SSL certificate automatic deployment method, device, electronic device and storage medium

Abstract

The present application provides a method, device, electronic device and storage medium for automatic deployment of SSL certificates, the method comprising: checking the configuration information of certificate deployment; if the configuration information is complete, issuing a certificate deployment request to the certificate lifecycle management system, so that the certificate lifecycle management system verifies the certificate deployment request to return the latest SSL certificate; the certificate deployment request includes the configuration information and the private key signature data of the local SSL certificate; judging whether the returned latest SSL certificate is the same as the local SSL certificate; if they are the same, ending the deployment; if they are not the same, verifying the certificate deployment parameters, and if the verification passes, deploying the latest SSL certificate and the private key of the latest SSL certificate to the target server. The present application can periodically obtain SSL certificates and automatically deploy them, and can adjust the brand and type of SSL certificates without modifying the client configuration. In addition, the present application can perform a variety of compliance checks during the certificate update process to improve security.

Description

Technical Field

[0001] The present application belongs to the field of digital certificate technology, and in particular, relates to a method, device, electronic device and storage medium for automatic deployment of SSL certificates. Background Art

[0002] In order to gain the trust of browsers in the Internet industry, a publicly trusted certificate authority (CA) is required to verify the domain name ownership of the applicant, and issue an SSL certificate after confirming that the applicant is real and legitimate. SSL certificates can authenticate the identity of a company or website. When a user visits a website, they can click on the website security certificate and trust seal to learn about the specific information of the website and identify the authenticity of the website. In addition, SSL certificates can also enable HTTPS encryption to protect the personal information entered by users on the website, ensure that privacy-sensitive information is not illegally tampered with, and prevent the leakage of transmitted information. Currently, the manual deployment of SSL certificates has problems such as complexity, error-proneness, and high management costs. Therefore, how to achieve automatic update of SSL certificates is a technical problem that technicians in this field need to solve urgently. Summary of the invention

[0003] The purpose of this application is to provide a method, device, electronic device and storage medium for automatic deployment of SSL certificates, so as to solve the technical problem of how to realize automatic update and deployment of SSL certificates.

[0004] In a first aspect, the present application provides a method for automatic deployment of SSL certificates, the method comprising:

[0005] Check the configuration information;

[0006] If the configuration information is complete, a certificate deployment request is sent to the certificate cycle management module, so that the certificate cycle management module verifies the certificate deployment request to return the latest SSL certificate and the private key of the latest SSL certificate; the certificate deployment request includes the configuration information and the private key signature data of the local SSL certificate;

[0007] Determine whether the returned latest SSL certificate is the same as the local SSL certificate;

[0008] If they are the same, the deployment ends;

[0009] If they are not the same, the certificate deployment parameters are verified, and if the verification passes, the latest SSL certificate and the private key of the latest SSL certificate are deployed to the target server.

[0010] In an implementation of the first aspect, when the local SSL certificate does not exist, the SSL certificate returned by the certificate lifecycle management module is used as the local SSL certificate, and the local SSL certificate and the corresponding private key are saved on the target server.

[0011] In an implementation of the first aspect, the configuration information includes subscription parameters, service name, target server type, and service listening port parameters;

[0012] The subscription parameter is used to obtain whether there is a new SSL certificate in the certificate cycle management module;

[0013] The service name, the target server type and the service listening port parameters are used to obtain the service address and port of the latest SSL certificate to be deployed.

[0014] In an implementation of the first aspect, verifying the certificate deployment parameter includes:

[0015] Verify whether the service name is included in the service address protection range of the latest SSL certificate;

[0016] Verify that the validity period of the latest SSL certificate is available;

[0017] Verify that the certificate chain of the latest SSL certificate is complete;

[0018] Verify whether the latest SSL certificate matches the corresponding private key.

[0019] In an implementation of the first aspect, the method further includes:

[0020] Regularly detect the SSL certificate status on the target server;

[0021] When it is detected that the SSL certificate is in an unhealthy state, an alarm is sent to the certificate cycle management module, so that the certificate cycle management module performs processing according to the early warning configuration.

[0022] In an implementation of the first aspect, the method further includes:

[0023] Sending a certificate signing request to an SSL certificate issuing authority through the certificate cycle management module to obtain an SSL certificate issued by the SSL certificate issuing authority;

[0024] The SSL certificate issued by the SSL certificate issuing authority is saved in the certificate lifecycle management module.

[0025] In an implementation of the first aspect, the method further includes:

[0026] Receiving a certificate update command from the certificate cycle management module;

[0027] A certificate deployment request is issued to the certificate lifecycle management module based on the certificate update command.

[0028] In a second aspect, the present application provides an SSL certificate automatic deployment device, the device comprising a deployment component and a certificate lifecycle management module: the deployment component is configured to:

[0029] Check the configuration information;

[0030] If the configuration information is complete, a certificate deployment request is sent to the certificate cycle management module, so that the certificate cycle management module verifies the certificate deployment request to return the latest SSL certificate; the certificate deployment request includes the configuration information and the private key signature data of the local SSL certificate;

[0031] Determine whether the latest SSL certificate is the same as the local SSL certificate;

[0032] If they are the same, the deployment is terminated; if they are not the same, the certificate deployment parameters are verified, and if the verification passes, the latest SSL certificate and the private key of the latest SSL certificate are deployed to the target server.

[0033] In a third aspect, the present application provides an electronic device comprising: one or more processors; and one or more memories, wherein the memories store computer-readable codes, and when the computer-readable codes are executed by the one or more processors, the automated SSL certificate deployment method as described above is implemented.

[0034] In a fourth aspect, the present application provides a computer-readable storage medium having instructions stored thereon, which, when executed by a processor, causes the processor to execute the SSL certificate automated deployment method as described.

[0035] As described above, the SSL certificate automatic deployment method, device, electronic device and storage medium described in this application have the following beneficial effects:

[0036] This application can regularly obtain the latest SSL certificates from the certificate lifecycle management system and automatically deploy them. The certificate lifecycle management system can communicate with multiple certificate authorities and support obtaining SSL certificates issued by multiple certificate authorities. When the client's SSL certificate product needs to be re-planned, the brand and type of the SSL certificate can be adjusted directly from the certificate lifecycle management system without the client having to apply again and without modifying the client's configuration. In addition, this application performs a variety of compliance checks during the process of updating and deploying SSL certificates, thereby improving the security of the deployment. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 Shown is a structural schematic diagram of an embodiment of the SSL certificate automatic deployment device described in an embodiment of the present application.

[0038] Figure 2 Shown is a structural schematic diagram of an embodiment of the SSL certificate automatic deployment device described in an embodiment of the present application.

[0039] Figure 3 Shown is a schematic diagram of the principles of a certificate update module in an embodiment of the present application.

[0040] Figure 4 Shown is a schematic diagram of the principles of a certificate update module in an embodiment of the present application.

[0041] Figure 5 Shown is a schematic flow chart of a physiological state regulation method according to an embodiment of the present application.

[0042] Figure 6 Shown is a schematic diagram of the internal structure of an electronic device described in an embodiment of the present application. DETAILED DESCRIPTION

[0043] The following describes the embodiments of the present application through specific examples, and those skilled in the art can easily understand other advantages and effects of the present application from the contents disclosed in this specification. The present application can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present application. It should be noted that the following embodiments and features in the embodiments can be combined with each other without conflict.

[0044] It should be noted that the illustrations provided in the following embodiments are only schematic illustrations of the basic concept of the present application, and thus the drawings only show components related to the present application rather than being drawn according to the number, shape and size of components in actual implementation. In actual implementation, the type, quantity and proportion of each component may be changed at will, and the component layout may also be more complicated.

[0045] In addition, in this application, descriptions such as "first", "second", etc. are only used for descriptive purposes and cannot be understood as indicating or implying their relative importance or implicitly indicating the number of technical features indicated. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In addition, the technical solutions between the various embodiments can be combined with each other, but they must be based on the ability of ordinary technicians in this field to implement them. When the combination of technical solutions is contradictory or cannot be implemented, it should be deemed that such combination of technical solutions does not exist and is not within the scope of protection required by this application.

[0046] An SSL certificate (Secure Sockets Layer certificate) is a digital certificate used to encrypt and protect Web communications. It ensures that sensitive information (such as passwords, credit card numbers, personal data, etc.) transmitted on the Internet remains secure and private. When an SSL certificate needs to be deployed, the applicant selects the correct certificate type according to the usage scenario, such as a single-domain certificate, a multi-domain certificate, etc., and sends the generated certificate signing request (including identity information such as domain names and public keys) to the corresponding certificate authority (CA). At this point, the CA will verify the identity of the applicant. Once the applicant's identity is verified, the CA will create an SSL certificate for it, which includes the public key and identity information in the certificate signing request. And in order to ensure that the SSL certificate is trusted, the CA will use its own private key to issue the SSL certificate and provide it to the applicant to guarantee the authenticity of the SSL certificate.

[0047] When the applicant receives the SSL certificate, he needs to install the SSL certificate and the corresponding private key on the Web server, and modify the server configuration file to specify the installation location of the SSL certificate. After the installation is complete, it is necessary to ensure that the SSL certificate is configured correctly. Then when the user visits the website, the user's browser will verify the SSL certificate. If the verification is successful, the user's browser will believe that the website is safe and can start secure communication. For example, the information entered by the user will be encrypted using the website's public key and then securely sent to the server. The server uses the private key corresponding to the SSL certificate to decrypt the information to achieve secure communication.

[0048] However, SSL certificates usually have an expiration date, and applicants need to pay attention to the expiration date of SSL certificates and whether there are new SSL certificates to be updated. If there is an SSL certificate to be updated, the applicant needs to apply for renewal and reinstall the updated SSL certificate. This means that every time the certificate is updated, the applicant needs to apply for an SSL certificate from the CA again and modify the server configuration file again to install the certificate to the target server. Therefore, the existing technology lacks real-time monitoring of the certificate deployment status and automatic deployment and update mechanism, which brings cost and efficiency issues to the deployment and management of SSL certificates.

[0049] In order to at least solve the above-mentioned technical problems, the embodiments of the present application provide a method, device, electronic device and storage medium for automatic deployment of SSL certificates, which can regularly obtain the latest SSL certificates from the certificate lifecycle management system and automatically deploy them. The certificate lifecycle management system can communicate with multiple certificate authorities and support the acquisition of SSL certificates issued by multiple certificate authorities. When the SSL certificate product needs to be re-planned, the brand and type of the SSL certificate can be adjusted directly from the certificate lifecycle management system without the need for the client to apply again and without modifying the client configuration. In addition, in the process of updating and deploying SSL certificates, the present application performs a variety of compliance checks to improve the security of the deployment.

[0050] Figure 1 The structure diagram of the SSL certificate automatic deployment device provided by the embodiment of the present application is shown. Figure 1 As shown, the SSL certificate automatic deployment device 1 includes a deployment component 11 and a certificate cycle management module 12.

[0051] The deployment component 11 is configured to check the configuration information of the certificate deployment; if the configuration information is complete, send a certificate deployment request to the certificate lifecycle management system, so that the certificate lifecycle management system verifies the certificate deployment request to return the latest SSL certificate and the private key of the latest SSL certificate; the certificate deployment request includes the configuration information and the private key signature data of the local SSL certificate; determine whether the latest SSL certificate is the same as the local SSL certificate; if they are the same, end the deployment; if they are not the same, verify the certificate deployment parameters, and if the verification passes, deploy the latest SSL certificate and the private key of the latest SSL certificate to the target server.

[0052] The configuration information of the certificate deployment refers to the service content that must be obtained before the deployment component 11 performs certificate deployment. That is, before starting the deployment, it is necessary to set the related services that need to deploy the SSL certificate, and the deployment component 11 can only start the deployment after obtaining the service information. In some embodiments, the configuration information includes subscription parameters, service name, target server type, and service listening port parameters.

[0053] In some embodiments, the subscription parameter identifies the life cycle of the SSL certificate and can be obtained from the back end of the certificate life cycle management module 12 to obtain whether there is a new SSL certificate in the certificate life cycle management system.

[0054] In some embodiments, the service name includes a domain name or an IP address, which is obtained from the target server configuration.

[0055] In some embodiments, the target server type supports iis and other, iis is the iis server under window, and other is other types of servers, such as: Nginx, Apache, etc.

[0056] In some embodiments, the service listening port parameter is the port number of the service listening, which refers to the network port used by an application or service on the target server to receive client requests, that is, the client communicates with the target server through this port. The service listening port parameter is obtained from the target server configuration.

[0057] In fact, the service name, the target server type and the service listening port parameters are used to obtain the service address and port of the latest SSL certificate to be deployed. That is, since users need to obtain the server's SSL certificate when accessing a website, when deploying the SSL certificate, it is necessary to clarify the service name, the target server type and the service listening port, so that after obtaining the latest SSL certificate, it can be deployed in the correct location, so that the client can successfully obtain and verify the SSL certificate deployed on the target server when communicating with the server.

[0058] In some embodiments, you can also choose to complete the following configuration information, including the certificate path, certificate chain path, private key path, and the commands that need to be executed by the server to load the configuration.

[0059] When configuring the target server, you usually need to specify the location of the SSL certificate file (.crt or .pem format) and the private key file (.key format). The certificate chain path refers to the path of all related certificates in the SSL certificate, including the complete chain from the server certificate (public key certificate) to the root certificate. The purpose of the certificate chain is to connect the server certificate to the trusted root certificate through the intermediate certificate to ensure that the client can verify the identity of the target server.

[0060] After the deployment component 11 checks the above configuration information, it sends a certificate deployment request to the certificate cycle management module 12. After the certificate cycle management module 12 receives the certificate deployment request, the certificate cycle management module 12 verifies the certificate deployment request using the public key. Since the certificate deployment request contains the private key signature data of the local SSL certificate, the certificate cycle management module 12 will verify the private key signature data after receiving the certificate deployment request, that is, determine the identity of the deployment component 11 to ensure the security of SSL certificate deployment.

[0061] When the verification is passed, the certificate cycle management module 12 returns the latest stored SSL certificate to the deployment component 11. Further, when the deployment component 11 detects that the configuration information is incomplete, it will stop deploying the SSL certificate to avoid certificate deployment or configuration errors.

[0062] When the deployment component 11 receives the latest SSL certificate returned, it determines whether the latest SSL certificate returned is the same as the local SSL certificate. If they are the same, it means that the local SSL certificate currently deployed is the latest and there is no need to update the deployment. If they are not the same, it is necessary to update and deploy the latest SSL certificate and the private key of the latest SSL certificate to the target server.

[0063] Furthermore, when the deployment component 11 determines that the returned latest SSL certificate is different from the local SSL certificate, the deployment component 11 verifies the certificate deployment parameters, and if the verification passes, deploys the latest SSL certificate and the private key of the latest SSL certificate to the target server.

[0064] The deployment component 11 verifies the certificate deployment parameters including:

[0065] Verify whether the service name is included in the service address protection range of the latest SSL certificate;

[0066] Verify that the validity period of the latest SSL certificate is available;

[0067] Verify that the certificate chain of the latest SSL certificate is complete;

[0068] Verify whether the latest SSL certificate matches the corresponding private key.

[0069] Among them, verifying whether the service name is included in the service address protection range of the latest SSL certificate means that the deployment component 11 checks whether the domain name or IP required by the service is included in the certificate SAN. The certificate SAN is an extension field in the SSL certificate, which is used to specify other DNS names (such as domain names, IP addresses, email addresses, etc.) supported by the SSL certificate. It allows an SSL certificate to be applicable not only to a single domain name (CN, Common Name), but also to multiple different domain names or IP addresses, thereby increasing the flexibility and scope of application of the certificate.

[0070] Among them, verifying whether the latest SSL certificate matches the corresponding private key means that after receiving the latest SSL certificate and the corresponding private key, the deployment component 11 uses the public key in the SSL certificate to verify the private key, and determines whether the latest SSL certificate is a certificate issued by a trusted CA, thereby ensuring the security of the certificate.

[0071] In some embodiments, when the local SSL certificate does not exist, that is, the SSL certificate has never been deployed on the target server, the deployment component 11 uses the SSL certificate returned by the certificate lifecycle management system 12 as the local SSL certificate, and saves the local SSL certificate and the corresponding private key on the target server.

[0072] That is, the deployment component 11 in the embodiment of the present application can not only deploy the SSL certificate on the server for the first time, but also update the SSL certificate on the target server in real time. When the SSL certificate has not been deployed on the target server, the deployment component 11 uses the SSL certificate returned by the certificate cycle management system as the local SSL certificate, and saves the local SSL certificate and the corresponding private key on the target server. In addition, the deployment component 11 will always monitor the health status of the local SSL certificate, and when an update is required, the deployment component 11 will send a certificate deployment request to the certificate cycle management system 112 to obtain the latest SSL certificate and the corresponding private key, and deploy them on the target server.

[0073] Furthermore, when the deployment is completed, the deployment component 11 is also configured to: regularly detect the SSL certificate status on the target server; when it is detected that the SSL certificate status is in an unhealthy state, send an alarm to the certificate cycle management module 12, so that the certificate cycle management module 12 performs processing according to the early warning configuration.

[0074] For example, the deployment component 11 regularly (hourly or daily) detects the status of the SSL certificate deployed on the target server, including checking the validity period of the SSL certificate, the integrity of the certificate chain, and accessing the target server HTTPS port to verify the validity of the SSL handshake.

[0075] Among them, the validity of the SSL handshake means that when the client and the target server establish a secure connection, the client checks whether the SSL certificate installed on the target server is expired, revoked, issued by a trusted root certificate, and whether the domain name (CN or SAN field) in the certificate matches the domain name of the connection, that is, effectively verifies the identity of the target server.

[0076] In some embodiments, the certificate lifecycle management module 12 can be connected to multiple CAs to support integrated management of different certificate issuing authorities. That is, the certificate lifecycle management module 12 sends a certificate signing request to an SSL certificate issuing authority (CA) to obtain an SSL certificate issued by the SSL certificate issuing authority, and saves the SSL certificate issued by the SSL certificate issuing authority to the certificate lifecycle management module 12.

[0077] In some embodiments, the certificate lifecycle management module 12 has multiple units that interact with CA services. For example, each CA (such as Let's Encrypt, DigiCert, etc.) corresponds to a unit to manage the application and verification of SSL certificates. And multiple units can support different certificate application protocols, such as ACME (for Let's Encrypt) and traditional CSR (for other CAs). As a result, the certificate lifecycle management module 12 can obtain SSL certificates issued by multiple CAs and store them securely. In addition, the certificate lifecycle management module 12 records all operation logs and provides audit functions to ensure system security and compliance.

[0078] Further, when the certificate cycle management module 12 obtains the latest SSL certificate from the CA, the subscription parameters of its backend will be updated and a certificate update command will be pushed. Then, after receiving the certificate update command pushed by the certificate cycle management module 12, the deployment component 11 will issue a certificate deployment request to the certificate cycle management system based on the certificate update command. In other embodiments, the deployment component 11 may also periodically send a certificate deployment request to the certificate cycle management module 12.

[0079] In some other embodiments, the deployment component 11 may be divided into different modules to jointly implement various functions of the deployment component 11 . Figure 2 Shown is a schematic diagram of the structure of an SSL certificate automatic deployment device provided by another embodiment of the present application. Figure 2 As shown, the SSL certificate automatic deployment device 1 includes a certificate lifecycle management module 12 , a certificate monitoring module 102 , a certificate updating module 103 and a service module 104 .

[0080] In some embodiments, the certificate lifecycle management module 12 is deployed on a dedicated server and provides a Web management interface and an API.

[0081] In some embodiments, the certificate monitoring module 102 is installed on a target server or on a hardware device that can access the target server and the certificate lifecycle management module 12, and is used to detect the certificate status.

[0082] In some embodiments, the certificate update module 103 and the service module 104 are deployed on a target server and can communicate with the certificate lifecycle management module 12. In some other embodiments, the certificate update module 103 and the service module 104 can be integrated into a hardware device.

[0083] Among them, the user can log in to the certificate life cycle management module 12, select the SSL certificate and enter the necessary information, such as the domain name (for example: example.com) and the certificate type (such as DV certificate), and the certificate life cycle management module 12 generates a certificate signing request based on this and sends it to the SSL certificate authority through the corresponding API interface. After obtaining the SSL certificate issued by the SSL certificate authority, the certificate life cycle management module 12 stores it securely.

[0084] Figure 3 The diagram is a schematic diagram showing the working principle of the certificate update module 103. Figure 3 As shown, the certificate update module 103 checks the configuration information. If the configuration information is complete, the certificate update module 103 sends a certificate deployment request to the certificate cycle management module 12, and the certificate deployment request includes the configuration information and the private key signature data of the local SSL certificate. The certificate cycle management module 12 verifies the private key in the certificate deployment request. When the verification is passed, it returns the latest stored SSL certificate and the corresponding private key to the certificate update module 103. At this time, the certificate update module 103 determines whether there is a local SSL certificate. When the local SSL certificate does not exist, the certificate update module 103 uses the SSL certificate returned by the certificate cycle management module 12 as the local SSL certificate, and saves the local SSL certificate and the corresponding private key to the target server, thereby realizing the first deployment of the SSL certificate. If the local SSL certificate exists, the certificate update module 103 determines whether the latest SSL certificate is the same as the local SSL certificate. If they are the same, the update deployment is not repeated. If they are not the same, the certificate update module 103 deploys the latest SSL certificate and the private key of the latest SSL certificate to the target server, thereby realizing the automatic update deployment of the SSL certificate.

[0085] Furthermore, Figure 4 The schematic diagram shows the principle of the certificate update module 103 acquiring and deploying the SSL certificate. Figure 4As shown, the certificate update module 103 records the current time, backup and rollback, and then sends a certificate deployment request to the certificate cycle management module 12. The certificate cycle management module 12 verifies the private key in the certificate deployment request. When the verification is passed, the latest stored SSL certificate and the corresponding private key are returned to the certificate update module 103. At this time, the certificate update module 103 determines whether the latest SSL certificate is the same as the local SSL certificate; if not, it checks whether the service name is included in the service address protection range of the latest SSL certificate; if so, it verifies whether the validity period of the latest SSL certificate is available; if available, it verifies whether the certificate chain of the latest SSL certificate is complete; if complete, it verifies whether the latest SSL certificate matches the corresponding private key; if they match, the certificate update module 103 will back up the local SSL certificate and the corresponding private key, and deploy the latest SSL certificate and the corresponding private key on the target server (for example: / etc / nginx / conf.d / example.com / ssl / ) after the backup. Afterwards, the certificate update module 103 will determine whether the service needs to be restarted to ensure that the latest SSL certificate is effective on the target server.

[0086] Further, the certificate update module 103 periodically sends a certificate deployment request to the certificate cycle management module 12 to download the latest SSL certificate, or after receiving the certificate update command from the certificate cycle management module 12, the service module 104 actively calls the certificate update module 103 to send a certificate deployment request to the certificate cycle management module 12. That is, the service module 104 interacts with the certificate cycle management module 12, receives the certificate update command from the certificate cycle management module 12, and calls the certificate update module 103 to send a certificate deployment request to the certificate cycle management module 12 to perform update deployment of the SSL certificate.

[0087] It should be noted that, as mentioned above, the certificate update module 103 and the service module 104 can be integrated. Then the certificate update module 103 can receive the certificate update command of the certificate cycle management module 12, and send a certificate deployment request to the certificate cycle management module 12 based on the command.

[0088] Further, when the local SSL certificate does not exist, the certificate updating module 103 uses the SSL certificate returned by the certificate lifecycle management module 12 as the local SSL certificate, and saves the local SSL certificate and the corresponding private key on the target server.

[0089] That is, the certificate update module 103 provided in the embodiment of the present application can periodically obtain the latest SSL certificate and deploy it on the target server to realize the automatic update deployment of the SSL certificate. Moreover, when performing certificate update deployment, the certificate update module 103 does not need to configure the target server again, but only needs to check whether the previous configuration information is complete, which greatly improves the deployment and update efficiency of the SSL certificate and realizes the centralized management of the certificate.

[0090] Furthermore, the certificate monitoring module 102 periodically detects the SSL certificate status on the target server; when it is detected that the SSL certificate status is in an unhealthy state, an alarm is sent to the certificate cycle management module 12, so that the certificate cycle management module 12 performs processing according to the early warning configuration.

[0091] The above-mentioned embodiment of the present application provides an SSL certificate automatic deployment device, which can implement the SSL certificate automatic deployment method described in the embodiment of the present application. However, the implementation device of the SSL certificate automatic deployment device described in the present application includes but is not limited to the structure of the SSL certificate automatic deployment device listed in the embodiment. All structural deformations and replacements of the prior art made according to the principles of the present application are included in the protection scope of the present application.

[0092] The following embodiments of the present application provide a method for automatic deployment of SSL certificates, which can be applied to Figure 1 or Figure 2 The SSL certificate automatic deployment device shown. However, it should be noted that Figure 1 or Figure 2 The above is provided as an example only. In fact, the present application does not impose any restrictions on the execution subject of some or all steps in the SSL certificate automatic deployment method described in the following embodiments of the present application.

[0093] Figure 5 The flowchart of the SSL certificate automatic deployment method described in the embodiment of the present application is shown as follows: Figure 5 As shown, the SSL certificate automatic deployment method includes steps S1 to S5.

[0094] S1. Check the configuration information.

[0095] Specifically, the configuration information includes subscription parameters, service name, target server type and service listening port parameters.

[0096] The subscription parameter is used to obtain whether there is a new SSL certificate in the certificate cycle management module, and can be obtained from the back end of the certificate cycle management module.

[0097] The service name, the target server type and the service listening port parameters are used to obtain the service address and port of the latest SSL certificate to be deployed.

[0098] S2. If the configuration information is complete, a certificate deployment request is sent to the certificate lifecycle management module, so that the certificate lifecycle management module verifies the certificate deployment request to return the latest SSL certificate and the private key of the latest SSL certificate.

[0099] The certificate deployment request includes the configuration information and private key signature data of the local SSL certificate.

[0100] S3. Determine whether the returned latest SSL certificate is the same as the local SSL certificate.

[0101] S4. If they are the same, end the deployment.

[0102] S5. If they are not the same, verify the certificate deployment parameters. If the verification passes, deploy the latest SSL certificate and the private key of the latest SSL certificate to the target server.

[0103] Specifically, verify whether the service name is included in the service address protection range of the latest SSL certificate;

[0104] Verify that the validity period of the latest SSL certificate is available;

[0105] Verify that the certificate chain of the latest SSL certificate is complete;

[0106] Verify whether the latest SSL certificate matches the corresponding private key.

[0107] Furthermore, when the local SSL certificate does not exist, the SSL certificate returned by the certificate lifecycle management module is used as the local SSL certificate, and the local SSL certificate and the corresponding private key are saved on the target server.

[0108] Furthermore, the SSL certificate status on the target server is detected regularly; when it is detected that the SSL certificate status is in an unhealthy state, an alarm is sent to the certificate life cycle management module, so that the certificate life cycle management module processes according to the early warning configuration.

[0109] Furthermore, a certificate signing request is sent to an SSL certificate issuing authority through the certificate lifecycle management module to obtain an SSL certificate issued by the SSL certificate issuing authority; and the SSL certificate issued by the SSL certificate issuing authority is saved in the certificate lifecycle management module.

[0110] Further, a certificate update command from the certificate cycle management module is received; and a certificate deployment request is issued to the certificate cycle management module based on the certificate update command.

[0111] The protection scope of the sleep regulation method described in the embodiment of the present application is not limited to the execution order of the steps listed in the present embodiment. All solutions implemented by adding, reducing or replacing steps in the prior art based on the principles of the present application are included in the protection scope of the present application.

[0112] This application can automatically deploy the latest SSL certificate to the target server and centrally manage SSL certificates without the need for clients to repeatedly request updates or reconfigure parameters for SSL certificate deployment. This application can monitor and automatically update SSL certificates in real time, reducing the cost of deploying and updating SSL certificates. In addition, this application can communicate with multiple certificate authorities and support obtaining SSL certificates issued by multiple certificate authorities.

[0113] In the several embodiments provided in the present application, it should be understood that the disclosed system, device or method can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of modules / units is only a logical function division. There may be other division methods in actual implementation, such as multiple modules or units can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or modules or units, which can be electrical, mechanical or other forms.

[0114] The modules / units described as separate components may or may not be physically separated, and the components displayed as modules / units may or may not be physical modules, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules / units may be selected according to actual needs to achieve the purpose of the embodiments of the present application. For example, the functional modules / units in the various embodiments of the present application may be integrated into one processing module, or each module / unit may exist physically separately, or two or more modules / units may be integrated into one module / unit.

[0115] Those of ordinary skill in the art should further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0116] An embodiment of the present application also provides a wearable device, including: one or more processors; and one or more memories, wherein the memories store computer-readable codes, and when the computer-readable codes are executed by the one or more processors, the functions of the bio-health system as described above are implemented.

[0117] The wearable device can be used with the help of Figure 6 The exemplary computing device architecture shown in FIG. Figure 6 As shown, the exemplary computing device may include a bus 910, one or more CPUs 920, a read-only memory (ROM) 930, a random access memory (RAM) 940, a communication port 950 connected to a network, an input / output component 960, a hard disk 970, etc. The storage device in the computing device 900, such as the ROM 930 or the hard disk 970, may store various data or files used for computer processing and / or communication and program instructions executed by the CPU. The computing device 900 may also include a user interface 980. Of course, Figure 6 The architecture shown is only exemplary and can be omitted according to actual needs when implementing different devices. Figure 6 One or more components of a computing device are shown.

[0118] The embodiment of the present application also provides a computer-readable storage medium, on which instructions are stored, and when the instructions are executed by the processor, the processor executes the physiological state regulation method as described in the present application. A person of ordinary skill in the art can understand that all or part of the steps in the method for implementing the above embodiment can be executed by computer-readable instructions stored on a computer-readable storage medium. Computer-readable storage media include, but are not limited to, for example, volatile memory and / or non-volatile memory. Volatile memory may include, for example, random access memory (RAM) and / or cache memory (cache), etc. Non-volatile memory may include, for example, read-only memory (ROM), hard disk, flash memory, etc.

[0119] The present application also provides a computer program product or a computer program, which includes computer-readable instructions stored in a computer-readable storage medium. The processor of the computer device can read the computer-readable instructions from the computer-readable storage medium, and the processor executes the computer-readable instructions, so that the computer device performs the physiological state regulation method described in each of the above embodiments.

[0120] The descriptions of the processes or structures corresponding to the above-mentioned figures have different emphases. For parts that are not described in detail in a certain process or structure, please refer to the relevant descriptions of other processes or structures.

[0121] The above embodiments are merely illustrative of the principles and effects of the present application and are not intended to limit the present application. Anyone familiar with the technology may modify or change the above embodiments without violating the spirit and scope of the present application. Therefore, all equivalent modifications or changes made by a person of ordinary skill in the art without departing from the spirit and technical ideas disclosed in the present application shall still be covered by the claims of the present application.

Claims

1. A method for automatic deployment of SSL certificates, characterized in that: The method comprises: Check the configuration information of certificate deployment; If the configuration information is complete, a certificate deployment request is sent to the certificate lifecycle management system, so that the certificate lifecycle management system verifies the certificate deployment request to return the latest SSL certificate and the private key of the latest SSL certificate; the certificate deployment request includes the configuration information and the private key signature data of the local SSL certificate; Determine whether the returned latest SSL certificate is the same as the local SSL certificate; If they are the same, the deployment ends; If they are not the same, the certificate deployment parameters are verified, and if the verification passes, the latest SSL certificate and the private key of the latest SSL certificate are deployed to the target server.

2. The SSL certificate automatic deployment method according to claim 1, characterized in that: The method comprises: When the local SSL certificate does not exist, the SSL certificate returned by the certificate lifecycle management system is used as the local SSL certificate, and the local SSL certificate and the corresponding private key are saved on the target server.

3. The SSL certificate automatic deployment method according to claim 1, characterized in that: The configuration information includes subscription parameters, service name, target server type and service listening port parameters; The subscription parameter is used to obtain whether there is a new SSL certificate in the certificate lifecycle management system; The service name, the target server type and the service listening port parameters are used to obtain the service address and port of the latest SSL certificate to be deployed.

4. The SSL certificate automatic deployment method according to claim 3, characterized in that: Verify that the certificate deployment parameters include: Verify whether the service name is included in the service address protection range of the latest SSL certificate; Verify that the validity period of the latest SSL certificate is available; Verify that the certificate chain of the latest SSL certificate is complete; Verify whether the latest SSL certificate matches the corresponding private key.

5. The SSL certificate automatic deployment method according to claim 1, characterized in that: The method further comprises: Regularly detect the SSL certificate status on the target server; When it is detected that the SSL certificate is in an unhealthy state, an alarm is sent to the certificate life cycle management system, so that the certificate life cycle management system performs processing according to the early warning configuration.

6. The SSL certificate automatic deployment method according to claim 1, characterized in that: The method further comprises: Sending a certificate signing request to an SSL certificate issuing authority through the certificate cycle management system to obtain an SSL certificate issued by the SSL certificate issuing authority; The SSL certificate issued by the SSL certificate issuing authority is saved in the certificate lifecycle management system.

7. The SSL certificate automatic deployment method according to claim 1, characterized in that: The method further comprises: Receiving a certificate update command from the certificate lifecycle management system; The certificate deployment request is issued to the certificate lifecycle management system based on the certificate update command.

8. An automatic deployment device for SSL certificates, characterized in that: The device includes a deployment component and a certificate cycle management system: the deployment component is configured to: Check the configuration information; If the configuration information is complete, a certificate deployment request is sent to the certificate lifecycle management system, so that the certificate lifecycle management system verifies the certificate deployment request to return the latest SSL certificate; The certificate deployment request includes the configuration information and private key signature data of the local SSL certificate; Determine whether the latest SSL certificate is the same as the local SSL certificate; If they are the same, the deployment ends; If they are not the same, the certificate deployment parameters are verified, and if the verification passes, the latest SSL certificate and the private key of the latest SSL certificate are deployed to the target server.

9. An electronic device, characterized in that: include: one or more processors; and One or more memories, wherein the memories store computer-readable codes, and when the computer-readable codes are executed by the one or more processors, the method for automatic deployment of SSL certificates as described in any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores instructions, and when the instructions are executed by the processor, the processor executes the SSL certificate automatic deployment method according to any one of claims 1 to 7.

Images