Certificate management method, system, device and computer equipment

Abstract

The application relates to the technical field of network security, in particular to a certificate management method, system and device and computer equipment. The method is applied to a client, and the method comprises the following steps: when it is determined that there is an expired certificate, an application information acquisition request is sent to a server based on a service object of the expired certificate, and an application command line fed back by the server is received; the application command line is constructed by the server based on pre-stored application information of the service object; an application request is generated based on the application command line, and the application request is sent to a CA end, the application request being used for instructing the CA end to feed back a signed certificate; a configuration information acquisition request is sent to the server, and a configuration command line fed back by the server is received, the configuration command line being constructed by the server based on pre-stored configuration information of the service object; and the signed certificate is processed based on the configuration information, so that the signed certificate replaces the expired certificate. The method can improve the efficiency of deploying the certificate.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, in particular to a certificate management method, system, device and computer equipment. BACKGROUND

[0002] The SSL (Secure Socket Layer) certificate is a kind of digital certificate, which is used to encrypt data in network transmission process, ensure the confidentiality and integrity of data, and provide identity authentication function. In recent years, in order to strengthen the security of SSL certificate, CA / B (Certificate Authority / Browser) alliance has taken measures to gradually reduce the validity period of certificate, and it is expected that the validity period of SSL certificate will be shortened to 3 months in the near future; so it will generate a large number of certificate registration tasks, and once the certificate expires, it will affect the application of encrypted communication chain, which may cause the business to be affected, therefore, how to reduce the problem of certificate expiration is also a difficulty.

[0003] In the related art, when the service provider deploys a new SSL certificate for its own product service each time, it needs to use the client of ACME protocol and manually input the registration information, the client of ACME protocol generates a registration request based on the registration information input by the user and sends it to the CA (Certificate Authority) end, the CA institution verifies the registration information, and then feeds back the SSL certificate to the client of ACME (Automated Certificate Management Environment) protocol, and the service provider manually inputs the deployment information to deploy the SSL certificate. However, the client of ACME protocol in the related art only supports the way of inputting information through command line, that is, the service provider needs to manually input the registration information and deployment information through the command line in the process of deploying the certificate, which undoubtedly leads to low efficiency of the service provider in deploying the SSL certificate.

[0004] Therefore, how to improve the efficiency of deploying the certificate is a problem to be solved urgently. SUMMARY

[0005] Therefore, it is necessary to provide a certificate management method, system, device and computer equipment capable of improving the efficiency of deploying the SSL certificate in view of the above technical problems.

[0006] In a first aspect, the present application provides a certificate management method applied to a client, the method comprising:

[0007] When it is determined that there is a near-expiration certificate, a client sends an application information obtaining request to a server based on a service object of the near-expiration certificate, and receives an application command line fed back by the server; the application command line is constructed by the server based on pre-stored application information of the service object of the user, and the near-expiration certificate is a certificate with a remaining lifetime less than or equal to a time threshold;

[0008] An application request is generated based on the application command line, and the application request is sent to a CA end, where the application request is used to instruct the CA end to feed back a subscription certificate;

[0009] A configuration information obtaining request is sent to the server, and a configuration command line fed back by the server is received, where the configuration command line is constructed by the server based on pre-stored configuration information of the service object of the user;

[0010] The subscription certificate is processed based on the configuration information, so that the subscription certificate replaces the near-expiration certificate.

[0011] Through the above technical solution, when it is determined that there is a near-expiration certificate, the client can automatically send an application information obtaining request to the server based on a service object of the near-expiration certificate. The server feeds back an application command line to the client based on pre-stored application information of the service object of the user, so that the client executes the application command line to generate application information and sends the application information to the CA end for certificate application. After the CA end feeds back a subscription certificate, the client sends a configuration information obtaining request to the server. The server feeds back a configuration command line to the client based on pre-stored configuration information, and the client executes the configuration command line to process the subscription certificate, so that the subscription certificate replaces the near-expiration certificate. In this process, the user does not need to manually monitor the near-expiration certificate. The user only needs to pre-store the application information and configuration information of each service object in the server. Through information interaction between the client and the server, the registration and configuration of the near-expiration certificate can be automatically implemented, thereby reducing the probability of expiration of the certificate of the service object. Compared with related technologies, the user does not need to input a command line to implement the registration and configuration of the certificate, thereby reducing the operation of manually inputting the command line by the user each time the subscription certificate is registered and configured, and thus the efficiency of configuring the certificate is improved.

[0012] In one of the embodiments, the method further includes:

[0013] Every preset time length, the remaining lifetimes of the target certificates are traversed once;

[0014] Based on the remaining lifetimes of the target certificates, it is determined whether there is a near-expiration certificate;

[0015] The time threshold corresponding to any target certificate is determined based on the complete lifetime corresponding to the any target certificate.

[0016] In one embodiment, the method further comprises:

[0017] sending a service purchase order to the service end and obtaining a verification code fed back by the service end; the verification code is sent to the client after the service end determines that the service purchase order takes effect;

[0018] adding the verification code in any request sent to the service end; wherein, the service end verifies whether the any request is valid based on the verification code when receiving the any request, and executes the any request when verifying that the any request is valid.

[0019] In a second aspect, the application further provides a certificate management method applied to a service end, comprising:

[0020] in response to an application information obtaining request sent by a client, constructing an application command line based on pre-stored application information of a service object, and feeding back the application command line to the client; the application information obtaining request is generated by the client based on a service object of a near-expiration certificate when determining that the near-expiration certificate exists, and the near-expiration certificate is a certificate with a remaining lifetime less than or equal to a time threshold;

[0021] in response to a configuration information obtaining request sent by the client, constructing a configuration command line based on pre-stored configuration information of the service object of the user, and feeding back the configuration command line to the client, so that the client processes a signed certificate based on the configuration command line, so that the signed certificate replaces the near-expiration certificate; the signed certificate is fed back to the client by a CA end based on an application request sent by the client, and the application request is generated by the client based on the application command line.

[0022] In one embodiment, the method further comprises:

[0023] in response to an application instruction input by a user, constructing an application command line by calling pre-stored application information of a service object, and the application instruction includes the service object;

[0024] constructing an application request based on the application command line, sending the application request to a CA end, and obtaining a signed certificate fed back by the CA end;

[0025] constructing a configuration command line by calling pre-stored configuration information of the service object, feeding back the configuration command line and the signed certificate to the client, so that the client processes the signed certificate based on the configuration command line, and configures the signed certificate for the service object.

[0026] In one of the embodiments, the method further comprises:

[0027] Upon receiving the service purchase order sent by the client, it is determined whether the service purchase order is valid, and after determining that the service purchase order is valid, the verification code is fed back to the server;

[0028] Upon receiving any instruction sent by the client, it is verified whether the instruction is valid based on the verification code in the instruction, and when it is verified that the instruction is valid, the instruction is executed; the verification code in the instruction is added by the client based on the verification code fed back by the server.

[0029] In a third aspect, the application further provides a certificate management system, comprising a server and a client, wherein:

[0030] The client is configured to send an application information acquisition request to the server based on the service object of the near-expiration certificate when it is determined that there is a near-expiration certificate, receive an application command line fed back by the server, generate an application request based on the application command line, and send the application request to the CA end to obtain a signing certificate fed back by the CA end; wherein the application command line is constructed by the server based on the application information of the service object pre-stored by the user; the near-expiration certificate is a certificate with a remaining lifetime less than or equal to a time threshold;

[0031] The client generates a configuration command line based on the configuration information of the service object pre-stored by the user in response to the configuration information acquisition request sent by the client, and feeds back the configuration command line to the client, so that the client processes the signing certificate based on the configuration command line, so that the signing certificate replaces the near-expiration certificate.

[0032] In a fourth aspect, the application further provides a certificate management device, comprising an application information acquisition module, an application request generation module, a configuration information acquisition module, and a configuration module, wherein:

[0033] The application information acquisition module is configured to send an application information acquisition request to the server based on the service object of the near-expiration certificate when it is determined that there is a near-expiration certificate, and receive an application command line fed back by the server; the application command line is constructed by the server based on the application information of the service object pre-stored by the user, and the near-expiration certificate is a certificate with a remaining lifetime less than or equal to a time threshold;

[0034] The application request generation module is configured to generate an application request based on the application command line and send the application request to the CA end, wherein the application request is used to instruct the CA end to feed back a signing certificate;

[0035] The configuration information obtaining module is configured to send a configuration information obtaining request to the server and receive a configuration command line fed back by the server, wherein the configuration command line is constructed by the server based on the pre-stored configuration information of the service object;

[0036] The configuration module is configured to process the subscription certificate based on the configuration information, so that the subscription certificate replaces the temporary certificate.

[0037] In a fifth aspect, the present application further provides a certificate management device, which comprises a first response module and a second response module, wherein:

[0038] The first response module is configured to construct an application command line based on pre-stored application information of a service object in response to an application information obtaining request sent by a client, and feed back the application command line to the client, wherein the application information obtaining request is generated by the client based on a service object of a temporary certificate when it is determined that the temporary certificate exists, and the temporary certificate is a certificate with a remaining lifetime less than or equal to a time threshold.

[0039] The second response module is configured to construct a configuration command line based on pre-stored configuration information of a service object of a user in response to a configuration information obtaining request sent by the client, and feed back the configuration command line to the client, so that the client processes a subscription certificate based on the configuration command line, so that the subscription certificate replaces the temporary certificate, wherein the subscription certificate is fed back to the client by a CA end based on an application request sent by the client, and the application request is generated by the client based on the application command line.

[0040] In a sixth aspect, the present application further provides a computer device comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the program steps of the certificate management method according to any one of the first aspect or the second aspect when executing the computer program.

[0041] In a seventh aspect, the present application further provides a computer readable storage medium, which stores a computer program, wherein the computer program is executed by a processor to implement the program steps of the certificate management method according to any one of the first aspect or the second aspect.

[0042] In an eighth aspect, the present application further provides a computer program product comprising a computer program, wherein the computer program is executed by a processor to implement the program steps of the certificate management method according to any one of the first aspect or the second aspect.

[0043] The certificate management method, system, device and computer equipment can automatically send an application information obtaining request to the server based on the service object of the expiring certificate when the client determines that there is an expiring certificate, the server generates an application command line based on the pre-stored application information of the service object of the user and feeds back to the client, the client executes the application command line to generate the application information and sends the application information to the CA end to apply for a certificate, after the CA end feeds back a signed certificate, the client sends a configuration information obtaining request to the server, the server generates a configuration command line based on the pre-stored configuration information of the user and feeds back to the client, and the client executes the configuration command line to process the signed certificate, so that the signed certificate replaces the expiring certificate. In this process, the user does not need to manually monitor the expiring certificate, the user only needs to pre-store the application information and configuration information of each service object in the server, and through the information interaction between the client and the server, the registration and configuration of the expiring certificate can be automatically realized, thereby reducing the probability of certificate expiration of the service object. Compared with the related art, the user does not need to input the command line to realize the registration and configuration of the certificate, thereby reducing the operation of manually inputting the command line by the user each time the signed certificate is registered and configured, and the efficiency of the configuration certificate is improved. BRIEF DESCRIPTION OF DRAWINGS

[0044] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related art, the drawings needed to be used in the embodiments or the related art description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0045] Figure 1 A schematic diagram of a certificate management system in an embodiment;

[0046] Figure 2 A flowchart of a certificate management method in an embodiment;

[0047] Figure 3 A flowchart of a step of determining an expiring certificate in an embodiment;

[0048] Figure 4 A flowchart of a certificate management method in another embodiment;

[0049] Figure 5 A flowchart of a certificate management method in another scenario;

[0050] Figure 6 An interaction logic diagram of a certificate management system in an embodiment;

[0051] Figure 7A structural block diagram of a certificate management device in one embodiment;

[0052] Figure 8 A structural block diagram of a certificate management device in another embodiment;

[0053] Figure 9 An internal structural diagram of a computer device in one embodiment. DETAILED DESCRIPTION

[0054] In order to make the purposes, technical solutions and advantages of the present application clearer, the present application will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and not to limit the present application.

[0055] The certificate management method provided by the embodiments of the present application can be applied to an application environment as shown in Figure 1 . In the application environment, the client can communicate with the server, the client obtains an application command line and a configuration command line from the server, the client sends an application request to the CA end based on the application command line, and obtains a signed certificate fed back by the CA end, and the client configures the signed certificate based on the configuration command line; the server can also send an application request to the CA end, and obtain a signed certificate fed back by the CA end, and the server configures the signed certificate. The data storage system can store data required to be processed by the server. The data storage system can be integrated on the server, or placed on a cloud or other network server. The client can be configured on a computer device, and the computer device can be, but is not limited to, various personal computers, notebook computers, smart phones, tablet computers, Internet of Things devices, portable wearable devices, and servers; the Internet of Things device can be a smart speaker, a smart television, a smart air conditioner, a smart vehicle device, etc.; the portable wearable device can be a smart watch, a smart bracelet, a head-mounted device, etc.; the server can be implemented by an independent server or a server cluster composed of multiple servers. The server is configured on the server, and a user can realize communication interaction with the server through the client, or the user can also realize information interaction with the server through a visual page of the server.

[0056] In one exemplary embodiment, as shown in Figure 2 , a certificate management method is provided, which is suitable for a scenario where the server and the client are configured on different cloud platforms. The method is described below by taking the client in Figure 1 as an example, which includes steps 110-140, wherein:

[0057] Step 110, when it is determined that there is a near-expiration certificate, an application information obtaining request is sent to the server based on the service object of the near-expiration certificate, and an application command line fed back by the server is received; the application command line is constructed by the server based on the application information of the service object pre-stored by the user, and the near-expiration certificate is a certificate with a remaining life less than or equal to the time threshold.

[0058] For the embodiments of the present application, the client is configured on the same platform as the user's each product (service object), and the client can be configured on a different platform from the server, for example, the server is configured on an A cloud platform, and the client and the user's each product (service object) are configured on a B cloud platform. The configuration information corresponding to each service object needs to be pre-stored by the user in the server, and the user can write the configuration information of each service object into the server storage through the visual interface of the server. The configuration information required for one service object at least includes domain name information (main domain name and subdomain name), organization information (organization name, organization address, and organization-related certificate), contact information, payment account, and API (Application Programming Interface, application programming interface) key or credential of the CA side, etc. The specific content of the configuration information is not limited in the embodiments of the present application.

[0059] The client is a client constructed based on the ACME (Automated Certificate Management Environment, automatic certificate management environment) protocol, and the server also supports the ACME protocol; that is, the server and the client both support the input of command lines to execute certificate application or configure corresponding steps. The client can monitor the remaining life of the certificate of each service object of the user, so as to determine whether there is a near-expiration certificate. When it is determined that there is a near-expiration certificate, the service object of the near-expiration certificate is determined, and the service object can be determined through a unique identifier ID (Identifier, identifier). Further, the client organizes the ID of the service object of the near-expiration certificate into a message of an application information obtaining request, and then sends the application information obtaining request to the server. When the server receives the application information obtaining request sent by the client, the application information of the service object is obtained based on the ID of the service object of the near-expiration certificate, and the application information is organized into an application command line, and then the application command line is fed back to the client.

[0060] Step 120, generating an application request based on the application command line, and sending the application request to the CA side, the application request being used to instruct the CA side to feed back a signed certificate.

[0061] For the embodiment of the present application, after receiving the application command line fed back by the server, the client runs the application command line, generates an application request carrying the application information in the command line, and then sends the application request to the CA (Certificate Authority, Certificate Authority) end to apply for certificate registration to the CA end; after receiving the application request, the CA end verifies the application information carried in the application request, and after verification, feeds back the signed signature certificate to the client; the signing certificate fed back to the client by the CA end is in a standard format.

[0062] Step 130, send a configuration information acquisition request to the server and receive the configuration command line fed back by the server, the configuration command line being constructed by the server based on the pre-stored configuration information of the service object.

[0063] For the embodiment of the present application, the client can initiate a configuration information acquisition request for the signing certificate to the server when receiving the signing certificate fed back by the client, or the client can send the application information acquisition request and the configuration information acquisition request to the server at the same time, and the timing of sending the configuration information acquisition request by the client to the server is not limited in the embodiment of the present application. The configuration information at least includes the service type and the configuration address; each service type corresponds to a format of certificate, and when configuring the signing certificate with different service types, the standard format of the signing certificate needs to be converted to the format suitable for the service type.

[0064] After receiving the configuration information acquisition request sent by the client, the server retrieves the configuration information corresponding to the ID of the service object carried in the configuration information acquisition request based on the ID of the service object, organizes the configuration information into a configuration command line, and then feeds back the configuration command line to the client.

[0065] Step 140, process the signing certificate based on the configuration information to replace the near-expiration certificate.

[0066] For the embodiment of the present application, after receiving the configuration command line fed back by the server, the client executes the configuration command line, and converts the signing certificate based on the configuration information in the configuration command line to obtain the converted signing certificate, then stores the signing certificate to the configuration address, and deletes the corresponding near-expiration certificate in the configuration address, that is, the near-expiration certificate is replaced by the signing certificate, thereby realizing the renewal of the certificate of the service object corresponding to the near-expiration certificate.

[0067] Further, the client can also be configured to actively retrieve the format and configuration address of the expiring certificate, and then configure the subscription certificate based on the format and configuration address of the expiring certificate; that is, the client converts the format of the subscription certificate based on the format of the expiring certificate, configures the converted subscription certificate in the configuration address corresponding to the expiring certificate, and deletes the expiring certificate, thereby realizing the renewal of the certificate of the service object corresponding to the expiring certificate.

[0068] It should be noted that the expiring certificate and the subscription certificate in the embodiments of the present application can be SSL (Secure Sockets Layer) certificates, or other types of digital certificates such as TLS (Transport Layer Security) certificates, which are not specifically limited in the embodiments of the present application.

[0069] In the above certificate management method, when it is determined that there is an expiring certificate, the client can automatically send an application information obtaining request to the server based on the service object of the expiring certificate, the server generates an application command line based on the pre-stored application information of the service object of the user and feeds back to the client, so that the client executes the application command line to generate the application information and sends it to the CA end for certificate application. After the CA end feeds back the subscription certificate, the client sends a configuration information obtaining request to the server, the server generates a configuration command line based on the pre-stored configuration information of the user and feeds back to the client, and the client executes the configuration command line to process the subscription certificate, so that the subscription certificate replaces the expiring certificate. In this process, the user does not need to manually monitor the expiring certificate, and the user only needs to pre-store the application information and configuration information of each service object in the server. Through the information interaction between the client and the server, the registration and configuration of the expiring certificate can be automatically realized, thereby reducing the probability of expiration of the certificate of the service object. Compared with related technologies, the user does not need to input the command line to realize the registration and configuration of the certificate, thereby reducing the operation of manually inputting the command line by the user each time the subscription certificate is registered and configured, and thus improving the efficiency of configuring the certificate.

[0070] In one of the embodiments, with reference to Figure 3 , the step of determining whether there is an expiring certificate can specifically include steps 101 and 102, wherein:

[0071] Step 101: traversing the remaining life of each target certificate every preset time interval;

[0072] Step 102: determining whether there is an expiring certificate based on the remaining life of each target certificate.

[0073] Specifically, the server is configured to traverse the target certificates of each service object once every preset time length to obtain the remaining life of each target certificate; compare the remaining life of each target certificate with the time length threshold corresponding to the target certificate to determine whether the target certificate is an expired certificate, and further determine whether there is an expired certificate among the target certificates. In one possible implementation, the time length threshold corresponding to each target certificate can be the same, which is a fixed value. In another possible implementation, the time length threshold corresponding to any target certificate is determined based on the full life of the target certificate; for example, the time length threshold is set to 20% of the full life of the target certificate, and at that time it can also be 10%. The specific time length of the time length threshold is not limited in the embodiments of the present application, as long as it is convenient for the client to discover the expired certificate in time and reduce the probability of the certificate of the service object expiring.

[0074] Further, in the scenario where the server and the client are configured in the same cloud platform: the client sends an application instruction to the server in response to the user's trigger, so that the server responds to the user's input application instruction, calls the pre-stored application information of the service object to construct an application command line, and the application instruction includes the service object; the client receives the signing certificate and the configuration command line sent by the server; wherein the signing certificate is fed back by the CA based on the application request sent by the server, and the application request is constructed by the server calling the pre-stored configuration information of the service object; the client processes the signing certificate based on the configuration command line to configure the signing certificate for the service object.

[0075] Further, when the user uses the client for the first time, the client needs to be activated, that is, the client is registered in the server, so as to realize the association of the client in the server. The specific process is as follows: the client sends a service purchase order to the server and obtains the voucher fed back by the server, wherein the voucher can be a verification code or a Token (token); the voucher is generated and sent to the client after the server determines that the service purchase order is valid. The service order specifically includes a payment voucher and the ID or IP address (Internet Protocol Address, Internet Protocol Address) of the server; after the server determines that the purchase order sent by the client is valid, the ID and / or IP address of the client is stored, and the voucher for the client is sent to the client based on the ID and / or IP address of the client.

[0076] After the client is activated, the client adds the voucher in any request when sending any request to the server; wherein the server verifies whether any request is valid based on the voucher when receiving any request, and the server executes any request when verifying that any request is valid.

[0077] The above is the process of renewing the near-expiration certificate of the service object by the client through interaction with the server and the CA. In practice, the user can also use the client to actively select the ID of a service object to generate an application information obtaining request and a configuration information obtaining request, and send them to the server, thereby updating the certificate of the service object selected by the user.

[0078] Meanwhile, the client not only has the functions of monitoring and renewing the target certificate of each service object, but also can realize the registration, extraction, renewal and revocation of the target certificate of any service object. In the process of realizing these functions, the client can obtain command lines organized based on the required related information from the server, and the client executes these command lines and realizes them through interaction with the CA. The specific implementation process of these functions will not be specifically introduced in the embodiments of the present application.

[0079] In an exemplary embodiment, as shown in Figure 4 , a certificate management method is provided, which is suitable for the scenario that the server and the client are configured in different cloud platforms. Taking the client in Figure 1 as an example, the method includes steps 210 and 220, wherein:

[0080] Step 210, in response to the application information obtaining request sent by the client, constructing an application command line based on the pre-stored application information of the service object, and feeding back the application command line to the client. The application information obtaining request is generated by the client based on the service object of the near-expiration certificate when it is determined that there is a near-expiration certificate, and the near-expiration certificate is a certificate with a remaining lifetime less than or equal to the time threshold.

[0081] For the embodiments of the present application, the client and the products (service objects) of the user are configured in the same platform, and the platform and the server are configured in different platforms; for example, the server is configured in A cloud platform, and the client and the products (service objects) of the user are configured in B cloud platform. The configuration information corresponding to each service object needs to be pre-stored in the server, and the user can write the configuration information of each service object into the server storage through the visual interface of the server. The configuration information required for a service object at least includes domain name information (main domain name and subdomain name), organization information (organization name, organization address, organization-related certificate), contact information, payment account, and API key or credential of the CA, etc. The specific content of the configuration information is not specifically limited in the embodiments of the present application.

[0082] The client is a client built based on an ACME (Automated Certificate Management Environment) protocol, and the server also supports the ACME protocol; that is, the server and the client both support the input of a command line to execute a certificate application or configure a corresponding step. The client can monitor the remaining life of a certificate of each service object of a user, to determine whether there is an expiring certificate. When it is determined that there is an expiring certificate, a service object of the expiring certificate is determined, and the service object can be determined by a unique identifier ID (Identifier). Further, the client organizes an ID of the service object of the expiring certificate into a message of an application information obtaining request, and then sends the application information obtaining request to the server. When the server receives the application information obtaining request sent by the client, the server obtains application information of the service object based on the ID of the service object of the expiring certificate, and organizes the application information into an application command line, and then feeds back the application command line to the client.

[0083] For the embodiment of the application, after the client receives the application command line fed back by the server, the client runs the application command line, generates an application request by using application information carried in the command line, and then sends the application request to a CA (Certificate Authority) end, to apply for the registration of a certificate of the service object of the expiring certificate to the CA end. After the CA end receives the application request, the CA end verifies the application information carried in the application request, and after the verification is passed, feeds back a signed signing certificate to the client. The signing certificate fed back to the client by the CA end is in a standard format.

[0084] In step 220, in response to the configuration information obtaining request sent by the client, a configuration command line is built based on the pre-stored configuration information of the service object of the user, and the configuration command line is fed back to the client, so that the client processes the signing certificate based on the configuration command line, to replace the expiring certificate with the signing certificate. The signing certificate is fed back to the client by the CA end based on the application request sent by the client, and the application request is generated by the client based on the application command line.

[0085] For the embodiment of the present application, the client can initiate a configuration information obtaining request for the subscription certificate to the server when receiving the subscription certificate with client feedback, or the client can send the application information obtaining request and the configuration information obtaining request to the server at the same time, and the timing of sending the configuration information obtaining request to the server by the client is not specifically limited in the embodiment of the present application. The configuration information at least includes a service type and a configuration address; each service type corresponds to a format of certificate, and when configuring the subscription certificate with different service types, the standard format of the subscription certificate needs to be format-converted to convert the standard format of the subscription certificate into a format suitable for the service type.

[0086] After receiving the configuration information obtaining request sent by the client, the server retrieves the configuration information corresponding to the ID of the service object pre-stored by the user based on the ID of the service object carried in the configuration information obtaining request, organizes the configuration information into a configuration command line, and then feeds back the configuration command line to the client.

[0087] For the embodiment of the present application, after receiving the configuration command line fed back by the server, the client executes the configuration command line, and format-converts the subscription certificate based on the configuration information in the configuration command line to obtain the converted subscription certificate, then stores the subscription certificate to the configuration address, and deletes the corresponding temporary certificate in the configuration address, that is, the temporary certificate is replaced by the subscription certificate, thereby realizing the renewal of the certificate of the service object corresponding to the temporary certificate.

[0088] Further, the client can also actively retrieve the format and configuration address of the temporary certificate, and then configure the subscription certificate based on the format and configuration address of the temporary certificate; that is, format-convert the subscription certificate based on the format of the temporary certificate, configure the converted subscription certificate in the configuration address corresponding to the temporary certificate, and delete the temporary certificate, thereby realizing the renewal of the certificate of the service object corresponding to the temporary certificate.

[0089] It should be noted that the temporary certificate and the subscription certificate in the embodiment of the present application can be SSL (Secure Sockets Layer, Secure Sockets Layer) certificate, or other types of digital certificate such as TLS (Transport Layer Security, Transport Layer Security) certificate, which is not specifically limited herein.

[0090] In the certificate management method, when the client determines that there is an expiring certificate, the client can automatically send an application information obtaining request to the server based on a service object of the expiring certificate, the server generates an application command line based on the pre-stored application information of the service object of the user and feeds back the application command line to the client, so that the client executes the application command line to generate the application information and sends the application information to the CA end to apply for the certificate, after the CA end feeds back the signed certificate, the client sends a configuration information obtaining request to the server, the server generates a configuration command line based on the pre-stored configuration information of the user and feeds back the configuration command line to the client, the client executes the configuration command line to process the signed certificate, so that the signed certificate replaces the expiring certificate. In this process, the user does not need to manually monitor the expiring certificate, the user only needs to pre-store the application information and the configuration information of each service object in the server, through the information interaction between the client and the server, the registration and the configuration of the expiring certificate can be automatically realized, so that the probability of the certificate of the service object expiring is reduced. Compared with the related art, the user does not need to input the command line to realize the registration and the configuration of the certificate, so that the operation of manually inputting the command line by the user each time the signed certificate is registered and configured is reduced, and the efficiency of the configuration of the certificate is improved.

[0091] Further, when the user uses the client for the first time, the user needs to activate the client, that is, the client is registered in the server, so that the association of the client in the server is realized. The specific process is as follows: the client sends a service purchase order to the server and obtains the voucher fed back by the server, wherein the voucher can be a verification code or a Token (token). The voucher is generated and sent to the client by the server after it is determined that the service purchase order is valid. The service order specifically includes a payment voucher and an ID or an IP address (Internet Protocol Address, Internet Protocol Address) of the server. When the server receives the service purchase order sent by the client, it determines whether the service purchase order is valid, and after it is determined that the service purchase order is valid, the ID and / or IP address of the client is stored, and the voucher for the client is sent to the client based on the ID and / or IP address of the client. When the server receives any instruction sent by the client, it verifies whether the instruction is valid based on the voucher in the instruction, and executes the instruction when the instruction is verified to be valid.

[0092] In one of the embodiments, when the service objects of the user are configured on the same cloud platform as the server, the user can directly register the certificates of the service objects through the server, and further extract, renew and revoke the certificates by using the client. Please refer to Figure 5 The steps of managing the certificates through the server can specifically include steps 310-330, wherein:

[0093] Step 310, in response to the user input application instruction, call the pre-stored application information of the service object to construct an application command line, and the application instruction includes the service object;

[0094] Step 320, based on the application command line, construct an application request, and send the application request to the CA end, and obtain the subscription certificate fed back by the CA end;

[0095] Step 330, call the pre-stored configuration information of the service object to construct a configuration command line, and feed back the configuration command line and the subscription certificate to the client, so that the client processes the subscription certificate based on the configuration command line, and configures the subscription certificate for the service object.

[0096] Specifically, the user inputs the application instruction to the service end through the visual interface of the service end, in response to the user input application instruction, the pre-stored application information of the service object is called to construct an application command line, and the application command line is executed, and the application request is constructed based on the application information of the service object. The service end sends the application request to the CA end, and obtains the subscription certificate fed back by the CA end. After receiving the subscription certificate fed back by the CA end, the service end calls the pre-stored configuration information of the service object to construct a configuration command line; the service end sends the subscription certificate and the configuration command line to the client, and the client processes the subscription certificate based on the configuration command line, and configures the subscription certificate for the service object.

[0097] It should be understood that although each step in the flowchart involved in the above embodiments is displayed in sequence according to the arrow, these steps are not necessarily executed in sequence according to the arrow. Unless otherwise stated herein, the execution of these steps has no strict sequence limitation, and these steps can be executed in other orders. Moreover, at least part of the steps in the flowchart involved in the above embodiments can include multiple steps or multiple stages, which are not necessarily executed at the same time, but can be executed at different times, and the execution sequence of these steps or stages is not necessarily sequential, but can be alternately executed with other steps or steps or stages in other steps.

[0098] In an exemplary embodiment, as shown in Figure 1 a certificate management system is provided, the certificate management system includes at least one service end and a plurality of clients, wherein:

[0099] For any client: the client is configured to send an application information acquisition request to the server based on the service object of the near-expiration certificate when it is determined that there is a near-expiration certificate, and receive the application command line fed back by the server, and generate an application request based on the application command line, and send the application request to the CA end to obtain the subscription certificate fed back by the CA end; wherein the application command line is constructed by the server based on the pre-stored application information of the service object of the user; the near-expiration certificate is a certificate with a remaining lifetime less than or equal to the time threshold;

[0100] The client generates a configuration command line based on the pre-stored configuration information of the service object of the user in response to the configuration information acquisition request sent by the client, and feeds back the configuration command line to the client, so that the client processes the subscription certificate based on the configuration command line, so that the subscription certificate replaces the near-expiration certificate.

[0101] In one of the embodiments, the client traverses the remaining lifetimes of the target certificates every preset time interval; and determines whether there is a near-expiration certificate based on the remaining lifetimes of the target certificates; wherein the time threshold corresponding to any target certificate is determined based on the complete lifetime corresponding to any target certificate.

[0102] In one of the embodiments, the client sends a service purchase order to the server, and the server determines whether the service purchase order is valid when receiving the service purchase order sent by the client, and feeds back a credential (verification code or Token token) to the server after determining that the service purchase order is valid. The client obtains the credential fed back by the server; and the client adds the credential in any request when sending any request to the server; the server verifies whether any request is valid based on the credential when receiving any request, and executes any request when verifying that any request is valid.

[0103] The above is one application scenario of the certificate management system, that is, the scenario in which the service objects of the user are configured in different cloud platforms. The certificate management system provided by the present application is also applicable to another application scenario, that is, the scenario in which the service objects of the user are configured in the same cloud platform. In this scenario, the user can directly register, extract, renew and revoke the certificates of the service objects through the server. The user can realize the interaction with the server through the visual page of the server, so as to realize the generation of the application request and the configuration information of the certificates by the server, and the interaction between the server and the CA end, so as to realize the registration, extraction, renewal and revocation of the certificates.

[0104] In one of the embodiments, refer to Figure 6The certificate management system mainly consists of three parts, namely a Web visual interface, a server for certificate management, and a client supporting the ACME protocol. The Web visual interface is a way for users to interact with the server. Users can input information to the server through the Web visual interface, and the server can also display relevant processing steps and information to the user through the Web visual interface. The certificate management system of the present application supports two certificate issuance modes.

[0105] Mode one: In the scenario where the user's service objects and the server are configured in the same cloud platform, the user completes the certificate application operation on the Web page. The user needs to obtain the domain name of the service object on the Web visual interface and fill it in the corresponding DNS (Domain Name System) service provider for domain name resolution. The server generates user order information (application instructions input by the user through the Web visual interface) and places an order (sends an application request) with the corresponding CA according to the user's domain name application information, and then associates the CA order (the signing certificate feedback by the CA) with the server order.

[0106] The user inputs the application instruction to the server through the Web visual interface of the server. In response to the user's input application instruction, the pre-stored application information of the service object is called to construct an application command line, and the application command line is executed, and then an application request is constructed based on the application information of the service object. The server sends the application request to the CA end and obtains the signing certificate feedback by the CA end. After receiving the signing certificate feedback by the CA end, the server calls the pre-stored configuration information of the service object to construct a configuration command line; then the server sends the signing certificate and the configuration command line to the client, and the client processes the signing certificate based on the configuration command line to configure the signing certificate for the service object.

[0107] Mode two: Web (World Wide Web) visual interface and ACME client are used together. The user sends a configuration information acquisition request of the service object to the server through the client. The server calls the pre-stored configuration information of the service object of the user to generate an application command line and feeds back to the client. The client configures the DNS automatic resolution information of the service object and sends an application request to the CA end, so as to obtain the signing certificate feedback by the CA end, thereby completing the certificate application. Then, according to the generated ACME protocol (the configuration command line generated by the server), the client automatically pulls the ACME protocol from the server, and reissues the certificate (i.e. replaces the issued certificate with the temporary certificate) according to the pulled ACME protocol.

[0108] Certificate management server: There are four units in the server, including request processing unit, CA selection unit, order unit, ACME command generation unit. First, the request processing unit creates a system order (confirms whether the purchase order is valid) according to the user request (purchase order), and selects the corresponding CA in the CA selection unit to create a CA order (send application request to CA end), then the order unit associates the system order (client purchase order) with the CA order, and generates the corresponding ACME command (configuration command line) according to the information of the CA order (configuration command line), and the ACME client pulls the command (configuration command line).

[0109] Certificate purchase and issuance: The user inputs the relevant information to the server in the Web visual interface, and completes the domain name application to the CA end and obtains the signed certificate through the server, the server can fill in the domain name verification and issue the certificate for the service object according to the domain name resolution of the certificate in the DNS service provider, or send the signed certificate to the client, so that the client of ACME reissues the signed certificate for the service object.

[0110] Server creates order: The server creates order (application information) and records user information (service object ID and client ID or IP address).

[0111] CA ordering: Certificate management service orders CA server (sends application request to CA end).

[0112] CA order information: CA issues order information (signed certificate) to the server.

[0113] ACME command generation unit: The server generates ACME protocol command according to the order and user filled DNS automatic deployment interface information of cloud platform, and displays it in the Web visual interface.

[0114] Register client: The user uses the client to register the client to the certificate management server (send purchase order and get the feedback of the server).

[0115] Command execution: The client actively executes the ACME command line (configuration command line or application command line).

[0116] Compared with the existing SSL certificate management website, the certificate management system provided in the embodiments of the present application contains a client supporting the ACME protocol, which can automatically apply for, issue, and deploy, thereby reducing the amount of manual operation of the user, and can automatically help the user manage the certificate of each service object and automatically replace the temporary certificate. Compared with the existing ACME protocol client, the certificate management system supports a web visual interface, and can automatically generate an ACME command according to order information, and after the user registers the client with the server, the client will automatically pull the ACME command (configuration command line) corresponding to the order, and then automatically perform the operation of reissuing and deploying the signing certificate of the service object.

[0117] In the embodiments of the present application, the client and the server in the certificate management system are limited, which can refer to the above-mentioned limitations of the client and the server in the certificate management method applied to the client, and also can refer to the above-mentioned limitations of the client and the server in the certificate management method applied to the server, which will not be repeated here.

[0118] Based on the same inventive concept, the embodiments of the present application also provide a certificate management device for implementing the above-mentioned certificate management method. The implementation scheme of the problem solving provided by the device is similar to the implementation scheme described in the above method, so the specific limitations in one or more certificate management device embodiments provided below can refer to the limitations of the certificate management method described above, which will not be repeated here.

[0119] In one exemplary embodiment, as shown in Figure 7 A certificate management device is provided, the device includes an application information acquisition module 701, an application request generation module 702, a configuration information acquisition module 703, and a configuration module 704, wherein:

[0120] The application information acquisition module 701 is configured to, when it is determined that there is a temporary certificate, send an application information acquisition request to the server based on the service object of the temporary certificate, and receive an application command line fed back by the server; the application command line is constructed by the server based on the pre-stored application information of the service object of the user, and the temporary certificate is a certificate whose remaining life is less than or equal to the time threshold;

[0121] The application request generation module 702 is configured to generate an application request based on the application command line, and send the application request to the CA end, the application request being used to instruct the CA end to feed back a signing certificate;

[0122] The configuration information acquisition module 703 is configured to send a configuration information acquisition request to the server, and receive a configuration command line fed back by the server, the configuration command line being constructed by the server based on the pre-stored configuration information of the service object;

[0123] The configuration module 704 is configured to process the subscription certificate based on the configuration information, so that the subscription certificate replaces the near-expiration certificate.

[0124] In the certificate management apparatus, when the client determines that there is a near-expiration certificate, the client can automatically send an application information obtaining request to the server based on the service object of the near-expiration certificate, the server generates an application command line based on the pre-stored application information of the service object of the user and feeds back the application command line to the client, so that the client executes the application command line to generate the application information and sends the application information to the CA end for certificate application. After the CA end feeds back the subscription certificate, the client sends a configuration information obtaining request to the server, the server generates a configuration command line based on the pre-stored configuration information of the user and feeds back the configuration command line to the client, and the client processes the subscription certificate by executing the configuration command line, so that the subscription certificate replaces the near-expiration certificate. In this process, the user does not need to manually monitor the near-expiration certificate. The user only needs to pre-store the application information and the configuration information of each service object in the server. Through the information interaction between the client and the server, the registration and configuration of the near-expiration certificate can be automatically realized, thereby reducing the probability of expiration of the certificate of the service object. Compared with related technologies, the user does not need to input the command line to realize the registration and configuration of the certificate, thereby reducing the operation of manually inputting the command line by the user each time the subscription certificate is registered and configured, and the efficiency of configuring the certificate is improved.

[0125] In one of the embodiments, the certificate management apparatus further comprises a near-expiration certificate determination module, wherein the near-expiration certificate determination module is specifically configured to:

[0126] Every preset time length, the remaining life of each target certificate is traversed once;

[0127] Based on the remaining life of each target certificate, it is determined whether there is a near-expiration certificate;

[0128] The time length threshold corresponding to any target certificate is determined based on the complete life corresponding to any target certificate.

[0129] In one of the embodiments, the certificate management apparatus further comprises an activation module, wherein the activation module is specifically configured to:

[0130] The service purchase order is sent to the server, and the verification code fed back by the server is obtained; the verification code is sent to the client after the server determines that the service purchase order is valid;

[0131] When any request is sent to the server, the verification code is added in any request; wherein, when any request is received, the server verifies whether any request is valid based on the verification code, and the server executes any request when verifying that any request is valid.

[0132] In one of the embodiments, as shown in Figure 8As shown, a certificate management apparatus is provided, comprising a first response module 801 and a second response module 802, wherein:

[0133] The first response module 801 is configured to, in response to an application information acquisition request sent by the client, construct an application command line based on pre-stored application information of the service object, and feed back the application command line to the client; the application information acquisition request is generated by the client based on the service object of the expiring certificate when it is determined that the expiring certificate exists; the expiring certificate is a certificate with a remaining lifetime less than or equal to a time threshold;

[0134] The second response module 802 is configured to, in response to a configuration information acquisition request sent by the client, construct a configuration command line based on pre-stored configuration information of the service object of the user, and feed back the configuration command line to the client, so that the client processes the signing certificate based on the configuration command line, and the signing certificate replaces the expiring certificate; the signing certificate is fed back to the client by the CA end based on an application request sent by the client; the application request is generated by the client based on the application command line.

[0135] In the above certificate management apparatus, when the client determines that the expiring certificate exists, the client can automatically send an application information acquisition request to the server based on the service object of the expiring certificate; the server generates an application command line based on the pre-stored application information of the service object of the user and feeds back the application command line to the client, so that the client executes the application command line to generate the application information and sends the application information to the CA end for certificate application; after the signing certificate is fed back by the CA end, the client sends a configuration information acquisition request to the server; the server generates a configuration command line based on the pre-stored configuration information and feeds back the configuration command line to the client; the client processes the signing certificate by executing the configuration command line, so that the signing certificate replaces the expiring certificate; in this process, the user does not need to manually monitor the expiring certificate; the user only needs to pre-store the application information and the configuration information of each service object in the server; through information interaction between the client and the server, the registration and configuration of the expiring certificate can be automatically implemented, thereby reducing the probability of certificate expiration of the service object; compared with related technologies, the user does not need to input the command line to implement the registration and configuration of the certificate, thereby reducing the operation of manually inputting the command line by the user each time the signing certificate is registered and configured, and thus the efficiency of configuring the certificate is improved.

[0136] In one of the embodiments, the certificate management apparatus further comprises an application module, which is specifically configured to:

[0137] In response to an application instruction input by the user, the application module constructs an application command line by calling the pre-stored application information of the service object; the application instruction includes the service object;

[0138] The application module constructs an application request based on the application command line, sends the application request to the CA end, and acquires the signing certificate fed back by the CA end.

[0139] The configuration information of the pre-stored service object is invoked to construct a configuration command line, and the configuration command line and the subscription certificate are fed back to the client, so that the client processes the subscription certificate based on the configuration command line, and configures the subscription certificate for the service object.

[0140] In one of the embodiments, the certificate management apparatus further comprises a verification module, and the verification module is specifically configured to:

[0141] Upon receiving the service purchase order sent by the client, it is determined whether the service purchase order is valid, and after determining that the service purchase order is valid, a verification code is fed back to the server;

[0142] Upon receiving any instruction sent by the client, it is verified whether the instruction is valid based on the verification code in the instruction, and when the instruction is verified to be valid, the instruction is executed; the verification code in the instruction is added by the client based on the verification code fed back by the server.

[0143] Each module in the above certificate management apparatus can be realized by software, hardware and combinations thereof in whole or in part. The above modules can be embedded in or independent of the processor in the computer device in hardware form, or can be stored in the memory in the computer device in software form, so as to be called and executed by the processor to perform the operations corresponding to the above modules.

[0144] In an exemplary embodiment, a computer device is provided, which can be used to configure the client and / or the server, and the internal structure diagram thereof can be as shown in Figure 9The computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit and an input device. The processor, the memory and the input / output interface are connected through a system bus. The communication interface, the display unit and the input device are connected to the system bus through the input / output interface. The processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for running the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is configured to exchange information between the processor and external devices. The communication interface of the computer device is configured to perform wired or wireless communication with external terminals. The wireless communication can be achieved through WIFI, mobile cellular network, NFC (Near Field Communication) or other technologies. The computer program is executed by the processor to implement a certificate management method. The display unit of the computer device is configured to form a visually visible picture, which can be a display screen, a projection device or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen. The input device of the computer device can be a touch layer overlaid on the display screen, or a key, trackball or touchpad arranged on the shell of the computer device, or an external keyboard, touchpad or mouse, etc.

[0145] Those skilled in the art can understand that Figure 9 The structure shown in the figure is only a block diagram of part of the structure related to the scheme of the present application, and does not constitute a limitation on the computer device to which the scheme of the present application is applied. The specific computer device can include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0146] In one exemplary embodiment, a computer device is provided, including a memory and a processor, the memory storing a computer program, and the processor executing the computer program to implement the steps of any certificate management method applied to the client and / or the server in the above method embodiments.

[0147] In one embodiment, a computer readable storage medium is provided, storing a computer program, and the computer program is executed by a processor to implement the steps of any certificate management method applied to the client and / or the server in the above method embodiments.

[0148] In one embodiment, a computer program product is provided, including a computer program, and the computer program is executed by a processor to implement the steps of any certificate management method applied to the client and / or the server in the above method embodiments.

[0149] It should be noted that the user information (including but not limited to user equipment information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved in the present application are all information and data authorized by the user or authorized by all parties, and the collection, use and processing of related data need to comply with relevant regulations.

[0150] It can be understood by those skilled in the art that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing related hardware through a computer program. The computer program can be stored in a non-volatile computer readable storage medium. When the computer program is executed, it can include the processes of the above-mentioned embodiments of each method. Any reference to memory, database or other medium used in the embodiments provided by the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical storage, high-density embedded non-volatile memory, resistive memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration but not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM), etc. The database involved in the embodiments provided by the present application can include at least one of a relational database and a non-relational database. The non-relational database can include a distributed database based on a block chain, etc., without being limited thereto. The processor involved in the embodiments provided by the present application can be a general-purpose processor, a central processing unit, a graphics processing unit, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., without being limited thereto.

[0151] The technical features of the above embodiments can be combined in any way. To make the description concise, not all possible combinations of the technical features in the above embodiments are described, but as long as the combinations of the technical features do not exist contradictions, they should be considered as the scope of the present disclosure.

[0152] The above embodiments only express several implementation ways of the present application, and the description is specific and detailed, but it should not be understood as a limitation to the patent scope of the present application. It should be pointed out that for ordinary skilled in the art, without departing from the concept of the present application, several modifications and improvements can be made, which all belong to the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the appended claims.

Claims

1. A certificate management method, characterized in that, Applied to a client, the method includes: When it is determined that a certificate is about to expire, the ID of the service object of the certificate is organized into a message for requesting application information, the request is sent to the server, and the application command line is received from the server. The application command line is constructed by the server based on the application information of the service object pre-stored by the user, and the certificate is a certificate with a remaining life of less than or equal to the duration threshold. An application request is generated based on the application command line and sent to the CA. The application request is used to instruct the CA to provide a signed certificate. Send a configuration information retrieval request to the server and receive a configuration command line from the server, wherein the configuration command line is constructed by the server based on the pre-stored configuration information of the service object; The signing certificate is processed based on the configuration information, so that the signing certificate replaces the expiring certificate.

2. The method according to claim 1, characterized in that, The method further includes: Every preset time interval, iterate through the remaining lifespan of each target certificate. Determine whether any near-expiration certificates exist based on the remaining lifespan of each target certificate; The duration threshold corresponding to any target certificate is determined based on the complete lifetime of the target certificate.

3. The method according to claim 1, characterized in that, The method further includes: Send a service purchase order to the server and obtain a verification code from the server; the verification code is sent to the client after the server confirms that the service purchase order is effective. When sending any request to the server, the verification code is added to the request; wherein, when the server receives the request, it verifies the validity of the request based on the verification code, and executes the request if the request is valid.

4. A certificate management method, characterized in that, Applied to the server side, the method includes: In response to the application information retrieval request sent by the client, an application command line is constructed based on the pre-stored application information of the service object, and the application command line is fed back to the client; the message of the application information retrieval request is organized by the client based on the ID of the service object of the near-expiration certificate when it is determined that there is a near-expiration certificate, and the near-expiration certificate is a certificate with a remaining lifespan less than or equal to the duration threshold; In response to the configuration information retrieval request sent by the client, a configuration command line is constructed based on the configuration information of the service object pre-stored by the user, and the configuration command line is fed back to the client so that the client processes the signed certificate based on the configuration command line, and the signed certificate replaces the expiring certificate; the signed certificate is fed back to the client by the CA based on the application request sent by the client, and the application request is generated by the client based on the application command line.

5. The method according to claim 4, characterized in that, The method further includes: In response to the user's input application command, the application command line is constructed by retrieving the pre-stored application information of the service object, wherein the application command includes the service object; An application request is constructed based on the application command line, and the application request is sent to the CA. The signing certificate is then obtained from the CA. The configuration command line is constructed by retrieving the pre-stored configuration information of the service object, and the configuration command line and the signing certificate are fed back to the client, so that the client processes the signing certificate based on the configuration command line and configures the signing certificate for the service object.

6. The method according to claim 4, characterized in that, The method further includes: Upon receiving a service purchase order from the client, determine whether the service purchase order is valid, and after confirming that the service purchase order is valid, send a verification code to the server. Upon receiving any instruction sent by the client, the system verifies the validity of the instruction based on the verification code in the instruction, and executes the instruction if the instruction is valid; the verification code in the instruction is added by the client based on the verification code fed back by the server.

7. A certificate management system, characterized in that, The certificate management system includes a server and a client, wherein: The client, upon determining the existence of a near-expiration certificate, organizes the ID of the service object of the near-expiration certificate into a request message for obtaining application information, sends the request to the server, receives the application command line from the server, generates an application request based on the application command line, and sends the application request to the CA to obtain the signed certificate from the CA; wherein, the application command line is constructed by the server based on the application information of the service object pre-stored by the user; the near-expiration certificate is a certificate with a remaining lifetime less than or equal to a duration threshold; In response to the configuration information retrieval request sent by the client, the server generates a configuration command line based on the configuration information of the service object pre-stored by the user, and feeds back the configuration command line to the client, so that the client processes the signed certificate based on the configuration command line, and the signed certificate replaces the expiring certificate.

8. A certificate management device, characterized in that, The device includes an application information acquisition module, an application request generation module, a configuration information acquisition module, and a configuration module, wherein: The application information acquisition module is used to, when it is determined that there is a certificate nearing expiration, organize the ID of the service object of the certificate nearing expiration into an application information acquisition request message, send the application information acquisition request to the server, and receive the application command line fed back by the server; the application command line is constructed by the server based on the application information of the service object pre-stored by the user, and the certificate nearing expiration is a certificate with a remaining lifespan less than or equal to a duration threshold. The application request generation module is used to generate an application request based on the application command line and send the application request to the CA terminal. The application request is used to instruct the CA terminal to provide a signed certificate. The configuration information acquisition module is used to send a configuration information acquisition request to the server and receive a configuration command line from the server. The configuration command line is constructed by the server based on the pre-stored configuration information of the service object. The configuration module is used to process the signing certificate based on the configuration information, so that the signing certificate replaces the expiring certificate.

9. A certificate management device, characterized in that, The device includes a first response module and a second response module, wherein: The first response module is used to respond to the application information retrieval request sent by the client, construct an application command line based on the pre-stored application information of the service object, and feed back the application command line to the client; the message of the application information retrieval request is organized by the client based on the ID of the service object of the near-expiration certificate when it is determined that there is a near-expiration certificate, and the near-expiration certificate is a certificate with a remaining life of less than or equal to the duration threshold; The second response module is used to respond to the configuration information acquisition request sent by the client, construct a configuration command line based on the configuration information of the service object pre-stored by the user, and feed the configuration command line back to the client so that the client processes the signed certificate based on the configuration command line, so that the signed certificate replaces the expiring certificate; the signed certificate is fed back to the client by the CA based on the application request sent by the client, and the application request is generated by the client based on the application command line.

10. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 6.

Images