Digital certificate processing method and device, computer equipment and readable storage medium

Abstract

The invention relates to a digital certificate processing method and device, computer equipment and a readable storage medium. The method comprises the following steps: receiving a certificate acquisition request sent by an application client, wherein the certificate acquisition request comprises a user domain name; acquiring a server virtual IP address matched with the user domain name of the certificate acquisition request, and determining target label information corresponding to the server virtual IP address; obtaining a binding relationship between preset label information and a preset digital certificate, and carrying out digital certificate query based on the target label information and the binding relationship to obtain a target digital certificate bound with the target label information; and feeding back the target digital certificate to the application client. By adopting the method, the accuracy of digital certificate matching can be improved.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a digital certificate processing method, apparatus, computer equipment, computer-readable storage medium, and computer program product. Background Art

[0002] SSL (Secure Socket Layer, network security protocol) / TLS (Transport Layer Security, transport layer security protocol) certificate is a type of digital certificate. Because it is configured on the server, it is also called SSL / TLS server certificate. SSL / TLS certificate complies with the SSL / TLS protocol and has server identity authentication and data transmission encryption functions. SNI (Server Name Indication) is an extension protocol of the SSL / TLS protocol, allowing the server to carry multiple SSL / TLS certificates on a single IP address, which can solve the problem that an HTTPS (Hypertext Transfer Protocol Secure) server has multiple domain names but cannot predict which domain name the client is requesting.

[0003] However, when some clients currently initiate HTTPS requests, they do not support SNI, resulting in the CDN (Content Delivery Network) cache server being unable to match the corresponding domain name certificate during the SSL / TLS handshake phase. Therefore, it can only return the default certificate. If the default certificate is not the certificate for the user's domain name, it will be considered as a mismatch by the client, and the HTTPS request will not be completed. Summary of the invention

[0004] The embodiments of the present application provide a digital certificate processing method, apparatus, computer device, computer-readable storage medium, and computer program product, which can accurately match a digital certificate acquisition request requested by a client.

[0005] In one aspect, the present application provides a method for processing a digital certificate. The method comprises:

[0006] Receiving a certificate acquisition request sent by an application client, wherein the certificate acquisition request includes a server virtual IP address that matches a user domain name of the application client;

[0007] Determine the target label information corresponding to the server virtual IP address;

[0008] Acquire a binding relationship between preset tag information and a preset digital certificate, perform a digital certificate query based on the target tag information and the binding relationship, and obtain a target digital certificate bound to the target tag information;

[0009] Feedback the target digital certificate to the application client.

[0010] On the other hand, the present application also provides a digital certificate processing device. The device includes:

[0011] A receiving module, configured to receive a certificate acquisition request sent by an application client, wherein the certificate acquisition request includes a server virtual IP address that matches a user domain name of the application client;

[0012] A determination module, used to determine the target label information corresponding to the virtual IP address of the server;

[0013] A query module, used to obtain a binding relationship between preset tag information and a preset digital certificate, perform a digital certificate query based on the target tag information and the binding relationship, and obtain a target digital certificate bound to the target tag information;

[0014] A feedback module is used to feed back the target digital certificate to the application client.

[0015] On the other hand, the present application also provides a computer device. The computer device includes a memory and a processor, the memory stores a computer program, and the processor implements the following steps when executing the computer program:

[0016] Receiving a certificate acquisition request sent by an application client, wherein the certificate acquisition request includes a server virtual IP address that matches a user domain name of the application client;

[0017] Determine the target label information corresponding to the server virtual IP address;

[0018] Acquire a binding relationship between preset tag information and a preset digital certificate, perform a digital certificate query based on the target tag information and the binding relationship, and obtain a target digital certificate bound to the target tag information;

[0019] Feedback the target digital certificate to the application client.

[0020] On the other hand, the present application also provides a computer-readable storage medium. The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the following steps are implemented:

[0021] Receiving a certificate acquisition request sent by an application client, wherein the certificate acquisition request includes a server virtual IP address that matches a user domain name of the application client;

[0022] Determine the target label information corresponding to the server virtual IP address;

[0023] Acquire a binding relationship between preset tag information and a preset digital certificate, perform a digital certificate query based on the target tag information and the binding relationship, and obtain a target digital certificate bound to the target tag information;

[0024] Feedback the target digital certificate to the application client.

[0025] On the other hand, the present application also provides a computer program product. The computer program product includes a computer program, and when the computer program is executed by a processor, the following steps are implemented:

[0026] Receiving a certificate acquisition request sent by an application client, wherein the certificate acquisition request includes a server virtual IP address that matches a user domain name of the application client;

[0027] Determine the target label information corresponding to the server virtual IP address;

[0028] Acquire a binding relationship between preset tag information and a preset digital certificate, perform a digital certificate query based on the target tag information and the binding relationship, and obtain a target digital certificate bound to the target tag information;

[0029] Feedback the target digital certificate to the application client.

[0030] The digital certificate processing method, device, computer equipment, computer-readable storage medium and computer program product configure preset label information for the server virtual IP address in advance, and pre-configure the binding relationship between the preset label information and the preset digital certificate, so that when receiving the certificate acquisition request sent by the application client, the server virtual IP address matching the user domain name of the application client is extracted from the certificate acquisition request, and the target label information corresponding to the server virtual IP address is determined. The binding relationship between the preset label information and the preset digital certificate is obtained, and a digital certificate query is performed based on the target label information and the binding relationship to obtain the target digital certificate bound to the target label information, and the target digital certificate is fed back to the application client, so that there is no need to use the user domain name to match the digital certificate, thereby solving the problem that the user domain name cannot be matched to the digital certificate due to the client not supporting SNI, and improving the accuracy of digital certificate matching and the efficiency of digital certificate acquisition. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0032] FIG1 is an application environment diagram of a digital certificate processing method in one embodiment;

[0033] FIG2 is a flow chart of a method for processing a digital certificate in one embodiment;

[0034] FIG3 is a schematic diagram of the architecture of a digital certificate processing method in one embodiment;

[0035] FIG4 is a schematic diagram of the architecture of a digital certificate processing method in one embodiment;

[0036] FIG5 is a schematic diagram of mounting the virtual IP addresses in a server group to each server in the server group in one embodiment;

[0037] FIG6 is a structural block diagram of a digital certificate processing device in one embodiment;

[0038] Figure 7 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0039] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0040] The digital certificate processing method provided in the embodiment of the present application can be applied to the application environment shown in Figure 1. Among them, the application client on the terminal 102 communicates with the node server 104 through the network. The data storage system can store the data that the node server 104 needs to process. The data storage system can be integrated on the node server 104, or it can be placed on the cloud or other network servers. The node server 104 receives a certificate acquisition request sent by the application client on the terminal 102, and the certificate acquisition request includes a server virtual IP address that matches the user domain name of the application client. The node server 104 determines the target tag information corresponding to the server virtual IP address. The node server 104 obtains the binding relationship between the preset tag information and the preset digital certificate. The node server 104 performs a digital certificate query based on the target tag information and the binding relationship, obtains the target digital certificate bound to the target tag information, and feeds back the target digital certificate to the application client on the terminal 102. Among them, the terminal 102 can be, but is not limited to, various personal computers, laptops, smart phones, tablet computers, Internet of Things devices and portable wearable devices, and the Internet of Things devices can be smart speakers, smart TVs, smart air conditioners, smart car-mounted devices, etc. The portable wearable device may be a smart watch, a smart bracelet, a head-mounted device, etc. The node server 104 may be a server in a server group or a server cluster.

[0041] In one embodiment, as shown in FIG. 2 , a digital certificate processing method is provided, and the method is applied to the node server in FIG. 1 as an example for description, including the following steps:

[0042] Step 202: Receive a certificate acquisition request sent by the application client, where the certificate acquisition request includes a server virtual IP address that matches the user domain name of the application client.

[0043] Specifically, the user sends a certificate acquisition request to the node server through the application client, and the certificate acquisition request includes a server virtual IP address that matches the user domain name of the application client.

[0044] In this embodiment, the application client determines the user domain name of the application client in response to the certificate acquisition event triggered by the user, and determines the server virtual IP address that matches the user domain name. The application client generates a certificate acquisition request based on the server virtual IP address.

[0045] In one embodiment, the application client may send a certificate acquisition request to a load balancing device, and the load balancing device may send the certificate acquisition request to a node server.

[0046] The node server receives the certificate acquisition request from the application client.

[0047] Step 204, determining the target label information corresponding to the server virtual IP address.

[0048] The server virtual IP address is the virtual IP address of the server. Each server has at least one virtual IP address. The virtual IP address (VIP) is used to switch between different hosts, mainly used for master-slave switching of the server.

[0049] Specifically, preset label information is configured in advance for each virtual IP address of the node server, and the virtual IP address and the preset label information correspond one to one.

[0050] The node server extracts the server virtual IP address from the certificate acquisition request and determines the target label information configured for the server virtual IP address.

[0051] Step 206, obtaining the binding relationship between the preset tag information and the preset digital certificate, performing a digital certificate query based on the target tag information and the binding relationship, and obtaining the target digital certificate bound to the target tag information.

[0052] Specifically, the node server constructs a binding relationship between each preset tag information and each preset digital certificate in advance, so that the preset tag information corresponds to the preset digital certificate one by one.

[0053] The node server can obtain the binding relationship between the preset tag information and the preset digital certificate, perform a digital certificate query based on the target tag information and the binding relationship, and obtain the target digital certificate bound to the target tag information.

[0054] In this embodiment, the node server can determine the real IP (Real Server Address, RIP) address corresponding to the server virtual IP address. The real IP address refers to the management IP address of the server, the real IP address used by the server node in the server cluster. The server can perform a digital certificate query based on the target label information and the binding relationship from the real IP address to obtain the target digital certificate bound to the target label information.

[0055] Step 208: Feedback the target digital certificate to the application client.

[0056] Specifically, the node server feeds back the target digital certificate to the application client.

[0057] In the above digital certificate processing method, by pre-configuring preset tag information for the server virtual IP address, and pre-configuring the binding relationship between the preset tag information and the preset digital certificate, when receiving the certificate acquisition request sent by the application client, the server virtual IP address that matches the user domain name of the application client is extracted from the certificate acquisition request, and the target tag information corresponding to the server virtual IP address is determined. The binding relationship between the preset tag information and the preset digital certificate is obtained, and a digital certificate query is performed based on the target tag information and the binding relationship to obtain the target digital certificate bound to the target tag information, and the target digital certificate is fed back to the application client, so that there is no need to use the user domain name to match the digital certificate, thereby solving the problem that the user domain name cannot be matched to the digital certificate due to the client not supporting SNI, and improving the accuracy of digital certificate matching and the efficiency of digital certificate acquisition.

[0058] In one embodiment, the method further includes: receiving a certificate acquisition request sent by an application client, including: receiving a certificate acquisition request forwarded by a load balancing device, the certificate acquisition request being sent by the application client to the load balancing device

[0059] Specifically, the application client sends a certificate acquisition request to the load balancing device, and the load balancing device forwards the certificate acquisition request to the node server. The node server receives the certificate acquisition request forwarded by the load balancing device.

[0060] In this embodiment, the certificate query request is forwarded to the node server through the load balancing device to achieve load balancing of the server and improve the processing efficiency of user requests.

[0061] As shown in Figure 3, it is a schematic diagram of the architecture of a digital certificate processing method in an embodiment. The application client may be a browser, and the global configuration center server refers to a CDN center server.

[0062] 1. The CDN central server sends configuration files to each CDN server.

[0063] 2. When the user initiates a certificate acquisition request through the browser, the local content distribution network server parses the certificate acquisition request and obtains the user's domain name;

[0064] 3. The CDN server determines the VIP address that matches the user's domain name and returns it to the browser;

[0065] 4. The browser sends a request with the VIP address to the load balancing device;

[0066] 5. The load balancing device receives the request, determines the RIP address corresponding to the VIP address, determines the RIP address of the target server based on the RIP addresses of each CDN server and the RIP address corresponding to the VIP address, and forwards the request to the target server.

[0067] 6. The target server's gateway determines the target tag information corresponding to the VIP address according to the VIP address in the request, and determines the target digital certificate bound to the target tag information;

[0068] 7. Feedback the target digital certificate to the browser.

[0069] As shown in FIG. 4 , it is a schematic diagram of the architecture of a data certificate processing method in an embodiment, which mainly includes a user configuration module, a digital certificate platform, a resource configuration module, and a policy generation and issuance module.

[0070] The user configuration module is used to maintain the user's basic information, domain name information, and plan the corresponding resource pool for the user.

[0071] The digital certificate platform is used to maintain digital certificates uploaded by users, issue digital certificates, and verify the validity of digital certificates.

[0072] The resource configuration module is used to maintain server (RIP) information, server group (GROUP) information, service virtual IP (VIP) information, label information, as well as the relationship between server groups, the relationship between server groups and service virtual IPs, and the relationship between labels and service virtual IPs.

[0073] Policy generation and delivery module: mainly plans the relationship between user certificates and labels, automatically generates configuration policies for service virtual IP (VIP) and user certificates, and delivers them to the CDN gateway for matching and response.

[0074] In this embodiment, the label information is configured for the VIP address of the server, and then the label information is bound to the user's digital certificate to achieve the binding relationship between the VIP address and the digital certificate. The VIP address list is sent and bound to the cache server in the user resource pool, and the policy configuration of the VIP and user certificate in the same server cluster is sent for loading by the CDN gateway. When the user request is forwarded to the cache server, the corresponding user digital certificate is matched according to the access VIP, and the user digital certificate information is responded to the visitor, thereby solving the problem that the client does not support SNI and the domain name can match the corresponding digital certificate.

[0075] In one embodiment, the method further comprises:

[0076] Create resource information for the server group, which includes the real IP address and virtual IP address corresponding to the server group, and preset tag information configured for the virtual IP address; mount each virtual IP address in the resource information to the server indicated by each real IP address; receive the digital certificate uploaded by the application client, and establish a binding relationship between the digital certificate and the preset tag information in the resource information; based on the resource information and the binding relationship, generate a configuration file for each server.

[0077] Specifically, the node server creates resource information of the server group, where the resource information includes a server group identifier, a real IP address and a virtual IP address corresponding to the server group, and preset label information configured for the virtual IP address.

[0078] The node server mounts each virtual IP address in the resource information to the server indicated by each real IP address.

[0079] The created server group resource information is shown in the following table:

[0080]

[0081] As shown in FIG5 , VIP1, VIP2, and VIP3 in the server group are mounted to each server in the server group respectively.

[0082] The node server receives the digital certificate uploaded by the application client, builds a binding relationship between the digital certificate and the preset tag information in the resource information, and generates a configuration file for each server based on the resource information and the binding relationship.

[0083] In this embodiment, resource information of the server group can be created through the central server, and each virtual IP address in the resource information can be mounted to the server indicated by each real IP address through the central server. The central server receives the digital certificate uploaded by the application client, builds a binding relationship between the digital certificate and the preset tag information in the resource information, and generates a configuration file for each server based on the resource information and the binding relationship.

[0084] In this embodiment, resource information of a server group is created, the resource information including a real IP address and a virtual IP address corresponding to the server group, and preset tag information configured for the virtual IP address, each virtual IP address in the resource information is respectively mounted on a server indicated by each real IP address, a digital certificate uploaded by an application client is received, a binding relationship between the digital certificate and the preset tag information in the resource information is established, and a configuration file for each server is generated based on the resource information and the binding relationship, so that the server can accurately feedback the digital certificate matching the virtual IP address to the application client based on the binding relationship between the digital certificate in the configuration file and the preset tag information.

[0085] In one embodiment, based on the resource information and the binding relationship, a configuration file for each server is generated, including:

[0086] Based on the resource information and the binding relationship, certificate policy configuration information for each server is generated; based on the configuration rules of each server and the certificate policy configuration information, a configuration file for the server is generated.

[0087] Specifically, the server's RIP cannot be used as a VIP. A single server serves multiple user domain names at the same time, which makes it impossible to match the domain names of all services on the local machine. Therefore, to configure preset label information for the VIP address, the following conditions must be met: The same VIP address is not allowed to have multiple preset label information to avoid matching multiple domain names corresponding to multiple labels.

[0088] The binding relationship between the digital certificate and the preset label information needs to meet the following conditions: one preset label information can only be bound to one digital certificate.

[0089] The relationship between tags and VIPs is as follows:

[0090]

[0091] In this embodiment, the node server receives the user identity information and digital certificate uploaded by the application client, and the user identity information includes the user ID and domain name information. Based on the binding relationship between the digital certificate and the preset label information, the user identity information, the SSL port and the SSL protocol, the certificate label planning information is generated. The certificate label planning information is shown in the following table:

[0092]

[0093] Based on resource information, binding relationship and certificate label planning information, generate certificate policy configuration information for each RIP address. The certificate policy configuration information includes VIP address, digital certificate storage path corresponding to the VIP address, digital certificate private key path, SSL port and SSL protocol. The certificate policy configuration information is shown in the following table:

[0094]

[0095] Based on the configuration rules and certificate policy configuration information of the server's gateway, a configuration file for the server is generated. The configuration file includes the RIP address, the VIP address corresponding to the RIP address, the storage path of the digital certificate corresponding to the VIP address and the private key path of the digital certificate, the SSL port, and the SSL protocol.

[0096] In this embodiment, it is necessary to generate the following final configuration file according to the configuration requirements of the CDN gateway NGINX software for the CDN gateway to load and take effect. Taking the server (1.1.1.1) as an example, the following configuration file is generated:

[0097] server {

[0098] listen 1.1.1.4:443 ssl default_server reuseport;

[0099] ssl_certificate user A certificate 1 path;

[0100] ssl_certificate_key User A certificate 1 private key path;

[0101] ssl_protocols TLSv1.1 TLSv1.2;

[0102] # Introduce other common configuration items

[0103] }

[0104] server {

[0105] listen 1.1.1.5:443 ssl default_server reuseport;

[0106] ssl_certificate User B certificate 1 path;

[0107] ssl_certificate_key User B certificate 1 private key path;

[0108] ssl_protocols TLSv1.1 TLSv1.2;

[0109] # Introduce other common configuration items

[0110] }

[0111] When the CDN gateway on the CDN cache server (1.1.1.1) loads the above configuration content and the user request is forwarded to the CDN gateway, it can obtain the VIP address of this request, read and respond to the corresponding digital certificate based on the VIP address.

[0112] The traditional technology assumes that the client supports the SNI protocol by default. When the client does not support the SNI protocol, the CDN system cannot obtain the domain name that the user wants to access. When the server serves multiple domain names, it cannot correctly match the normal certificate information. In this embodiment, the label information is configured for the VIP address, and the label information is bound to the digital certificate of the user's domain name, so that the VIP address can be indirectly bound to the digital certificate, and the configuration policy is sent to the CDN cache server. When the user request is forwarded to the CDN cache server, the digital certificate is matched according to the requested VIP address to quickly and accurately respond to the client's request.

[0113] In one embodiment, the method further comprises:

[0114] When there are new servers in the server group, the configuration file is sent to the new servers.

[0115] Specifically, the node server automatically identifies the newly listed server in the server group, automatically generates the relationship between the VIP in the server group and the user domain name certificate based on the relationship between the label and the certificate in the group, and sends the policy configuration to the CDN server. For example:

[0116] Server group: dx_xiamen1, a new server is added, the server's RIP: 1.1.1.7, the following configuration policy will be automatically generated and issued:

[0117] server {

[0118] listen 1.1.1.4:443 ssl default_server reuseport;

[0119] ssl_certificate user A certificate 1 path;

[0120] ssl_certificate_key User A certificate 1 private key path;

[0121] ssl_protocols TLSv1.1 TLSv1.2;

[0122] # Introduce other common configuration items

[0123] }

[0124] server {

[0125] listen 1.1.1.5:443 ssl default_server reuseport;

[0126] ssl_certificate User B certificate 1 path;

[0127] ssl_certificate_key User B certificate 1 private key path;

[0128] ssl_protocols TLSv1.1 TLSv1.2;

[0129] # Introduce other common configuration items

[0130] }

[0131] In this embodiment, a new server group is added or a VIP is added to an existing server, and the VIP in the server group is marked with an existing label. A new server group (dx_quanzhou1) is added as follows:

[0132]

[0133] Automatically generate the relationship between the machine's VIP and user certificate, and send the policy configuration to the server group:

[0134] server {

[0135] listen 3.1.1.4:443 ssl default_server reuseport;

[0136] ssl_certificate user A certificate 1 path;

[0137] ssl_certificate_key User A certificate 1 private key path;

[0138] ssl_protocols TLSv1.1 TLSv1.2;

[0139] # Introduce other common configuration items

[0140] }

[0141] server {

[0142] listen 3.1.1.5:443 ssl default_server reuseport;

[0143] ssl_certificate User B certificate 1 path;

[0144] ssl_certificate_key User B certificate 1 private key path;

[0145] ssl_protocols TLSv1.1 TLSv1.2;

[0146] # Introduce other common configuration items

[0147] }

[0148] When there are new servers in the server group, the configuration files can be sent to the new servers through the central server.

[0149] In this embodiment, VIP addresses are managed by labeling, and the automatic generation and distribution of configurations can be realized for the server delisting and server removal in the server group, and the increase and decrease of VIPs in the server group, according to the label granularity. In addition, the label is used as an intermediate medium between the VIP and the user domain name certificate to avoid the coupling relationship between the VIP and the digital certificate of the user domain name, and can be updated and deployed independently to avoid the risk of misoperation.

[0150] In one embodiment, receiving a certificate acquisition request sent by an application client includes:

[0151] An encrypted certificate acquisition request sent by an application client is received, where the encrypted certificate acquisition request is obtained by encrypting the certificate acquisition request based on an encryption key; a decryption key is obtained, and the encrypted certificate acquisition request is decrypted based on the decryption key to obtain the certificate acquisition request.

[0152] Specifically, the node server receives an encrypted certificate acquisition request sent by the application client, the encrypted certificate acquisition request is obtained by encrypting the certificate acquisition request based on the encryption key. The server obtains a decryption key, decrypts the encrypted certificate acquisition request based on the decryption key, and obtains the certificate acquisition request.

[0153] In this embodiment, an encrypted certificate acquisition request sent by an application client is received, and the encrypted certificate acquisition request is decrypted based on a decryption key to obtain a certificate acquisition request, thereby being able to protect user requests through encryption keys and decryption keys and improve the security of data transmission.

[0154] In this embodiment, both the node server and the central server can be CDN servers.

[0155] In one embodiment, a digital certificate processing method is provided, comprising:

[0156] The central server creates resource information of the server group, which includes the real IP address and virtual IP address corresponding to the server group, and preset label information configured for the virtual IP address;

[0157] The central server mounts each virtual IP address in the resource information to the server indicated by each real IP address;

[0158] The central server receives the digital certificate uploaded by the application client and establishes a binding relationship between the digital certificate and the preset tag information in the resource information;

[0159] The central server generates certificate policy configuration information for each server based on resource information and binding relationships;

[0160] The central server generates a configuration file for each server based on the configuration rules and certificate policy configuration information of each server, and sends the configuration file to the server.

[0161] When there is a new server in the server group, the central server sends the configuration file to the new server.

[0162] The local content distribution network server receives a certificate acquisition request sent by the application client, where the certificate acquisition request includes a user domain name;

[0163] The local content distribution network server obtains a server virtual IP address that matches the user domain name of the certificate acquisition request, and feeds the server virtual IP address back to the application client;

[0164] The application client generates a certificate acquisition request, which includes a server virtual IP address that matches the user domain name of the application client;

[0165] The application client sends a certificate acquisition request to the load balancing device, and the load balancing device forwards the certificate acquisition request to the node server.

[0166] The node server obtains the binding relationship between the preset label information and the preset digital certificate, performs a digital certificate query based on the target label information and the binding relationship, and obtains the target digital certificate bound to the target label information;

[0167] The node server feeds back the target digital certificate to the application client.

[0168] In this embodiment, the tag information is configured for the user's VIP address, and then the tag information is bound to the user's digital certificate to achieve the binding relationship between the VIP address and the digital certificate. The VIP address list is sent down and bound to the CDN server in the customer resource pool, and the policy configuration of the VIP address and digital certificate in the same cluster is sent down at the same time for the CDN gateway to load, so that when the user's certificate acquisition request is forwarded to the CDN server, it can match the corresponding digital certificate according to the access VIP address, and feedback the digital certificate to the user, thereby solving the problem that the client does not support SNI, resulting in the domain name being matched to the corresponding digital certificate.

[0169] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0170] Based on the same inventive concept, the embodiment of the present application also provides a digital certificate processing device for implementing the digital certificate processing method involved above. The implementation solution provided by the device to solve the problem is similar to the implementation solution recorded in the above method, so the specific limitations in the one or more digital certificate processing device embodiments provided below can refer to the limitations of the digital certificate processing method above, and will not be repeated here.

[0171] In one embodiment, as shown in FIG6 , a digital certificate processing device 600 is provided, including:

[0172] The receiving module 602 receives a certificate acquisition request sent by the application client, where the certificate acquisition request includes a server virtual IP address that matches a user domain name of the application client.

[0173] The determination module 604 is used to determine the target label information corresponding to the server virtual IP address.

[0174] The query module 606 is used to obtain the binding relationship between the preset tag information and the preset digital certificate, perform digital certificate query based on the target tag information and the binding relationship, and obtain the target digital certificate bound to the target tag information.

[0175] The feedback module 608 is used to feed back the target digital certificate to the application client.

[0176] In this embodiment, by pre-configuring preset tag information for the server virtual IP address, and pre-configuring the binding relationship between the preset tag information and the preset digital certificate, when receiving the certificate acquisition request sent by the application client, the server virtual IP address that matches the user domain name of the application client is extracted from the certificate acquisition request, and the target tag information corresponding to the server virtual IP address is determined. The binding relationship between the preset tag information and the preset digital certificate is obtained, and a digital certificate query is performed based on the target tag information and the binding relationship to obtain the target digital certificate bound to the target tag information, and the target digital certificate is fed back to the application client, so that there is no need to use the user domain name to match the digital certificate, thereby solving the problem that the user domain name cannot be matched to the digital certificate due to the client not supporting SNI, and improving the accuracy of digital certificate matching and the efficiency of digital certificate acquisition.

[0177] In one embodiment, the apparatus further comprises:

[0178] The forwarding module is used to receive the certificate acquisition request forwarded by the load balancing device, and the certificate acquisition request is sent by the application client to the load balancing device.

[0179] In this embodiment, the certificate query request is forwarded to the node server through the load balancing device to achieve load balancing of the server and improve the processing efficiency of user requests.

[0180] In one embodiment, the apparatus further comprises:

[0181] The resource configuration module is used to create resource information of the server group, which includes the real IP address and virtual IP address corresponding to the server group, and the preset label information configured for the virtual IP address; each virtual IP address in the resource information is mounted on the server indicated by each real IP address;

[0182] A user configuration module is used to receive a digital certificate uploaded by an application client and establish a binding relationship between the digital certificate and the preset tag information in the resource information;

[0183] The policy generation module is used to generate a configuration file for each server based on resource information and binding relationships.

[0184] In this embodiment, resource information of a server group is created, the resource information including a real IP address and a virtual IP address corresponding to the server group, and preset tag information configured for the virtual IP address, each virtual IP address in the resource information is respectively mounted on a server indicated by each real IP address, a digital certificate uploaded by an application client is received, a binding relationship between the digital certificate and the preset tag information in the resource information is established, and a configuration file for each server is generated based on the resource information and the binding relationship, so that the server can accurately feedback the digital certificate matching the virtual IP address to the application client based on the binding relationship between the digital certificate in the configuration file and the preset tag information.

[0185] In one embodiment, the policy generation module is further used to generate certificate policy configuration information for each server based on resource information and binding relationships; and to generate a configuration file for the server based on the configuration rules of each server and the certificate policy configuration information.

[0186] In this embodiment, label information is configured for the VIP address, and the label information is bound to the digital certificate of the user domain name, so that the VIP address can be indirectly bound to the digital certificate, and the configuration policy is sent to the CDN cache server. When the user request is forwarded to the CDN cache server, the digital certificate is matched according to the requested VIP address to quickly and accurately respond to the client's request.

[0187] In one embodiment, the apparatus further comprises:

[0188] The sending module is used to send the configuration file to the newly added server when there is a newly added server in the server group.

[0189] In this embodiment, VIP addresses are managed by labeling, and the automatic generation and distribution of configurations can be realized for the server delisting and server removal in the server group, and the increase and decrease of VIPs in the server group, according to the label granularity. In addition, the label is used as an intermediate medium between the VIP and the user domain name certificate to avoid the coupling relationship between the VIP and the digital certificate of the user domain name, and can be updated and deployed independently to avoid the risk of misoperation.

[0190] In one embodiment, the receiving module 602 is further used to receive an encrypted certificate acquisition request sent by the application client, where the encrypted certificate acquisition request is obtained by encrypting the certificate acquisition request based on an encryption key;

[0191] A decryption key is obtained, and the encrypted certificate acquisition request is decrypted based on the decryption key to obtain a certificate acquisition request.

[0192] In this embodiment, an encrypted certificate acquisition request sent by an application client is received, and the encrypted certificate acquisition request is decrypted based on a decryption key to obtain a certificate acquisition request, thereby being able to protect user requests through encryption keys and decryption keys and improve the security of data transmission.

[0193] Each module in the above digital certificate processing device can be implemented in whole or in part by software, hardware, or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each module.

[0194] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Figure 7 As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. The processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store digital certificate processing data. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a digital certificate processing method is implemented.

[0195] Those skilled in the art will understand that Figure 7 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0196] The embodiment of the present application also provides a computer-readable storage medium, one or more non-volatile computer-readable storage media containing computer-executable instructions, when the computer-executable instructions are executed by one or more processors, the processors execute the steps of the digital certificate processing method.

[0197] The embodiment of the present application also provides a computer program product including instructions, which, when executed on a computer, enables the computer to execute the digital certificate processing method.

[0198] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards of relevant countries and regions.

[0199] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0200] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0201] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A digital certificate processing method, characterized in that: include: Receiving a certificate acquisition request sent by an application client, wherein the certificate acquisition request includes a server virtual IP address that matches a user domain name of the application client; Determine the target label information corresponding to the server virtual IP address; Acquire a binding relationship between preset tag information and a preset digital certificate, perform a digital certificate query based on the target tag information and the binding relationship, and obtain a target digital certificate bound to the target tag information; Feedback the target digital certificate to the application client.

2. The method according to claim 1, characterized in that The receiving a certificate acquisition request sent by the application client includes: A certificate acquisition request forwarded by a load balancing device is received, wherein the certificate acquisition request is sent by the application client to the load balancing device.

3. The method according to claim 1, characterized in that The method further comprises: Creating resource information of a server group, the resource information including a real IP address and a virtual IP address corresponding to the server group, and preset label information configured for the virtual IP address; Mounting each of the virtual IP addresses in the resource information to the server indicated by each real IP address; Receiving a digital certificate uploaded by an application client, and establishing a binding relationship between the digital certificate and the preset tag information in the resource information; Based on the resource information and the binding relationship, a configuration file for each of the servers is generated.

4. The method according to claim 3, characterized in that The generating a configuration file for each server based on the resource information and the binding relationship includes: Based on the resource information and the binding relationship, generating certificate policy configuration information for each of the servers; Based on the configuration rule of each server and the certificate policy configuration information, a configuration file for the server is generated.

5. The method according to claim 3, characterized in that: The method further comprises: When there is a newly added server in the server group, the configuration file is sent to the newly added server.

6. The method according to any one of claims 1 to 5, characterized in that: The receiving a certificate acquisition request sent by the application client includes: Receiving an encrypted certificate acquisition request sent by an application client, wherein the encrypted certificate acquisition request is obtained by encrypting the certificate acquisition request based on an encryption key; A decryption key is obtained, and the encrypted certificate acquisition request is decrypted based on the decryption key to obtain a certificate acquisition request.

7. A digital certificate processing device, characterized in that: include: A receiving module, configured to receive a certificate acquisition request sent by an application client, wherein the certificate acquisition request includes a server virtual IP address that matches a user domain name of the application client; A determination module, used to determine the target label information corresponding to the virtual IP address of the server; A query module, used to obtain a binding relationship between preset tag information and a preset digital certificate, perform a digital certificate query based on the target tag information and the binding relationship, and obtain a target digital certificate bound to the target tag information; A feedback module is used to feed back the target digital certificate to the application client.

8. A computer device comprising a memory and a processor, wherein a computer program is stored in the memory, wherein: When the computer program is executed by the processor, the processor is caused to perform the steps of the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images