request sent to the server. When the server receives any request, it verifies the validity of the request based on the credentials. If the server verifies the validity of any request, it executes the request.

[0077] The above describes the process by which the client renews the expiring certificate of a service object through interaction with the server and the CA. In practice, users can also use the client to actively select the ID of a service object, generate an application information retrieval request and a configuration information retrieval request, and send them to the server to update the certificate of the selected service object.

[0078] Meanwhile, the client not only has the function of monitoring and renewing the target certificates of each service object, but also can register, extract, renew, and revoke the target certificate of any service object. In the process of implementing these functions, the client can obtain command lines organized based on the required relevant information from the server, execute these command lines, and achieve the same result through interaction with the CA. The specific implementation process of these functions is not described in detail in this embodiment.

[0079] In one exemplary embodiment, such as Figure 4 As shown, a certificate management method is provided, suitable for scenarios where the server and client are configured on different cloud platforms; this method is applied to... Figure 1 Taking the client as an example, the explanation includes steps 210 and 220, where:

[0080] Step 210: In response to the application information retrieval request sent by the client, construct an application command line based on the pre-stored application information of the service object, and send the application command line back to the client; the application information retrieval request is generated by the client based on the service object with the near-expiration certificate when it is determined that there is a near-expiration certificate. The near-expiration certificate is a certificate with a remaining lifespan less than or equal to the duration threshold.

[0081] In this embodiment, the client and user's various products (service objects) are configured on the same platform, which is different from the server. For example, the server is configured on cloud platform A, and the client and user's various products (service objects) are configured on cloud platform B. The configuration information for each service object needs to be pre-stored on the server. Users can write the configuration information of each service object to the server's storage through the server's visual interface. The configuration information required for a service object includes at least domain name information (main domain name and subdomain name), organization information (organization name, organization address, organization-related certificates), contact information, payment account, and API key or credential from the CA. This embodiment does not specifically limit the content of the configuration information.

[0082] The client is built on the ACME (Automated Certificate Management Environment) protocol, and the server also supports the ACME protocol; that is, both the server and client support command-line input to execute certificate application or configuration steps. The client can monitor the remaining lifespan of certificates for each user's service objects to determine if any are nearing expiration. When a near-expiration certificate is identified, the service object of the near-expiration certificate is determined, which can be identified by a unique identifier (ID). The client then organizes the ID of the service object of the near-expiration certificate into a request message for obtaining application information and sends the request to the server. Upon receiving the request from the client, the server retrieves the application information for the service object based on the ID of the near-expiration certificate, organizes the application information into a request command line, and then sends the request command line back to the client.

[0083] In this embodiment of the application, after receiving the application command line from the server, the client runs the application command line, generates an application request from the application information carried in the command line, and then sends the application request to the CA (Certificate Authority) to apply for certificate registration for the service object of the expiring certificate. After receiving the application request, the CA verifies the application information carried in the application request, and after the verification is successful, sends the signed certificate back to the client. The signed certificate sent by the CA to the client is in a standard format.

[0084] Step 220: In response to the configuration information retrieval request sent by the client, construct a configuration command line based on the configuration information of the service object pre-stored by the user, and feed the configuration command line back to the client so that the client can process the signed certificate based on the configuration command line and replace the expiring certificate with the signed certificate; the signed certificate is fed back to the client by the CA based on the application request sent by the client, and the application request is generated by the client based on the application command line.

[0085] In this embodiment, the client may initiate a request to the server for configuration information of the signed certificate upon receiving the certificate from the client. Alternatively, the client may send both the application information request and the configuration information request to the server simultaneously. This embodiment does not specify the timing of the client sending the configuration information request to the server. The configuration information includes at least the service type and configuration address. Each service type corresponds to a certificate format. When configuring a signed certificate for different service types, the standard format signed certificate needs to be converted to the format applicable to the service type.

[0086] After receiving the configuration information retrieval request from the client, the server retrieves the configuration information pre-stored by the user corresponding to the service object ID carried in the configuration information retrieval request, organizes the configuration information into a configuration command line, and then sends the configuration command line back to the client.

[0087] In this embodiment of the application, after receiving the configuration command line from the server, the client executes the configuration command line and converts the format of the contract certificate based on the configuration information in the configuration command line to obtain the converted contract certificate. Then, the contract certificate is stored in the configuration address, and the corresponding expiring certificate in the configuration address is deleted. In other words, the expiring certificate is replaced by the contract certificate, thereby realizing the renewal of the certificate of the service object corresponding to the expiring certificate.

[0088] Furthermore, the client can also actively retrieve the format and configuration address of the expiring certificate, and then configure the signed certificate based on the format and configuration address of the expiring certificate; that is, convert the format of the signed certificate based on the format of the expiring certificate, configure the converted signed certificate at the configuration address corresponding to the expiring certificate, and delete the expiring certificate, thereby realizing the renewal of the certificate of the service object corresponding to the expiring certificate.

[0089] It should be noted that the expiring certificate and the signed certificate in this application embodiment can be SSL (Secure Sockets Layer) certificates or other types of digital certificates, such as TLS (Transport Layer Security) certificates. No specific limitation is made here in this application embodiment.

[0090] In the aforementioned certificate management method, when the client determines that a near-expiration certificate exists, it can automatically send an application information retrieval request to the server based on the service object of the near-expiration certificate. The server generates an application command line based on the application information of the service object pre-stored by the user and sends it back to the client. The client then executes the application command line to generate application information and sends it to the CA to apply for a certificate. After the CA returns a signed certificate, the client sends a configuration information retrieval request to the server. The server generates a configuration command line based on the configuration information pre-stored by the user and sends it back to the client. The client executes the configuration command line to process the signed certificate, thereby replacing the near-expiration certificate. In this process, the user does not need to manually monitor the near-expiration certificate. The user only needs to pre-store the application information and configuration information of each service object in the server. Through information interaction between the client and the server, the registration and configuration of the near-expiration certificate can be automatically realized, thereby reducing the probability of the service object's certificate expiring. Furthermore, compared with related technologies, the user no longer needs to enter command lines to realize certificate registration and configuration, thereby reducing the operation of manually entering command lines each time a signed certificate is registered and configured, thus improving the efficiency of certificate configuration.

[0091] Furthermore, when a user uses the client for the first time, they need to activate the client, which involves registering the client with the server to establish client association within the server. The specific process is as follows: The client sends a service purchase order to the server and receives credentials from the server. These credentials can be a verification code or a token. The credentials are generated and sent to the client after the server confirms the service purchase order is valid. The service order specifically includes a payment credential and the server's ID or IP address (Internet Protocol Address). When the server receives the service purchase order from the client, it determines whether the order is valid. After confirming the order's validity, it stores the client's ID and / or IP address and sends credentials specific to the client based on that ID and / or IP address. When the server receives any instruction from the client, it verifies the validity of that instruction based on the credentials within it and executes the instruction if it is valid.

[0092] In one embodiment, when a user's various service objects and the server are configured on the same cloud platform, the user can directly register certificates for each service object through the server, and further utilize the client to extract, renew, and revoke the certificates. Please refer to... Figure 5 The steps for certificate management via the server can specifically include steps 310-330, where:

[0093] Step 310: In response to the user's input application command, retrieve the pre-stored application information of the service object to construct the application command line, which includes the service object;

[0094] Step 320: Construct an application request based on the application command line, send the application request to the CA, and obtain the signing certificate from the CA.

[0095] Step 330: Retrieve the pre-stored configuration information of the service object to construct a configuration command line, and send the configuration command line and the signing certificate back to the client, so that the client can process the signing certificate based on the configuration command line and configure the signing certificate for the service object.

[0096] Specifically, the user inputs an application command to the server through a visual interface. In response, the server retrieves pre-stored application information for the service object, constructs an application command line, and executes it, building an application request based on the service object's application information. The server sends the application request to the Certificate Authority (CA) and obtains the signed certificate from the CA. After receiving the signed certificate from the CA, the server retrieves pre-stored configuration information for the service object and constructs a configuration command line. The server then sends the signed certificate and configuration command line to the client. The client processes the signed certificate based on the configuration command line to configure the signed certificate for the service object.

[0097] It should be understood that although the steps in the flowcharts of the above embodiments are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the above embodiments may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0098] In one exemplary embodiment, such as Figure 1 As shown, a certificate management system is provided, which includes at least one server and multiple clients, wherein:

[0099] For any client: When it is determined that a near-expiration certificate exists, the client sends an application information retrieval request to the server based on the service object of the near-expiration certificate, receives the application command line from the server, generates an application request based on the application command line, and sends the application request to the CA to obtain the signed certificate from the CA; wherein, the application command line is constructed by the server based on the application information of the service object pre-stored by the user; the near-expiration certificate is a certificate with a remaining lifetime less than or equal to the duration threshold;

[0100] In response to the configuration information retrieval request sent by the client, the client generates a configuration command line based on the configuration information of the service object pre-stored by the user, and feeds the configuration command line back to the client so that the client can process the signed certificate based on the configuration command line and replace the expiring certificate with the signed certificate.

[0101] In one embodiment, the client iterates through the remaining lifespan of each target certificate every preset time interval; and determines whether there is a near-expiration certificate based on the remaining lifespan of each target certificate; wherein, the time threshold corresponding to any target certificate is determined based on the complete lifespan corresponding to any target certificate.

[0102] In one embodiment, the client sends a service purchase order to the server. Upon receiving the service purchase order, the server determines whether the order is valid. If the order is valid, the server sends a credential (verification code or token) back to the client. The client retrieves the credential from the server; and when sending any request to the server, the client adds the credential to that request. Upon receiving any request, the server verifies its validity based on the credential. If the request is valid, the server executes it.

[0103] The above describes one application scenario of the certificate management system: a scenario where the user's various service objects and the server are configured on different cloud platforms. The certificate management system provided in this application is also applicable to another scenario: a scenario where the user's various service objects and the server are configured on the same cloud platform. In this scenario, the user can directly register, retrieve, renew, and revoke certificates for each service object through the server. Users can interact with the server through a visual interface, thereby generating certificate application requests and configuration information using the server, and interacting with the CA to register, retrieve, renew, and revoke certificates.

[0104] In one embodiment, reference Figure 6This certificate management system mainly consists of three parts: a web-based visual interface, a certificate management server, and a client supporting the ACME protocol. The web-based visual interface is the way for users to interact with the server. Users can input information into the server through the web-based visual interface, and the server's relevant processing steps and information can also be displayed to the user through the web-based visual interface. The certificate management system in this embodiment supports two certificate issuance methods.

[0105] Method 1: In scenarios where the user's various service objects and the server are configured on the same cloud platform, the user completes the certificate application process through a web page. The user needs to obtain the domain name of the service object through the web visualization interface and fill it in to the corresponding DNS (Domain Name System) service provider for domain name resolution. The server will generate the user's order information (the application instruction entered by the user through the web visualization interface), and place an order with the corresponding CA (send an application request) based on the user's domain name application information. Then, it will associate the CA order (the signed certificate returned by the CA) with the server's order.

[0106] Users input application commands into the server via a web-based visual interface. In response, the server retrieves pre-stored application information for the service object, constructs an application command line, executes it, and then builds an application request based on the service object's application information. The server sends the application request to the Certificate Authority (CA) and obtains a signed certificate from the CA. After receiving the signed certificate from the CA, the server retrieves pre-stored configuration information for the service object and constructs a configuration command line. The server then sends the signed certificate and configuration command line to the client, which processes the signed certificate based on the configuration command line to configure the signed certificate for the service object.

[0107] Method 2: Using a web (World Wide Web) visual interface and the ACME client. The user sends a request to the server to retrieve the configuration information of the service object. The server retrieves the user's pre-stored configuration information, generates an application command line, and sends it back to the client. The client configures the service object's DNS for automatic resolution and sends an application request to the CA (Certificate Authority), thereby obtaining the signed certificate from the CA and completing the certificate application. Then, based on the generated ACME protocol (the configuration command line generated by the server), the client automatically retrieves the ACME protocol from the server and reissues the certificate according to the retrieved ACME protocol (i.e., replacing the issued certificate with the expiring certificate).

[0108] Certificate Management Server: The server consists of four units: a request processing unit, a CA selection unit, an order unit, and an ACME command generation unit. First, the request processing unit creates a system order based on the user's request (purchase order) (confirming the validity of the purchase order). Then, the CA selection unit selects the corresponding CA and creates a CA order (sending an application request to the CA). Next, the order unit associates the system order (the client's purchase order) with the CA order and generates the corresponding ACME command (configuration command line) based on the CA order information. The ACME client then retrieves the command (configuration command line).

[0109] Certificate Purchase and Issuance: Users input relevant information into the server through the web visualization interface, and complete the domain name application and obtain the signing certificate through the server to the CA. The server can verify the domain name based on the domain name resolution of the certificate after filling in the DNS service provider and issue a certificate for the service object. Alternatively, the signing certificate can be sent to the client, so that the ACME client can re-sign the signing certificate for the service object.

[0110] The server creates an order (application information) and records user information (the ID of the service recipient and the ID or IP address of the client).

[0111] CA order placement: The certificate management service places an order with the CA server (sends an application request to the CA).

[0112] CA sends order information: The CA sends order information (contract certificate) to the server.

[0113] ACME Command Generation Unit: The server generates ACME protocol commands based on the order and information such as the cloud platform's DNS automatic deployment interface filled in by the user, and displays them on the web visualization interface.

[0114] Register Client: Users use the client to register the client with the certificate management server (send purchase orders and obtain credentials from the server).

[0115] Command execution: The client actively executes the ACME command line (configure command line or request command line).

[0116] Compared to existing SSL certificate management websites, the certificate management system provided in this application includes a client that supports the ACME protocol. This client can automatically apply for, issue, and deploy certificates, reducing manual operations for users. It can also automatically manage certificates for various service objects and automatically replace expiring certificates. Furthermore, compared to existing ACME protocol clients, this certificate management system supports a web-based visual interface and can automatically generate ACME commands based on order information. After a user registers their client with the server, the client automatically retrieves the ACME commands (configuration command lines) corresponding to the order and then automatically performs operations such as reissue and deployment of signed certificates for service objects.

[0117] In this application embodiment, the limitations on the client and server in the certificate management system can be referred to in the embodiments of the certificate management method applied to the client, and also to the embodiments of the certificate management method applied to the server. These limitations will not be repeated here.

[0118] Based on the same inventive concept, this application also provides a certificate management device for implementing the certificate management method described above. The solution provided by this device is similar to the implementation described in the above method; therefore, the specific limitations in one or more certificate management device embodiments provided below can be found in the limitations of the certificate management method described above, and will not be repeated here.

[0119] In one exemplary embodiment, such as Figure 7 As shown, a certificate management device is provided, comprising an application information acquisition module 701, an application request generation module 702, a configuration information acquisition module 703, and a configuration module 704, wherein:

[0120] The application information acquisition module 701 is used to send an application information acquisition request to the server based on the service object of the near-expiration certificate when it is determined that there is a near-expiration certificate, and to receive the application command line fed back by the server; the application command line is constructed by the server based on the application information of the service object pre-stored by the user, and the near-expiration certificate is a certificate with a remaining life of less than or equal to the duration threshold.

[0121] The application request generation module 702 is used to generate an application request based on the application command line and send the application request to the CA. The application request is used to instruct the CA to provide a signing certificate.

[0122] The configuration information acquisition module 703 is used to send a configuration information acquisition request to the server and receive the configuration command line fed back by the server. The configuration command line is constructed by the server based on the pre-stored configuration information of the service object.

[0123] Configuration module 704 is used to process the signed certificate based on configuration information, so that the signed certificate replaces the expiring certificate.

[0124] In the aforementioned certificate management device, when the client determines that a near-expiration certificate exists, it can automatically send an application information retrieval request to the server based on the service object of the near-expiration certificate. The server generates an application command line based on the application information of the service object pre-stored by the user and sends it back to the client. The client then executes the application command line to generate application information and sends it to the CA to apply for a certificate. After the CA returns a signed certificate, the client sends a configuration information retrieval request to the server. The server generates a configuration command line based on the configuration information pre-stored by the user and sends it back to the client. The client executes the configuration command line to process the signed certificate, thereby replacing the near-expiration certificate. In this process, the user does not need to manually monitor the near-expiration certificate. The user only needs to pre-store the application information and configuration information of each service object in the server. Through information interaction between the client and the server, the registration and configuration of the near-expiration certificate can be automatically realized, thereby reducing the probability of the service object's certificate expiring. Moreover, compared with related technologies, the user no longer needs to enter command lines to realize certificate registration and configuration, thereby reducing the manual operation of entering command lines each time a signed certificate is registered and configured, thus improving the efficiency of certificate configuration.

[0125] In one embodiment, the certificate management device further includes a near-expiration certificate determination module, wherein the near-expiration certificate determination module is specifically used for:

[0126] Every preset time interval, iterate through the remaining lifespan of each target certificate.

[0127] Determine whether there are any near-expiration certificates based on the remaining life of each target certificate;

[0128] The duration threshold for any target certificate is determined based on the complete lifetime of that target certificate.

[0129] In one embodiment, the certificate management device further includes an activation module, wherein the activation module is specifically used for:

[0130] Send a service purchase order to the server and obtain a verification code from the server; the verification code is sent to the client after the server confirms that the service purchase order has taken effect.

[0131] When sending any request to the server, a verification code is added to the request; when the server receives any request, it verifies the validity of the request based on the verification code, and executes the request if the request is valid.

[0132] In one exemplary embodiment, such as Figure 8As shown, a certificate management device is provided, including a first response module 801 and a second response module 802, wherein:

[0133] The first response module 801 is used to respond to the application information retrieval request sent by the client, construct an application command line based on the pre-stored application information of the service object, and feed the application command line back to the client; the application information retrieval request is generated by the client based on the service object with the near-expiration certificate when it is determined that there is a near-expiration certificate. The near-expiration certificate is a certificate with a remaining lifespan less than or equal to the duration threshold.

[0134] The second response module 802 is used to respond to the configuration information acquisition request sent by the client, construct a configuration command line based on the configuration information of the service object pre-stored by the user, and feed the configuration command line back to the client so that the client can process the signed certificate based on the configuration command line and replace the expiring certificate with the signed certificate; the signed certificate is fed back to the client by the CA based on the application request sent by the client, and the application request is generated by the client based on the application command line.

[0135] In the aforementioned certificate management device, when the client determines that a near-expiration certificate exists, it can automatically send an application information retrieval request to the server based on the service object of the near-expiration certificate. The server generates an application command line based on the application information of the service object pre-stored by the user and sends it back to the client. The client then executes the application command line to generate application information and sends it to the CA to apply for a certificate. After the CA returns a signed certificate, the client sends a configuration information retrieval request to the server. The server generates a configuration command line based on the configuration information pre-stored by the user and sends it back to the client. The client executes the configuration command line to process the signed certificate, thereby replacing the near-expiration certificate. In this process, the user does not need to manually monitor the near-expiration certificate. The user only needs to pre-store the application information and configuration information of each service object in the server. Through information interaction between the client and the server, the registration and configuration of the near-expiration certificate can be automatically realized, thereby reducing the probability of the service object's certificate expiring. Moreover, compared with related technologies, the user no longer needs to enter command lines to realize certificate registration and configuration, thereby reducing the manual operation of entering command lines each time a signed certificate is registered and configured, thus improving the efficiency of certificate configuration.

[0136] In one embodiment, the certificate management device further includes an application module, which is specifically used for:

[0137] In response to the user's input application command, the application command line is constructed by retrieving the pre-stored application information of the service object, and the application command includes the service object;

[0138] The application request is constructed based on the application command line, and the application request is sent to the CA. The signing certificate is then obtained from the CA.

[0139] The configuration command line is constructed by retrieving the pre-stored configuration information of the service object. The configuration command line and the signing certificate are then sent back to the client, enabling the client to process the signing certificate based on the configuration command line and configure the signing certificate for the service object.

[0140] In one embodiment, the certificate management device further includes a verification module, which is specifically used for:

[0141] Upon receiving a service purchase order from the client, determine whether the service purchase order is valid, and after confirming that the service purchase order is valid, send a verification code to the server.

[0142] Upon receiving any instruction from the client, the system verifies the validity of the instruction based on the verification code within it, and executes the instruction if it is valid. The verification code in any instruction is added by the client based on the verification code returned by the server.

[0143] Each module in the aforementioned certificate management device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in the processor of a computer device in hardware form or independent of it, or stored in the memory of the computer device in software form, so that the processor can call and execute the operations corresponding to each module.

[0144] In one exemplary embodiment, a computer device is provided that can be used to configure a client and / or a server, and its internal structure diagram can be as follows: Figure 9As shown, the computer device includes a processor, memory, input / output interfaces, a communication interface, a display unit, and an input device. The processor, memory, and input / output interfaces are connected via a system bus, and the communication interface, display unit, and input device are also connected to the system bus via the input / output interfaces. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The input / output interfaces are used for exchanging information between the processor and external devices. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, mobile cellular networks, NFC (Near Field Communication), or other technologies. When executed by the processor, the computer program implements a certificate management method. The display unit is used to form a visually visible image and can be a display screen, a projection device, or a virtual reality imaging device. The display screen can be an LCD screen or an e-ink screen. The input device of the computer device can be a touch layer covering the display screen, or buttons, trackballs, or touchpads set on the casing of the computer device, or external keyboards, touchpads, or mice, etc.

[0145] Those skilled in the art will understand that Figure 9 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0146] In one exemplary embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of any of the certificate management methods applied to a client and / or a server as described in the above method embodiments.

[0147] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the steps of any of the certificate management methods applied to a client and / or server as described in the above method embodiments.

[0148] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps of any of the certificate management methods applied to a client and / or server as described in the above method embodiments.

[0149] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0150] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0151] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0152] The above embodiments are merely illustrative of several implementation methods of this application, and their descriptions are relatively specific and detailed. However, they should not be construed as limiting the scope of this application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A certificate management method, characterized in that: Applied to a client, the method comprises: When it is determined that there is a certificate that is about to expire, the service object based on the certificate that is about to expire sends an application information acquisition request to the server, and receives an application command line fed back by the server; the application command line is constructed by the server based on the application information of the service object pre-stored by the user, and the certificate that is about to expire is a certificate whose remaining life is less than or equal to the duration threshold; Generate an application request based on the application command line, and send the application request to the CA end, where the application request is used to instruct the CA end to feedback the signing certificate; Sending a configuration information acquisition request to the server, and receiving a configuration command line fed back by the server, wherein the configuration command line is constructed by the server based on pre-stored configuration information of the service object; The contract certificate is processed based on the configuration information so that the contract certificate replaces the expiring certificate.

2. The method according to claim 1, characterized in that The method further comprises: Every preset time, the remaining life of each target certificate is traversed once; Determining whether there is an expiring certificate based on the remaining life of each target certificate; The duration threshold corresponding to any target certificate is determined based on the complete life span corresponding to any target certificate.

3. The method according to claim 1, characterized in that The method further comprises: Sending a service purchase order to the server and obtaining a verification code fed back by the server; the verification code is sent to the client after the server determines that the service purchase order is effective; When sending any request to the server, the verification code is added to the request; wherein, when receiving the request, the server verifies whether the request is valid based on the verification code, and when the server verifies that the request is valid, the server executes the request.

4. A certificate management method, characterized in that: Applied to the server, the method includes: In response to the application information acquisition request sent by the client, an application command line is constructed based on the application information of the pre-stored service object, and the application command line is fed back to the client; the application information acquisition request is generated by the client based on the service object of the expiring certificate when it is determined that there is an expiring certificate, and the expiring certificate is a certificate whose remaining life is less than or equal to the duration threshold; In response to a configuration information acquisition request sent by the client, a configuration command line is constructed based on the configuration information of the service object pre-stored by the user, and the configuration command line is fed back to the client, so that the client processes the signing certificate based on the configuration command line, so that the signing certificate replaces the expiring certificate; the signing certificate is fed back to the client by the CA based on the application request sent by the client, and the application request is generated by the client based on the application command line.

5. The method according to claim 4, characterized in that The method further comprises: In response to an application instruction input by a user, retrieve application information of a pre-stored service object to construct an application command line, wherein the application instruction includes the service object; Construct an application request based on the application command line, send the application request to the CA, and obtain the signing certificate fed back by the CA; Retrieving the pre-stored configuration information of the service object to construct a configuration command line, feeding back the configuration command line and the contract certificate to the client, so that the client processes the contract certificate based on the configuration command line and configures the contract certificate for the service object.

6. The method according to claim 1, characterized in that The method further comprises: Upon receiving the service purchase order sent by the client, determining whether the service purchase order is effective, and after determining that the service purchase order is effective, feeding back a verification code to the server; When receiving any instruction sent by the client, verify whether the instruction is valid based on the verification code in the instruction, and execute the instruction when it is verified that the instruction is valid; the verification code in the instruction is added by the client based on the verification code fed back by the server.

7. A certificate management system, characterized in that: The certificate management system includes a server and a client, wherein: The client is used to send an application information acquisition request to the server based on the service object of the expiring certificate when determining that there is an expiring certificate, and receive an application command line fed back by the server, and generate an application request based on the application command line, and send the application request to the CA to obtain the signed certificate fed back by the CA; wherein the application command line is constructed by the server based on the application information of the service object pre-stored by the user; the expiring certificate is a certificate whose remaining life is less than or equal to the duration threshold; The client generates a configuration command line based on the configuration information of the service object pre-stored by the user in response to the configuration information acquisition request sent by the client, and feeds back the configuration command line to the client, so that the client processes the signing certificate based on the configuration command line, so that the signing certificate replaces the expiring certificate.

8. A certificate management device, characterized in that: The device comprises an application information acquisition module, an application request generation module, a configuration information acquisition module and a configuration module, wherein: An application information acquisition module, used for sending an application information acquisition request to a server based on the service object of the expiring certificate when it is determined that there is an expiring certificate, and receiving an application command line fed back by the server; the application command line is constructed by the server based on the application information of the service object pre-stored by the user, and the expiring certificate is a certificate whose remaining life is less than or equal to the duration threshold; An application request generation module, used to generate an application request based on the application command line, and send the application request to the CA end, wherein the application request is used to instruct the CA end to feedback the signing certificate; A configuration information acquisition module, used to send a configuration information acquisition request to the server, and receive a configuration command line fed back by the server, wherein the configuration command line is constructed by the server based on pre-stored configuration information of the service object; A configuration module is used to process the contract certificate based on the configuration information so that the contract certificate replaces the expiring certificate.

9. A certificate management device, characterized in that: The device comprises a first response module and a second response module, wherein: A first response module, configured to respond to an application information acquisition request sent by a client, construct an application command line based on the application information of a pre-stored service object, and feed the application command line back to the client; the application information acquisition request is generated by the client based on the service object of the expiring certificate when determining that there is an expiring certificate, and the expiring certificate is a certificate whose remaining life is less than or equal to a duration threshold; The second response module is used to respond to the configuration information acquisition request sent by the client, build a configuration command line based on the configuration information of the service object pre-stored by the user, and feed back the configuration command line to the client, so that the client processes the signing certificate based on the configuration command line, so that the signing certificate replaces the expiring certificate; the signing certificate is fed back to the client by the CA based on the application request sent by the client, and the application request is generated by the client based on the application command line.

10. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

Images