SSL certificate expiration detection method and system

Abstract

The invention provides an SSL certificate expiration detection method and system, a computing device and a computer readable storage medium, and the method achieves the comprehensive coverage and unified management of a plurality of cloud environments, solves a problem that the coverage ranges of different cloud platforms are inconsistent, and guarantees that each SSL certificate is in monitoring. And a large number of requests can be processed in a short time by adopting a high-concurrency detection technology, so that the detection efficiency is improved, the detection accuracy is enhanced, and any change can be found in time. In addition, full-link verification focuses on verification in a complex network environment, the problem that the detection precision of a traditional method in the complex environment is reduced is solved, and it is ensured that the certificate state in each node and path is accurately detected. Besides, the intelligent alarm effectively solves the problem of alarm fatigue through grading, duplicate removal and batch processing mechanisms, the user only receives important notifications instead of repeated and redundant alarm information, the efficiency and precision of SSL certificate monitoring are improved, and it is ensured that the SSL certificate has good elasticity and adaptability in a dynamically changing IT environment.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a method and system for detecting the expiration of SSL certificates, a computing device, and a computer-readable storage medium. Background Technology

[0002] In the process of enterprise digital transformation, SSL certificate management has become a significant challenge for IT operations and maintenance. Current SSL domain certificate expiration detection solutions suffer from several technical shortcomings: for example, in terms of network environment complexity, certificates at the CDN proxy level may lead to inaccurate detection results; different certificates on multiple backend servers in a load-balanced environment are difficult to comprehensively cover; and insufficient support for SNI leads to improper handling of multiple domains under the same IP address, easily overlooking subdomains under wildcard certificates. Data management also has shortcomings, often focusing only on certificate expiration dates while ignoring other important information such as issuing authorities and encryption algorithms, and lacking historical tracking of certificate replacements; furthermore, existing systems lack sufficient automation, still requiring significant manual intervention when problems are discovered. Summary of the Invention

[0003] In view of this, embodiments of this application provide a method and system for detecting the expiration of SSL certificates, a computing device, and a computer-readable storage medium to address the technical deficiencies existing in the prior art.

[0004] According to a first aspect of the embodiments of this application, an SSL certificate expiration detection method is provided, comprising:

[0005] The DNS service periodically retrieves remote DNS records and saves them locally;

[0006] The SSL certificate verification service obtains the SSL certificate based on the DNS record request and verifies the SSL certificate;

[0007] The DNS service analyzes the certificate detection results and then triggers an alarm notification device to send a notification.

[0008] According to a second aspect of the embodiments of this application, an SSL certificate expiration detection system is provided, comprising:

[0009] DNS service unit, SSL certificate detection service unit, and alarm notification unit;

[0010] The DNS service unit periodically acquires remote DNS records and saves them locally; and analyzes the certificate detection results returned by the SSL certificate detection service unit.

[0011] The SSL certificate detection service unit obtains the SSL certificate based on the DNS record request and verifies the SSL certificate;

[0012] The alarm notification device issues an alarm notification based on the analysis of the certificate detection results by the DNS service unit.

[0013] According to a third aspect of the present application, a computing device is provided, including a memory, a processor, and computer instructions stored in the memory and executable on the processor, wherein the processor executes the instructions to implement the steps of the SSL certificate expiration detection method.

[0014] According to a fourth aspect of the embodiments of this application, a computer-readable storage medium is provided that stores computer instructions, which, when executed by a processor, implement the steps of the SSL certificate expiration detection method.

[0015] The method provided by the embodiments of this application achieves comprehensive coverage and unified management of multiple cloud environments, solving the problem of inconsistent coverage between different cloud platforms and ensuring that every SSL certificate is under monitoring. Furthermore, the use of high-concurrency detection technology enables a large number of requests to be processed in a short time, improving both detection efficiency and accuracy, ensuring that any changes are detected promptly. It also focuses on verification in complex network environments through end-to-end verification, overcoming the problem of decreased detection accuracy in complex environments compared to traditional methods, ensuring that the certificate status at each node and path is accurately detected. In addition, intelligent alerting effectively solves the problem of alert fatigue through hierarchical, deduplication, and batch processing mechanisms, ensuring that users receive only important notifications, rather than repetitive and redundant alert information. This application not only improves the efficiency and accuracy of SSL certificate monitoring but also ensures its good resilience and adaptability in dynamically changing IT environments. Attached Figure Description

[0016] Figure 1 This is a structural block diagram of the computing device provided in the embodiments of this application;

[0017] Figure 2 This is a flowchart illustrating an SSL certificate expiration detection method provided in an embodiment of this application;

[0018] Figure 3 This is a schematic diagram of the structure of an SSL certificate expiration detection system provided in an embodiment of this application. Detailed Implementation

[0019] Many specific details are set forth in the following description to provide a full understanding of this application. However, this application can be implemented in many other ways different from those described herein, and those skilled in the art can make similar extensions without departing from the spirit of this application; therefore, this application is not limited to the specific embodiments disclosed below.

[0020] The terminology used in one or more embodiments of this application is for the purpose of describing particular embodiments only and is not intended to limit the scope of one or more embodiments of this application. The singular forms “a,” “the,” and “the” used in one or more embodiments of this application and in the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” used in one or more embodiments of this application refers to and includes any or all possible combinations of one or more associated listed items.

[0021] It should be understood that although the terms first, second, etc., may be used to describe various information in one or more embodiments of this application, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, first may also be referred to as second without departing from the scope of one or more embodiments of this application, and similarly, second may also be referred to as first. Depending on the context, the word "if" as used herein may be interpreted as "in response to a determination".

[0022] This application provides a method and system for detecting the expiration of SSL certificates, a computing device, and a computer-readable storage medium, which will be described in detail in the following embodiments.

[0023] Figure 1 A structural block diagram of a computing device 100 according to an embodiment of this application is shown. The components of the computing device 100 include, but are not limited to, a memory 110 and a processor 120. The processor 120 is connected to the memory 110 via a bus 130, and a database 150 is used to store data.

[0024] The computing device 100 also includes an access device 140, which enables the computing device 100 to communicate via one or more networks 160. Examples of these networks include a Public Switched Telephone Network (PSTN), a Local Area Network (LAN), a Wide Area Network (WAN), a Personal Area Network (PAN), or a combination of communication networks such as the Internet. The access device 140 may include one or more of any type of wired or wireless network interface (e.g., a Network Interface Card (NIC)), such as an IEEE 802.11 Wireless Local Area Network (WLAN) interface, a Wi-MAX interface, an Ethernet interface, a Universal Serial Bus (USB) interface, a cellular network interface, a Bluetooth interface, a Near Field Communication (NFC) interface, and so on.

[0025] In one embodiment of this application, the aforementioned components of the computing device 100 and Figure 1 Other components, not shown, can also be connected to each other, for example, via a bus. It should be understood that... Figure 1The block diagram of the computing device shown is for illustrative purposes only and is not intended to limit the scope of this application. Those skilled in the art can add or replace other components as needed.

[0026] The computing device 100 can be any type of stationary or mobile computing device, including mobile computers or mobile computing devices (e.g., tablet computers, personal digital assistants, laptop computers, notebook computers, netbooks, etc.), mobile phones (e.g., smartphones), wearable computing devices (e.g., smartwatches, smart glasses, etc.) or other types of mobile devices, or stationary computing devices such as desktop computers or PCs.

[0027] In the embodiments of this application, Figure 2 A flowchart of an SSL certificate expiration detection method provided in this application is shown, including steps 202 to 206.

[0028] Step 202: The DNS service periodically retrieves remote DNS records and saves them locally.

[0029] In this step, a timer is configured at the application layer to periodically start the DNS fetching task at the service layer, thereby implementing an automated timed triggering mechanism to ensure the regular updating of DNS information.

[0030] Furthermore, when performing the DNS retrieval task, the DNS service in the service layer loads the configuration file and calls multiple providers in the provider layer to obtain DNS records for multiple cloud services based on the configuration. Each provider encapsulates the API call methods for different cloud DNS services.

[0031] Specifically, the DNS service uses multi-threading or asynchronous call technology to call multiple providers, allowing requests to be sent to different DNS service providers (such as Alibaba Cloud, AWS, etc.) simultaneously.

[0032] Furthermore, the DNS service parses and integrates the DNS data returned by the DNS service provider and stores it locally. Specifically, it uniformly formats DNS data from different service providers to ensure data consistency across multiple platforms. It uses standard data formats (such as JSON) for storage to simplify subsequent retrieval and resolution.

[0033] Preferably, when using a Provider to retrieve DNS records from a cloud service provider, the DNS service employs a robust retry mechanism. When an API call fails, failure detection is first performed to identify the error type. Subsequently, the mechanism makes a retry decision based on the specific error type, determining whether a retry is necessary. To effectively manage retry intervals, the DNS service uses an exponential backoff algorithm, which automatically adjusts the retry interval to avoid server overload. Finally, based on the decision, the DNS service executes API call retries, striving for successful and reliable data retrieval through an orderly and strategic retry process.

[0034] Step 204: The SSL certificate verification service obtains the SSL certificate based on the DNS record request and verifies the SSL certificate.

[0035] In this step, the DNS service resolves the obtained DNS records to obtain a list of domain names, and then sends all domain names to the SSL certificate verification service, which completes the certificate verification.

[0036] Specifically, the SSL certificate verification service launches multiple concurrent coroutines to execute certificate verification tasks, each of which includes:

[0037] (1) Check the service port of the target domain: Confirm that the connection is using the correct port, usually 443 (the default port for HTTPS). Then verify whether the service port of the target domain is open and accessible, for example: telnetexample.com 443. If the port is accessible, proceed to the next step; if the port is unavailable, record the domain as a non-HTTPS domain.

[0038] (2) Establish a TLS connection, for example:

[0039] Use OpenSSL tools to inspect TLS connections and obtain certificate information.

[0040] openssl s_client-connect example.com:443

[0041] Alternatively, use the language's SSL library to connect, specifying the TLS version to ensure security.

[0042] import ssl

[0043] ssl_context=ssl.create_default_context()

[0044] ssl_context.options&=~(ssl.OP_NO_TLSv1_2|ssl.OP_NO_TLSv1_3)

[0045] Preferably, when establishing a TLS connection, a specified server name (ServerName) is used to support SNI, thereby allowing the target domain name to be specified during the TLS handshake. This enables the server to return the correct SSL certificate, especially when multiple domain names are hosted on a single server. Specifically, by setting a custom ServerName using information obtained from DNS records, it ensures that the client correctly indicates the requested domain name during the handshake process, allowing the server to return the appropriate SSL certificate.

[0046] For example, when a server hosts multiple domain names through a single IP address, such as:

[0047] Domain A: site.videogames.example.com (certificate expiring soon);

[0048] Domain B: site.onlinecourses.example.com (Certificate expires a long time ago)

[0049] When establishing a TLS connection, if an IP address or a wildcard address such as *example.com is used directly, the server, not receiving valid SNI information, will not know which domain the user wants to access and may default to returning the first or a default certificate for that IP address. This certificate may not be the certificate for site.videogames.example that the user wants to check, but rather the certificate for site.onlinecourses.example.

[0050] Therefore, in this embodiment of the application, the ServerName is explicitly set when constructing a TLS connection request. For example, for a connection request to site.videogames.example.com, the ClientHello message in the TLS handshake process explicitly tells the server that the target domain name is site.videogames.example.com, which tells the server that it should return a certificate that matches that domain name.

[0051] (3) Obtain the certificate chain and perform multi-level verification. This step obtains the certificate chain returned from the server. For example, the following command can be used to obtain the certificate chain information:

[0052] The `openssl s_client-connect example.com:443-servername example.com-showcerts` command verifies the root certificate, intermediate certificates, and server leaf certificates. Certificate details include:

[0053] Issuer: The CA that issues the certificate.

[0054] Subject: The main information of the certificate, including the domain name.

[0055] Validity period: start and end dates.

[0056] Serial number: A unique identifier for the certificate.

[0057] Encryption algorithm: An algorithm used for signing and encryption.

[0058] Multi-level certificate verification includes:

[0059] 1. Domain name matching verification

[0060] Extract the Common Name (CN) and Subject Alternative Name (SAN) from the leaf certificate returned by the target server. Examine the CN and SAN fields in the server certificate to ensure that at least one of them exactly matches the domain name of the connection.

[0061] For example: if connecting to www.example.com, the CN on the certificate should be www.example.com or www.example.com should be included in the SAN.

[0062] 2. Certificate Chain Verification

[0063] The certificate verification process involves not only checking the "leaf certificate" sent by the server, but also verifying the validity of the entire certificate chain. The certificate chain also includes intermediate certificates and the root certificate, which together ensure the trustworthiness of the final server certificate. Certificate chain verification includes:

[0064] Confirm that the server leaf certificate was signed by an intermediate certificate;

[0065] Verify that the intermediate certificate's signature chain is valid, meaning the intermediate certificate was signed by the root certificate;

[0066] Check if the root certificate is in the browser's or operating system's trusted certificate store. The root certificate itself is self-signed and is pre-installed on the system.

[0067] This trust cascade confirms that the SSL certificate chain is complete and trustworthy. The integrity of the certificate chain means that each certificate can be verified by the next higher level until it finally matches the root certificate. This ensures that the entire path from the target server certificate to the root certificate is trustworthy.

[0068] 3. Certificate expiration check

[0069] After extracting the start and end dates ("Validation Start" and "Validation End" fields) from the certificate, verify that the current date is within the validity period of the certificate.

[0070] Furthermore, the SSL certificate verification service returns the verification results to the DNS service, which then stores them locally.

[0071] Step 206: The DNS service triggers an alarm notification device to send a notification after processing the detection results.

[0072] In this step, after obtaining the certificate detection results, the DNS service further analyzes them to identify problems in the results, such as expired certificates and verification failures. Based on the type and severity of the problems, the service categorizes the problems and issues and then issues notifications.

[0073] First, the urgency is assessed by calculating the remaining validity period of the certificate. The alarm level is determined based on the remaining time to determine whether it is an emergency or a routine notification.

[0074] For example, a critical alarm is generated for expired certificates, an emergency alarm is generated for certificates that expire within 10 days, a warning alarm is generated for certificates that expire within 30 days, and other errors are generated as error alarms.

[0075] Furthermore, for each alarm level, an appropriate message format should be set to ensure effective information delivery. For example, critical and emergency alarms should be displayed in red font, while other alarms should be displayed in normal font.

[0076] Then, alarm messages are constructed according to the message format, involving the collection of detailed information related to the alarm, including certificate details and problem background. The alarm content is organized according to the message format requirements of the instant messaging tool, and alarms with similar problems are processed in batches and sent together to save resources.

[0077] Preferably, a deduplication check is performed on the alarm message before it is sent, including:

[0078] Historical record query: Access the alarm system's database or logs to query recently sent alarm records. Focus on alarm items related to the currently detected problem to obtain information on their sending over a past period.

[0079] Duplicate Alarm Determination: Based on historical records, compare the content of the current alarm to be sent with the content of previously sent alarms. Use certain criteria, such as alarm type, problem description, and affected system components, to assess the similarity between the two. If the current alarm is completely identical to an alarm in the historical records in terms of content and scope of impact, it is marked as a duplicate alarm.

[0080] Time window check: Determine the alarm silence period, that is, avoid sending the same alarm repeatedly during this period.

[0081] Check if the current time is within a quiet period. This setting is typically determined based on the organization's specific needs and can be a time range of several hours or days. If the current time is within a quiet period and the alarm is marked as duplicated, avoid sending the alarm again.

[0082] Finally, the API of an instant messaging tool (such as DingTalk) is called to push alarm information. Successful sending needs to be checked in real time; if sending fails, a retry mechanism is initiated to ensure successful message delivery. Simultaneously, the status and results of all sending activities are recorded for subsequent review and improvement.

[0083] In the embodiments described above, to address the technical shortcomings of traditional SSL certificate monitoring, firstly, comprehensive coverage and unified management of multiple cloud environments are provided, resolving the issue of inconsistent coverage between different cloud platforms and ensuring that every SSL certificate is under monitoring. Secondly, high-concurrency detection technology enables a large number of requests to be processed in a short time, improving both detection efficiency and accuracy, ensuring that any changes are detected promptly. End-to-end verification focuses on verification in complex network environments, overcoming the problem of decreased detection accuracy in complex environments using traditional methods, ensuring that the certificate status at each node and path is accurately detected. Furthermore, intelligent alerting effectively solves the alert fatigue problem through hierarchical, deduplication, and batch processing mechanisms, ensuring that users receive only important notifications, rather than repetitive and redundant alert information. This application not only improves the efficiency and accuracy of SSL certificate monitoring but also ensures its good resilience and adaptability in dynamically changing IT environments.

[0084] Corresponding to the above method embodiments, this application also provides an embodiment of an SSL certificate expiration detection system, the system comprising:

[0085] DNS service unit, SSL certificate detection service unit, and alarm notification unit;

[0086] The DNS service unit periodically acquires remote DNS records and saves them locally; and analyzes the certificate detection results returned by the SSL certificate detection service unit.

[0087] The SSL certificate detection service unit obtains the SSL certificate based on the DNS record request and verifies the SSL certificate;

[0088] The alarm notification device issues an alarm notification based on the analysis of the certificate detection results by the DNS service unit.

[0089] The above is an illustrative scheme of an SSL certificate expiration detection system according to this embodiment. It should be noted that the technical solution of this SSL certificate expiration detection system belongs to the same concept as the technical solution of the SSL certificate expiration detection method described above. Details not described in detail in the technical solution of this SSL certificate expiration detection system can be found in the description of the technical solution of the SSL certificate expiration detection method described above.

[0090] In one embodiment of this application, a computing device is also provided, including a memory, a processor, and computer instructions stored in the memory and executable on the processor, wherein the processor executes the instructions to implement the steps of the SSL certificate expiration detection method.

[0091] The above is an illustrative scheme of a computing device according to this embodiment. It should be noted that the technical solution of this computing device and the technical solution of the above-described SSL certificate expiration detection method belong to the same concept. For details not described in detail in the technical solution of the computing device, please refer to the description of the technical solution of the above-described SSL certificate expiration detection method.

[0092] An embodiment of this application also provides a computer-readable storage medium storing computer instructions that, when executed by a processor, implement the steps of the SSL certificate expiration detection method as described above.

[0093] The above is an illustrative scheme of a computer-readable storage medium according to this embodiment. It should be noted that the technical solution of this storage medium belongs to the same concept as the technical solution of the SSL certificate expiration detection method described above. Details not described in detail in the technical solution of the storage medium can be found in the description of the technical solution of the SSL certificate expiration detection method described above.

[0094] The foregoing has described specific embodiments of this application. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in a different order than that shown in the embodiments and may still achieve the desired results. Furthermore, the processes depicted in the drawings do not necessarily require the specific or sequential order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0095] The computer instructions include computer program code, which may be in the form of source code, object code, executable file, or some intermediate form. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording media, USB flash drive, portable hard drive, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media, etc. It should be noted that the content included in the computer-readable medium may be appropriately added to or subtracted according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media may not include electrical carrier signals and telecommunication signals.

[0096] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that this application is not limited to the described order of actions, as some steps may be performed in other orders or simultaneously according to this application. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions and modules involved are not necessarily essential to this application.

[0097] In the above embodiments, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0098] The preferred embodiments disclosed above are merely illustrative of this application. The optional embodiments do not exhaustively describe all details, nor do they limit the invention to the specific implementations described. Clearly, many modifications and variations can be made based on the content of this application. These embodiments are selected and specifically described in this application to better explain the principles and practical applications of this application, thereby enabling those skilled in the art to better understand and utilize this application. This application is limited only by the claims and their full scope and equivalents.

Claims

1. A method for detecting the expiration of an SSL certificate, characterized in that, include: The DNS service periodically retrieves remote DNS records and saves them locally; The SSL certificate verification service obtains the SSL certificate based on the DNS record request and verifies the SSL certificate; The DNS service analyzes the certificate detection results and then triggers an alarm notification device to send a notification.

2. The method according to claim 1, wherein, The DNS service periodically retrieves remote DNS records and saves them locally, including: The DNS service periodically and asynchronously calls multiple Providers to obtain DNS records for multiple cloud services according to the timer settings; each Provider encapsulates the API call methods for different cloud DNS.

3. The method according to claim 2, wherein, The DNS service periodically retrieves remote DNS records and saves them locally, which also includes: the DNS service parses and integrates the DNS data returned by the DNS service provider and then stores it locally.

4. The method according to claim 1, wherein, The SSL certificate verification service obtains the SSL certificate based on the DNS record request and verifies the SSL certificate, including: The DNS service resolves the DNS records to obtain a list of domain names, and then sends the list of domain names to the SSL certificate detection service, which performs the certificate detection.

5. The method according to claim 4, wherein, The certificate verification service performs the following: The SSL certificate detection service initiates multiple concurrent coroutines to execute certificate detection tasks and returns the detection results to the DNS service. Each certificate detection task includes: checking the service port of the target domain in the domain name list, establishing a TLS connection through the service port, obtaining the certificate chain of the target domain after the connection is established, and performing multi-level verification.

6. The method according to claim 5, wherein, Establishing a TLS connection via the service port includes: When constructing a TLS connection request, specify the specific domain name of the request during the TLS handshake so that the server can return the correct SSL certificate.

7. The method according to claim 5, wherein, Establishing a TLS connection through the service port, and then obtaining the certificate chain of the target domain name and performing multi-layer verification after the connection is established, includes: Extract the common name and alternate name from the leaf certificate returned by the target server; check the CN and SAN fields in the leaf certificate to determine if at least one of them exactly matches the target domain name of the connection; Check if the leaf certificate is signed by an intermediate certificate; check if the intermediate certificate is signed by a root certificate; check if the root certificate is in the browser's or operating system's trusted certificate store. Extract the start and end dates from certificates at all levels and verify that the current date is within the certificate's validity period.

8. The method according to claim 1, wherein, The DNS service analyzes the certificate detection results and triggers an alarm notification to send a notification, including: The DNS service obtains certificate detection results, identifies problems in the results, and classifies the problems according to their type and severity before issuing notifications.

9. An SSL certificate expiration detection system, characterized in that, include: DNS service unit, SSL certificate detection service unit, and alarm notification unit; The DNS service unit periodically retrieves remote DNS records and saves them locally; The certificate detection results returned by the SSL certificate detection service unit are analyzed. The SSL certificate detection service unit obtains the SSL certificate based on the DNS record request and verifies the SSL certificate; The alarm notification device issues an alarm notification based on the analysis of the certificate detection results by the DNS service unit.

10. A computing device, comprising a memory, a processor, and computer instructions stored in the memory and executable on the processor, characterized in that, When the processor executes the instructions, it implements the steps of the method according to any one of claims 1-7.

11. A computer-readable storage medium storing computer instructions, characterized in that, When executed by the processor, this instruction implements the steps of the method according to any one of claims 1-7.

Images