Certificate management method and device and related equipment
By automatically selecting certificate validity period and key length priority sorting on the client side, the cumbersome problem of TLS authentication in multi-certificate environments is solved, realizing automated and secure certificate management, and improving the accuracy of TLS authentication and user experience.
Patent Information
- Application Number
- CN202511357448.3
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-09-22
- Publication Date
- 2026-01-06
AI Technical Summary
In a multi-certificate environment, clients find it difficult to accurately and conveniently select the appropriate certificate for TLS two-way authentication, resulting in frequent user operations, cumbersome processes, difficulty in achieving batch and automated deployment, and a high risk of authentication failure or security issues.
The client receives a certificate retrieval request from the server, prioritizes the target certificates in the local certificate store based on the certificate validity period and key length, and automatically selects the certificate with the highest priority for authentication. Combined with security policy verification, the client ensures the legality and applicability of the certificate.
It enables automated certificate selection in multi-certificate environments, improving the accuracy and security of authentication, optimizing user experience, supporting automated deployment and unified security policies for enterprises, and reducing manual intervention.
Smart Images
Figure CN121283643A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of network security technology, and in particular to a certificate management method, apparatus and related equipment. Background Technology
[0002] With increasingly stringent information security requirements, the TLS (Transport Layer Security) protocol, an encryption protocol that ensures secure network communication and provides encryption and authentication functions for data transmission, is widely used for internet data encryption and identity authentication. In high-security scenarios such as enterprises, finance, and government, servers typically require clients to also provide digital certificates to achieve TLS mutual authentication. During this process, the client needs to submit an appropriate certificate to complete identity authentication according to the authentication requirements issued by the server.
[0003] However, modern terminals (such as enterprise PCs and laptops) often have multiple client certificates installed. These certificates are issued by different CAs (Certificate Authorities) and used in different business systems. How to accurately and conveniently select the appropriate certificate in a multi-certificate environment has become a key issue in the client authentication process. Summary of the Invention
[0004] This application provides a certificate management method, apparatus, and related equipment.
[0005] Firstly, this application provides a certificate management method applied to a client; the method includes:
[0006] The client receives a certificate request from the server, wherein the client sends an authentication request to the server when it determines that authentication is required before executing the target service; the certificate request includes certificate filtering conditions.
[0007] Traverse the local certificate store and filter out a list of target certificates that match the certificate filtering criteria.
[0008] If the target certificate list includes multiple target certificates, the multiple target certificates are prioritized based on the certificate validity period and / or certificate key length of each target certificate;
[0009] The target certificate with the highest current priority is sent to the server as the current authentication certificate, so that the server can perform authentication based on the current authentication certificate.
[0010] Optionally, the certificate filtering criteria include: certificate type and certificate issuing authority.
[0011] Optionally, the method further includes:
[0012] If a successful authentication message is received from the server, the current authentication certificate is recorded as the certificate associated with the target business.
[0013] Optionally, if an authentication failure message is received from the server, the current authentication certificate is deleted from the target certificate list, and the step of sending the target certificate with the highest priority as the current authentication certificate to the server is executed until an authentication success message is received from the server, or there is no available certificate in the target certificate list.
[0014] Optionally, the method further includes:
[0015] The current authentication certificate is verified using a security policy to determine whether it can be used for authentication of the target business.
[0016] Optionally, the method further includes:
[0017] If it is determined that a certificate associated with the target business is maintained locally, the certificate is sent to the server so that the server can perform authentication based on the current authentication certificate.
[0018] Secondly, this application provides a certificate management device for use on a client side; the device includes:
[0019] A receiving unit is used to receive a certificate acquisition request sent by a server, wherein the client sends an authentication request to the server when it determines that authentication is required before executing the target service; the certificate acquisition request includes certificate filtering conditions.
[0020] The matching unit is used to traverse the local certificate store and filter out a list of target certificates that match the certificate filtering criteria from the local certificate store.
[0021] The sorting unit, if the target certificate list includes multiple target certificates, is used to sort the multiple target certificates by priority based on the certificate validity period and / or certificate key length of each target certificate;
[0022] The sending unit is used to send the target certificate with the highest current priority as the current authentication certificate to the server so that the server can perform authentication based on the current authentication certificate.
[0023] Optionally, the certificate filtering criteria include: certificate type and certificate issuing authority.
[0024] Optionally, the device further includes:
[0025] If the receiving unit receives a successful authentication message from the server, the recording unit is used to record the current authentication certificate as the certificate associated with the target service.
[0026] Optionally, the device further includes a deletion unit:
[0027] If the receiving unit receives an authentication failure message from the server, the deletion unit is used to delete the current authentication certificate from the target certificate list, and the sending unit is used to perform the step of sending the target certificate with the highest priority as the current authentication certificate to the server, until the receiving unit receives an authentication success message from the server, or there is no available certificate in the target certificate list.
[0028] Optionally, the device further includes:
[0029] The verification unit is used to perform security policy verification on the current authentication certificate to determine whether the current authentication certificate can be used for the authentication of the target service.
[0030] Optionally, the device further includes a determination unit:
[0031] If the determination unit determines that a certificate associated with the target service is maintained locally, the sending unit is used to send the certificate to the server so that the server can perform authentication based on the current authentication certificate.
[0032] Thirdly, embodiments of this application provide a certificate management device, which includes:
[0033] Memory, used to store program instructions;
[0034] A processor is configured to invoke program instructions stored in the memory and execute the steps of the method as described in any one of the first aspects above, according to the obtained program instructions.
[0035] Fourthly, embodiments of this application also provide a computer-readable storage medium storing computer-executable instructions for causing a computer to perform the steps of the method as described in any of the first aspects above.
[0036] In summary, the certificate management method provided in this application embodiment is applied to a client. The method includes: receiving a request from a server to obtain a certificate, wherein the client sends an authentication request to the server when it determines that authentication is required before executing a target service; the request to obtain a certificate includes certificate filtering conditions; traversing the local certificate library and filtering out a list of target certificates that match the certificate filtering conditions; if the list of target certificates includes multiple target certificates, prioritizing the multiple target certificates based on their certificate validity period and / or certificate key length; and sending the target certificate with the highest current priority as the current authentication certificate to the server so that the server can perform authentication based on the current authentication certificate.
[0037] The certificate management method provided in this application allows the client to automatically select and choose the most suitable certificate from the local certificate store based on the certificate type and CA information issued by the server; this avoids manual intervention, improves the accuracy and security of authentication, optimizes the user experience, and supports enterprise automation, batch deployment, and unified security policies.
[0038] By utilizing the certificate type and CA list information in the server's CertificateRequest message during the TLS handshake phase, local certificate matching, optimization, and selection are performed automatically without manual user intervention. Attached Figure Description
[0039] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments of this application or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this application. For those skilled in the art, other drawings can be obtained based on these drawings of the embodiments of this application.
[0040] Figure 1 A detailed flowchart of a certificate management method provided for an embodiment of this application;
[0041] Figure 2 This is a schematic diagram of the structure of a certificate management device provided in an embodiment of this application;
[0042] Figure 3 This is a schematic diagram of the hardware architecture of a certificate management device provided in an embodiment of this application. Detailed Implementation
[0043] The terminology used in the embodiments of this application is for the purpose of describing particular embodiments only and is not intended to limit the application. The singular forms “a,” “the,” and “the” as used in this application and claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used herein refers to any and all possible combinations comprising one or more of the associated listed items.
[0044] It should be understood that although the terms first, second, third, etc., may be used to describe various information in embodiments of this application, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, without departing from the scope of this application, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Depending on the context, the word "if" may also be interpreted as "when," "when," or "in response to a determination."
[0045] Currently, the main process for client certificate selection during TLS mutual authentication in mainstream operating systems (such as Windows) and applications (typical TLS handshake and certificate selection process) is as follows:
[0046] A. The client initiates a TLS connection, and the server sends a CertificateRequest message, which includes the acceptable certificate types and CAs.
[0047] B. If there is only one certificate that meets the requirements locally, automatically select that certificate.
[0048] C. If there are multiple eligible certificates on the local machine, and the certificate cannot be automatically selected each time, the system or application will pop up a window requiring the user to select manually.
[0049] D. After the user selects a certificate, the client uses that certificate to complete the TLS handshake.
[0050] However, the pop-up windows every time multiple certificate services are connected result in frequent user operations and a cumbersome process. Ordinary users often struggle to distinguish the purpose of certificates, easily leading to incorrect selections that cause authentication failures or security issues. Large-scale, automated deployment is difficult, failing to meet the needs of unattended scenarios. Users misselecting important certificates may result in privacy leaks or misuse of certificates. A unified strategy is difficult to implement, hindering large-scale endpoint security management.
[0051] This application provides a scheme for automated selection of TLS client certificates in a multi-certificate environment.
[0052] For example, see Figure 1 The diagram shown is a detailed flowchart of a certificate management method provided in an embodiment of this application. This method is applied to a client and includes the following steps:
[0053] Step 100: Receive the request from the server to obtain the certificate.
[0054] When the client determines that authentication is required before executing the target service, it sends an authentication request to the server; the request to obtain a certificate includes certificate filtering conditions.
[0055] In practical applications, when a client needs to access a target service, if it determines that certificate authentication is required, it will send an authentication request to the server of the target service (which integrates certificate authentication functionality). After receiving the authentication request from the client, the server will send a request to the client to obtain a certificate, which includes certificate filtering conditions.
[0056] Specifically, the authentication request initiated by the client can be a TLS connection request.
[0057] In this embodiment, the certificate filtering criteria may include the certificate type and the certificate issuing authority. Of course, other information may also be included in the certificate filtering criteria, but this embodiment does not impose specific limitations on them.
[0058] In this way, after receiving a certificate retrieval request from the server, the client can parse the request and obtain the certificate filtering criteria. For example, the certificate filtering criteria could be the certificate type and a list of CAs (Certificate Authorities).
[0059] Step 110: Traverse the local certificate store and select a list of target certificates that match the certificate selection criteria from the local certificate store.
[0060] In practical applications, the client maintains a local certificate store, which contains a set of certificates required by the client to access different services and / or different servers.
[0061] In this embodiment of the application, after parsing the certificate filtering conditions, the client can traverse the local certificate database, find the target certificate that matches the certificate filtering conditions, and form a target certificate list.
[0062] For example, suppose the client's local certificate store contains certificate 1, certificate 2, certificate 3, ..., certificate n. The target certificate that matches the certificate filtering criteria can be certificate 1, certificate 2, and certificate 3.
[0063] Step 120: If the target certificate list includes multiple target certificates, then prioritize the multiple target certificates based on their certificate validity period and / or certificate key length.
[0064] In practical applications, each certificate has its own validity period and certificate key. In this embodiment, after filtering the target certificate list, if the target certificate list contains only one target certificate, then the target certificate is directly sent to the server for authentication.
[0065] If the target certificate list includes multiple target certificates, then it is necessary to prioritize the multiple target certificates according to their certificate validity period and / or certificate key length.
[0066] Specifically, the target certificates can first be sorted based on their validity period, with longer validity periods giving higher priority. For target certificates with the same validity period, they can then be sorted based on the length of their key, with longer key lengths giving higher priority. This will result in a sorted list of target certificates.
[0067] Step 130: Send the target certificate with the highest priority as the current authentication certificate to the server so that the server can perform authentication based on the current authentication certificate.
[0068] Specifically, select the target certificate with the highest priority from the target certificate list as the current authentication certificate, and send the current authentication certificate to the server for authentication.
[0069] Furthermore, if a successful authentication message is received from the server, the current authentication certificate is recorded as the certificate associated with the target service.
[0070] In other words, the server authenticates the client based on the current authentication certificate sent by the client. If the authentication is successful, the server sends a success message to the client. Upon receiving the success message, the client confirms that the authentication was successful, and the authentication process ends.
[0071] The client records the current authentication certificate as the certificate associated with the target business, meaning that the certificate can be used for subsequent fast authentication of the target business.
[0072] Furthermore, if an authentication failure message is received from the server, the current authentication certificate is removed from the target certificate list, and the step of sending the target certificate with the highest priority as the current authentication certificate to the server is executed until an authentication success message is received from the server, or there is no available certificate in the target certificate list.
[0073] In other words, when the server attempts to authenticate based on the current authentication certificate sent by the client, if the authentication fails, it sends an authentication failure feedback to the client. This means that the current authentication certificate sent by the client is not the authentication certificate required by the target business. At this point, the certificate is removed from the target certificate list, resulting in an updated target certificate list. The highest priority target certificate in the target certificate list is then sent to the server as the current authentication certificate, causing the server to perform the authentication operation again. This process is repeated until the server successfully authenticates or there are no usable certificates left in the target certificate list.
[0074] In this embodiment, to ensure the security of certificates in the local certificate store, a security policy can be set on the client. Specifically, the security policy can be used to check the legitimacy of the CA list carried in the certificate acquisition request sent by the server, preventing the server from misleading and causing improper certificate leakage; it can also be linked with enterprise and terminal security policies to restrict the scope of use of each certificate. It determines whether there are target certificates in the target certificate list whose scope of use does not meet the conditions.
[0075] In summary, in this embodiment of the application, before sending the target certificate with the highest priority as the current authentication certificate to the server, a security policy verification can be performed on the current authentication certificate to determine whether the current authentication certificate can be used for the authentication of the target service.
[0076] In this embodiment of the application, the certificate management method further includes the following steps:
[0077] If it is determined that a certificate associated with the target business is maintained locally, the certificate is sent to the server so that the server can perform authentication based on the current authentication certificate.
[0078] In other words, after each business that requires authentication completes its first successful authentication, the client can maintain the association between each business and the certificate. During the validity period of each certificate, when the client accesses each business again, it can directly find the corresponding authentication based on the association and quickly complete the certificate authentication.
[0079] In other words, the client records the correspondence between the server's various services and certificates, which can be automatically reused next time without the need for further filtering.
[0080] For example, see Figure 2 The diagram shown is a structural schematic of a certificate management device provided in an embodiment of this application. This device is applied to a client and includes:
[0081] The receiving unit 20 is used to receive a request to obtain a certificate sent by the server, wherein the client sends an authentication request to the server when it determines that authentication is required before executing the target service; the request to obtain a certificate includes certificate filtering conditions.
[0082] Matching unit 21 is used to traverse the local certificate library and filter out a list of target certificates that match the certificate filtering conditions from the local certificate library;
[0083] Sorting unit 22, if the target certificate list includes multiple target certificates, is used to sort the multiple target certificates by priority based on the certificate validity period and / or certificate key length of each target certificate;
[0084] Sending unit 23 is used to send the target certificate with the highest current priority as the current authentication certificate to the server so that the server can perform authentication based on the current authentication certificate.
[0085] Optionally, the certificate filtering criteria include: certificate type and certificate issuing authority.
[0086] Optionally, the device further includes:
[0087] If the receiving unit 20 receives a successful authentication message from the server, the recording unit is used to record the current authentication certificate as the certificate associated with the target service.
[0088] Optionally, the device further includes a deletion unit:
[0089] If the receiving unit 20 receives an authentication failure message from the server, the deletion unit is used to delete the current authentication certificate from the target certificate list, and the sending unit 23 is used to perform the step of sending the target certificate with the highest priority as the current authentication certificate to the server, until the receiving unit 20 receives an authentication success message from the server, or there is no available certificate in the target certificate list.
[0090] Optionally, the device further includes:
[0091] The verification unit is used to perform security policy verification on the current authentication certificate to determine whether the current authentication certificate can be used for the authentication of the target service.
[0092] Optionally, the device further includes a determination unit:
[0093] If the determination unit determines that a certificate associated with the target service is maintained locally, the sending unit 23 is used to send the certificate to the server so that the server can perform authentication based on the current authentication certificate.
[0094] These units can be one or more integrated circuits configured to implement the above methods, such as one or more Application Specific Integrated Circuits (ASICs), one or more digital signal processors (DSPs), or one or more Field Programmable Gate Arrays (FPGAs). Alternatively, when one of these units is implemented using processing element scheduler code, the processing element can be a general-purpose processor, such as a Central Processing Unit (CPU) or other processor capable of calling program code. Furthermore, these units can be integrated together to form a system-on-a-chip (SOC).
[0095] Furthermore, regarding the certificate management device provided in this application embodiment, from a hardware perspective, the hardware architecture diagram of the certificate management device can be found in [reference needed]. Figure 3 As shown, the certificate management device may include: a memory 30 and a processor 31.
[0096] The memory 30 is used to store program instructions; the processor 31 calls the program instructions stored in the memory 30 and executes the above method embodiment according to the obtained program instructions. The specific implementation method and technical effect are similar, and will not be described again here.
[0097] Optionally, this application also provides a client, including at least one processing element (or chip) for performing the above method embodiments.
[0098] Optionally, this application also provides a program product, such as a computer-readable storage medium storing computer-executable instructions for causing the computer to perform the above-described method embodiments.
[0099] Here, a machine-readable storage medium can be any electronic, magnetic, optical, or other physical storage device that can contain or store information, such as executable instructions, data, etc. For example, a machine-readable storage medium can be: RAM (Random Access Memory), volatile memory, non-volatile memory, flash memory, storage drives (such as hard disk drives), solid-state drives, any type of storage disk (such as optical discs, DVDs, etc.), or similar storage media, or combinations thereof.
[0100] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer, which can take the form of a personal computer, laptop computer, cellular phone, camera phone, smartphone, personal digital assistant, media player, navigation device, email sending and receiving device, game console, tablet computer, wearable device, or any combination of these devices.
[0101] For ease of description, the above devices are described separately by function as various units. Of course, in implementing this application, the functions of each unit can be implemented in one or more software and / or hardware.
[0102] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, embodiments of this application can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.
[0103] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.
[0104] Furthermore, these computer program instructions can also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in the process. Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.
[0105] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.
[0106] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.
Claims
1. A certificate management method characterized by comprising: The method is applied to a client, and comprises the following steps: receiving a request for obtaining a certificate sent by a server, wherein the client sends an authentication request to the server when it is determined that authentication is required before executing a target service; the request for obtaining the certificate comprises a certificate screening condition; traversing a local certificate library to screen a target certificate list matching the certificate screening condition from the local certificate library; if the target certificate list comprises a plurality of target certificates, performing priority sorting on the plurality of target certificates based on a certificate validity period and / or a certificate key length of each target certificate; sending a target certificate with a highest current priority as a current authentication certificate to the server, so that the server performs authentication based on the current authentication certificate.
2. The method of claim 1, wherein, The certificate screening condition comprises a certificate type and a certificate issuing authority.
3. The method of claim 1, wherein, The method further comprises the following steps: if a message of successful authentication fed back by the server is received, recording the current authentication certificate as a certificate associated with the target service.
4. The method according to any one of claims 1 to 3, characterized in that, if a message of failed authentication fed back by the server is received, deleting the current authentication certificate from the target certificate list, and performing the step of sending a target certificate with a highest current priority as a current authentication certificate to the server until a message of successful authentication fed back by the server is received or there is no available certificate in the target certificate list.
5. The method according to any one of claims 1 to 3, wherein The method further comprises the following steps: performing security policy checking on the current authentication certificate to determine whether the current authentication certificate can be used for authentication of the target service.
6. The method of claim 3, wherein, The method further comprises the following steps: if it is determined that a certificate associated with the target service is maintained locally, sending the certificate to the server, so that the server performs authentication based on the current authentication certificate.
7. A certificate management apparatus characterized by comprising: The device is applied to a client, and comprises the following units: a receiving unit configured to receive a request for obtaining a certificate sent by a server, wherein the client sends an authentication request to the server when it is determined that authentication is required before executing a target service; the request for obtaining the certificate comprises a certificate screening condition; a matching unit configured to traverse a local certificate library to screen a target certificate list matching the certificate screening condition from the local certificate library; an ordering unit configured to, if the target certificate list comprises a plurality of target certificates, perform priority sorting on the plurality of target certificates based on a certificate validity period and / or a certificate key length of each target certificate; a sending unit configured to send a target certificate with a highest current priority as a current authentication certificate to the server, so that the server performs authentication based on the current authentication certificate.
8. The apparatus of claim 7, wherein, The device further comprises a deleting unit: if the receiving unit receives a message of failed authentication fed back by the server, the deleting unit is configured to delete the current authentication certificate from the target certificate list, and the sending unit is configured to perform the step of sending a target certificate with a highest current priority as a current authentication certificate to the server until the receiving unit receives a message of successful authentication fed back by the server or there is no available certificate in the target certificate list.
9. A certificate management apparatus characterized by comprising: The certificate management device comprises: a memory configured to store program instructions; a processor configured to invoke program instructions stored in the memory to perform the steps of the method of any of claims 1-6 in accordance with the obtained program instructions.
10. A computer-readable storage medium, characterized in that, The computer readable storage medium stores computer executable instructions for causing the computer to perform the steps of the method of any of claims 1-6.