A method and system for verifying that a digital certificate is valid and in compliance

Abstract

The application relates to the field of cryptography and digital certificate technology, and particularly relates to a method and system for verifying compliance and validity of a digital certificate, which comprises the following steps: automatically obtaining root CA certificates and operation CA certificates from multiple-source public nodes such as national electronic authentication root CAs and operation CAs, establishing the ownership mapping between the certificates and service agencies, constructing a unified verification evidence pool, and eliminating the verification blind area caused by the mutual isolation of various data sources; for the certificate to be verified, the digital signature technology is used to verify from bottom to top until the national root certificate is verified and signed, so that a complete certificate chain is constructed, and the electronic authentication service agency is quickly identified; the certificate chain integrity, the validity period of the certificates at all levels, the revocation state, the public key algorithm, and whether the basic constraints and key usage of the CA certificates are compliant are verified, the compliance and validity of the certificate are comprehensively judged, and the associated electronic authentication service agency information is output. Through the automatic fusion of multiple-source data, the data islands are broken, the CA certificates obtained by automatic crawling are ensured to be consistent with the official source, the lag and errors caused by manual collection are avoided, and an accurate and reliable data basis is provided for subsequent verification.

Description

Technical Field

[0001] This invention relates to the fields of cryptography and digital certificate technology, and in particular to a method and system for verifying the compliance and validity of digital certificates. Background Technology

[0002] Digital certificates, as a core component of the Public Key Infrastructure (PKI) system, are a crucial means of ensuring the security of identity authentication, data encryption, and digital signatures in network communications. In my country, electronic authentication services follow the regulatory framework of the Electronic Signature Law. The State Cryptography Administration assumes the industry's cryptographic regulatory functions, and the National Electronic Authentication Root CA serves as the trust anchor. Various operating CAs issue digital certificates to end users and lower-level CAs, forming a hierarchical certificate trust system. In the fields of electronic authentication and cybersecurity, the compliance and validity verification of digital certificates is a fundamental prerequisite for identity authentication, trust transfer, and security auditing. In real-world scenarios involving massive amounts of digital certificate verification, trust source data such as root CA certificates and operational CA certificates are scattered across public nodes of different institutions, including the national electronic authentication root CA and various operational CAs. These data sources are isolated and lack a unified aggregation and correlation mechanism. When verifying certificates, verifiers often have to rely on partial data from a single source, resulting in significant verification blind spots and making it difficult to comprehensively and accurately assess the trust status of certificates. Secondly, existing certificate verification methods largely rely on manual collection and maintenance. When tracing the issuance source of a certificate is necessary, verifiers often need to determine attribution through hierarchical queries or manual judgment, which is not only inefficient but also prone to delays and errors. These problems hinder the accuracy and reliability of compliance and validity verification of digital certificates. Summary of the Invention

[0003] To overcome the above shortcomings, this invention provides a method and system for verifying the compliance and validity of digital certificates. It aims to improve the problems caused by data silos, information lag, and blind spots in certificate verification resulting from the use of a single data source and manual maintenance in existing methods for verifying the compliance and validity of digital certificates. In a first aspect, the present invention provides the following technical solution: a method for verifying the compliance and validity of a digital certificate, comprising: S1. Automatically obtain the root CA certificate and the operating CA certificate from the public node of the National Electronic Certification Root CA; S2. Automatically obtain the intermediate certificate of the operating CA from the public node of the operating CA; S3. For certificates to be verified, use digital signature technology to verify them step by step from bottom to top until they pass the verification with the national root certificate. S4 verifies the integrity of the certificate chain, the validity period of certificates at each level, revocation status, public key algorithm, basic constraints of CA certificates, key usage, etc., and comprehensively judges the compliance and validity of the certificate. Secondly, the present invention provides the following technical solution: a system for verifying the compliance and validity of digital certificates, the system comprising: The certificate acquisition module is used to automatically obtain root CA certificates and operating CA certificates from the public nodes of the national electronic certification root CA, and automatically obtain intermediate certificates of operating CAs from the public nodes of each operating CA. It integrates multi-source certificate data to build a unified evidence pool and establishes an attribution mapping between certificates and service institutions. The certificate chain construction module is used to verify the certificate to be verified using digital signature technology from bottom to top, verifying the digital signature of the current certificate with the public key of the higher-level certificate, iterating and tracing until it passes the verification with the national root certificate, and building a complete certificate chain. The compliance and validity verification module is used to verify the integrity of the certificate chain, the validity period of certificates at all levels, revocation status, public key algorithm, basic constraints of CA certificates, key usage, etc., to comprehensively determine the compliance and validity of certificates, and output the associated electronic certification service provider information. The present invention has the following beneficial effects: 1. In this invention, through the automatic acquisition and fusion mechanism of multi-source public nodes, the root CA certificate, the operation CA certificate and intermediate certificate are automatically crawled and aggregated from data sources such as the national electronic certification root CA and operation CA, the attribution mapping between certificates and service institutions is established, and a unified verification evidence pool is constructed. This breaks the verification blind spot caused by the isolation of each data source and provides an accurate, complete and reliable data foundation for subsequent verification. 2. In this invention, automated crawling ensures that certificate data remains consistent with the official source in real time, avoiding data lag and human error caused by manual collection and maintenance, reducing certificate data maintenance costs, and ensuring the timeliness and accuracy of verification basis. 3. In this invention, through a bottom-up, step-by-step digital signature verification and certificate chain construction mechanism, electronic certification service providers can be automatically traced and quickly identified, solving the problem of difficulty in determining certificate ownership in cross-institutional scenarios and improving the automation and efficiency of certificate verification. 4. This invention comprehensively verifies multiple dimensions, including certificate chain integrity, validity period of certificates at each level, revocation status, public key algorithm, basic constraints of CA certificates, and key usage. This replaces the traditional single verification method that only focuses on signature traceability, comprehensively covering key checks for certificate compliance and validity. It effectively avoids misjudgments and omissions caused by factors such as expiration and revocation, improving the reliability and completeness of the verification results. Attached Figure Description Figure 1 This is a flowchart illustrating a method for verifying the compliance and validity of digital certificates proposed in this invention. Figure 2 This is a schematic diagram of the architecture of a system for verifying the compliance and validity of digital certificates proposed in this invention. Detailed Implementation The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention. Example 1 In a first embodiment of the present invention, the present invention provides a method for verifying the compliance and validity of digital certificates, such as... Figure 1 As shown, it includes the following steps: S1. Automatically obtain the root CA certificate and operating CA certificate from the public node of the National Electronic Certification Root CA. Specifically, in this step, the system uses a pre-defined web crawling module to periodically or as needed access the public certificate publishing node of the national electronic certification root CA to obtain all root CA certificates and authorized operational CA certificates issued by that node. The obtained certificate data includes, but is not limited to, the certificate's X.509 standard format file, CA organization name, and other key fields. After acquisition, the system parses and verifies the integrity of the certificates, and stores the parsed certificate data in the root CA certificate repository and operational CA certificate repository of the verification evidence pool. S2. Automatically obtain the intermediate certificate of the operating CA from the public node of the operating CA. In this step, the system uses a pre-set web crawling module to periodically or as needed traverse the public certificate publishing nodes of each operating CA, automatically crawling intermediate certificates issued by each operating CA. For the obtained intermediate certificates, digital signature technology is used to verify them step by step from bottom to top until the certificate of the operating CA already obtained and confirmed in S1 is verified. After successful verification, it is confirmed that the issuer certificate of the intermediate certificate is indeed an operating CA certificate obtained in S1. The intermediate certificate is then added to the local certificate store, forming a fused evidence pool together with the root CA certificate and operating CA certificate obtained in S1. The issuance attribution relationship between the intermediate certificate and the corresponding operating CA is recorded in the evidence pool. Through the above steps S1 and S2, this invention integrates the root CA certificate, operational CA certificate and intermediate certificate automatically obtained from multiple public nodes to construct a verification evidence pool that includes the root CA certificate library, operational CA certificate library and intermediate certificate library. This eliminates the verification blind spots caused by the isolation of each data source and provides a comprehensive, accurate and reliable data foundation for subsequent certificate chain construction and compliance verification. S3. For certificates to be verified, use digital signature technology to verify them step by step from bottom to top until they pass the verification with the national root certificate, thus building a complete certificate chain. The specific process for this step is as follows: S301, The system receives the digital certificate to be verified and proceeds to S302. S302. Set the certificate to be verified as the current certificate, extract the issuer information of the certificate, and use it to match the certificate issued by its superior in the evidence pool; extract the fingerprint information of the certificate, and use it to compare whether it is a self-signed certificate in the future. S303. Search the evidence pool for the issuer certificate of the current certificate, i.e., the superior certificate. The search criteria are: the user information of the superior certificate must match the issuer information of the current certificate. If a matching superior certificate is found, proceed to S304; otherwise, proceed to S309, marking the certificate chain construction as failed. S304. Verify the digital signature of the current certificate using the public key of the parent certificate. Specifically, using the public key carried in the parent certificate, verify the signature of the data to be signed and the signature value portion of the current certificate using the signature algorithm identified by the current certificate (such as SHA256withRSA, SM3withSM2, etc.). If the verification passes, proceed to S305; otherwise, proceed to S309, marking the certificate chain construction as failed. S305. Determine if the superior certificate is a self-signed certificate, i.e., the fingerprint of the superior certificate matches the fingerprint of the current certificate. If it is a self-signed certificate, proceed to S306; otherwise, proceed to S307. S306. If it is a self-signed certificate, it means that the certificate is the national root CA certificate. The certificate chain is traced back to the trust anchor point, and then proceeds to S308. S307 If it is not a self-signed certificate, set the parent certificate as the current certificate and return to S302 to continue tracing to the next higher level. S308. The certificate chain has been successfully constructed. Output the complete certificate chain from the certificate to be verified to the national root CA certificate. At the same time, based on the attribution mapping relationship of the certificates at each level in the certificate chain, output the electronic certification service provider information associated with the certificate to be verified. S309, Certificate chain construction failed. S4 verifies the integrity of the certificate chain, the validity period of certificates at each level, revocation status, and public key algorithm, and comprehensively determines the compliance and validity of the certificate. The specific process for this step is as follows: S401. Based on the construction result of S3, the judgment is made as follows: if S3 has successfully constructed a complete certificate chain and reached the trust anchor point, the judgment is passed; if S3 fails to construct, the judgment is failed. S402. Certificate Validity Verification at Each Level: The validity period field of each certificate in the certificate chain is checked one by one, comparing the certificate usage time with the start and end dates of the validity period of each certificate. If the current time of any certificate at any level is not within its validity period (i.e., expired or not yet effective), then the certificate chain is determined to have an validity period anomaly. S403. Certificate Revocation Status Verification at Each Level: For each certificate in the certificate chain, the system automatically retrieves the Certificate Revocation List (CRL) published by the corresponding Electronic Certification Service Provider based on the certificate's CRL distribution point URL, and checks whether the certificate's serial number exists in the CRL. Simultaneously, the system also supports Online Certificate Status Protocol (OCSP) queries, allowing real-time access to the certificate's revocation status by sending a query request to the OCSP responder. If any certificate is found to have been revoked, the verification fails. S404, Verification of Public Key Algorithms for Certificates at All Levels: This check verifies whether the public key algorithms and signature algorithms used by certificates at each level of the certificate chain comply with relevant national cryptography management regulations and standards. Certificates using non-compliant algorithms are marked as non-compliant. S405. Verify the basic constraints of each CA certificate level. Check if the basic constraint extension of the certificate has been marked as a CA, explicitly declaring its authority to issue lower-level certificates. If a CA certificate at a certain level is not marked as a CA, it is determined that the certificate lacks issuing authority, and the certificate chain is invalid. Check the path length limit field of the certificate. If this field exists, calculate the current CA's hierarchical position in the certificate chain, ensuring that the number of lower-level certificates it has issued does not exceed the allowed path depth limit. If the limit is exceeded, the certificate chain is determined to violate path constraints, and the verification fails. S406. Verification of Key Purpose for CA Certificates at All Levels: Check whether the key purpose extension of the certificate includes the purpose of issuing the certificate. If this is not included in the key purpose extension, even if the certificate is a CA, it is not authorized to use its private key to issue lower-level certificates and is deemed non-compliant. S407. Comprehensive Judgment: The system integrates the inspection results from S401 to S406. If all inspections pass, the certificate to be verified is deemed compliant and valid, and the associated electronic certification service provider information is output. Otherwise, the corresponding reasons for non-compliance or invalidity are output to provide a basis for subsequent business processing. Example 2 In a second embodiment of the present invention, the present invention provides a system for verifying the compliance and validity of digital certificates, such as... Figure 2 As shown, it includes the following steps: The certificate acquisition module automatically retrieves root CA and operational CA certificates from the public nodes of the National Electronic Certification Root CA, and automatically retrieves intermediate certificates of operational CAs from their public nodes. It then merges multi-source certificate data to construct a unified verification evidence pool, establishing a mapping relationship between certificates and electronic certification service organizations. Specifically, this module includes a crawling submodule, a parsing submodule, and a synchronization submodule. The crawling submodule is responsible for accessing the public certificate publishing nodes of the National Electronic Certification Root CA and operational CAs according to preset scheduled tasks or external triggering instructions, downloading certificate files and related data. The parsing submodule is responsible for parsing the acquired X.509 format certificates, extracting key fields such as certificate subject, issuer, serial number, validity period, public key algorithm, certificate fingerprint, and CRL distribution point URL. The synchronization submodule is responsible for comparing existing data in the verification evidence pool, identifying newly added or changed certificates, and performing incremental synchronization updates. Through the collaborative work of these submodules, the certificate data in the evidence pool is ensured to be comprehensive, accurate, and timely synchronized with the official source. The certificate chain construction module is used to verify certificates to be verified using digital signature technology in a bottom-up, hierarchical manner. It verifies the digital signature of the current certificate using the public key of the higher-level certificate, iterating and tracing until it successfully verifies the signature against the national root certificate, thus constructing a complete certificate chain. Specifically, this module includes a certificate lookup submodule, a signature verification submodule, and a chain tracing submodule. The certificate lookup submodule matches the corresponding higher-level certificate issued by the current certificate in the evidence pool. The signature verification submodule uses the matched public key of the higher-level certificate to verify the digital signature of the current certificate, verifying the integrity and authenticity of the signature data. The chain tracing submodule controls the iteration process; when the higher-level certificate is not a self-signed root certificate, it sets the higher-level certificate as the current certificate and continues tracing upwards until the signature verification reaches the national root certificate or tracing fails. After successful construction, this module outputs the complete certificate trust chain and the associated electronic certification service provider identification information. The compliance and validity verification module verifies the integrity of the certificate chain, the validity period of certificates at each level, revocation status, public key algorithm, and the basic constraints and key usage of CA certificates. It comprehensively determines the compliance and validity of certificates and outputs associated electronic certification service provider information. Specifically, this module includes a certificate chain verification submodule, a validity period verification submodule, a revocation status verification submodule, a public key algorithm verification submodule, a basic constraint verification submodule, a key usage verification submodule, and a comprehensive judgment submodule. The certificate chain verification submodule checks the continuity of the certificate issuance relationship at each level of the certificate chain. The validity period verification submodule compares the certificate usage time with the start and end dates of the validity period of each level of certificate. The revocation status verification submodule checks the revocation status of certificates at each level by obtaining the CRL revocation list or initiating an OCSP online query. The public key algorithm verification submodule checks whether the public key algorithms of certificates at each level comply with relevant national cryptographic management standards. The basic constraint verification submodule checks whether the basic constraints of CA certificates at each level are CA certificates and whether the certificate path length exceeds the limit. The key usage verification submodule verifies whether the key usage of CA certificates at each level includes issuing certificates. The comprehensive judgment submodule summarizes the inspection conclusions of the above submodules and outputs the final compliance and validity judgment result and the associated electronic certification service provider information. Finally, it should be noted that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing embodiments or make equivalent substitutions for some of the technical features. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for verifying the compliance and validity of a digital certificate, characterized in that, include: S1. Automatically obtain the root CA certificate and the operating CA certificate from the public node of the National Electronic Certification Root CA; S2. Automatically obtain the intermediate certificate of the operating CA from the public node of the operating CA; S3. For certificates to be verified, use digital signature technology to verify them step by step from bottom to top until they pass the verification with the national root certificate. S4 verifies the integrity of the certificate chain, the validity period of certificates at each level, revocation status, public key algorithm, basic constraints of CA certificates, key usage, etc., and comprehensively judges the compliance and validity of the certificate.

2. The method for verifying the compliance and validity of a digital certificate according to claim 1, characterized in that, In step S1, the root CA certificate and the operating CA certificate are automatically obtained from the public node of the national electronic certification root CA, including: The system automatically initiates query requests to the public nodes of the national electronic certification root CA to retrieve the root CA certificate list and the operational CA certificate list. Each record in the root CA certificate list carries fields such as root CA certificate name, certificate serial number, DN information, certificate validity period, and certificate download. The system retrieves the corresponding CA certificate one by one according to the certificate download address of each entry in the list, and uses the root CA certificate name field of the entry to indicate the service provider affiliation of the retrieved certificate. Each record in the operational CA certificate list carries fields such as operational CA organization, certificate serial number, subject, status, type, certificate validity period, and certificate download. The system retrieves the corresponding CA certificate one by one according to the certificate download address of each entry in the list, and uses the operational CA organization field of the entry to indicate the service provider affiliation of the retrieved certificate. The affiliation mapping relationship between certificates and service providers is persisted to the local certificate store.

3. The method for verifying the compliance and validity of a digital certificate according to claim 1, characterized in that, In step S2, the intermediate certificate of the operating CA is automatically obtained from the public node of the operating CA, including: Automatically initiate query requests to each public node of the operating CA to obtain the intermediate certificate of the operating CA published by it. For the obtained intermediate certificate, use digital signature technology to verify it step by step from bottom to top. After confirming that the issuer certificate belongs to the operating CA certificate in S1, merge the obtained certificate into the local certificate store and form a fused evidence pool together with the certificate obtained in S1.

4. The method for verifying the compliance and validity of a digital certificate according to claim 1, characterized in that, In S3, for the certificate to be verified, digital signature technology is used to verify it step by step from bottom to top until it passes verification with the national root certificate, including: Extract the issuer field of the certificate to be verified, retrieve the certificate that matches the issuer from the certificates obtained from S1 and S2 as the superior certificate, and use the public key of the superior certificate to verify the digital signature of the certificate to be verified; if the signature verification is successful and the superior certificate is not a national root certificate, then use the superior certificate as the current certificate to continue iterating upwards for verification until a certain level certificate passes the signature verification with the national root certificate, and the certificate chain is completed.

5. The method for verifying the compliance and validity of a digital certificate according to claim 1, characterized in that, In step S4, the integrity of the certificate chain, the validity period of certificates at each level, revocation status, public key algorithm, and basic constraints and key usage of CA certificates are verified to comprehensively determine the compliance and validity of the certificates, including: Check whether the certificate chain extends completely from the certificate to be verified to the national root certificate; verify whether the validity period of each certificate in the certificate chain covers the certificate usage time; query the CRL or OCSP response of each certificate to confirm that it has not been revoked; verify whether the public key algorithm of each certificate complies with the relevant standards and policy compliance requirements for commercial cryptographic algorithms issued by the national cryptography management authority; check whether the basic constraints of each CA certificate in the certificate chain include CA and whether the path length exceeds the limit; check whether the key purpose of each CA certificate in the certificate chain includes issuing certificates; if all of the above are passed, the certificate is deemed compliant and valid. At the same time, output the electronic certification service authority corresponding to the certificate to be verified based on the attribution mapping established in S1 and S2.

6. A system for verifying the compliance and validity of digital certificates, characterized in that, A method for verifying the compliance and validity of a digital certificate as described in any one of claims 1-5, the system comprising: The certificate acquisition module is used to automatically obtain root CA certificates and operating CA certificates from the public nodes of the national electronic certification root CA, and automatically obtain intermediate certificates of operating CAs from the public nodes of each operating CA. It integrates multi-source certificate data to build a unified evidence pool and establishes an attribution mapping between certificates and service institutions. The certificate chain construction module is used to verify the certificate to be verified using digital signature technology from bottom to top, verifying the digital signature of the current certificate with the public key of the higher-level certificate, iterating and tracing until it passes the verification with the national root certificate, and building a complete certificate chain. The compliance and validity verification module is used to verify the integrity of the certificate chain, the validity period of certificates at all levels, revocation status, public key algorithm, basic constraints of CA certificates, key usage, etc., to comprehensively determine the compliance and validity of certificates, and output the associated electronic certification service provider information.

Images