Certificate updating method and device, computer device and storage medium

Abstract

The application relates to a certificate updating method and device, a computer device and a storage medium. The method comprises the following steps: when address updating information corresponding to a target virtual address of a load balancer is acquired, a first timing task is executed; when the execution time length of the first timing task is less than or equal to a first delay time length, an updating type is determined according to the address updating information; when the updating type is a delay updating certificate, a time stamp when the address updating information is acquired and the address updating information are packaged into a to-be-executed task and added to a first delay queue; and the first consumption thread executes the to-be-executed task in the first delay queue with a waiting time length greater than the first delay time length to update the certificate according to a preset period, so that the certificate between the load balancer and the key server is kept consistent without adding an additional synchronization mechanism, thereby solving the problem that the existing synchronization mechanism for updating the certificate increases the system complexity.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a certificate renewal method, apparatus, computer device, and storage medium. Background Technology

[0002] In modern computer networks, load balancing systems are key components for achieving high availability and scalability. Layer 7 load balancers (like Tengine) play a crucial role in handling application layer protocols such as HTTP / HTTPS. However, when using a key server for certificate management, the reload schedulers for Tengine and keyserver may be inconsistent. This can lead to discrepancies in the underlying configurations of Tengine and keyserver during certificate updates, meaning that certificate consistency between Tengine and keyserver cannot be guaranteed. This impacts service operation and security. Current solutions employ additional, complex synchronization mechanisms for certificate updates between Tengine and keyserver, but these mechanisms increase system complexity. Summary of the Invention

[0003] This application provides a certificate update method, apparatus, computer device, and storage medium to address the problem that existing certificate update synchronization mechanisms increase system complexity.

[0004] Firstly, this application provides a certificate renewal method applied to a load balancer, the method comprising:

[0005] When the address update information corresponding to the target virtual address of the load balancer is obtained, a first scheduled task is executed, wherein the target virtual address is the virtual address corresponding to any application layer protocol supported by the load balancer, and the first scheduled task is used to reload the configuration file required by the load balancer for information update.

[0006] When the execution duration of the first scheduled task is less than or equal to the first delay duration, the update type is determined according to the address update information. The first delay duration is the execution duration of the second scheduled task when the key server and the load balancer simultaneously receive the address update information. The second scheduled task is used to reload the configuration file required by the key server for information update.

[0007] When the update type is a delayed certificate update, the timestamp of the address update information obtained and the address update information are packaged into a task to be executed and added to the first delayed queue.

[0008] The first consumer thread periodically executes pending tasks in the first delay queue whose waiting time is longer than the first delay time to update certificates according to a preset period. The waiting time indicates the time difference between the acquisition timestamp of the corresponding pending task and the execution timestamp of the first consumer thread.

[0009] Secondly, this application provides a certificate update method applied to a key server, the method comprising:

[0010] When the address update information corresponding to the target virtual address is obtained, a second scheduled task is executed. The second scheduled task is used to reload the configuration file required by the key server for information update. The execution duration of the second scheduled task is used as the first delay duration for the load balancer to perform certificate delayed update.

[0011] When the update operation in the address update information is to update the certificate, the cached certificate corresponding to the target virtual address is copied to a preset directory. The cached certificate in the preset directory is used by the load balancer to access the certificate during the certificate update process of the key server.

[0012] When the second scheduled task finishes execution, the target certificate in the address update information replaces the cached certificate to complete the certificate update, wherein the update timestamp of the target certificate in the key server is earlier than the update timestamp of the target certificate in the load balancer.

[0013] Thirdly, this application provides a certificate renewal apparatus, the apparatus comprising:

[0014] The first acquisition module is used to execute a first timed task when it acquires the address update information corresponding to the target virtual address of the load balancer. The target virtual address is the virtual address corresponding to any application layer protocol supported by the load balancer. The first timed task is used to reload the configuration file required by the load balancer for information update.

[0015] The first determining module is used to determine the update type based on the address update information when the execution duration of the first scheduled task is less than or equal to the first delay duration. The first delay duration is the execution duration of the second scheduled task when the key server and the load balancer simultaneously receive the address update information. The second scheduled task is used to reload the configuration file required by the key server for information update.

[0016] The first delay processing module is used to package the timestamp of the address update information obtained and the address update information into a task to be executed and add it to the first delay queue when the update type is delayed update certificate.

[0017] The first execution module is used to periodically execute pending tasks in the first delay queue whose waiting time is longer than the first delay time through the first consumer thread according to a preset period to update certificates. The waiting time indicates the time difference between the acquisition timestamp of the corresponding pending task and the execution timestamp of the first consumer thread.

[0018] Fourthly, this application provides a certificate renewal apparatus, the apparatus comprising:

[0019] The second acquisition module is used to execute a second scheduled task when the address update information corresponding to the target virtual address is acquired. The second scheduled task is used to reload the configuration file required by the key server for information update. The execution duration of the second scheduled task is used as the first delay duration for the load balancer to perform certificate delayed update.

[0020] The copy module is used to copy the cached certificate corresponding to the target virtual address to a preset directory when the update operation in the address update information is to update the certificate. The cached certificate in the preset directory is used by the load balancer to access the certificate during the certificate update process of the key server.

[0021] The certificate update module is used to replace the cached certificate with the target certificate in the address update information to complete the certificate update when the second scheduled task ends, wherein the update timestamp of the target certificate in the key server is earlier than the update timestamp of the target certificate in the load balancer.

[0022] Fifthly, this application provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the above-described certificate update method.

[0023] Sixthly, this application also provides a computer storage medium storing computer-executable instructions for executing the above-described certificate update method.

[0024] Compared with the prior art, the technical solution provided in this application embodiment has the following advantages: The method provided in this application embodiment, upon obtaining the address update information corresponding to the target virtual address of the load balancer, executes a first scheduled task, wherein the target virtual address is the virtual address corresponding to any application layer protocol supported by the load balancer, and the first scheduled task is used to reload the configuration file required by the load balancer for information updates; when the execution duration of the first scheduled task is less than or equal to a first delay duration, the update type is determined according to the address update information, wherein the first delay duration is the time required for the key server to execute the update information in conjunction with the load balancer. When the address update information is received, the execution duration of the second scheduled task is set. The second scheduled task is used to reload the configuration file required by the key server for information update. When the update type is a delayed certificate update, the acquisition timestamp when the address update information is obtained and the address update information are packaged into a task to be executed and added to the first delayed queue. The first consumer thread executes the tasks to be executed in the first delayed queue with a waiting time longer than the first delayed duration at preset intervals to update the certificate. The waiting time indicates the time difference between the acquisition timestamp of the corresponding task to be executed and the execution timestamp of the first consumer thread.

[0025] Based on the above method, since the load balancer takes less time to execute the first scheduled task than the key server takes to execute the second scheduled task, if the load balancer determines that the update type is delayed certificate update after completing the first scheduled task, it will wait for the key server to complete the second scheduled task before updating the certificate. That is, the load balancer achieves certificate synchronization with the key server through delayed certificate update. The above method does not require an additional synchronization mechanism and can achieve certificate consistency between the load balancer and the key server without adding an additional synchronization mechanism, thereby solving the problem that the existing certificate update synchronization mechanism increases system complexity. Attached Figure Description

[0026] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.

[0027] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0028] One or more embodiments are illustrated by way of example with reference numerals in the accompanying drawings. These illustrations do not constitute a limitation on the embodiments. Elements with the same reference numerals in the drawings are denoted as similar elements. Unless otherwise stated, the figures in the drawings are not to be limited by scale.

[0029] Figure 1 An application environment diagram for a certificate update method provided in this application embodiment;

[0030] Figure 2 A flowchart illustrating a certificate update method provided in an embodiment of this application;

[0031] Figure 3 A flowchart illustrating a certificate update method provided in an embodiment of this application;

[0032] Figure 4 A flowchart illustrating a certificate update method provided in an embodiment of this application;

[0033] Figure 5 A flowchart illustrating a certificate update method provided in an embodiment of this application;

[0034] Figure 6 A flowchart illustrating a certificate update method provided in an embodiment of this application;

[0035] Figure 7 A flowchart illustrating a certificate update method provided in an embodiment of this application;

[0036] Figure 8 A structural block diagram of a certificate renewal device provided in an embodiment of this application;

[0037] Figure 9 A structural block diagram of a certificate renewal device provided in an embodiment of this application;

[0038] Figure 10 This is a schematic diagram of the internal structure of a computer device provided in an embodiment of this application. Detailed Implementation

[0039] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0040] The following disclosure provides numerous different embodiments or examples for implementing various structures of the invention. To simplify the disclosure, specific examples of components and arrangements are described below. These are merely examples and are not intended to limit the scope of the invention. Furthermore, reference numerals and / or letters may be repeated in different examples. Such repetition is for simplification and clarity and does not in itself indicate a relationship between the various embodiments and / or arrangements discussed.

[0041] Figure 1 This is a diagram illustrating the application environment of a certificate update method in one embodiment. (Refer to...) Figure 1 This certificate renewal method is applied to a certificate renewal system. The certificate renewal system includes a load balancer 110 and a key server 120. The load balancer 110 and the key server 120 are connected via a network. The load balancer 110 or the key server 120 can be implemented using a standalone server or a server cluster consisting of multiple servers.

[0042] In one embodiment, Figure 2 This is a flowchart illustrating a certificate update method in one embodiment, with reference to... Figure 2 This provides a certificate renewal method. This embodiment primarily applies this method to the aforementioned... Figure 1 Taking load balancer 110 as an example, the certificate renewal method specifically includes the following steps:

[0043] Step S210: When the address update information corresponding to the target virtual address of the load balancer 110 is obtained, a first timed task is executed, wherein the target virtual address is the virtual address corresponding to any application layer protocol supported by the load balancer 110, and the first timed task is used to reload the configuration file required by the load balancer 110 for information update.

[0044] Specifically, the address update information is the operation information sent by the backend administrator to the certificate update system through the client. This information is used to update the configuration corresponding to the target virtual address. The target virtual address is the virtual address (VIP, Virtual IP) corresponding to any application layer protocol supported by the load balancer 110. This virtual address is also called the front-end IP or public IP of the load balancer 110. When a client sends a request to the load balancer 110, it is actually sent to the IP address corresponding to the VIP, rather than directly to the backend server. The VIP serves as the entry IP address of the load balancer 110, allowing clients to access the services provided by the load balancer 110. The VIP provides a unified entry point, simplifying the client access process.

[0045] Address update information can be used to update the digital certificate, parameters, or delete the digital certificate of a target virtual address. The address update information includes the target virtual address, the update operation performed on the target virtual address (e.g., updating the certificate, updating parameters, or deletion), and if the update operation is to update the certificate, the address update information also includes the certificate identifier of the target certificate to be updated. If the update operation is to update parameters, the address update information also includes the parameter data to be updated for the target virtual address.

[0046] The first scheduled task is the reload scheduled task corresponding to load balancer 110. After executing the first scheduled task, load balancer 110 will execute the update operation in the address update information.

[0047] Step S220: When the execution duration of the first scheduled task is less than or equal to the first delay duration, the update type is determined according to the address update information. The first delay duration is the execution duration of the second scheduled task when the key server 120 and the load balancer 110 simultaneously receive the address update information. The second scheduled task is used to reload the configuration file required by the key server 120 for information update.

[0048] Specifically, if the execution time of the first scheduled task is less than the first delay time, it means that the load balancer 110 takes less time to reload the configuration file than the key server 120. If the update operation in the address update information is to update the certificate, and the load balancer 110 updates the certificate immediately after executing the first scheduled task, it may result in the key server 120's certificate not being successfully reloaded while the load balancer 110 has already completed its configuration reload. In this case, when the load balancer 110 requests a new certificate from the key server 120, it may obtain the old certificate, which will affect the normal operation and security of the service.

[0049] Therefore, in order to prevent the above phenomenon from occurring, it is necessary to determine the update type as delayed certificate update, immediate certificate update, or immediate parameter update based on the update operation in the address update information. The update type is used to indicate whether the update operation in the address update information is executed immediately or delayed.

[0050] Step S230: When the update type is a delayed certificate update, the timestamp of the acquisition when the address update information is obtained and the address update information are packaged into a task to be executed and added to the first delayed queue.

[0051] Specifically, when the update type is delayed certificate update, it means that after the load balancer 110 completes the first scheduled task, it cannot immediately update the certificate. Instead, it packages the timestamp of the obtained address update information and the address update information into a task to be executed and adds it to the first delayed queue. The first delayed queue is used to store tasks that need to be executed with a delay. The first delayed queue is denoted as Delay Queue.

[0052] Step S240: The first consumer thread periodically executes the pending tasks in the first delay queue whose waiting time is longer than the first delay time according to a preset period to update the certificate. The waiting time indicates the time difference between the acquisition timestamp of the corresponding pending task and the execution timestamp of the first consumer thread.

[0053] Specifically, the first consumer thread periodically executes tasks in the first delay queue whose waiting time exceeds the first delay duration for certificate updates. The waiting time refers to the time difference between the timestamp of the corresponding address update information acquisition and the execution timestamp of the first consumer thread. A task will only be executed by the first consumer thread if its waiting time exceeds the first delay duration. This means that the load balancer 110 will only perform certificate updates after the key server 120 has completed the second scheduled task. If the update operation in the address update information is a certificate update after the key server 120 has completed the second scheduled task, it will immediately begin the certificate update process. This ensures that the load balancer 110 and the key server 120 can perform certificate updates synchronously and that their certificate states remain consistent. This method eliminates the need for additional synchronization mechanisms, achieving certificate consistency between the load balancer 110 and the key server 120 without requiring additional synchronization mechanisms. This solves the problem of increased system complexity caused by existing certificate update synchronization mechanisms.

[0054] In one embodiment, such as Figure 3 As shown, the step of updating certificates by periodically executing pending tasks in the first delay queue with a waiting time longer than the first delay time through the first consumer thread according to a preset period includes:

[0055] Step S2401: Within a preset time period before the execution timestamp of the first consumer thread in the current execution cycle, transfer the pending tasks in the first delay queue whose waiting time is less than or equal to the first delay time to the second delay queue.

[0056] Step S2401: The first consumer thread performs certificate updates by executing the remaining pending tasks in the first delay queue within the current execution cycle.

[0057] Specifically, within a preset time period before the execution timestamp of the current execution cycle, the first consumer thread transfers tasks awaiting execution in the first delay queue with a waiting time less than or equal to the first delay duration to the second delay queue, denoted as the Delay task. The preset time period can be 3 seconds, 5 seconds, or 10 seconds. This means that as the first consumer thread approaches executing tasks in the first delay queue, the second delay queue stores tasks with a waiting time not exceeding the first delay duration. This allows the first consumer thread to execute the remaining tasks in the first delay queue uniformly when the current execution cycle arrives, completing the certificate update for one execution cycle. This prevents the first consumer thread from mistakenly executing tasks with a waiting time less than the first delay duration, which could cause the load balancer 110 to prematurely update the certificate relative to the key server 120.

[0058] In one embodiment, such as Figure 4 As shown, after the first consumer thread performs certificate updates by executing the remaining tasks to be executed in the first delay queue during the current execution cycle, the method further includes:

[0059] Step S2403: When the current execution cycle of the first consumer thread ends, the tasks to be executed in the second delay queue are transferred back to the first delay queue.

[0060] Enter the next loop and re-execute step S2401. Within a preset time period before the execution timestamp of the first consumer thread in the next execution cycle, transfer the pending tasks in the first delay queue whose waiting time is less than or equal to the first delay time to the second delay queue.

[0061] Enter the next loop and re-execute step S2402. In the next execution cycle, the first consumer thread executes the remaining pending tasks in the first delay queue to update the certificate.

[0062] Specifically, at the end of the current execution cycle of the first consumer thread, the tasks to be executed in the second delay queue are put back into the first delay queue to continue waiting. Then, the waiting time of the next cycle is compared with the first delay time. At this time, the waiting time refers to the time difference between the timestamp obtained and the execution timestamp of the first consumer thread in the new execution cycle. Before the first consumer thread executes the tasks to be executed in the first delay queue, the tasks to be executed in the first delay queue with a waiting time not exceeding the first delay time are transferred to the second delay queue. The remaining tasks to be executed in the first delay queue are then executed by the first consumer thread in the next execution cycle. That is, the next execution cycle is used as the current execution cycle to re-execute the above steps S2401 to S2403.

[0063] Before the start of each execution cycle, the storage of the first delay queue and the second delay queue are checked, which is equivalent to a cyclical check of the execution cycle. At the start of the execution cycle, the first consumer thread consumes and executes the remaining tasks to be executed in the first delay queue. The first and second delay queues are used to delay the execution of tasks with different timestamps to ensure that the execution time of each task to be executed is after the key server 120 has completed the second timed task, thereby ensuring that the certificate update corresponding to each task to be executed is synchronized with the certificate update of the key server 120.

[0064] In one embodiment, determining the update type based on the address update information includes at least one of the following:

[0065] When the update operation in the address update information is to update the certificate, and the access status of the update operation for the key server 120 is "access required", the update type is determined to be a delayed certificate update.

[0066] If the update operation in the address update information is to update the certificate, but the access status of the update operation for the key server 120 is not required, then the update type is determined to be timely certificate update.

[0067] When the update operation in the address update information is an update parameter or a deletion operation, the update type is determined to be a timely update parameter.

[0068] Specifically, the update operation in the address update information is a certificate update, indicating that the address update information is used to update the digital certificate of the target virtual address. This means that the certificate identifier of the digital certificate for the target virtual address in the local cache of the load balancer 110 is inconsistent with the certificate identifier of the target certificate in the address update information. Therefore, the digital certificate corresponding to the target virtual address in the cache needs to be replaced with the target certificate from the address update information. Next, it is determined whether this certificate update operation requires access to the key server 120. If the `use_keyserver` parameter in the address update information is `True`, it indicates that access to the key server 120 is required. Since access to the key server 120 is required, the certificate update needs to be performed after the second scheduled task is completed on the key server 120. Therefore, the update type is determined to be a delayed certificate update.

[0069] If the use_keyserver parameter in the address update information is False, it means that the update operation does not need to access the key server 120. In this case, the load balancer 110 can directly execute the update operation without waiting for the key server 120 to complete the certificate update. Therefore, the update type is determined to be timely certificate update.

[0070] Updating parameters refers to updating parameters other than the certificate corresponding to the target virtual address. The deletion operation can be either a certificate deletion operation or a parameter deletion operation. The certificate deletion operation deletes the existing digital certificate in the cache, and the parameter deletion operation deletes the target parameter corresponding to the target virtual address. If the update operation in the address update information is either an update parameter or a deletion operation, since neither update parameter nor deletion operation requires access to the key server 120, the load balancer 110 can directly execute the update operation without waiting for the key server 120 to complete the certificate update. Therefore, the update type can be determined to be an immediate update parameter.

[0071] In one embodiment, such as Figure 5 As shown, after determining the update type based on the address update information, the method further includes:

[0072] Step S250: When the update type is timely certificate update or timely parameter update, immediately perform the corresponding update operation according to the address update information.

[0073] Specifically, when the update type is "timely certificate update" or "timely parameter update", it means that the update operation corresponding to this update type can be executed immediately without waiting for the cryptographic server to complete the certificate update. Therefore, the corresponding update operation is executed according to the address update information to immediately execute the parameter update or deletion operation.

[0074] In one embodiment, such as Figure 6 As shown, a certificate update method is provided, applied to a key server 120, the method comprising:

[0075] Step S310: When the address update information corresponding to the target virtual address is obtained, a second scheduled task is executed. The second scheduled task is used to reload the configuration file required by the key server 120 for information update. The execution duration of the second scheduled task is used as the first delay duration for the load balancer 110 to perform certificate delay update.

[0076] Specifically, the address update information is sent to both the key server 120 and the load balancer 110 simultaneously. Since the execution time of the second scheduled task by the key server 120 is longer than the execution time of the first scheduled task by the load balancer 110, the load balancer 110 needs to wait for the key server 120 to execute the second scheduled task and complete the certificate update before performing the certificate update itself. Therefore, the execution time of the second scheduled task by the key server 120 is used as the first delay time for the load balancer 110 to perform the certificate delayed update.

[0077] Step S320: When the update operation in the address update information is to update the certificate, the cached certificate corresponding to the target virtual address is copied to a preset directory. The cached certificate in the preset directory is used by the load balancer 110 to access the certificate during the certificate update process of the key server 120.

[0078] Specifically, a cached certificate refers to an old version certificate corresponding to the target virtual address in the local cache of the key server 120. When the update operation in the address update information is to update the certificate, the key server 120 will copy the cached certificate corresponding to the target virtual address in the local cache to a preset directory. That is, the load balancer 110 can continue to obtain the old version certificate by accessing the preset directory, thus avoiding the old version cached certificate used by the load balancer 110 from becoming invalid during the certificate update process of the key server 120.

[0079] Step S330: When the second timed task finishes execution, the target certificate in the address update information replaces the cached certificate to complete the certificate update, wherein the update timestamp of the target certificate in the key server 120 is earlier than the update timestamp of the target certificate in the load balancer 110.

[0080] Specifically, when the key server 120 completes the second scheduled task, it begins certificate updates, replacing the cached certificate with the target certificate from the address update information. Since the load balancer 110 waits for the key server 120 to complete the second scheduled task before performing the certificate update through the first consumer thread, and the first consumer thread runs periodically according to a preset schedule, it doesn't start immediately after the key server 120 completes the second scheduled task. It likely starts running after the key server 120 has completed the certificate update. Therefore, it can be ensured that the target certificate's update timestamp on the key server 120 is earlier than the target certificate's update timestamp on the cached certificate. The update timestamp in load balancer 110 means that load balancer 110 can update its certificate after key server 120 completes the certificate update, thus ensuring that the certificate status of load balancer 110 and key server 120 are consistent. This effectively solves the certificate update inconsistency and security problems caused by the inconsistent reload schedule of load balancer 110 and key server 120. No additional synchronization logic is needed to ensure the consistency of certificate status between load balancer 110 and key server 120, thereby reducing system complexity and helping to reduce the risk of service interruption and leakage of sensitive information, and improving user experience.

[0081] In one embodiment, such as Figure 7 As shown, after obtaining the address update information corresponding to the target virtual address and executing the second timed task, the method further includes:

[0082] Step S340: When the update operation in the address update information is a certificate deletion operation, the timestamp of the acquisition when the address update information is acquired and the address update information are packaged into a task to be executed and added to the third delay queue.

[0083] Step S350: The second consumer thread periodically executes the pending tasks in the third delay queue whose delay duration is greater than the second delay duration. The second delay duration is the update duration for the load balancer 110 to delete the certificate of the target virtual address when the load balancer 110 and the key server 120 simultaneously receive the address update information.

[0084] Specifically, the certificate deletion operation is used to delete digital certificates in the local cache. If the update operation in the address update information is a certificate deletion operation, in order to prevent the load balancer 110 from needing to access the certificate to be deleted in the key server 120, the timestamp of the address update information acquisition and the address update information are packaged into a task to be executed and added to the third delay queue for delayed execution. The second consumer thread periodically executes the task to be executed in the third delay queue with a delay duration longer than the second delay duration. The second delay duration is the update duration for the load balancer 110 to delete the same certificate. The key server 120 can ensure that the certificate is deleted only after the load balancer 110 deletes the certificate to be deleted indicated in the address update information. This ensures that the certificate has enough time for the load balancer 110 to use before deletion.

[0085] Figures 2 to 7 This is a flowchart illustrating a certificate update method in one embodiment. It should be understood that, although... Figures 2 to 7 The steps in the flowchart are shown sequentially as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order in which these steps are executed, and they can be performed in other orders. Figures 2 to 7 At least some of the steps in the process may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least some of the sub-steps or stages of other steps.

[0086] In one embodiment, such as Figure 8 As shown, a certificate renewal device is provided, comprising:

[0087] The first acquisition module 410 is used to execute a first timed task when it acquires the address update information corresponding to the target virtual address of the load balancer 110. The target virtual address is the virtual address corresponding to any application layer protocol supported by the load balancer 110. The first timed task is used to reload the configuration file required by the load balancer 110 for information update.

[0088] The first determining module 420 is used to determine the update type based on the address update information when the execution duration of the first scheduled task is less than or equal to the first delay duration. The first delay duration is the execution duration of the second scheduled task when the key server 120 and the load balancer 110 simultaneously receive the address update information. The second scheduled task is used to reload the configuration file required by the key server 120 for information update.

[0089] The first delay processing module 430 is used to package the acquisition timestamp when the address update information is acquired and the address update information into a task to be executed and add it to the first delay queue when the update type is delayed update certificate.

[0090] The first execution module 440 is used to periodically execute pending tasks in the first delay queue with a waiting time longer than the first delay time through the first consumer thread according to a preset period to update certificates. The waiting time indicates the time difference between the acquisition timestamp of the corresponding pending task and the execution timestamp of the first consumer thread.

[0091] In one embodiment, the first execution module 440 is further configured to:

[0092] Within a preset time period before the execution timestamp of the first consumer thread in the current execution cycle, tasks waiting to be executed in the first delay queue with a waiting time less than or equal to the first delay time are transferred to the second delay queue;

[0093] The first consumer thread performs certificate updates by executing the remaining pending tasks in the first delay queue within the current execution cycle.

[0094] In one embodiment, the first execution module 440 is further configured to:

[0095] When the current execution cycle of the first consumer thread ends, the tasks to be executed in the second delay queue are transferred back to the first delay queue;

[0096] Within a preset time period before the execution timestamp of the first consumer thread in the next execution cycle, tasks waiting to be executed in the first delay queue with a waiting time less than or equal to the first delay time are transferred to the second delay queue;

[0097] The first consumer thread performs certificate updates by executing the remaining pending tasks in the first delayed queue during the next execution cycle.

[0098] In one embodiment, the first determining module 420 is further configured to:

[0099] When the update operation in the address update information is to update the certificate, and the access status of the update operation for the key server 120 is "access required", the update type is determined to be a delayed certificate update.

[0100] If the update operation in the address update information is to update the certificate, but the access status of the update operation for the key server 120 is not required, then the update type is determined to be timely certificate update.

[0101] When the update operation in the address update information is an update parameter or a deletion operation, the update type is determined to be a timely update parameter.

[0102] In one embodiment, the apparatus further includes a timely processing module for:

[0103] When the update type is timely certificate update or timely parameter update, the corresponding update operation is immediately executed according to the address update information.

[0104] In one embodiment, such as Figure 9 As shown, a certificate update device is provided, applied to a key server 120, the certificate update device comprising:

[0105] The second acquisition module 510 is used to execute a second scheduled task when the address update information corresponding to the target virtual address is acquired. The second scheduled task is used to reload the configuration file required by the key server 120 for information update. The execution duration of the second scheduled task is used as the first delay duration for the load balancer 110 to perform certificate delay update.

[0106] The copy module 520 is used to copy the cached certificate corresponding to the target virtual address to a preset directory when the update operation in the address update information is to update the certificate. The cached certificate in the preset directory is used by the load balancer 110 to access and use during the certificate update process of the key server 120.

[0107] The certificate update module 530 is used to replace the cached certificate with the target certificate in the address update information to complete the certificate update when the second scheduled task ends, wherein the update timestamp of the target certificate in the key server 120 is earlier than the update timestamp of the target certificate in the load balancer 110.

[0108] In one embodiment, the apparatus further includes a deletion module for:

[0109] When the address update information corresponding to the target virtual address is obtained, after executing the second timed task, if the update operation in the address update information is a certificate deletion operation, the timestamp of obtaining the address update information and the address update information are packaged into a task to be executed and added to the third delay queue.

[0110] The second consumer thread periodically executes pending tasks in the third delay queue with a delay duration greater than the second delay duration, wherein the second delay duration is the update duration for the load balancer 110 to delete the certificate of the target virtual address when the load balancer 110 and the key server 120 simultaneously receive the address update information.

[0111] like Figure 10 As shown, this application provides a computer device including a processor 711, a communication interface 712, a memory 713, and a communication bus 714, wherein the processor 711, the communication interface 712, and the memory 713 communicate with each other through the communication bus 714.

[0112] Memory 713 is used to store computer programs;

[0113] When the processor 711 executes the program stored in the memory 713, it implements the certificate update method provided in any of the foregoing method embodiments.

[0114] Those skilled in the art will understand that Figure 10 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0115] In one embodiment, the certificate update device provided in this application can be implemented as a computer program, which can be implemented in the form of, for example, Figure 10 It runs on the computer device shown. The computer device's memory can store the various program modules that make up the certificate update device, for example, Figure 8The first acquisition module 410, the first determination module 420, the first delay processing module 430, and the first execution module 440 are shown. The computer program comprised of these modules causes the processor to execute the certificate update methods described in the various embodiments of this application.

[0116] Figure 10 The computer device shown can be used as follows Figure 8 In the certificate update device shown, the first acquisition module 410 executes a first scheduled task when it acquires address update information corresponding to the target virtual address of the load balancer 110. The target virtual address is any virtual address corresponding to an application layer protocol supported by the load balancer 110. The first scheduled task is used to reload the configuration file required by the load balancer 110 for information updates. The computer device can use the first determination module 420 to determine the update type based on the address update information when the execution duration of the first scheduled task is less than or equal to a first delay duration. The first delay duration is the execution duration of a second scheduled task executed by the key server 120 when it and the load balancer 110 simultaneously receive the address update information. The second scheduled task is used to reload the configuration file required by the key server 120 for information updates. The computer device can use the first delay processing module 430 to package the acquisition timestamp when the address update information is acquired and the address update information into a task to be executed and add it to the first delay queue when the update type is a delayed certificate update. The computer device can use the first execution module 440 to execute the pending tasks in the first delay queue whose waiting time is longer than the first delay time according to a preset period through the first consumer thread to update the certificate. The waiting time indicates the time difference between the acquisition timestamp of the corresponding pending task and the execution timestamp of the first consumer thread.

[0117] This application also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the certificate update method as provided in any of the foregoing method embodiments.

[0118] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0119] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented using software plus a general-purpose hardware platform, or of course, using hardware. Based on this understanding, the above technical solutions, in essence or the parts that contribute to the related technology, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0120] It should be understood that the terminology used herein is for the purpose of describing particular exemplary embodiments only and is not intended to be limiting. Unless the context clearly indicates otherwise, the singular forms “a,” “an,” and “described” as used herein may also mean including the plural forms. The terms “comprising,” “including,” “containing,” and “having” are inclusive and therefore indicate the presence of the stated features, steps, operations, elements, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, elements, components, and / or combinations thereof. The method steps, processes, and operations described herein are not construed as requiring them to be performed in a particular order described or illustrated unless the order of performance is explicitly indicated. It should also be understood that alternatives or substitutions may be used.

[0121] The above description is merely a specific embodiment of the present invention, enabling those skilled in the art to understand or implement the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the present invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features claimed herein.

Claims

1. A certificate renewal method, characterized in that, Applied to load balancers, the method includes: When the address update information corresponding to the target virtual address of the load balancer is obtained, a first scheduled task is executed, wherein the target virtual address is the virtual address corresponding to any application layer protocol supported by the load balancer, and the first scheduled task is used to reload the configuration file required by the load balancer for information update. When the execution duration of the first scheduled task is less than or equal to the first delay duration, the update type is determined according to the address update information. The first delay duration is the execution duration of the second scheduled task when the key server and the load balancer simultaneously receive the address update information. The second scheduled task is used to reload the configuration file required by the key server for information update. When the update type is a delayed certificate update, the timestamp of the address update information obtained and the address update information are packaged into a task to be executed and added to the first delayed queue. The first consumer thread periodically executes pending tasks in the first delay queue whose waiting time is longer than the first delay time to update certificates according to a preset period. The waiting time indicates the time difference between the acquisition timestamp of the corresponding pending task and the execution timestamp of the first consumer thread.

2. The method according to claim 1, characterized in that, The step of updating certificates by periodically executing pending tasks in the first delay queue with a waiting time longer than the first delay time through the first consumer thread according to a preset period includes: Within a preset time period before the execution timestamp of the first consumer thread in the current execution cycle, tasks waiting to be executed in the first delay queue with a waiting time less than or equal to the first delay time are transferred to the second delay queue; The first consumer thread performs certificate updates by executing the remaining pending tasks in the first delay queue within the current execution cycle.

3. The method according to claim 2, characterized in that, After the first consumer thread performs certificate updates by executing the remaining tasks in the first delayed queue during the current execution cycle, the method further includes: When the current execution cycle of the first consumer thread ends, the tasks to be executed in the second delay queue are transferred back to the first delay queue; Within a preset time period before the execution timestamp of the first consumer thread in the next execution cycle, tasks waiting to be executed in the first delay queue with a waiting time less than or equal to the first delay time are transferred to the second delay queue; The first consumer thread performs certificate updates by executing the remaining pending tasks in the first delayed queue during the next execution cycle.

4. The method according to claim 1, characterized in that, Determining the update type based on the address update information includes at least one of the following: When the update operation in the address update information is to update the certificate, and the access status of the update operation to the key server is "access required", the update type is determined to be a delayed certificate update. If the update operation in the address update information is to update the certificate, but the access status of the update operation to the key server is not required, then the update type is determined to be timely certificate update. When the update operation in the address update information is an update parameter or a deletion operation, the update type is determined to be a timely update parameter.

5. The method according to claim 4, characterized in that, After determining the update type based on the address update information, the method further includes: When the update type is timely certificate update or timely parameter update, the corresponding update operation is immediately executed according to the address update information.

6. A certificate renewal method, characterized in that, Applied to a key server, the method includes: When the address update information corresponding to the target virtual address is obtained, a second scheduled task is executed. The second scheduled task is used to reload the configuration file required by the key server for information update. The execution duration of the second scheduled task is used as the first delay duration for the load balancer to perform certificate delayed update. When the update operation in the address update information is to update the certificate, the cached certificate corresponding to the target virtual address is copied to a preset directory. The cached certificate in the preset directory is used by the load balancer to access the certificate during the certificate update process of the key server. When the second scheduled task finishes execution, the target certificate in the address update information replaces the cached certificate to complete the certificate update, wherein the update timestamp of the target certificate in the key server is earlier than the update timestamp of the target certificate in the load balancer.

7. The method according to claim 6, characterized in that, Upon obtaining the address update information corresponding to the target virtual address, after executing the second timed task, the method further includes: When the update operation in the address update information is a certificate deletion operation, the timestamp of the acquisition when the address update information was obtained and the address update information are packaged into a task to be executed and added to the third delay queue; The second consumer thread periodically executes pending tasks in the third delay queue with a delay duration greater than the second delay duration, wherein the second delay duration is the update duration for the load balancer to delete the certificate of the target virtual address when it and the key server simultaneously receive the address update information.

8. A certificate renewal device, characterized in that, The device includes: The first acquisition module is used to execute a first scheduled task when it acquires the address update information corresponding to the target virtual address of the load balancer. The target virtual address is the virtual address corresponding to any application layer protocol supported by the load balancer. The first scheduled task is used to reload the configuration file required by the load balancer for information update. The first determining module is used to determine the update type based on the address update information when the execution duration of the first scheduled task is less than or equal to the first delay duration. The first delay duration is the execution duration of the second scheduled task when the key server and the load balancer simultaneously receive the address update information. The second scheduled task is used to reload the configuration file required by the key server for information update. The first delay processing module is used to package the timestamp of the address update information obtained and the address update information into a task to be executed and add it to the first delay queue when the update type is delayed update certificate. The first execution module is used to periodically execute pending tasks in the first delay queue whose waiting time is longer than the first delay time through the first consumer thread according to a preset period to update certificates. The waiting time indicates the time difference between the acquisition timestamp of the corresponding pending task and the execution timestamp of the first consumer thread.

9. A certificate renewal device, characterized in that, The device includes: The second acquisition module is used to execute a second scheduled task when the address update information corresponding to the target virtual address is acquired. The second scheduled task is used to reload the configuration file required by the key server for information update. The execution duration of the second scheduled task is used as the first delay duration for the load balancer to perform certificate delayed update. The copy module is used to copy the cached certificate corresponding to the target virtual address to a preset directory when the update operation in the address update information is to update the certificate. The cached certificate in the preset directory is used by the load balancer to access the certificate during the certificate update process of the key server. The certificate update module is used to replace the cached certificate with the target certificate in the address update information to complete the certificate update when the second scheduled task ends, wherein the update timestamp of the target certificate in the key server is earlier than the update timestamp of the target certificate in the load balancer.

10. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the method of any one of claims 1 to 5 or 6 to 7.

11. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method of any one of claims 1 to 5 or 6 to 7.

Images