SSL certificate management method, system, medium, and electronic device based on heterogeneous CA environment

Abstract

The present invention provides an SSL certificate management method, system, medium, and electronic device based on a heterogeneous CA environment, wherein the system includes: a multi-CA adaptation module for interacting with a target CA system; a security audit module for encrypting and storing the SSL certificate; an automated management module for obtaining the SSL certificate from the security audit module and realizing automated distribution and lifecycle management of the SSL certificate; an integration module for deploying the SSL certificate to a Web server, a load balancer, a cloud asset, or a cloud service based on the automated management module; and a monitoring module for monitoring the SSL certificate and issuing an alarm when the SSL certificate is abnormal. The SSL certificate management method, system, medium, and electronic device based on a heterogeneous CA environment of the present invention can realize unified management of SSL certificates in a multi-CA environment, and improve management efficiency and security of the entire lifecycle of SSL certificates.

Description

Technical Field

[0001] The present invention belongs to the technical field of network communication security, and relates to an SSL (Secure Socket Layer) certificate management method, system, storage medium and electronic equipment based on a heterogeneous Certificate Authority (CA) environment. Background Art

[0002] SSL certificate is issued by a trusted digital certificate authority after verifying the server's identity in compliance with the SSL protocol. It has server identity authentication and data transmission encryption functions. SSL certificate authenticates the user and server by establishing an SSL secure channel (Secure socket layer, SSL) between the client browser and the Web server, encrypts and hides the transmitted data to ensure that the data is not changed during transmission, that is, the integrity of the data.

[0003] With the development of the Internet and corporate intranets, SSL / TLS (Transport Layer Security) certificates have become an important tool for protecting network communication security and are widely used in encrypted communications for websites, application services, load balancers, and API interfaces. However, current SSL certificate management methods have the following shortcomings:

[0004] 1) There are many types of CAs and the interface protocols are not unified;

[0005] 2) There are a large number of public CA certificates and self-signed certificates within the enterprise that are not properly managed or are managed inefficiently;

[0006] 3) Lack of unified monitoring and exception handling;

[0007] 4) The internal system environment and network environment of the enterprise are too complex, resulting in difficulty in integration, chaotic management, and low degree of automation; 6) The issuance and operation logs are missing, or the logs are not audited, resulting in key leakage and property loss. Summary of the invention

[0008] The present invention provides an SSL certificate management method, system, medium, and electronic device based on a heterogeneous CA environment, which can realize unified management of SSL certificates in a multi-CA environment and effectively improve the management efficiency and security of the entire life cycle of SSL certificates.

[0009] In the first aspect, the present invention provides an SSL certificate management system based on a heterogeneous CA environment, the system comprising: a multi-CA adaptation module, used to interact with a target CA system to apply for, verify, issue, renew and revoke SSL certificates; a security audit module, used to encrypt and store the SSL certificates; an automated management module, used to obtain the SSL certificates from the security audit module, and to implement automated distribution and lifecycle management of the SSL certificates; an integration module, used to deploy the SSL certificates to a Web server, load balancer, cloud asset or cloud service based on the automated management module; a monitoring module, used to monitor the SSL certificates and issue an alarm when the SSL certificates are abnormal.

[0010] In an implementation of the first aspect, the multi-CA adaptation module includes a CA adapter, and the CA adapter is used to adapt multiple types of CA systems to interact with the target CA system; the multiple types of CA systems include public CA systems and private CA systems.

[0011] In an implementation of the first aspect, the user applying for an SSL certificate based on the multi-CA adaptation module includes the following steps:

[0012] The digital certificate registration center generates an SSL certificate number based on the SSL certificate type selected by the user;

[0013] The multi-CA adapter dynamically generates an application template according to the SSL certificate number;

[0014] The digital certificate registration center reviews the application information input by the user based on the application model;

[0015] The digital certificate registration center receives a certificate application file, the certificate application file is provided by the user or provided by the key management center according to the user's request; the certificate application file provided by the key management center also includes a key set by the user;

[0016] When the certificate application document includes the key, the digital certificate registration center uses the private key to encrypt the key based on the SM4 symmetric encryption algorithm;

[0017] The multi-CA adaptation module provides the SSL certificate code, the certificate application file provided by the digital certificate registration center, and the application information to a matching CA system;

[0018] The matching CA system generates an SSL certificate, and the digital certificate registration certificate provides the SSL certificate to the user; when the certificate application file includes a key, the private key is also provided to the user.

[0019] In an implementation of the first aspect, the security audit module is also used to record the operator behavior log, and desensitize and asymmetrically encrypt the operator behavior log for storage; when an abnormal operation is detected based on the operator behavior log, an alarm message is issued.

[0020] In an implementation of the first aspect, the lifecycle management includes application, renewal, distribution, revocation and deployment of the SSL certificate.

[0021] In an implementation of the first aspect, the monitoring module monitoring the SSL certificate includes the following steps:

[0022] Setting a monitoring detector, wherein the monitoring detector is used to monitor the SSL certificate;

[0023] Setting a deployment location of the monitoring detector, wherein the deployment location is a Web server, a load balancer, a cloud asset, or a cloud service;

[0024] Set the number information of the monitored SSL certificate;

[0025] Setting a scanning mode, wherein the scanning mode includes manual scanning or periodic scanning;

[0026] Based on the monitoring detector, the scanning method is used to monitor the SSL certificate, the deployment information of the SSP certificate is obtained, and the deployment information is provided to the monitoring service, so that the monitoring service generates a monitoring report according to the deployment information.

[0027] In an implementation of the first aspect, the monitoring module further includes:

[0028] SSL certificate filtering module, used to set the SSL certificate type, certificate brand and intermediate root certificate targeted by compliance rules;

[0029] The compliance rule setting module is used to set the compliance rules; the compliance rules include one or more combinations of certificate brand, intermediate root certificate, certificate issuing company name, certificate encryption algorithm, certificate signing algorithm, and protocols supported by the certificate.

[0030] In a second aspect, the present invention provides an SSL certificate management method based on a heterogeneous CA environment, the method comprising the following steps:

[0031] Interact with the target CA system based on the multi-CA adaptation module to apply for, verify, issue, renew and revoke SSL certificates;

[0032] Encrypting and storing the SSL certificate based on a security audit module;

[0033] Obtaining the SSL certificate from the security audit module based on the automation management module, and implementing automated distribution and lifecycle management of the SSL certificate;

[0034] Calling the automation management module based on the integration module to deploy the SSL certificate to a web server, a load balancer, a cloud asset or a cloud service;

[0035] The SSL certificate is monitored based on a monitoring module, and an alarm is issued when the SSL certificate is abnormal.

[0036] In a third aspect, the present invention provides a storage medium having a computer program stored thereon, which, when executed by a processor, implements the above-mentioned SSL certificate management method based on a heterogeneous CA environment.

[0037] In a fourth aspect, the present invention provides an electronic device, comprising: a processor and a memory;

[0038] The memory is configured to store a computer program;

[0039] The processor is configured to execute the computer program stored in the memory so that the electronic device executes the above-mentioned SSL certificate management method based on a heterogeneous CA environment.

[0040] As described above, the SSL certificate management method, system, medium, and electronic device based on a heterogeneous CA environment described in the present invention have the following beneficial effects:

[0041] (1) It can manage SSL certificates of all CA systems in one stop and support flexible expansion of new CA systems. It can adapt to multiple CA systems by uniformly adapting to the ACME interface and API of different CA systems, avoiding locking in a single supplier and reducing dependence on a single CA.

[0042] (2) Supports personalized compliance, alarm strategies and extensions to meet the complex audit requirements of various industries for the system, and ensures the security of data storage and transmission through exception analysis and data encryption;

[0043] (3) It realizes the comprehensive automation and closed-loop management of SSL certificate management, significantly improving cross-platform adaptability; it simplifies the certificate lifecycle management in heterogeneous CA environments and efficiently adapts to complex scenarios;

[0044] (4) Through plug-in and modular design, the efficiency of SSL certificate distribution and deployment is improved, and the process from application to deployment is shortened from minutes to seconds, which meets the needs of high-frequency updates;

[0045] (5) It solves the performance bottleneck problem of monitoring services and ensures performance stability in high-concurrency scenarios. The monitoring and detection services can be distributed in different network environments and different systems, while providing a unified monitoring platform to achieve unified management in complex environments, greatly reducing management complexity and operation and maintenance costs. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 Shown is a schematic diagram of a scene of an electronic device of the present invention in an embodiment;

[0047] Figure 2 Shown is a schematic diagram of the structure of an SSL certificate management system based on a heterogeneous CA environment in one embodiment of the present invention;

[0048] Figure 3 Shown is a schematic diagram of an application scenario of a multi-CA adapter of the present invention in one embodiment;

[0049] Figure 4 Shown is a flow chart of an SSL certificate management method based on a heterogeneous CA environment in one embodiment of the present invention;

[0050] Figure 5 It is a schematic structural diagram of an electronic device of the present invention in one embodiment. DETAILED DESCRIPTION

[0051] The following describes the embodiments of the present invention by specific examples, and those skilled in the art can easily understand other advantages and effects of the present invention from the contents disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present invention. It should be noted that the following embodiments and features in the embodiments can be combined with each other without conflict.

[0052] It should be noted that the illustrations provided in the following embodiments are only schematic illustrations of the basic concept of the present invention, and thus the drawings only show components related to the present invention rather than being drawn according to the number, shape and size of components in actual implementation. In actual implementation, the type, quantity and proportion of each component may be changed arbitrarily, and the component layout may also be more complicated.

[0053] In addition, in the present invention, descriptions such as "first", "second", etc. are only used for descriptive purposes and cannot be understood as indicating or implying their relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In addition, the technical solutions between the various embodiments can be combined with each other, but they must be based on the ability of ordinary technicians in the field to implement them. When the combination of technical solutions is contradictory or cannot be implemented, it should be deemed that such a combination of technical solutions does not exist and is not within the scope of protection required by the present invention.

[0054] The following embodiments of the present invention provide an SSL certificate management system based on a heterogeneous CA environment, which can be applied to Figure 1 The electronic device 1 is integrated with various functional modules for SSL certificate management, and can adapt to the appropriate CA system according to the different SSL certificate requirements of the user end 2, and deploy the SSL certificate to the server 3, while uniformly managing and monitoring the SSL certificate, so as to adapt to a variety of complex application scenarios.

[0055] The technical solutions in the embodiments of the present invention will be described in detail below in conjunction with the accompanying drawings in the embodiments of the present invention.

[0056] like Figure 2 As shown, in one embodiment, the SSL certificate management system based on a heterogeneous CA environment of the present invention includes a multi-CA adaptation module 1, a security audit module 2, an automatic management module 3, an integration module 4 and a monitoring module 5.

[0057] The multi-CA adaptation module 1 is used to interact with the target CA system to apply for, verify, issue, renew and revoke SSL certificates. The multi-CA adaptation module 1 includes a CA adapter (CA Gateway). The CA adapter is used to adapt multiple types of CA systems to interact with the target CA system. In one embodiment, the CA adapter encapsulates interfaces for application, verification, issuance, renewal and revocation of SSL certificates, and uses standard protocols to interact with each CA system through an API, thereby achieving flexible certificate request distribution and redundant design of multiple CAs.

[0058] Preferably, the multiple types of CA systems include public CA systems and private CA systems. Figure 3As shown, the CA adapter can also be divided into a public CA adapter (CA Gateway) and a private CA adapter (PCA Gateway). The public CA adapter and the private CA adapter are matched to public CA systems (such as Sectigo / Digice, CFCA, sslTrus CA, etc.) and private CA systems (such as Microsoft PCA, sslTrus PCA, etc.) respectively.

[0059] In one embodiment, the user applies for an SSL certificate based on the multi-CA adaptation module, including the following steps:

[0060] a) The Registration Authority (RA) generates an SSL certificate number based on the SSL certificate type selected by the user. The user logs in to the RA and selects the SSL certificate type.

[0061] b) The multi-CA adapter dynamically generates an application template according to the SSL certificate number.

[0062] c) The digital certificate registration center reviews the application information input by the user based on the application model.

[0063] d) The digital certificate registration center receives a certificate application document, which is provided by the user or by the key management center according to the user's request; the certificate application document provided by the key management center (Key Management Center, KMC) also includes a key set by the user.

[0064] e) When the certificate application document includes the key, the digital certificate registration center encrypts the key using a private key, wherein the digital certificate registration center encrypts the private key based on the SM4 symmetric encryption algorithm.

[0065] f) The multi-CA adaptation module provides the SSL certificate code, the certificate application file provided by the digital certificate registration center and the application information to the matching CA system.

[0066] g) The matching CA system generates an SSL certificate, and the digital certificate registration certificate provides the SSL certificate to the user; when the certificate application document includes a key, the private key is also provided to the user.

[0067] The security audit module 2 is connected to the multi-CA adaptation module 1, and is used to encrypt and store the SSL certificate. Specifically, the multi-CA adaptation module 1 provides the SSL certificate provided by the CA system to the security audit module 2. The security audit module 2 encrypts and stores the SSL certificate and the private key. An asymmetric encryption algorithm is used for encryption to prevent man-in-the-middle attacks. Preferably, the security audit module 2 is also used to record the operator behavior log, desensitize and asymmetric encrypt the operator behavior log, and back up the log regularly. Operator behavior includes all SSL certificate operations, including application, renewal, revocation and exception handling. The operator behavior log includes detailed information such as operation time, operator, target certificate, etc. When the security audit module 2 detects an abnormal operation based on the operator behavior log, it can issue an alarm message according to the alarm rules.

[0068] The automation management module 3 is connected to the security audit module 2, and is used to obtain the SSL certificate from the security audit module 2, and realize the automatic distribution and life cycle management of the SSL certificate. Specifically, the automation management module 3 provides the automation function of certificate distribution and installation, and is responsible for the life cycle management of the SSL certificate, including application, renewal, distribution, revocation, and deployment. In particular, the automation management module 3 regularly checks the validity of the SSL certificate and automatically renews it, and is integrated with a DNS service provider to support automated DNS verification and HTTP verification. When it is detected that the SSL certificate is about to expire, the automation management module 3 sends an expiration notification to the administrator via email, SMS or instant messaging tools; for CA systems that support the ACME protocol, the automation management module 3 automatically initiates a renewal request; supports users to select certificates for revocation operations through the interface; when key leakage occurs or SSL certificate information needs to be changed, the automation management module 3 quickly applies for a new certificate and updates related configurations.

[0069] The integration module 4 is connected to the automation management module 3, and is used to deploy the SSL certificate to a Web server, a load balancer, a cloud asset or a cloud service (such as Redis, Alibaba Cloud MSQL, Alibaba Cloud MDB, Alibaba Cloud OceanBase-Oracle, Microsoft Cloud Web Application, Microsoft Cloud Application Gateway, etc.) based on the automation management module 3. Specifically, the integration module 4 is based on a plug-in framework and is integrated with common tools (such as Ansible, Jenkins, GitLab CI / CD) to achieve automated deployment of SSL certificates. Preferably, the integration module 4 supports certificate management for common Web servers (such as Nginx, Apache) and load balancers (such as F5). It should be noted that the automation management module 3 has a distribution function for SSL certificates, but it cannot determine the destination of SSL certificate distribution. The integration module 4 is used to determine where the distributed SSL certificates are deployed. Therefore, the automation management module 3 is called by the integration module 4 to complete the deployment after the distribution of the SSL certificate.

[0070] The monitoring module 5 is connected to the automation management module 3, and is used to monitor the SSL certificate and issue an alarm when the SSL certificate is abnormal. Specifically, the monitoring module 5 monitors the usage status of the SSL certificate distributed by the automation management module 3 in real time. Preferably, the monitoring module 5 can also monitor the usage status of the externally provided SSL certificate in real time. The usage status includes revocation status, certificate chain integrity and SSL / TLS handshake status. Among them, the monitoring module 5 monitors the following information: certificate information, certificate chain information, support protocol information, SSL certificate vulnerabilities, client compatibility information, etc. When the monitoring module 5 detects an SSL certificate abnormality (such as certificate expiration or unauthorized root certificate use), an alarm event is triggered and recorded in the log. Preferably, the monitoring module 5 can also automatically execute preset policies according to the SSL certificate abnormality, such as revoking the certificate, generating a new certificate and replacing it.

[0071] In one embodiment, the monitoring module 5 monitors the SSL certificate including the following steps:

[0072] 1) Setting a monitoring detector, wherein the monitoring detector is used to monitor the SSL certificate.

[0073] 2) Setting the deployment location of the monitoring detector, the deployment location is a Web server, a load balancer, a cloud asset or a cloud service. Therefore, the monitoring module 5 can monitor the SSL certificates on the Web server, the load balancer, the cloud asset and the cloud service, which is not affected by the network environment and the operating system.

[0074] 3) Setting the serial number information of the monitored SSL certificate, wherein the serial number information is the unique identification code of the SSL certificate in its life cycle.

[0075] 4) Set the scanning mode, which includes manual scanning or periodic scanning.

[0076] 5) Based on the monitoring detector, the scanning method is used to monitor the SSL certificate, the deployment information of the SSL certificate is obtained, and the deployment information is provided to the monitoring service, so that the monitoring service generates a monitoring report according to the deployment information, and sends it to the user via email, WeChat, SMS, etc., so that the user can know the usage status of the SSL certificate in real time.

[0077] In one embodiment, the monitoring module 5 supports customized compliance rules, so that it can flexibly adapt to industry and enterprise needs, better prevent potential risks, improve operation and maintenance efficiency, and better support dynamic adjustment and expansion. Therefore, the monitoring module 5 also includes an SSL certificate filtering module and a compliance rule setting module. The SSL certificate filtering module is used to set the SSL certificate type, certificate brand and intermediate root certificate for which the compliance rule is targeted. If the SSL certificate filtering setting is not performed, the compliance rule is valid for all SSL certificates; otherwise, it is only valid for the set SSL certificate type. The compliance rule setting module is used to set the compliance rules; the compliance rules include one or more combinations of certificate brand, intermediate root certificate, certificate issuing company name, certificate encryption algorithm, certificate signature algorithm, and the protocol supported by the certificate. Among them, multiple compliance rules can be set, and if one compliance rule is not met, it is judged as non-compliant; only when all rules are met, it is judged as compliant. The monitoring module 5 regularly obtains monitoring data for each compliance rule, obtains compliance conclusions through compliance judgment algorithms, and informs users of compliance reports through emails and other means.

[0078] It should be noted that the implementation device of the SSL certificate management system based on a heterogeneous CA environment described in the present invention includes but is not limited to the structure of the SSL certificate management system based on a heterogeneous CA environment listed in this embodiment. All structural deformations and replacements of the prior art made according to the principles of the present invention are included in the protection scope of the present invention.

[0079] like Figure 4 As shown, in one embodiment, the SSL certificate management method based on a heterogeneous CA environment of the present invention includes steps S1 to S5.

[0080] Step S1: interact with the target CA system based on the multi-CA adaptation module to apply for, verify, issue, renew and revoke SSL certificates.

[0081] Step S2: Encrypt and store the SSL certificate based on the security audit module.

[0082] Step S3: Obtain the SSL certificate from the security audit module based on the automation management module, and implement automated distribution and lifecycle management of the SSL certificate.

[0083] Step S4: Based on the integration module, the automation management module is called to deploy the SSL certificate to a Web server, a load balancer, a cloud asset or a cloud service.

[0084] Step S5: Monitor the SSL certificate based on the monitoring module and issue an alarm when the SSL certificate is abnormal.

[0085] Among them, the above steps correspond one-to-one to each module in the SSL certificate management system based on the heterogeneous CA environment, so they are not repeated here.

[0086] The protection scope of the SSL certificate management method based on a heterogeneous CA environment described in the embodiment of the present invention is not limited to the execution order of the steps listed in this embodiment. All solutions implemented by adding, reducing or replacing steps in the prior art based on the principles of the present invention are included in the protection scope of the present invention.

[0087] In the several embodiments provided by the present invention, it should be understood that the disclosed system, device or method can be implemented in other ways. For example, the device embodiments described above are only schematic, for example, the division of modules / units is only a logical function division, and there may be other division methods in actual implementation, such as multiple modules or units can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or modules or units, which can be electrical, mechanical or other forms.

[0088] The modules / units described as separate components may or may not be physically separated, and the components displayed as modules / units may or may not be physical modules, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules / units may be selected according to actual needs to achieve the purpose of the embodiments of the present invention. For example, the functional modules / units in the various embodiments of the present invention may be integrated into one processing module, or each module / unit may exist physically separately, or two or more modules / units may be integrated into one module / unit.

[0089] Those of ordinary skill in the art should further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0090] The embodiment of the present invention also provides a computer-readable storage medium. A person of ordinary skill in the art can understand that all or part of the steps in the method for implementing the above embodiment can be completed by instructing the processor through a program, and the program can be stored in a computer-readable storage medium, and the storage medium is a non-transitory medium, such as a random access memory, a read-only memory, a flash memory, a hard disk, a solid-state hard disk, a magnetic tape, a floppy disk, an optical disc, and any combination thereof. The above storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or a data center that includes one or more available media integrated. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a digital video disc (DVD)), or a semiconductor medium (e.g., a solid-state disk (SSD)), etc.

[0091] An embodiment of the present invention further provides an electronic device, which includes a processor and a memory.

[0092] The memory is configured to store a computer program.

[0093] The memory includes: ROM, RAM, disk, USB flash drive, memory card or CD and other media that can store program codes.

[0094] The processor is connected to the memory and is configured to execute the computer program stored in the memory so that the electronic device executes the above-mentioned EEG signal acquisition method.

[0095] Preferably, the processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components.

[0096] like Figure 5 As shown, the electronic device of the present invention is in the form of a general computing device. The components of the electronic device may include but are not limited to: one or more processors or processing units 51, a memory 52, and a bus 53 connecting different system components (including the memory 52 and the processing unit 51).

[0097] Bus 53 represents one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, a processor or a local bus using any of a variety of bus architectures. For example, these architectures include but are not limited to Industry Standard Architecture (ISA) bus, Micro Channel Architecture (MAC) bus, Enhanced ISA bus, Video Electronics Standards Association (VESA) local bus and Peripheral Component Interconnect (PCI) bus.

[0098] Electronic devices typically include a variety of computer system readable media. These media can be any available media that can be accessed by the electronic device, including volatile and non-volatile media, removable and non-removable media.

[0099] The memory 52 may include computer system readable media in the form of volatile memory, such as random access memory (RAM) 521 and / or cache memory 522. The electronic device may further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, the storage system 523 may be used to read and write non-removable, non-volatile magnetic media ( Figure 5 not shown, usually called a "hard drive"). Although Figure 5Not shown, a disk drive for reading and writing to a removable non-volatile disk (e.g., a "floppy disk"), and an optical disk drive for reading and writing to a removable non-volatile optical disk (e.g., a CD-ROM, a DVD-ROM, or other optical media) may be provided. In these cases, each drive may be connected to the bus 53 via one or more data medium interfaces. The memory 52 may include at least one program product having a set (e.g., at least one) of program modules that are configured to perform the functions of the various embodiments of the present invention.

[0100] A program / utility 524 having a set (at least one) of program modules 5241 may be stored, for example, in the memory 52, such program modules 5241 including but not limited to an operating system, one or more application programs, other program modules, and program data, each of which or some combination thereof may include an implementation of a network environment. The program modules 5241 generally perform the functions and / or methods of the embodiments described herein.

[0101] The electronic device may also communicate with one or more external devices (e.g., keyboards, pointing devices, displays, etc.), one or more devices that enable a test subject to interact with the electronic device, and / or any device that enables the electronic device to communicate with one or more other computing devices (e.g., network cards, modems, etc.). Such communication may be performed via input / output (I / O) interface 54. Furthermore, the electronic device may also communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) via network adapter 55. Figure 5 As shown, the network adapter 55 communicates with other modules of the electronic device via the bus 53. It should be understood that, although not shown in the figure, other hardware and / or software modules can be used in conjunction with the electronic device, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0102] The above embodiments are merely illustrative of the principles and effects of the present invention, and are not intended to limit the present invention. Anyone familiar with the art may modify or alter the above embodiments without departing from the spirit and scope of the present invention. Therefore, all equivalent modifications or alterations made by a person of ordinary skill in the art without departing from the spirit and technical concept disclosed by the present invention shall still be covered by the claims of the present invention.

Claims

1. An SSL certificate management system based on a heterogeneous CA environment, characterized by: The system comprises: Multi-CA Adaptation Module, used to interact with the target CA system to apply for, verify, issue, renew and revoke SSL certificates; A security audit module, used for encrypting and storing the SSL certificate; An automated management module, used to obtain the SSL certificate from the security audit module and implement automated distribution and lifecycle management of the SSL certificate; An integration module for deploying the SSL certificate to a web server, a load balancer, a cloud asset or a cloud service based on the automation management module; The monitoring module is used to monitor the SSL certificate and issue an alarm when the SSL certificate is abnormal.

2. The SSL certificate management system based on a heterogeneous CA environment according to claim 1, characterized in that: The multi-CA adaptation module includes a CA adapter, and the CA adapter is used to adapt multiple types of CA systems to interact with a target CA system; the multiple types of CA systems include public CA systems and private CA systems.

3. The SSL certificate management system based on a heterogeneous CA environment according to claim 1, characterized in that: The user applies for an SSL certificate based on the multi-CA adaptation module, including the following steps: The digital certificate registration center generates an SSL certificate number based on the SSL certificate type selected by the user; The multi-CA adapter dynamically generates an application template according to the SSL certificate number; The digital certificate registration center reviews the application information input by the user based on the application model; The digital certificate registration center receives a certificate application file, the certificate application file is provided by the user or provided by the key management center according to the user's request; the certificate application file provided by the key management center also includes a key set by the user; When the certificate application document includes the key, the digital certificate registration center uses the private key to encrypt the key based on the SM4 symmetric encryption algorithm; The multi-CA adaptation module provides the SSL certificate code, the certificate application file provided by the digital certificate registration center, and the application information to a matching CA system; The matching CA system generates an SSL certificate, and the digital certificate registration certificate provides the SSL certificate to the user; when the certificate application file includes a key, the private key is also provided to the user.

4. The SSL certificate management system based on a heterogeneous CA environment according to claim 1, characterized in that: The security audit module is also used to record operator behavior logs, and desensitize and asymmetrically encrypt the operator behavior logs for storage; when abnormal operations are detected based on the operator behavior logs, an alarm message is issued.

5. The SSL certificate management system based on a heterogeneous CA environment according to claim 1, characterized in that: The lifecycle management includes the application, renewal, distribution, revocation and deployment of the SSL certificate.

6. The SSL certificate management system based on a heterogeneous CA environment according to claim 1, characterized in that: The monitoring module monitors the SSL certificate including the following steps: Setting a monitoring detector, wherein the monitoring detector is used to monitor the SSL certificate; Setting a deployment location of the monitoring detector, wherein the deployment location is a Web server, a load balancer, a cloud asset, or a cloud service; Set the number information of the monitored SSL certificate; Setting a scanning mode, wherein the scanning mode includes manual scanning or periodic scanning; Based on the monitoring detector, the scanning method is used to monitor the SSL certificate, the deployment information of the SSP certificate is obtained, and the deployment information is provided to the monitoring service, so that the monitoring service generates a monitoring report according to the deployment information.

7. The SSL certificate management system based on a heterogeneous CA environment according to claim 1, characterized in that: The monitoring module also includes: SSL certificate filtering module, used to set the SSL certificate type, certificate brand and intermediate root certificate targeted by compliance rules; The compliance rule setting module is used to set the compliance rules; the compliance rules include one or more combinations of certificate brand, intermediate root certificate, certificate issuing company name, certificate encryption algorithm, certificate signing algorithm, and protocols supported by the certificate.

8. A method for managing SSL certificates based on a heterogeneous CA environment, characterized in that: The method comprises the following steps: Interact with the target CA system based on the multi-CA adaptation module to apply for, verify, issue, renew and revoke SSL certificates; Encrypting and storing the SSL certificate based on a security audit module; Obtaining the SSL certificate from the security audit module based on the automation management module, and implementing automated distribution and lifecycle management of the SSL certificate; Calling the automation management module based on the integration module to deploy the SSL certificate to a web server, a load balancer, a cloud asset or a cloud service; The SSL certificate is monitored based on a monitoring module, and an alarm is issued when the SSL certificate is abnormal.

9. A storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the SSL certificate management method based on a heterogeneous CA environment described in claim 8 is implemented.

10. An electronic device, characterized in that: include: Processor and memory; The memory is configured to store a computer program; The processor is configured to execute the computer program stored in the memory so that the electronic device executes the SSL certificate management method based on a heterogeneous CA environment as described in claim 8.

Images