Electronic device and certificate management method

Abstract

To reduce the workload on a client terminal side that occurs when the settings of an electronic device are changed.SOLUTION: A key storage unit 41 stores a root key pair and a server key pair, and a distribution unit 42 distributes a root public key to a PC. A certificate generation unit 43 generates a server certificate in which the setting information of an embedded device 10 and the server public key are signed with the root private key, and stores the server certificate in a certificate storage unit 44. A sending unit 45 sends the server certificate stored in the certificate storage unit 44 to the PC in response to access. A determination unit 46 determines whether a change in the setting of the embedded device 10 requires updating of the server certificate. When it is determined that the update is necessary, a control unit 47 causes the certificate generation unit 43 to regenerate the server certificate including the changed setting information, and updates the server certificate stored in the certificate storage unit 44 to the regenerated server certificate.SELECTED DRAWING: Figure 2

Description

[Technical Field]

[0001] The present invention relates to communications technology. [Background technology]

[0002] BACKGROUND ART Several technologies relating to electronic certificates used for authenticating communication partners and encrypting communication content in communications between electronic devices are known (see, for example, Patent Documents 1 to 4). [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Application Laid-Open No. 2011-135389 [Patent Document 2] Japanese Patent Application Laid-Open No. 2009-44557 [Patent Document 3] Japanese Patent Application Laid-Open No. 2006-174152 [Patent Document 4] International Publication No. 2010 / 067812 Summary of the Invention [Problem to be solved by the invention]

[0004] Electronic devices with web server functionality may generate a server certificate as a self-signed certificate. To use the web server provided by such electronic devices, the server certificate must be registered in a client terminal such as a PC with web browser functionality. When the settings of the electronic device are changed, the server certificate may need to be updated, which requires the time and effort of re-registering the updated server certificate in the client terminal. [Means for solving the problem]

[0005] An electronic device according to one embodiment has a web server function. The electronic device includes a key storage unit, a distribution unit, a certificate generation unit, a certificate storage unit, a sending unit, a determination unit, and a control unit. The key storage unit stores a pair of a first public key and a first private key and a second public key and a second private key in a public key cryptosystem. The distribution unit distributes the first public key to a client terminal using the web server function. The certificate generation unit generates a server certificate by signing, with the first private key, certificate information including configuration information indicating the configuration of the electronic device and the second public key. The certificate storage unit stores the server certificate. The sending unit sends the server certificate stored in the certificate storage unit to the client terminal in response to access to the electronic device from the client terminal. When a change is made to the configuration of the electronic device, the determination unit determines whether the change requires updating of the server certificate stored in the certificate storage unit. When the control unit determines that the change requires updating, the control unit controls the certificate generation unit and the certificate storage unit. The control over the certificate generation unit causes the server certificate to be regenerated, the server certificate including the changed configuration information as certificate information, and the control over the certificate storage unit causes the stored server certificate to be updated with the regenerated server certificate. [Effects of the Invention]

[0006] According to the above aspect, the workload on the client terminal side that occurs when the settings of the electronic device are changed is reduced. [Brief explanation of the drawings]

[0007] [Figure 1] FIG. 1 is a diagram illustrating an example of the configuration of an in-house system. [Figure 2] FIG. 2 is a diagram illustrating an example of a functional configuration of an embedded device. [Figure 3] FIG. 1 illustrates an example of a hardware configuration of an embedded device. [Figure 4] 10 is a flowchart illustrating an example of a startup process. [Figure 5]10 is a flowchart illustrating an example of a server certificate creation process. [Figure 6] 10 is a flowchart illustrating an example of a root public key distribution process. [Figure 7] FIG. 10 is a sequence diagram showing an example of a processing flow in the on-premise system when accessing a Web server function. [Figure 8] FIG. 10 is a sequence diagram showing an example of a processing flow in an on-premise system when changing settings on an embedded device. DETAILED DESCRIPTION OF THE INVENTION

[0008] In the embodiment described below, an electronic device having server functionality generates a root public key that serves as a root certificate and a root private key that pairs with the root public key in a public key cryptosystem, and distributes the root public key to a client terminal. The electronic device also generates a pair of keys (a server public key and a server private key) in a public key cryptosystem used for encrypted communication with the client terminal, and stores a server certificate generated by signing certificate information including the server public key and configuration information of the electronic device with the root private key. When the electronic device is actually in operation, when a client terminal accesses the electronic device, the client terminal verifies the server certificate sent from the electronic device with the previously distributed root public key, thereby enabling safe use of the server function provided by the electronic device.

[0009] Furthermore, when a setting change is made to the electronic device, the electronic device determines whether the change requires updating of the server certificate. If it determines that an update is necessary, the electronic device signs certificate information including the updated setting information of the electronic device with the root private key, and regenerates and stores the server certificate. In this way, when a client terminal accesses the electronic device after the setting change, the client terminal can verify the updated server certificate sent from the electronic device with the previously distributed root public key, so no additional workload is imposed on the client terminal.

[0010] Hereinafter, embodiments will be described in detail with reference to the drawings.

[0011] First, a description will be given of Fig. 1. Fig. 1 is a diagram showing an example of the configuration of an on-premise system 1. This on-premise system 1 is a system installed in, for example, a factory.

[0012] The on-premise system 1 comprises at least one embedded device 10 and a PC 20. The embedded device 10 and the PC 20 are connected via a communication network, LAN 30. Note that "PC" is an abbreviation for personal computer, and "LAN" is an abbreviation for local area network.

[0013] The embedded device 10 is an example of an electrical device that embodies the present invention.

[0014] The setting management UI function 11 is a function that provides a UI (User Interface) to the PC 20 so that an administrator who operates the PC 20 can make various settings for the embedded device 10.

[0015] The Web server function 12 is a function that provides the PC 20 with the Web (World Wide Web).

[0016] The SSL / TLS function 13 is a function that provides a connection by encrypted communication between the embedded device 10 and the PC 20. Note that "SSL" is an abbreviation for Secure Sockets Layer, and "TLS" is an abbreviation for Transport Layer Security.

[0017] The TCP / IP function 14 is a function that provides a communication protocol for communication between the embedded device 10 and the PC 20. Note that "TCP" is an abbreviation for Transmission Control Protocol, and "IP" is an Internet Protocol.

[0018] The Ethernet function 15 is a function that provides an interface with the LAN 30 .

[0019] The embedded device 10 further has a setting management function 16 , a root key management function 17 , and a server certificate management function 18 , as well as a key and certificate store 19 .

[0020] The setting management function 16 is a function for managing various settings for the embedded device 10 .

[0021] The root key management function 17 is a function for managing a root key pair (root public key and root private key), which is a pair of keys in a public key cryptosystem. The root private key is used for signing to generate a server certificate.

[0022] The server certificate management function 18 is a function for managing the server certificate for the embedded device 10 as a web server, and includes a function for managing a server key pair (a server public key and a server private key), which is a key pair in a public key cryptosystem. The server public key is a key included in the server certificate as certificate information together with the setting information of the embedded device 10.

[0023] The key and certificate store 19 is a storage device that stores a root key pair, a server key pair, and a server certificate.

[0024] The PC 20 is an example of a client terminal that uses the Web server function 12 provided by the embedded device 10.

[0025] The PC 20 is equipped with an OS 21. The OS 21 provides an SSL / TLS function 22, a TCP / IP function 23, and an Ethernet function 24. These functions are the same as the SSL / TLS function 13, the TCP / IP function 14, and the Ethernet function 15.

[0026] The PC 20 also includes a web browser 25. The web browser 25 is application software that uses a web server provided by the embedded device 10, and runs on the OS 21.

[0027] The PC 20 further includes a key and certificate store 26. The key and certificate store 26 is a storage device that stores the root public key, server public key, and server certificate for the embedded device 10.

[0028] The on-premise system 1 is configured as described above. An example of the functional configuration of the embedded device 10 in this on-premise system 1 will be described in more detail with reference to FIG.

[0029] The configuration management function 16, root key management function 17, server certificate management function 18, and key / certificate store 19 provided by the embedded device 10 in FIG. 1 are provided by each component of the embedded device 10 shown in FIG. 2, either individually or in combination.

[0030] The key storage unit 41 stores a root public key (first public key) and a root private key (first private key), which are paired in the public key cryptosystem, as well as a server public key (second public key) and a server private key (second private key).

[0031] The distribution unit 42 distributes the root public key (first public key) to client terminals that use the Web server function 12 provided by the embedded device 10.

[0032] The certificate generation unit 43 generates a server certificate by signing, with the root private key (first private key), certificate information including setting information indicating the content of settings for the embedded device 10 and a server public key (second public key).

[0033] The certificate storage unit 44 stores the server certificate generated by the certificate generation unit 43 .

[0034] The sending unit 45 sends the server certificate stored in the certificate storing unit 44 to the PC 20 in response to an access from the PC 20 to the embedded device 10, for example, an access for using the Web server function 12.

[0035] When a change is made to the settings of the embedded device 10, the determination unit 46 determines whether the change requires updating of the server certificate stored in the certificate storage unit 44. In this determination, the determination unit 46 determines that updating of the server certificate is required when, for example, the change to the settings of the embedded device 10 changes the setting of information that identifies the embedded device 10. Note that the information that identifies the embedded device 10 is, for example, the Internet Protocol address or domain name of the embedded device 10.

[0036] When it is determined that a change in the settings of the embedded device 10 requires updating of the server certificate, the control unit 47 controls the certificate generation unit 43 and the certificate storage unit 44. In controlling the certificate generation unit 43, the control unit 47 causes the certificate generation unit 43 to regenerate a server certificate that includes, as certificate information, setting information after the change in the settings of the embedded device 10. In controlling the certificate storage unit 44, the control unit 47 updates the stored server certificate to the server certificate regenerated by the certificate generation unit 43.

[0037] The key generation unit 48 generates a pair of keys that are paired in the public key cryptosystem.

[0038] For example, when the embedded device 10 is started up and the root public key and root private key are not stored in the key storage unit 41, the control unit 47 controls the key generation unit 48 and the key storage unit 41. In controlling the key generation unit 48, the control unit 47 causes the key generation unit 48 to generate the root public key and root private key. In controlling the key storage unit 41, the control unit 47 causes the key storage unit 41 to store the root public key and root private key generated by the key generation unit 48.

[0039] Furthermore, for example, when the server certificate is not stored in the certificate storage unit 44 when the embedded device 10 is started up, the control unit 47 controls the key generation unit 48, the key storage unit 41, the certificate generation unit 43, and the certificate storage unit 44. In controlling the key generation unit 48, the control unit 47 causes the key generation unit 48 to generate a server public key and a server private key. In controlling the key storage unit 41, the control unit 47 causes the key generation unit 48 to store the server public key and server private key generated by the key generation unit 48 in the key storage unit 41. In controlling the certificate generation unit 43, the control unit 47 causes the certificate generation unit 43 to newly generate a server certificate that includes the server public key generated by the key generation unit 48 as certificate information. In controlling the certificate storage unit 44, the control unit 47 stores the server certificate newly generated by the certificate generation unit 43 in the certificate storage unit 44.

[0040] The embedded device 10 has, for example, the above-mentioned functional configuration. Next, an example of the hardware configuration of the embedded device 10 will be described with reference to FIG.

[0041] The embedded device 10 comprises the following components: a CPU 51, a memory 52, an input device 53, an output device 54, an auxiliary storage device 55, and a communication I / F 56. All of these components are connected to an internal bus 57, and are configured to enable data exchange between the components. Note that "CPU" is an abbreviation for Central Processing Unit. Also, "I / F" is an abbreviation for Interface.

[0042] The CPU 51 controls each hardware component of the embedded device 10 by, for example, executing a predetermined program using the memory 52, thereby enabling the embedded device 10 to provide each function it has.

[0043] The input device 53 is, for example, a keyboard or pointing device for inputting instructions, or various sensors.

[0044] The output device 54 is used, for example, to output various types of information.

[0045] The auxiliary storage device 55 is a non-volatile storage device, such as a flash memory, that provides the function of the key and certificate store 19 in Fig. 1 and is used by the CPU 51 to provide the key storage unit 41 and the certificate storage unit 44 in Fig. 2.

[0046] The communication I / F 56 transmits and receives various data to and from the PC 20 via the LAN 30 in accordance with instructions sent from the CPU 51. The communication I / F 56 provides the Ethernet function 15 in Fig. 1 and is also used by the CPU 51 to provide the distribution unit 42 and the sending unit 45 in Fig. 2.

[0047] Next, various processes performed by the CPU 51 of the embedded device 10 will be described.

[0048] First, a description will be given of the startup process that is first performed when power supply to the embedded device 10 is started. Fig. 4 is a flowchart showing the processing content of an example of the startup process.

[0049] 4 starts, first, in S101, the data stored in the key / certificate store 19 is checked. Then, in the following S102, a process is performed to determine whether or not a root key pair is stored based on the result of this check.

[0050] In the determination process of S102, if it is determined that the root key pair is stored (if the determination result is Yes), the process proceeds to S105, and if it is determined that the root key pair is not stored (if the determination result is No), the process proceeds to S103. Note that a case in which the root key pair is not stored in the key / certificate store 19 refers to a case in which power is supplied to the embedded device 10 for the first time during construction work of the on-premise system 1 before actual operation.

[0051] In S103, a process of generating a root key pair is performed, and in the following S104, a process of storing the generated root key pair in the key / certificate store 19 is performed, and then the process proceeds to S105.

[0052] Next, in S105, based on the result of the check in the process of S101, a process is performed to determine whether or not a server certificate is stored in the key and certificate store 19. In this determination process, if it is determined that a server certificate is stored (if the determination result is Yes), the process proceeds to S106, and if it is determined that a server certificate is not stored (if the determination result is No), the process proceeds to S108. A case in which a server certificate is not stored in the key and certificate store 19 is when power is supplied to the embedded device 10 for the first time during the construction work of the on-premise system 1 before it goes into production.

[0053] In S106, a process is performed to determine whether or not the settings of the embedded device 10 have been changed. In this determination process, if it is determined that the settings have been changed (if the determination result is Yes), the process proceeds to S107, where a process is performed to determine whether or not the change in settings requires updating of the server certificate.

[0054] In the determination process of S107, when it is determined that the change in the settings of the embedded device 10 requires updating of the server certificate (when the determination result is Yes), the process proceeds to S108. For example, when the setting of the Internet Protocol address or domain name of the embedded device 10 is changed, this corresponds to a case where the change in the settings of the embedded device 10 requires updating of the server certificate.

[0055] In S108, a server certificate is created, the details of which will be described later.

[0056] After the server certificate creation process in S108 is completed, the startup process in Fig. 4 ends. Also, when it is determined in the determination process in S106 that the settings for the embedded device 10 have not been changed (when the determination result is No), the startup process in Fig. 4 ends. Furthermore, when it is determined in the determination process in S107 that the settings for the embedded device 10 have not been changed and require updating of the server certificate (when the determination result is No), the startup process in Fig. 4 ends.

[0057] The above-described processing is the startup processing. Note that the processing of S103 corresponds to the processing of the key generation unit 48, the processing of S104 corresponds to the processing of the key storage unit 41, and the processing of S106 and S107 corresponds to the processing of the determination unit 46. Note that the control unit 47 is involved in the entire startup processing.

[0058] Next, the server certificate creation process in S108 of the above-mentioned startup process will be described below. Fig. 5 is a flowchart showing the process contents of the server certificate creation process.

[0059] When the server certificate creation process is started, first, in S201, a process of generating a server key pair is performed, and then in S202, a process of storing the generated server key pair in the key and certificate store 19 is performed.

[0060] Next, in S203, a process is performed to acquire the current settings for the embedded device 10. Then, in the following S204, a process is performed to generate a server certificate.

[0061] In the process of S204, first, a process is performed to create certificate information including device setting information, which is information about the setting contents of the embedded device 10 to be included in the server certificate, and the server public key of the server key pair created in the process of S201. Next, a process is performed to sign the created certificate information with the root private key of the root key pair stored in the key and certificate store 19, and a server certificate is created.

[0062] In S205, the server certificate generated in the process of S204 is stored in the key and certificate store 19, after which the server certificate generation process ends and the process returns to the original process.

[0063] The above-described processing is the server certificate creation processing. Note that the processing of S201 corresponds to the processing of the key generation unit 48, and the processing of S202 corresponds to the processing of the key storage unit 41. Furthermore, the processing of S203 and S204 corresponds to the processing of the certificate generation unit 43, and the processing of S205 corresponds to the processing of the certificate storage unit 44.

[0064] Next, a root public key distribution process will be described, which distributes the root public key of the root key pair generated in the embedded device 10 in response to a download request sent from the PC 20 via the LAN 30. Fig. 6 is a flowchart showing an example of the root public key distribution process. This process is performed when the on-premise system 1 is being built before it goes live, and is performed after the above-mentioned startup process has been completed.

[0065] When the processing in FIG. 6 starts, first, in S301, a process of receiving a request to download the root public key is performed, and then in S302, a process of determining whether or not a download request has been received is performed.

[0066] If it is determined in the determination process of S302 that a download request has been received (the determination result is Yes), the process proceeds to S303. Then, in S303, the root public key stored in the key and certificate store 19 is obtained and transmitted to the requesting PC 20 via the LAN 30, and then the process proceeds to S304. The PC 20 receives the root public key transmitted from the embedded device 10 in the process of S303 and stores it in the key and certificate store 26.

[0067] On the other hand, if it is determined in the determination process of S302 that a download request has not been received (the determination result is No), the process of S303 is skipped and the process proceeds to S304.

[0068] In S304, a process is performed to determine whether the construction work of the local system 1 has been completed, and if it is determined that it has been completed (if the determination result is Yes), the root public key distribution process is terminated. On the other hand, if it is determined that the construction work of the local system 1 has not been completed and is still ongoing (if the determination result is No), the process returns to S301 and the above-mentioned processes are continued. For example, if an instruction to switch the operation of the embedded device 10 from system construction to actual operation is received, it is determined in the determination process of S304 that the construction work of the local system 1 has been completed.

[0069] The above-mentioned process is the root public key distribution process, which corresponds to the process of the distribution unit 42.

[0070] Instead of distributing the root public key as described above, the root public key may be distributed to the PC 20 via a tool device for maintaining the embedded device 10. That is, for example, a tool device for maintaining the embedded device 10 is connected to a P2P (Peer-to-Peer) interface (not shown) provided in the embedded device 10, and the root public key is downloaded to the tool device. The P2P interface is, for example, a USB (Universal Serial Bus) interface. Then, the tool device is connected to the PC 20, and the PC 20 downloads the root public key from the tool device and stores it in the key and certificate store 26. The root public key generated in the embedded device 10 may be distributed to the PC 20 in this manner, for example.

[0071] Next, a process flow during actual operation of the on-premise system 1 after construction work will be described.

[0072] First, an example of the flow of processing in the local system 1 when accessing the Web server function 12 provided by the embedded device 10 will be described with reference to the sequence diagram shown in FIG.

[0073] In order to use the web server function 12 provided by the embedded device 10 with the web browser 25 of the PC 20, the embedded device 10 is accessed from the PC 20. This access uses an SSL / TLS connection and performs server authentication processing (S400).

[0074] In this server authentication process, in response to access from the PC 20, the embedded device 10 performs a process of sending the server certificate stored in the key / certificate store 19 to the PC 20. This process corresponds to the process of the sending unit 45 in FIG. 2.

[0075] Meanwhile, when the PC 20 receives the server certificate from the embedded device 10, it performs a process of verifying the signature with the root private key in the server certificate with the root public key that was distributed from the embedded device 10 during the construction work of the local system 1 and stored in the key and certificate store 26. If this verification is successful and the server authentication process is completed, the PC 20 starts encrypted communication with the Web server function 12 of the embedded device 10 using the server public key that was included as certificate information in the server certificate.

[0076] Next, an example of the flow of processing in the on-premise system 1 when changing the settings of the embedded device 10 will be described with reference to the sequence diagram shown in FIG.

[0077] First, the PC 20 accesses the embedded device 10 in order to use the web server function 12 provided by the embedded device 10 with the web browser 25 of the PC 20. This access uses an SSL / TLS connection and performs server authentication processing (S400). This server authentication processing is similar to that described using FIG. 7.

[0078] After the server authentication process is completed and encrypted communication with the Web server function 12 of the embedded device 10 is initiated, the PC 20 issues an instruction to change the settings of the embedded device 10. In the example of Figure 8, this change request is sent from the PC 20 to the embedded device 10 in response to an operation by the administrator of the local system 1 to change the settings on the UI provided to the PC 20 by the setting management UI function 11 of the embedded device 10. The setting management UI function 11 uses the Web server function 12 to provide a UI on the Web browser 25 of the PC 20, acquires the operation by the administrator to change the settings, and passes a setting change instruction associated with the acquired operation to the setting management function 16.

[0079] The setting management function 16 performs processing to change the settings of the embedded device 10 in accordance with the setting change instruction passed from the setting management UI function 11 (S510).

[0080] When the setting change process of S510 is completed, the setting management function 16 displays a setting change operation completion screen on the display screen of the PC 20. This setting change operation completion screen includes an operation button for issuing an instruction to restart the embedded device 10. The setting management function 16 uses the setting management UI function 11 and the Web server function 12 to display the setting change operation completion screen on the Web browser 25 of the PC 20.

[0081] When the administrator of the on-premise system 1 issues an instruction to restart the embedded device 10 to the PC 20, this operation is acquired by the setting management UI function 11 via the Web server function 12, and the setting management UI function 11 passes the restart instruction to the setting management function 16. In accordance with the restart instruction, the setting management function 16 performs termination processing to terminate the various processes being executed by the embedded device 10 (S520), performs disconnection processing to disconnect the SSL / TLS connection with the PC 20 (S530), and then restarts the embedded device 10.

[0082] After the embedded device 10 is restarted, the startup process shown in FIG. 4 is performed. Here, for example, if the setting change is a change to the Internet Protocol address or domain name setting of the embedded device 10, the results of the determination processes in S102, S105, S106, and S107 in the startup process performed at this time will all be Yes. In this case, the server certificate creation process, which is the process in S108 in the startup process, is performed as server certificate update process (S550). Through this process, a server certificate is regenerated that includes, as certificate information, the setting information for the embedded device 10 after the setting change, and the server certificate stored in the key / certificate store 19 is updated to the regenerated server certificate. Thereafter, the sequence shown in FIG. 7 is performed again.

[0083] When the on-premise system 1 is in operation, various processes are carried out in the above-described procedure.

[0084] As described above, the embedded device 10 of this embodiment stores a root key pair and a server key pair in the key and certificate store 19 and distributes the root public key of the root key pair to the PC 20. The embedded device 10 also generates a server certificate by signing, with the root private key of the root key pair, certificate information including configuration information indicating the configuration details for the embedded device 10 and the server public key of the server key pair, and stores the server certificate in the key and certificate store 19. When the embedded device 10 is accessed by the PC 20, it sends the server certificate stored in the key and certificate store 19 to the PC 20 in response to the access. When a change is made to the configuration of the embedded device 10, the embedded device 10 determines whether the change requires the server certificate to be updated. If the embedded device 10 determines that an update is required, it regenerates a server certificate including the changed configuration information as certificate information, and updates the server certificate stored in the key and certificate store 19 to the regenerated server certificate.

[0085] By having the embedded device 10 of this embodiment perform the above processing, the workload on the PC 20 side that occurs when the settings of the embedded device 10 are changed is reduced.

[0086] While the disclosed embodiments and their advantages have been described in detail above, those skilled in the art may make various modifications, additions, and omissions without departing from the scope of the invention as clearly set forth in the claims. [Explanation of symbols]

[0087] 1. On-premise system 10 Embedded devices 11 Settings management UI function 12 Web Server Function 13, 22 SSL / TLS function 14, 23 TCP / IP functions 15, 24 Ethernet function 16 Settings management function 17 Root Key Management Function 18 Server certificate management function 19, 26 Key and Certificate Store 20 PC 21 OS 25 Web Browsers 30 LAN 41 Key storage 42 Distribution Section 43 Certificate Generation Unit 44 Certificate Storage Unit 45 Sending Department 46 Judgment section 47 Control Unit 48 Key generation section 51 CPU 52 memory 53 Input Device 54 Output Device 55 Auxiliary storage device 56 Communication I / F 57 Internal Bus

Claims

1. An electronic device having a web server function, a key storage unit that stores a first public key and a first private key, and a second public key and a second private key, which are paired in a public key cryptosystem; a distribution unit that distributes the first public key to a client terminal that uses the web server function; a certificate generating unit that generates a server certificate by signing, with the first private key, certificate information including setting information indicating settings for the electronic device and the second public key; a certificate storage unit that stores the server certificate; a sending unit that sends the server certificate stored in the certificate storage unit to the client terminal in response to access to the electronic device from the client terminal; a determination unit that determines, when the setting of the electronic device is changed, whether the change requires updating of the server certificate stored in the certificate storage unit; a control unit that, when it is determined that the change requires the update, controls the certificate generation unit to regenerate the server certificate including the setting information after the change as the certificate information, and controls the certificate storage unit to update the stored server certificate to the regenerated server certificate; An electronic device comprising:

2. 2. The electronic device according to claim 1, wherein the determination unit determines that the change requires the update when the change is a change to a setting of information that identifies the electronic device.

3. 3. The electronic device according to claim 2, wherein the information for identifying the electronic device is an Internet protocol address or a domain name of the electronic device.

4. a key generation unit that generates a pair of keys in a public key cryptosystem; When the first public key and the first private key are not stored in the key storage unit at the time of startup of the electronic device, the control unit controls the key generation unit to generate the first public key and the first private key, and controls the key storage unit to store the generated first public key and first private key.

4. The electronic device according to claim 1, wherein the first and second electrodes are electrically connected to the first and second electrodes.

5. a key generation unit that generates a pair of keys in a public key cryptosystem; If the server certificate is not stored in the certificate storage unit when the electronic device is started up, the control unit controls the key generation unit to generate the second public key and the second private key, controls the key storage unit to store the generated second public key and the second private key, and further controls the certificate generation unit to newly generate the server certificate including the generated second public key as the certificate information, and controls the certificate storage unit to store the newly generated server certificate.

4. The electronic device according to claim 1, wherein the first and second electrodes are electrically connected to the first and second electrodes.

6. A certificate management method performed by an electronic device having a web server function, comprising: Distributing the first public key of a pair of a first public key and a first private key and a second public key and a second private key, which are stored in a key storage unit of the electronic device, to a client terminal that uses the Web server function; generating a server certificate by signing, with the first private key, certificate information including setting information indicating the content of settings for the electronic device and the second public key; storing the server certificate in a certificate storage unit included in the electronic device; In response to an access from the client terminal to the electronic device, the server certificate stored in the certificate storage unit is sent to the client terminal; When the setting of the electronic device is changed, it is determined whether the change requires updating of the server certificate stored in the certificate storage unit; when it is determined that the change requires the update, regenerate the server certificate including the setting information after the change as the certificate information, and update the server certificate stored in the certificate storage unit to the regenerated server certificate. A certificate management method comprising:

Images