A method and system for automated certificate management and dynamic threshold early warning

Abstract

This invention discloses a method and system for automated certificate management and dynamic threshold early warning, relating to the fields of network security and network operation and maintenance management. The method includes: actively probing target servers via the TLS protocol to obtain certificate chains and parse certificate attribute data, comparing them with a filing database to achieve automatic discovery and binding of unmanaged certificate assets; constructing a multi-dimensional association mapping model including certificate entities, application entities, and responsible entity entities to generate a certificate dependency graph; traversing the graph using a breadth-first search algorithm to generate a cascading impact list; collecting historical certificate handling time records of responsible persons, calculating the average and standard deviation to determine personalized early warning lead time, and dynamically setting the early warning trigger time window; and in response to the early warning trigger signal, sending an early warning notification to the associated responsible persons and creating a handling work order with a configured mandatory closed-loop mechanism. This invention achieves proactive discovery and intelligent management of certificate assets throughout their entire lifecycle.

Description

Technical Field

[0001] This invention relates to the fields of network security and network operation and maintenance management technology, specifically to a method and system for automated certificate management and dynamic threshold early warning. Background Technology

[0002] Digital certificates, as a core infrastructure for identity authentication and secure communication in cyberspace, are widely used in critical security scenarios such as trusted identity authentication, data integrity verification, and communication link encryption. With the distributed evolution of enterprise IT architectures and the continuous expansion of business scale, the number of digital certificates has increased dramatically, making their standardized management throughout their entire lifecycle a crucial issue for enterprise network security operations and maintenance.

[0003] Currently, some existing technologies have attempted to explore the automated management of TLS certificates. For example, Chinese invention patent publication CN116938474A proposes an automated TLS certificate management method. This method involves a certificate application server initiating a certificate application or renewal request to a certificate server, which then obtains the issued TLS certificate from the CA and distributes it to the certificate application server. Simultaneously, a certificate client installed on the certificate application server automates the installation and deployment of the certificate. The certificate server periodically monitors the validity period of the installed certificates, automatically triggering the renewal process when the certificate validity period meets the renewal policy. This method achieves, to a certain extent, automated closed-loop management of certificate application, deployment, monitoring, and renewal.

[0004] However, the aforementioned existing technologies still have the following shortcomings: Firstly, the certificate asset discovery in this solution relies on the pre-installation of certificate clients on the certificate server. It cannot proactively discover certificate assets running on servers and network devices without deployed clients, resulting in blind spots in certificate asset management and making it difficult to achieve comprehensive screening and unified management of certificate assets across the entire network.

[0005] Secondly, the early warning mechanism of this solution adopts a fixed strategy for triggering, and fails to dynamically adjust the timing of the early warning according to the differentiated management response capabilities of different responsible entities or business scenarios. In operation and maintenance practice, this can easily lead to a dilemma: early warnings result in a flood of invalid alarms, or early warnings result in the risk of certificate expiration and loss of control.

[0006] Third, the solution treats certificates as independent management objects and does not establish a dependency model between certificates and application systems. When a certificate expires or changes, it cannot automatically identify the affected upstream business systems and responsible persons. Impact assessment relies on manual investigation, resulting in low response efficiency. Summary of the Invention

[0007] To overcome the shortcomings of the existing technology, the present invention provides a method and system for automated certificate management and dynamic threshold early warning.

[0008] A method for automated certificate management and dynamic threshold early warning includes the following steps: Step S1, Automated Detection and Intelligent Management of Certificate Assets: A secure connection is established with the target server through proactive interaction at the protocol level. A handshake process based on the transport layer security protocol is used to obtain the digital certificate chain carried by the target server. The server certificate is extracted from the certificate chain and parsed to obtain certificate attribute data, including public key fingerprint, serial number, issuer, user, validity period, and a list of optional user names. This certificate attribute data is compared with existing certificate records in the filing database. If a matching record exists, the certificate is confirmed to have completed filing. If no matching record is found, the certificate is determined to be a newly discovered unmanaged certificate asset. The ITSM platform is used to obtain the information of the designated application system and responsible person for this newly discovered certificate. The certificate information is then bound to the designated application system and responsible person, completing the certificate filing and automated management.

[0009] The method further includes a multi-source certificate centralized filing step: in response to a certificate filing request initiated by a certificate applicant, the submitted certificate file and associated institution information and application system identifier are obtained, and after review and confirmation by the certificate manager, certificate filing is performed to establish a binding relationship between the certificate and the application.

[0010] The method further includes a certificate reuse management step: constructing a many-to-many mapping relationship model between certificates and applications; when an application system applies to use a registered certificate, identifying the current person in charge of the certificate and triggering the certificate reuse collaboration process; and completing the certificate reuse registration after confirmation by the current person in charge.

[0011] Step S2, Certificate Dependency Graph Construction: A multi-dimensional association mapping model is constructed, which includes certificate entities, application entities, and responsible entity entities. In the model, the certificate entity records the certificate identity and validity period attributes, the application entity records the target host, service port, and business scenario attributes that carry the certificate, and the responsible entity records the personnel identity and contact information attributes. The certificate entity and the application entity establish binding records through an association table, and the application entity and the responsible entity establish attribution records through an association table, thereby forming a directed graph structure with certificate nodes, application nodes, and responsible entity nodes as vertices and binding relationships and attribution relationships as edges, namely, the certificate dependency graph.

[0012] Step S3, Cascade effect analysis based on dependency graph: When any managed certificate triggers an early warning condition, starting from that certificate node, a breadth-first search algorithm is used to traverse the certificate dependency graph, expanding layer by layer along the directed edges to obtain all upstream application system nodes and corresponding responsible person nodes directly or indirectly affected by the certificate, generating a cascading impact list containing affected institutions, affected application systems, and affected responsible persons.

[0013] Step S4, Calculation of dynamic early warning threshold based on historical behavioral characteristics: The system collects records of the processing time for each responsible person to complete the certificate renewal process within a preset sliding window, calculates the average and standard deviation of the processing time records, and uses the average and standard deviation as statistical features reflecting the certificate processing efficiency of the responsible person. Based on the average and standard deviation, the system calculates the warning lead time for the responsible person, and uses the certificate expiration date as a benchmark. The date obtained by subtracting the warning lead time from the certificate expiration date is used as the starting boundary of the warning trigger time window to determine the warning trigger time window. When the current date of the system enters the warning trigger time window, a warning trigger signal is generated for the responsible person.

[0014] The method also includes a trend detection step: monitoring the trend of changes in the processing time of the person in charge in the recent period. If the processing time is detected to be increasing and the increase exceeds a preset threshold, the safety factor used to calculate the advance warning amount is increased.

[0015] Step S5, Cascading early warning notification and mandatory closed-loop control: In response to the warning trigger signal, based on the cascading impact list, a warning notification containing certificate expiration information is sent to all relevant responsible parties via at least one channel, such as email, SMS, or the enterprise instant messaging system. Simultaneously, the ITSM platform interface is invoked to create certificate processing work orders for each relevant responsible party. These work orders are configured with a mandatory closed-loop mechanism, requiring the responsible party to associate a certificate renewal application or certificate revocation application with the work order before closing it. In response to the work order's completion instruction, the specific processing action information associated with the responsible party is obtained and recorded in the system log, and the work order is closed. If any work order is not processed within a preset time limit, an alarm escalation operation is performed, pushing the work order and warning information to the superior management node.

[0016] An automated certificate management and dynamic threshold early warning system is provided to implement the method described above. The system includes: The certificate detection and management module is used to establish a secure connection with the target server through proactive interaction at the protocol layer. Based on the handshake process of the transport layer security protocol, it obtains the digital certificate chain carried by the target server, extracts the server certificate from the certificate chain and parses it to obtain certificate attribute data. The certificate attribute data is compared with the existing certificate records in the filing database. If a matching record is found, it is confirmed that the certificate has been filed. If no matching record is found, the certificate is determined to be a newly discovered unmanaged certificate asset, triggering the certificate filing process to establish the association mapping relationship between the certificate and the application system and the responsible person, thus completing the automated management of certificate assets.

[0017] The centralized certificate filing module is used to respond to certificate filing requests initiated by certificate applicants, obtain the submitted certificate files and associated institution information and application system identifiers, and execute certificate filing after review and confirmation by the certificate manager, thus establishing a binding relationship between the certificate and the application.

[0018] The certificate reuse management module is used to build a many-to-many mapping relationship model between certificates and applications. When an application system applies to use a registered certificate, it identifies the current person in charge of the certificate and triggers the certificate reuse collaboration process. After confirmation by the current person in charge, the certificate reuse registration is completed.

[0019] The dependency management module is used to build a multi-dimensional association mapping model that includes certificate entities, application entities, and responsible persons entities. It records the dependency relationships between certificates and application systems, and between application systems and responsible persons through a directed graph structure, and generates a certificate dependency graph.

[0020] The dynamic threshold early warning module is used to collect the processing time records of each responsible person completing the certificate renewal process within a preset sliding window, calculate the average and standard deviation of the processing time records, calculate the early warning advance amount corresponding to the responsible person based on the average and standard deviation, determine the early warning trigger time window based on the certificate expiration date and the early warning advance amount, and generate an early warning trigger signal when the current date of the system enters the early warning trigger time window.

[0021] The cascading analysis module, in response to the warning trigger signal, uses a breadth-first search algorithm to traverse the certificate dependency graph starting from the target certificate node, identifies all upstream application systems associated with the certificate that triggered the warning and their corresponding responsible persons, and generates a cascading impact list.

[0022] The notification and work order management module is used to respond to the warning trigger signal, send a warning notification containing certificate expiration information to all relevant responsible persons through at least one channel of email, SMS or enterprise instant messaging system according to the cascading impact list, and create certificate handling work orders for each relevant responsible person in the ITSM platform. In response to the handling completion instruction of the work order, the module obtains and records the specific handling action information associated with the responsible person, closes the work order, and performs an alarm escalation operation if any work order is not handled within a preset time limit.

[0023] Compared with the prior art, this application has the following advantages: 1. Fundamental differences between certificate asset discovery and custody methods Existing technologies employ a passive certificate management architecture, heavily relying on pre-installed certificate clients on certificate servers for certificate asset discovery. Certificate information is aggregated by having the client register instances with the certificate server and periodically retrieve tasks. This architecture is essentially a "proxy-dependent" discovery mechanism, and its technical flaw lies in the fact that certificate assets hosted on infrastructure such as servers, network devices, and load balancers without deployed clients cannot be detected by the system, creating a systemic blind spot in asset management. When an enterprise's IT architecture includes numerous third-party hosted devices, legacy systems, or closed environments where proxy programs cannot be installed, this solution is incapable of achieving comprehensive certificate asset monitoring.

[0024] This application innovatively employs a proactive detection mechanism based on the TLS protocol stack itself. It directly initiates a TCP connection to the target address and executes the standard TLS handshake process. Leveraging the inherent behavior of the TLS protocol, which requires sending a certificate chain to the client during the handshake phase, it extracts the server certificate from the handshake response. This solution requires no proxy program to be installed on the target server, is not limited by the target environment type, and can proactively scan and detect all IP addresses and domain names on the entire network. It completely eliminates blind spots in asset management at the architectural level, achieving comprehensive coverage of all eligible certificate assets.

[0025] 2. Differences in the intelligence of early warning triggering mechanisms Existing technologies employ a fixed-strategy early warning triggering method, which sets a fixed number of advance warning days for all certificates and triggers an alarm when the remaining validity period reaches this threshold. The technical drawback of this approach is that it fails to consider the differences in response efficiency among different responsible parties and the changing behavioral patterns of the same responsible party at different times. This results in the fixed threshold failing to adequately address the varying response efficiencies of different groups, leading to invalid alarms for those with fast responses and potentially causing late warnings and certificate expiration for those with slow responses. This creates a dual dilemma of "proliferated invalid alarms" and "missed high-risk certificate reports."

[0026] This application establishes a dynamic threshold prediction model based on historical behavioral characteristics. By collecting the actual processing time of each responsible person in completing the entire certificate renewal process within a sliding time window, the average and standard deviation are calculated to quantitatively reflect the responsible person's true responsiveness. Based on this, personalized early warning advances are dynamically calculated. Simultaneously, a trend detection mechanism is introduced. When a deteriorating trend in the responsible person's response efficiency is detected, the safety factor is automatically increased, releasing the warning in advance. This mechanism allows the warning triggering timing to adaptively adjust dynamically according to changes in the responsible person's behavioral patterns, achieving a qualitative leap from "uniform, static thresholds" to "personalized, dynamic thresholds."

[0027] 3. System-level differences in certificate management granularity Current technologies treat certificates as independent management objects, focusing only on the issuance, deployment, monitoring, and renewal of the certificates themselves. They fail to establish a connection between certificates and the application systems that support their services, nor do they establish an attribution mapping between application systems and responsible operators. When a certificate expires or changes, the system can only issue an alert for the certificate itself, failing to inform operators which business systems the certificate serves, which services will be interrupted due to the certificate expiration, and who is responsible for handling the issue. Impact assessment relies entirely on manual investigation, which is extremely inefficient and prone to omissions in large-scale distributed environments.

[0028] This application constructs a three-dimensional dynamic association mapping model of "certificate, application, and responsible person," which accurately records the binding relationship between certificates and application systems, and the attribution relationship between application systems and responsible persons through a directed graph structure. Based on this model, when any certificate triggers an alert, the system uses a breadth-first search algorithm to perform a full traversal of the dependency graph, automatically identifying all upstream applications affected by the certificate and their corresponding responsible persons, generating a complete list of cascading impacts, thus achieving a leap from "single-point certificate alert" to "automatic assessment of global impact."

[0029] 4. The distinction between the presence and absence of a closed-loop management and control mechanism While existing technologies involve automated processes for certificate monitoring and renewal, they lack deep integration with ITSM process platforms and a mandatory closed-loop control mechanism for work orders. There is a lack of process-based connection between certificate expiration warnings and actual handling execution, resulting in problems such as untraceable handling progress and unverifiable handling results after the warning is issued.

[0030] This application deeply embeds certificate alerts into the ITSM work order workflow system. When an alert is triggered, a processing work order with mandatory closed-loop attributes is automatically created for each associated responsible person. The responsible person must associate a clear processing action (certificate renewal or revocation) within the work order before the case can be closed. If the processing is not completed within the time limit, the alert will be automatically upgraded, ensuring that the entire process of certificate lifecycle management is traceable and auditable.

[0031] The aforementioned technical features are not simply a stack of isolated functions, but rather an organic collaboration and deep integration around the closed loop of certificate lifecycle management—"discovery—modeling—early warning—response"—resulting in a systemic technical effect greater than the sum of its parts (1+1>2). This is specifically reflected in the following collaborative mechanisms: Collaboration between discovery and modeling. The certificate detection and management module, while automatically discovering certificate assets and triggering the filing process, simultaneously feeds certificate information to the dependency management module, driving real-time updates to the dependency graph. This design ensures that newly discovered certificates are immediately included in dependency analysis, fundamentally eliminating blind spots in impact analysis caused by unmanaged assets. In contrast, existing technologies often separate certificate discovery from dependency management; certificates missed in the discovery phase remain completely invisible in subsequent management phases, amplifying security risks at each stage.

[0032] The collaboration between the graph and cascading is crucial. The directed graph structure built by the dependency management module forms the computational basis for the impact surface traversal performed by the cascading analysis module. When the dynamic threshold warning module determines that a certificate has met the warning conditions, the warning trigger signal synchronously drives the cascading analysis module to perform a breadth-first traversal of the dependency graph, starting from that certificate node. The graph provides relational data, and the cascading module provides traversal computation capabilities; together, they output a complete list of cascading impacts. This collaborative architecture of data and algorithms allows impact surface assessment to maintain stable computational efficiency as the graph size grows, exhibiting excellent horizontal scalability. Existing technologies completely lack the synergistic cooperation between this data foundation and computational capabilities, forcing impact surface assessment to rely solely on manual, step-by-step checks.

[0033] The dynamic threshold and work order coordination is key. The dynamic threshold early warning module calculates personalized early warning lead times based on the historical behavior data of each responsible person. The cascading early warning notification and work order management modules then release the early warning precisely at the optimal time point and create a work order based on this calculation. The timing of the early warning trigger directly determines whether the responsible person has a sufficient and reasonable time window to complete the handling process. The actual handling time of the work order then serves as a new sample, feeding back into the historical behavior database of the dynamic threshold, driving iterative optimization of subsequent early warning thresholds. A positive data loop is formed between early warning release and work order handling: each handling action optimizes the accuracy of the next early warning decision. Existing fixed threshold solutions completely lack this data-driven adaptive evolution capability.

[0034] In summary, this application constructs a complete and adaptive intelligent management technology solution for the entire lifecycle of certificates through the collaborative operation of proactive certificate asset detection, multi-dimensional dependency graph construction, dynamic threshold early warning based on historical behavior, and mandatory closed-loop management via ITSM work orders. Compared with existing technologies, this application achieves an architectural upgrade from "passive dependency proxy" to "proactive full-network detection" in asset discovery, an intelligent leap from "unified fixed threshold" to "personalized dynamic adaptation" in early warning mechanisms, an efficiency revolution from "manual single-point investigation" to "automatic cascading graph traversal" in impact analysis, and a qualitative change in management from "early warning as the end point" to "handling as the closed loop" in closed-loop management. The synergistic effect between these technical features further amplifies the above advantages, enabling the system as a whole to have self-evolution and self-optimization capabilities, effectively solving the systemic technical challenges of comprehensive certificate asset management, accurate early warning, and automatic impact assessment in existing technologies. Attached Figure Description

[0035] Figure 1 This is a schematic diagram of the overall process of the method in Example 1; Figure 2 This is a schematic diagram of the overall system architecture for Example 2. Detailed Implementation

[0036] I. Definitions Digital Certificate: A public key certificate is an electronic file signed by a certificate authority that contains information such as the identity of the public key owner, the public key data, and its validity period. It is used for authentication, data encryption, and integrity verification in network communication. In this invention, it specifically refers to X.509 format certificates used for SSL / TLS protocol communication.

[0037] Certificate fingerprint: A fixed-length hash value calculated using a secure hash algorithm on the certificate body data. It is used to uniquely identify a certificate and serves as a key identifier for certificate deduplication and fast comparison.

[0038] TLS handshake: A series of protocol negotiation steps between the client and server before establishing a secure connection, including protocol version negotiation, cipher suite negotiation, certificate exchange, and key negotiation. During the handshake process, the server must send its certificate chain to the client according to the protocol specifications.

[0039] Certificate chain: An ordered sequence of certificates consisting of the server certificate, intermediate certificates, and the root certificate. During the TLS handshake, the server sends its own certificate and necessary intermediate certificates to the client as a certificate chain. The client verifies the certificate trust chain by verifying each certificate chain step by step until it trusts the root certificate.

[0040] ITSM platform: An IT service management platform, an information system used for planning, designing, delivering, operating, and controlling enterprise IT services. In this invention, it serves as the interactive interface for the certificate management process and the central hub for work order workflow.

[0041] Dependency Graph: A directed graph data structure constructed with certificate nodes, application nodes, and responsible person nodes as vertices, and the binding relationship between certificates and applications, and the attribution relationship between applications and responsible persons as edges, used to represent the multi-level dependency relationships between digital certificates, application systems, and responsible persons.

[0042] Cascading impact: In a certificate dependency graph, when a certificate node expires or changes, the ripple effects on all upstream application systems and responsible parties that directly or indirectly depend on that certificate, as identified through graph traversal.

[0043] Warning lead time: The time interval between the warning triggering time and the certificate expiration date, measured in calendar days, used to determine the timing of sending the warning notification.

[0044] Sliding window: In time series data analysis, a fixed-length time interval is selected from the current time point to form the analysis sample set. This invention uses six months as the sliding window length.

[0045] Forced closure: In the work order management process, the work order initiator cannot directly close the work order. The work order can only be closed after the specific handling actions are associated with and recorded within the work order.

[0046] II. Example 1 Figure 1 This is a flowchart illustrating the automatic detection and intelligent management of server certificates provided in an embodiment of the present invention. The specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0047] Step S1: Automated detection and intelligent management of certificate assets.

[0048] Step S1 specifically includes the following sub-steps: Sub-step S101 involves configuring the target address and port information to be probed through the ITSM platform. The ITSM platform provides a probe configuration interface to the user, through which the user inputs the domain name and port or IP address and port to be probed. The ITSM platform encapsulates the probe address and port information configured by the user into a probe task and sends it to the certificate probe service of the certificate filing management system through the interface service.

[0049] In sub-step S102, after receiving the probe request, the certificate probe service creates a secure socket connection based on the target address and port. Specifically, the certificate probe service uses SSLSocketFactory to create an SSLSocket instance, configures the read timeout parameter through the setSoTimeout method, and configures the connection timeout parameter through the setConnectTimeout method to prevent probe thread blocking and resource leakage due to the target server's lack of response. Subsequently, the certificate probe service calls the connect method of SSLSocket to initiate a TCP three-way handshake connection to the target domain name or IP address and port. After the TCP connection is successfully established, the certificate probe service calls the startHandshake method of SSLSocket to initiate a TLS handshake request to the target server in accordance with the TLS protocol specification.

[0050] Sub-step S103: Determine if the handshake was successful. If the handshake was successful, the target server sends its certificate chain as a Certificate message to the certificate detection service according to the protocol specification during the TLS handshake process, and proceeds to sub-step S104; if the handshake failed, the certificate detection service catches exceptions, including SSLHandshakeException, SSLProtocolException, SocketTimeoutException, and SocketException. The certificate detection service returns the exception information and failure status to the ITSM platform, ending this detection.

[0051] In sub-step S104, the certificate detection service extracts the first certificate object with array index 0 from the certificate chain returned by the target server. According to the TLS protocol interaction specification, the first certificate in the certificate chain is the server certificate itself, and subsequent certificates are intermediate certificates and the root certificate. The certificate detection service then forcibly converts the extracted certificate object into X.509Certificate format.

[0052] Sub-step S105: The certificate detection service performs a parsing operation on the X509Certificate object. The parsing operation specifically includes: calling the getSerialNumber method to obtain the certificate serial number; calling the getName method of getIssuerX500Principal to obtain the issuer's identifiable name; calling the getName method of getSubjectX500Principal to obtain the user's identifiable name; calling the getNotBefore method to obtain the certificate's start validity period timestamp; calling the getNotAfter method to obtain the certificate's end validity period timestamp; calling the getSignatureAlgName method to obtain the signature algorithm name; calling the getPublicKey method to obtain the public key object, obtaining the key type through the getAlgorithm method of the public key object, and then calling the getModulus and getBitLength methods to obtain the key length after type casting; calling the getSubjectAlternativeNames method to obtain a list of optional user names; performing a SHA-256 hash operation on the certificate's encoded byte array using the MessageDigest class to generate a certificate fingerprint; and determining whether it is a self-signed certificate by checking whether the issuer and user are the same.

[0053] Sub-step S106 compares the extracted certificate attribute data with existing certificate records in the certificate filing database. The comparison employs a composite index matching strategy: the certificate detection service combines the certificate serial number and the issuer's identifiable name into a composite key and performs an exact match query in the filing database. If the composite key match fails, a further query is performed using the certificate fingerprint as the second matching key to address the situation where the serial number format of the same certificate differs across different systems.

[0054] Sub-step S107: Determine if an existing record is matched. If an existing record is matched, it is confirmed that the certificate has been registered. The certificate detection service returns confirmation information containing the detected certificate serial number and certificate subject to the ITSM platform, and the detection ends. If no record is matched, the certificate is determined to be a newly discovered unmanaged certificate asset, and the process proceeds to sub-step S108.

[0055] In sub-step S108, the certificate detection service constructs a new certificate discovery notification and returns it to the ITSM platform via the interface service. The notification payload contains complete certificate attribute data: certificate serial number, certificate subject, issuer, start validity period, end validity period, public key fingerprint, signature algorithm, key type and length, and a list of optional user names. After parsing the notification payload, the ITSM platform displays the certificate attribute data on the user interface and provides an application system selection control and a responsible person selection control, allowing operators to specify the application system and responsible person for the newly discovered certificate.

[0056] In sub-step S109, after the operator completes the attribution configuration, the ITSM platform assembles the certificate identifier, the attribution application system identifier, and the responsible person identifier into a certificate filing request, and sends it to the certificate filing management system's filing interface via HTTP protocol. Upon receiving the request, the certificate filing management system initiates a database transaction, inserts a new certificate record into the certificate information table, and inserts a binding record between the certificate identifier and the application identifier, as well as an attribution record between the application identifier and the responsible person identifier, into the association table. After the transaction is committed, the system returns a successful filing status to the ITSM platform, completing the automated management of certificate assets.

[0057] In a multi-source certificate centralized filing scenario, the certificate applicant initiates a certificate filing application through the ITSM platform, selects and uploads a local certificate file, and fills in necessary information such as the issuing organization and application system identifier. The ITSM platform encapsulates the certificate file using Base64 encoding into a filing request and sends it to the certificate filing management system. Upon receiving the request, the certificate filing system decodes the certificate file, performs a SHA-256 hash operation on the certificate file's byte array using the MessageDigest class, and compares the hash value with the certificate hash value submitted by the applicant. If the hash values ​​match, the verification passes, confirming the data source is trustworthy and has not been tampered with; if the hash values ​​do not match, the filing request is rejected and an integrity verification failure message is returned. After successful verification, the system submits the filing information to the certificate administrator's review queue. The certificate administrator reviews the accuracy and compliance of the certificate filing information through the ITSM platform, triggers a confirmation operation, and the system automatically executes the certificate filing. When parsing the certificate, the certificate filing system recognizes the certificate file's encoding and encapsulation formats, supporting DER and PEM encoding formats, PKCS12 / PFX formats, and PKCS7 formats for standard X.509 certificates.

[0058] In certificate reuse management scenarios, the certificate registration system establishes a cross-mapping index table in the database that maps certificate identifiers to application identifiers. This index table supports many-to-many mapping relationships. When an application system applies to use a registered certificate through the ITSM platform, the system queries the cross-mapping index table based on the certificate identifier in the application request to obtain a list of all application systems currently bound to the certificate and the certificate holder's identifier. The system then sends a reuse application notification to the certificate holder, containing the applicant's application system identifier, applicant information, and a description of the business scenario. After the certificate holder confirms the reuse application through the ITSM platform, the system inserts a new mapping record between the applicant's application system identifier and the certificate identifier into the cross-mapping index table, completing the certificate reuse registration.

[0059] Step S2: Construct the certificate dependency graph.

[0060] Step S2 specifically includes the following sub-steps: Sub-step S201: Construct the data structure of the multi-dimensional association mapping model. The certificate filing management system establishes the following data tables in the relational database: Certificate Information Table: Stores certificate entity data. Fields include certificate identifier, certificate fingerprint, certificate subject, certificate serial number, issuer, start validity period, end validity period, signature algorithm, key type, and length. The certificate identifier is the primary key, and unique indexes are created for the combinations of certificate fingerprint and certificate serial number with the issuer. Application Information Table: Stores application entity data. Fields include application identifier, host address, port number, service scenario, application name, and affiliated organization. The application identifier is the primary key. Personnel Information Table: Stores responsible person entity data. Fields include personnel identifier, personnel name, contact number, email address, and affiliated department. The personnel identifier is the primary key. Association Relationship Table: Records the mapping relationships between certificate entities and application entities, and between application entities and responsible person entities. Fields include association identifier, certificate identifier, application identifier, organization identifier, personnel identifier, personnel type, and priority sequence. The association identifier is the primary key. A composite index is created for the combination of certificate identifier and application identifier, and a composite index is created for the combination of application identifier and personnel identifier.

[0061] Sub-step S202 involves constructing a certificate dependency graph based on the aforementioned data structure. In this graph, each certificate node contains the certificate identifier and expiration date attribute from the certificate information table; each application node contains the application identifier, host address, and service scenario attribute from the application information table; and each responsible person node contains the personnel identifier and contact information attribute from the personnel information table. The directed edge construction logic is as follows: when the certificate detection and management module completes certificate registration, it inserts a record into the association table, establishing a directed edge from the application node to the certificate node, indicating that the application is bound to and depends on the certificate. When the certificate centralized registration module or certificate reuse management module establishes a certificate-application binding, it similarly establishes a directed edge from the application node to the certificate node in the association table. In the application information table, the application identifier is associated with the certificate owner identifier, and a directed edge from the application node to the responsible person node is established through the association table, indicating that the application belongs to the responsible person's management. This forms a directed graph structure with certificate nodes, application nodes, and responsible person nodes as vertices and dependency and attribution relationships as edges—the certificate dependency graph.

[0062] Step S3: Cascade effect analysis based on dependency graph.

[0063] When any managed certificate triggers an alert, a breadth-first search algorithm is used to traverse the certificate dependency graph, starting from that certificate node. This retrieves all upstream application system nodes directly or indirectly affected by the certificate, along with their corresponding responsible nodes, generating a cascading impact list containing affected organizations, application systems, and responsible parties. The implementation logic of the breadth-first search algorithm is as follows: The system initializes a first-in-first-out queue, enqueues the target certificate node, and initializes a set of visited nodes. When the queue is not empty, a node is retrieved from the head of the queue. The system then queries the relationship table for all records where the certificate identifier is the value of the certificate identifier field. The application identifier in each record is extracted, and the corresponding application node is added to the queue, with the access path recorded.

[0064] Step S4: Calculate the dynamic early warning threshold based on historical behavioral characteristics.

[0065] Step S4 specifically includes the following sub-steps: Sub-step S401: The certificate filing management system deploys a scheduled inspection task. This task is implemented using the Quartz scheduling framework and is configured to trigger at a fixed time each day. After the task starts, the system uses SQL statements to query the certificate identifier and expiration date fields of all records in the certificate information table, calculates the difference in days between the expiration date of each record and the current system date, and obtains the remaining valid days for each certificate.

[0066] Sub-step S402 involves collecting historical certificate processing data from each responsible person within a preset sliding window. The system uses the current system date as the endpoint and traces back six months into the sliding window, collecting data from the work order history table and system operation log table of the certificate filing management system. Collection conditions include: the work order type is a certificate renewal work order, the work order status is closed, and the responsible person's identifier is not empty. For each responsible person R, all certificate renewal work order records completed within the sliding window are queried. For each record, the warning notification sending time and the work order closing time are extracted, and the time difference between the two times is calculated and quantified in calendar days to obtain processing time data points. The system removes abnormal data points according to preset stagnation judgment rules: data points where the time difference between the work order closing time and the warning notification sending time is less than or equal to zero, and data points where the processing time is greater than the mean of all samples plus three times the standard deviation are removed, retaining the valid sample dataset. If the amount of valid sample data is less than the preset number, the system reverts to the default parameters.

[0067] Sub-step S403 calculates the statistical characteristic reflecting the efficiency of certificate processing for the responsible person. For the valid sample dataset of the responsible person R, the system calculates the mean μ according to the following formula: μ equals the sum of all valid sample data points divided by the number of valid sample data points. The system calculates the standard deviation σ according to the following formula: σ equals the square root of the sum of the squares of the differences between all valid sample data points and the mean, divided by the number of valid sample data points.

[0068] Sub-step S404: Perform risk trend detection. The system extracts the three most recent data points from the valid sample dataset and calculates a first average. It then extracts the three next most recent data points and calculates a second average. The difference between the first and second averages is divided by the second average to obtain the month-on-month growth rate. If the month-on-month growth rate is greater than or equal to a preset threshold (preferably 30%), the system determines that the responsible party's response capability has deteriorated and increases the safety factor Q by a preset step size (preferably by 0.5). If the month-on-month growth rate is less than the preset threshold, the system maintains the safety factor Q at a preset default value (preferably 1.5). The preset step size is a system-level parameter that can be configured in the background, ranging from 0.1 to 1.0, with a default value of 0.5, and is used to control the sensitivity of the safety factor to trend detection.

[0069] Sub-step S405: Calculate the early warning lead time. The early warning lead time T is determined as follows: Early warning lead time T equals the safety factor Q multiplied by the average value μ, plus the fluctuation tolerance coefficient β multiplied by the standard deviation σ, plus the enterprise-mandated minimum lead time Tpolicy_min. The enterprise-mandated minimum lead time is a system-level preset parameter that applies uniformly to all responsible parties. The fluctuation tolerance coefficient β is a globally configurable parameter in the backend.

[0070] Sub-step S406: Determine the warning trigger time window. The system obtains the timestamp corresponding to the certificate expiration date, and uses this timestamp as the endpoint to shift the warning lead time forward by T natural days to obtain the starting boundary timestamp of the warning trigger time window. The certificate expiration date timestamp is used as the ending boundary timestamp to form the warning trigger time window.

[0071] Sub-step S407: Determine if the current system date falls within the warning trigger time window. The system obtains the current system timestamp and determines whether the timestamp is between the start and end boundaries of the warning trigger time window. If yes, generate a warning trigger signal for the responsible person and proceed to step S5; otherwise, return to sub-step S401 to continue the next round of scheduled inspections.

[0072] Step S5: Cascaded early warning notification and mandatory closed-loop management.

[0073] Step S5 specifically includes the following sub-steps: Sub-step S501 executes cascading warning notifications based on the cascading impact list. The system is deeply integrated with the ITSM platform, calling the ITSM platform's work order creation interface to create a certificate expiration handling service request form for each responsible party in the cascading impact list. Each work order automatically fills in basic certificate information, expiration date, affected application systems, and suggested handling methods. Simultaneously, the system sends high-priority warning notifications to all relevant responsible parties through multiple channels including email, SMS, and enterprise instant messaging software to ensure information delivery.

[0074] Sub-step S502: Implement mandatory closed-loop management. Work orders are configured with a mandatory closed-loop attribute; the work order processing interface does not provide a direct closure entry point. The responsible person must perform one of the following operations in the work order to trigger the work order closure process: associate a certificate renewal application record and upload the new certificate filing information; or associate a certificate revocation application record and upload the revocation confirmation document. The system obtains the specific handling actions associated by the responsible person and records them in the system log, completing the work order closure.

[0075] Sub-step S503: Determine whether the work order has been processed within the preset time limit. If the work order is processed within the preset time limit, the current warning process ends; if the work order is not processed within the preset time limit, proceed to sub-step S504.

[0076] Sub-step S504: Perform alarm escalation. The system automatically pushes the work order and warning information to the superior supervisor node or security handling team, and increases the notification frequency and priority until the certificate is renewed or revoked.

[0077] III. Example 2 This invention provides an automated certificate management and dynamic threshold early warning system for implementing the method described in Embodiment 1. The system architecture of this invention is described below in conjunction with the system's module composition and the data interaction relationships between modules.

[0078] Figure 2 This is a schematic diagram of the overall architecture of the system according to an embodiment of the present invention. Figure 2 As shown, the system includes a certificate detection and management module, a centralized certificate filing module, a certificate reuse management module, a dependency management module, a dynamic threshold early warning module, a cascading analysis module, and a notification and work order control module.

[0079] The certificate detection and management module establishes a secure connection with the target server through proactive interaction at the protocol layer. Based on a handshake process using transport layer security protocols, it obtains the digital certificate chain carried by the target server, extracts the server certificate from the certificate chain, and parses it to obtain certificate attribute data. This certificate attribute data includes the public key fingerprint, certificate serial number, issuer's common name, user's common name, certificate's initial validity period, certificate's expiration validity period, a list of optional user names, signature algorithm, key type and length, and whether it is self-signed. The certificate detection and management module compares the extracted certificate attribute data with existing certificate records in the registration database, based on the certificate serial number and certificate issuer information. If a matching record is found, the certificate is confirmed to have completed registration. If no matching record is found, the certificate is determined to be a newly discovered unmanaged certificate asset, triggering the certificate registration process to establish a mapping relationship between the certificate, the application system, and the responsible party, thus completing the automated management of the certificate asset.

[0080] The centralized certificate filing module responds to certificate filing requests initiated by certificate applicants through the ITSM platform, obtaining the submitted certificate files and associated organization information and application system identifiers. After receiving the certificate files, the module recalculates the certificate hash value and compares it with the hash value submitted synchronously by the applicant, performing integrity verification on the certificate files. Upon successful verification, the module submits the certificate filing information to the certificate administrator for review and confirmation. After confirmation, the module executes the certificate filing operation, writing the certificate information into the filing database and establishing the binding relationship between the certificate and the application. The centralized certificate filing module is compatible with and supports various certificates issued by self-built CAs, enterprise RAs, and external authoritative organizations, including standard X.509 certificates, PKCS12 / PFX format certificates, and PKCS7 format certificates.

[0081] The certificate reuse management module constructs a many-to-many mapping model between certificates and applications, and establishes a cross-mapping index between certificate identifiers and application identifiers in the filing database. When an application system applies to use a filed certificate through the ITSM platform, the certificate reuse management module automatically identifies and locks the current certificate holder's information, triggers a certificate reuse collaboration process reminder, and sends a reuse application notification containing the applying application system information and business scenario to the current certificate holder. After the current certificate holder confirms the reuse application through the ITSM platform, the certificate reuse management module binds the applying application system identifier with the certificate identifier, updates the many-to-many mapping table, and completes the certificate reuse filing.

[0082] The dependency management module constructs a multi-dimensional association mapping model containing certificate entities, application entities, and responsible entity entities. In this model, the certificate information table stores certificate entity data, with fields including certificate identifier, certificate fingerprint, certificate subject, certificate serial number, issuer, start validity period, and end validity period. The application information table stores application entity data, with fields including application identifier, host address, port number, and service scenario. The personnel information table stores responsible entity data, with fields including personnel identifier, personnel name, contact number, and email address. The association table records the mapping relationships between certificate entities and application entities, and between application entities and responsible entity entities, with fields including certificate identifier, application identifier, organization identifier, personnel identifier, personnel type, and priority sequence. Based on this data structure, the dependency management module constructs a directed graph-structured certificate dependency graph, with certificate nodes, application nodes, and responsible entity nodes as vertices and the binding and attribution relationships recorded in the association table as edges.

[0083] The dynamic threshold early warning module collects records of the processing time for each responsible person to complete the certificate renewal process within a preset sliding window. Processing time is defined as the time interval between the sending of the early warning notification and the closing of the certificate renewal work order. After removing abnormally stalled work orders, the module retains valid samples and calculates the average and standard deviation of the processing time records. When the number of valid samples is insufficient, the module reverts to the system default parameters. The module monitors the trend of processing time changes for responsible persons in recent time periods. When it detects an increasing trend in processing time exceeding a preset threshold, it raises the safety factor. The module determines the early warning lead time based on the average, standard deviation, safety factor, fluctuation tolerance factor, and the company's mandatory minimum lead time. Using the certificate expiration date as the baseline, the module subtracts the early warning lead time from the certificate expiration date as the starting boundary of the early warning trigger time window. The module performs daily scheduled checks. When the current system date enters the early warning trigger time window, it generates an early warning trigger signal and outputs the certificate identifier that triggered the early warning and the corresponding responsible person identifier to the cascading analysis module.

[0084] After receiving the warning trigger signal from the dynamic threshold warning module, the cascading analysis module uses a breadth-first search algorithm to traverse the certificate dependency graph, starting from the certificate node that triggered the warning. The breadth-first search algorithm begins by searching the association table for all application identifiers corresponding to that certificate identifier, obtaining the first-level application nodes directly dependent on that certificate. Then, for each first-level application node, it searches the association table for all personnel identifiers corresponding to that application identifier, obtaining the first-level responsible person nodes. Subsequently, it expands outwards layer by layer, searching for application nodes and their corresponding responsible person nodes bound to other certificates in the same certificate chain, until all reachable nodes have been traversed. The cascading analysis module generates a complete cascading impact list containing affected institutions, affected application systems, and affected responsible persons, and outputs the cascading impact list to the notification and work order management module.

[0085] After receiving the cascading impact list from the cascading analysis module, the notification and work order management module, in response to the early warning trigger signal, executes early warning notifications and work order creation based on the cascading impact list. The module is deeply integrated with the ITSM platform, calling its work order creation interface to create a certificate expiration handling service request form for each record in the cascading impact list. Each work order automatically includes basic certificate information, expiration date, affected application systems, and suggested handling methods. Simultaneously, the module sends high-priority early warning notifications to relevant responsible parties through multiple channels, including email, SMS, and enterprise instant messaging software. Work orders created by the module have a mandatory closed-loop attribute; the work order processing interface does not provide a direct closure entry. Responsible parties must associate a certificate renewal application with the work order and upload new certificate filing information, or associate a certificate revocation application with the work order and upload revocation confirmation documents, before triggering the work order closure process. Upon receiving the work order's completion instruction, the module retrieves the specific handling actions associated with the responsible party, records them in the system log, and then executes work order closure. If any work order is not processed within the preset time limit, the notification and work order management module will perform an alarm escalation operation, automatically pushing the work order and early warning information to the superior supervisor node or the safety handling team, and increasing the notification frequency and priority.

[0086] IV. Example 3 (Application Scenario Example 1: Centralized Management of Bank System Certificates) In a digital transformation project of a large commercial bank, the bank's IT architecture encompassed 79 business systems, including core payment systems, online banking systems, mobile banking systems, intermediary business platforms, and data warehouses. These systems were deployed across different server clusters and container environments, resulting in extremely dispersed certificate assets. Previously, the bank used a proxy-based certificate management solution, which could only collect certificate information on Linux servers with deployed proxies. This meant that a large number of certificate assets running on Windows servers, load balancers, and cloud-native environments were not covered, leading to severely incomplete asset ledgers.

[0087] After adopting the technical solution of this application, the bank's operations and maintenance team configured the entire network's IP address range and port range through the ITSM platform. The certificate detection and management module actively probed a total of 1024 IP addresses and commonly used TLS ports such as 443 and 8443 across the bank. During the probe, the system used the TLS handshake protocol to obtain certificate chains from each target server, extracted the server certificates, parsed attribute data, and intelligently compared them with the filing database. After three complete scan cycles, the system discovered a total of 2524 existing certificates, of which more than 100 certificates were identified as certificates shared by multiple systems. Previously, the manual ledger only recorded 1987 certificates, and the newly discovered 537 certificates were distributed in load balancers, container platforms, and some old Windows servers, representing a long-standing management blind spot.

[0088] The dependency management module constructs a certificate dependency graph based on the discovered certificate data. Taking an EV certificate used for a payment gateway as an example, this certificate is jointly bound and used by the core payment system and three front-end transaction systems. The relationship table records that this certificate is also associated with five maintenance personnel. When this certificate triggers an alert by calculating a personalized advance warning through the dynamic threshold warning module, the cascading analysis module performs a breadth-first search traversal starting from this certificate node, automatically identifying all four application system nodes that directly depend on this certificate and their corresponding five responsible personnel nodes, generating a complete cascading impact list. The cascading impact list also displays organizational information, system information, and contact information for the responsible personnel, allowing the maintenance team to manually confirm and supplement information before sending the warning notification.

[0089] The notification and work order management module automatically created five certificate expiration handling work orders based on the cascading impact list, which were then assigned to five responsible persons. Warning notifications were also sent via both WeChat and SMS. All work orders were closed within the preset handling timeframe, and no production incidents occurred due to certificate expiration.

[0090] V. Example 4 (Application Scenario Example 2: Dynamic Early Warning Scenario for Internet Enterprise Certificates) An internet technology company operates 33 business systems, including an online marketplace, content delivery network, API gateway, and developer platform, managing a total of 366 certificates. Three independent operations teams are responsible for certificate management for their respective business lines. The change approval processes differ significantly across these business lines: certificate changes for the core transaction system require approval from security review, architecture review, and the change management committee, with an average processing time of 12 days; while certificate changes for the development and testing environment only require approval from the development manager, with an average processing time of 2 days.

[0091] Before adopting the technical solution of this application, the company used a strategy of issuing unified early warnings 30 days before certificate expiration. For Person A, who was responsible for the transaction system, the actual average processing time was 12 days, with a standard deviation of 4 days. The fixed 30-day early warning window meant that they would start receiving early warning notifications 30 days before the certificate expired, with approximately 18 days spent in invalid alarm interference and no processing. For Person B, who was responsible for the development and testing environment, the actual average processing time was 2 days, with a standard deviation of 1 day. The fixed 30-day early warning window also resulted in a large number of invalid alarms.

[0092] After adopting the technical solution of this application, the dynamic threshold early warning module collects the historical processing time records of responsible persons A and B within the sliding window of the past six months. For responsible person A, there are a total of 18 valid samples, with a calculated average μ of 12 days and a standard deviation σ of 4 days. Trend detection shows that the month-on-month growth rate of the processing time in the last three periods is 8%, which does not exceed the preset threshold, maintaining the default safety factor of 1.5. The early warning lead time is calculated to be T = 1.5 × 12 + 1.0 × 4 + 7 = 29 days. The system triggers an early warning 29 days before the certificate expires, which exactly covers the average processing time of 12 days and the change approval process, ensuring that they have sufficient time to complete all approval steps. For responsible person B, there are a total of 24 valid samples, with a calculated average μ of 2 days and a standard deviation σ of 1 day. The early warning lead time is calculated to be T = 1.5 × 2 + 1.0 × 1 + 7 = 11 days. The system triggers an early warning 11 days before the certificate expires, reducing invalid alarm interference by approximately 19 days.

[0093] During operation, due to team personnel adjustments, the processing time for the three most recent incidents involving the responsible person, A, gradually increased from 11 days to 16 days, representing a month-on-month increase of 45%, exceeding the preset threshold. Upon detecting this change, the trend detection unit automatically increased the safety factor from 1.5 to 2.0. The system then adjusted the early warning lead time to 2.0 × 12 + 1.0 × 4 + 7 = 35 days, ensuring a sufficient time window for handling incidents even with a decrease in the responsible person's response efficiency.

[0094] VI. Example 5 (Application Scenario Example 3: Gray Deployment Scenario of Certificates on Government Cloud Platform) A provincial government cloud platform hosts public service systems from dozens of commissions and bureaus, all of which provide services through a unified API gateway. The platform plans to gradually migrate its existing RSA certificates to the Chinese national cryptographic standard SM2 certificates. However, the compatibility of SM2 certificates with different client environments is uncertain, and a direct full switch poses significant risks.

[0095] In this scenario, the certificate reuse management module comes into play. The platform operations team first completes the filing and storage of a batch of national cryptographic certificates through the centralized certificate filing module, establishing a many-to-many mapping model between certificates and applications. The API gateway, as an application entity, registers in the application information table and establishes binding relationships with both RSA certificates and national cryptographic certificates. The certificate reuse management module records the list of application systems currently bound to each certificate identifier and the corresponding certificate holder information.

[0096] When the platform plans to switch the traffic of a test domain to a national cryptographic certificate, the operations and maintenance personnel initiate a certificate reuse application through the ITSM platform, specifying the target certificate identifier and the target application system identifier. The certificate reuse management module identifies the current owner of the certificate, triggers the certificate reuse collaboration process, and sends a reuse application notification containing the application system information and the switchover plan to the current owner. After assessing the compatibility test results and switchover risks, the current owner confirms the reuse application, and the system automatically updates the association table, binding the application system to the national cryptographic certificate.

[0097] When a national cryptographic certificate triggers an alert, the cascading analysis module traverses the certificate dependency graph starting from that certificate node, automatically identifying all application system nodes bound to the certificate and their corresponding responsible parties. The notification and work order management module sends alert notifications to all responsible parties and creates handling work orders, ensuring that all responsible parties for business systems using the certificate are aware of the certificate status and can collaboratively complete renewal or switchover procedures.

[0098] The embodiments described above are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be covered within the protection scope of the present invention.

Claims

1. A method for automated certificate management and dynamic threshold early warning, characterized in that, include: Step S1: Establish a secure connection with the target server through active interaction of the protocol, obtain its certificate chain through TLS handshake, extract the server certificate and parse to obtain certificate attribute data; The certificate attribute data is compared with existing records in the filing database. If there is no match, it is determined to be a newly discovered unmanaged certificate asset. The information of the designated application system and responsible person is obtained and bound to it to complete the management. Step S2: Construct a multi-dimensional association mapping model of certificate entity, application entity and responsible person entity. The certificate entity and application entity establish binding records through the association relationship table, and the application entity and responsible person entity establish attribution records through the association relationship table, forming a directed graph structure with certificate node, application node and responsible person node as vertices and binding relationship and attribution relationship as edges, i.e. certificate dependency relationship graph. Step S3: When a managed certificate triggers an early warning condition, starting from the certificate node, a breadth-first search algorithm is used to traverse the certificate dependency graph to obtain all upstream application system nodes and corresponding responsible person nodes directly or indirectly affected by the certificate, and a cascading impact list is generated. Step S4: Collect the processing time records of each responsible person in completing the certificate renewal process within the preset sliding window, and calculate the average and standard deviation; calculate the early warning lead time based on the average and standard deviation, and use the certificate expiration date as the benchmark, subtract the early warning lead time from the expiration date as the starting boundary of the early warning trigger time window, and determine the early warning trigger time window; When the current system date enters this window, an alert trigger signal is generated; Step S5: In response to the warning trigger signal, send a warning notification to all relevant responsible persons according to the cascading impact list, and create a certificate handling work order for each relevant responsible person. The work order is configured with a mandatory closed-loop mechanism. The responsible person can only close the work order after associating the certificate renewal or revocation handling action in the work order. In response to the work order handling completion instruction, obtain the handling action information and record it in the system log, and close the work order.

2. The method for automated certificate management and dynamic threshold early warning according to claim 1, characterized in that, In step S1, a secure connection is established with the target server through active interaction of the protocol, and its certificate chain is obtained through a TLS handshake. Specifically, this includes: creating a secure socket based on the target address and port, initiating a TCP connection to the target server, and initiating a TLS handshake request after the TCP connection is successfully established; after the handshake is successful, the first certificate object with array index 0 is extracted from the certificate chain returned by the target server as the server certificate.

3. The method for automated certificate management and dynamic threshold early warning according to claim 1, characterized in that, In step S1, the certificate attribute data is compared with existing records in the filing database. Specifically, this includes: combining the certificate serial number and the issuer's identifiable name into a composite key, and performing an exact match query in the filing database; if the composite key match fails, a further query is performed using the certificate fingerprint as the second matching key.

4. The method for automated certificate management and dynamic threshold early warning according to claim 1, characterized in that, Step S1 also includes a multi-source certificate centralized filing step: in response to the certificate filing request initiated by the certificate applicant, the submitted certificate file and associated institution information and application system identifier are obtained, and after the certificate manager reviews and confirms it, the certificate filing is performed to establish the binding relationship between the certificate and the application.

5. The method for automated certificate management and dynamic threshold early warning according to claim 1, characterized in that, Step S1 also includes a certificate reuse management step: constructing a many-to-many mapping relationship model between certificates and applications; when an application system applies to use a registered certificate, identifying the current person in charge of the certificate and triggering the certificate reuse collaboration process; and completing the certificate reuse registration after confirmation by the current person in charge.

6. The method for automated certificate management and dynamic threshold early warning according to claim 1, characterized in that, In step S4, the early warning lead time is determined as follows: the early warning lead time equals the safety factor multiplied by the average value, plus the fluctuation tolerance factor multiplied by the standard deviation, plus the preset minimum mandatory lead time for enterprises.

7. The method for automated certificate management and dynamic threshold early warning according to claim 6, characterized in that, Step S4 also includes a trend detection step: extract the three most recent data points from the processing duration record to calculate the first average value, extract the three next newest data points to calculate the second average value, divide the difference between the first average value and the second average value by the second average value to obtain the month-on-month growth rate, and if the month-on-month growth rate is greater than or equal to a preset threshold value, the safety factor is increased.

8. The method for automated certificate management and dynamic threshold early warning according to claim 1, characterized in that, In step S3, the breadth-first search algorithm is implemented as follows: initialize the first-in-first-out queue, enqueue the target certificate node, and initialize the set of visited nodes; when the queue is not empty, take the current node from the head of the queue, query the corresponding application identifier in the association table with the certificate identifier of the current node, add the application node to the queue, and record the access path.

9. The method for automated certificate management and dynamic threshold early warning according to claim 1, characterized in that, In step S5, if any work order is not processed within the preset time limit, an alarm escalation operation is performed, and the work order and warning information are pushed to the superior management node.

10. A certificate automated management and dynamic threshold early warning system, characterized in that, The system for implementing the automated certificate management and dynamic threshold early warning method as described in any one of claims 1 to 9 includes: The certificate detection and management module is used to actively interact with the target server to establish a secure connection, obtain its certificate chain through TLS handshake, extract the server certificate and parse the certificate attribute data, compare the certificate attribute data with existing records in the filing database, and if there is no match, it is determined to be a newly discovered unmanaged certificate asset, triggering the certificate filing process to establish the association mapping relationship between the certificate and the application system and the responsible person, and completing the automated management of certificate assets. The centralized certificate filing module is used to respond to certificate filing requests initiated by certificate applicants, obtain the submitted certificate files and associated institution information and application system identifiers, and execute certificate filing after review and confirmation by the certificate manager, thus establishing a binding relationship between the certificate and the application. The certificate reuse management module is used to build a many-to-many mapping relationship model between certificates and applications. When an application system applies to use a registered certificate, it identifies the current person in charge of the certificate and triggers the certificate reuse collaboration process. After confirmation by the current person in charge, the certificate reuse registration is completed. The dependency management module is used to build a multi-dimensional association mapping model that includes certificate entities, application entities, and responsible persons entities. It records the dependency relationships between certificates and application systems, and between application systems and responsible persons through a directed graph structure, and generates a certificate dependency graph. The dynamic threshold early warning module is used to collect the processing time records of each responsible person in completing the certificate renewal process within a preset sliding window, calculate the average and standard deviation, calculate the early warning lead time based on the average and standard deviation, and determine the early warning trigger time window based on the certificate expiration date and the early warning lead time. When the current date of the system enters the window, an early warning trigger signal is generated. The cascading analysis module, in response to the warning trigger signal, uses a breadth-first search algorithm to traverse the certificate dependency graph starting from the target certificate node, identify all upstream application systems and corresponding responsible persons associated with the certificate that triggered the warning, and generate a cascading impact list. The notification and work order management module is used to respond to the early warning trigger signal, send early warning notifications to all related responsible persons according to the cascading impact list, create certificate handling work orders for each related responsible person, obtain and record the handling action information associated with the responsible person in response to the work order handling completion instruction, close the work order, and perform an alarm escalation operation if any work order is not handled within a preset time limit.

Images