Method, system and device for performing automatic acme domain name verification, and storage medium

Abstract

The present invention relates to the technical field of Internet communications. Disclosed are a method, system and device for performing automatic ACME domain name verification, and a storage medium, which are used for solving the technical problems in the prior art of there being security risks when domain name verification is performed by means of a cloud service provider, and a verification process being complicated and insufficiently automated. The method comprises: responding to and resolving a certificate application request sent by a user, and acquiring user domain name information carried in the certificate application request; on the basis of the user domain name information, creating an ACME order by means of an ACME account of the user, randomly generating a domain name verification token, and on the basis of a user public key corresponding to the ACME account, generating a domain name verification value; identifying the type of a DNS resolution platform corresponding to the user domain name information, and on the basis of the type of the DNS resolution platform, calling the corresponding DNS resolution platform to perform domain name resolution; and performing polling and then detecting whether the domain name resolution has taken effect, and if the domain name resolution has taken effect, completing domain name verification, and signing and issuing a certificate.

Description

ACME Domain Name Automatic Verification Methods, Systems, Equipment, and Storage Media Technical Field

[0001] This invention relates to the field of Internet communication technology, and in particular to an ACME domain name automatic verification method, system, device and storage medium. Background Technology

[0002] The ACME (Automatic Certificate Management Environment, RFC 8555) protocol is an internet standard. According to this protocol, users first install the ACME client on the node where the certificate server needs to be deployed by downloading it. Then, they specify the directory URL (Uniform Resource Locator) provided by the CA (Certificate Authority) via the command line, specify the private key type, specify the authentication method, specify the authentication path (file path or DNS service provider API), specify the deployment path, and specify the certificate reload command. Finally, the certificate application and deployment are completed. The ACME client will periodically check whether the certificate list it maintains needs to be updated and automatically complete the last application action.

[0003] In existing technologies, when performing automatic domain name verification, it is necessary to obtain the DNS interface key from the cloud service provider and configure it through environment variables on the ACME client. This is cumbersome and poses security risks. For example, if the server is compromised, there is a risk of leaking the DNS interface key, which can easily threaten the security of domain name resolution. Furthermore, the existing ACME cannot specify multiple DNS resolutions in the same automatic issuance. Cloud users may use DNS resolutions from different cloud providers at the same time, and the existing automation solutions of cloud providers cannot be effectively integrated with ACME.

[0004] Summary of the Invention

[0005] The main objective of this invention is to solve the technical problems in the prior art where there are security risks when verifying domain names through cloud service providers, and the verification process is cumbersome and not automated enough.

[0006] The first aspect of the present invention provides an ACME domain name automatic verification method, comprising: responding to and parsing a certificate application request issued by a user, and obtaining user domain name information carried in the certificate application request;

[0007] Based on the user's domain name information, an ACME order is created through the user's ACME account and a domain name verification token is randomly generated. A domain name verification value is then generated based on the user's public key corresponding to the ACME account.

[0008] Identify the type of DNS resolution platform corresponding to the user's domain name information, and call the corresponding DNS resolution platform to perform domain name resolution according to the type of DNS resolution platform;

[0009] The system polls to check if the domain name resolution is effective. If the domain name resolution is effective, the system completes the domain name verification and issues a certificate.

[0010] Optionally, in a first implementation of the first aspect of the present invention, before responding to and parsing the certificate application request issued by the user and obtaining the user domain name information carried in the certificate application request, the method further includes:

[0011] Generate a user key, and request to register an ACME account based on the user key and the information of the EAB account corresponding to the current user;

[0012] Upon receiving an ACME account registration request, the request is parsed, and the existence of the corresponding EAB account is checked.

[0013] If an EAB account exists, an ACME account is created based on the EAB account, and the ACME account is associated with the cloud platform corresponding to the EAB account and the unique user identifier.

[0014] Optionally, in a second implementation of the first aspect of the present invention, before generating the user key and requesting registration of an ACME account based on the user key and the information of the EAB account corresponding to the current user, the method further includes:

[0015] Generate a unique user identifier for the user, and initiate an EAB account creation request based on the unique user identifier;

[0016] Based on the EAB account creation request, create an EAB account and bind it to the unique user identifier.

[0017] Optionally, in a third implementation of the first aspect of the present invention, identifying the type of DNS resolution platform corresponding to the user domain name information and calling the corresponding DNS resolution platform to perform domain name resolution according to the type of the DNS resolution platform includes:

[0018] Based on the user's domain name information, domain name verification value, and the user's unique user identifier, query the NS record of the domain name;

[0019] The type of the DNS resolution platform identified is determined based on the NS record, wherein the type of the DNS resolution platform includes a proprietary DNS resolution platform and a managed DNS resolution platform;

[0020] If it is a proprietary DNS resolution platform, then add domain name resolution directly through the proprietary DNS resolution platform;

[0021] If it is a managed DNS resolution platform, then obtain the permissions of the managed DNS resolution platform and connect to the managed DNS resolution platform to verify the domain name resolution.

[0022] Optionally, in a fourth implementation of the first aspect of the present invention, before responding to and parsing the certificate application request issued by the user and obtaining the user domain name information carried in the certificate application request, the method further includes:

[0023] Obtain permission to manage DNS resolution, add the interface key of the managed cloud platform, and obtain permission to manage the domain name resolution of the managed DNS resolution platform through the interface key;

[0024] The method for obtaining permissions from the managed DNS resolution platform includes:

[0025] Obtain the interface key of the hosted DNS resolution platform, and obtain the domain name resolution permission of the hosted DNS resolution platform based on the interface key.

[0026] Optionally, in a fifth implementation of the first aspect of the present invention, the type of the DNS resolution platform further includes other DNS resolution platforms that are not owned DNS resolution platforms or managed DNS resolution platforms; the step of identifying the type of the DNS resolution platform corresponding to the user domain name information and calling the corresponding DNS resolution platform to perform domain name resolution verification according to the type of the DNS resolution platform further includes:

[0027] If the domain name is from another DNS resolution platform, a domain name resolution verification request will be sent to the user to select the corresponding DNS resolution platform.

[0028] A second aspect of the present invention provides an ACME domain name automatic verification system, characterized in that the ACME domain name automatic verification system comprises:

[0029] The ACME server is used to respond to and parse the certificate application request issued by the user, obtain the user domain name information carried in the certificate application request; based on the user domain name information, create an ACME order through the user's ACME account and randomly generate a domain name verification token, and generate a domain name verification value according to the user's public key corresponding to the ACME account;

[0030] The cloud platform is used to identify the type of DNS resolution platform corresponding to the user's domain name information, and to call the corresponding DNS resolution platform to perform domain name resolution according to the type of DNS resolution platform;

[0031] The ACME service is also used to poll and check whether the domain name resolution has taken effect. If the domain name resolution verification has taken effect, the domain name verification is completed and a certificate is issued.

[0032] A third aspect of the present invention provides an ACME domain name automatic verification device, comprising: a memory and at least one processor, wherein the memory stores instructions; the at least one processor invokes the instructions in the memory to cause the ACME domain name automatic verification device to perform the steps of the ACME domain name automatic verification method described above.

[0033] A fourth aspect of the present invention provides a computer-readable storage medium storing instructions that, when executed on a computer, cause the computer to perform the steps of the ACME domain name automatic verification method described above.

[0034] The technical solution provided by this invention responds to and parses a certificate application request issued by a user, obtaining the user's domain name information carried in the certificate application request; based on the user's domain name information, an ACME order is created through the user's ACME account and a domain name verification token is randomly generated, and a domain name verification value is generated according to the user's public key corresponding to the ACME account; the type of DNS resolution platform corresponding to the user's domain name information is identified, and the corresponding DNS resolution platform is called to perform domain name resolution according to the type of DNS resolution platform; the domain name resolution is polled to check whether it has taken effect, and if the domain name resolution has taken effect, the domain name verification is completed and a certificate is issued. This method can reduce the security risks existing when performing domain name verification through cloud service providers, simplify the verification process, and improve the degree of automation of verification. Furthermore, the system, electronic device, and computer-readable storage medium provided by this invention also solve the corresponding technical problems. Attached Figure Description

[0035] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0036] Figure 1 is a flowchart illustrating the first embodiment of the ACME domain name automatic verification method according to the present invention.

[0037] Figure 2 is a flowchart illustrating the second embodiment of the ACME domain name automatic verification method in this invention.

[0038] Figure 3 is a schematic diagram of information interaction in the ACME domain name automatic verification method in an embodiment of the present invention;

[0039] Figure 4 is a schematic diagram of an embodiment of the ACME domain name automatic verification system according to the present invention;

[0040] Figure 5 is a schematic diagram of another embodiment of the ACME domain name automatic verification system in this invention;

[0041] Figure 6 is a schematic diagram of an embodiment of the ACME domain name automatic verification device in this invention;

[0042] Figure 7 is a schematic diagram of the principle of a computer-readable medium in an embodiment of the present invention. Detailed Implementation

[0043] Exemplary embodiments of the invention will now be described more fully with reference to the accompanying drawings. However, these exemplary embodiments can be implemented in many forms and should not be construed as limiting the invention to the embodiments set forth herein. Rather, these exemplary embodiments are provided to make the invention more comprehensive and complete, and to facilitate a full communication of the inventive concept to those skilled in the art. The same reference numerals in the drawings denote the same or similar elements, components, or parts, and therefore repeated descriptions of them will be omitted.

[0044] Subject to the inventive concept, the features, structures, characteristics or other details described in a particular embodiment may be combined in one or more other embodiments in a suitable manner.

[0045] In the description of specific embodiments, the features, structures, characteristics, or other details described in this invention are intended to enable those skilled in the art to fully understand the embodiments. However, it is not excluded that those skilled in the art can practice the technical solutions of this invention without one or more of the specific features, structures, characteristics, or other details.

[0046] The flowcharts shown in the accompanying drawings are merely illustrative and do not necessarily include all content and operations / steps, nor do they necessarily have to be performed in the described order. For example, some operations / steps can be broken down, while others can be combined or partially combined; therefore, the actual execution order may change depending on the specific circumstances.

[0047] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities can be implemented in software, in one or more hardware modules or integrated circuits, or in different network and / or processor devices and / or microcontroller devices.

[0048] The terms “and / or” or “and / or” include all combinations of any one or more of the listed items.

[0049] Please refer to Figure 1. The first embodiment of the ACME domain name automatic verification method in this invention includes:

[0050] S101. Respond to and parse the certificate application request issued by the user, and obtain the user domain name information carried in the certificate application request;

[0051] It is understood that the subject of this invention can be the ACME domain name automatic verification system, or it can be a terminal or a server; no specific limitation is made here.

[0052] In this embodiment, the ACME client refers to a software application used in the Automated Certificate Management Environment (ACME) protocol to generate, update, and manage SSL (Secure Socket Layer) / TLS (Transport Layer Security) certificates. It automates the certificate application, verification, and renewal process by interacting with the ACME server. Current ACME client implementations include acme.sh and certbot, which communicate with the ACME server via HTTPS (Hypertext Transfer Protocol Secure) and exchange data using JSON (JavaScript Object Notation) format. The certificate application request in this step also carries the user's domain name information for which domain name verification is required.

[0053] Corresponding to the ACME client, this embodiment also includes an ACME server. The ACME server is part of the Automatic Certificate Management Environment (ACME) protocol and is responsible for receiving certificate requests from clients, performing domain name verification, and issuing SSL / TLS certificates. It is typically operated by a Certificate Authority (CA) or its authorized agents and is a server-side implementation supporting the ACME protocol. It communicates with the ACME client via HTTPS, exchanges data using JSON format, and may use encryption technology to protect the communication process.

[0054] Specifically, in this step, the ACME client receives the certificate request, responds to and parses the request to obtain the user domain information carried in the certificate request. In a practical example, the acme.sh script can be used to request the automatic issuance and renewal of SSL / TLS certificates via the ACME protocol.

[0055] S102. Based on the user's domain name information, create an ACME order through the user's ACME account and randomly generate a domain name verification token, and generate a domain name verification value according to the user's public key corresponding to the ACME account.

[0056] After obtaining the user domain information carried in the certificate application request, the ACME client generates a new order request based on the user domain information and sends the generated new order request to the ACME server.

[0057] After receiving a request from the ACME client, the ACME server randomly generates a domain verification token, which is used for subsequent domain verification. This domain verification token can be a Token.

[0058] Obtain the user's public key corresponding to the ACME account, generate the fingerprint of the user's public key, encode the fingerprint of the user's public key to obtain the key fingerprint encoding; generate the domain name verification value based on the token and the key fingerprint encoding. In a specific implementation of domain name verification value generation, it can be in the following form: Key Authorization = token||'.'||base64url(Thumbprint(account Key));

[0059] Here, Key Authorization refers to the domain verification value, base64url(Thumbprint(account Key)) represents the value obtained by encoding the fingerprint corresponding to the user's public key after hash calculation and Base64URL encoding, and "." is a string concatenation character used to separate the token and the account key fingerprint encoding value.

[0060] The obtained domain verification value is placed in a specific location during subsequent domain verification processes so that the ACME server can verify the client's control over the domain; for example, in HTTP verification, it is placed in a specified URL path; in DNS (Domain Name System) verification, it is placed in a specified DNS record.

[0061] S103. Identify the type of DNS resolution platform corresponding to the user's domain name information, and call the corresponding DNS resolution platform to perform domain name resolution according to the type of DNS resolution platform;

[0062] This embodiment also utilizes a cloud platform, which is a virtualized platform operated by a third-party service provider that provides comprehensive services such as computing resources, storage space, databases, networks, software, analytics, and intelligence via the Internet. This embodiment primarily involves the DNS resolution service and SSL certificate application service provided by the cloud platform. The cloud platform identifies the type of DNS resolution platform corresponding to the user's domain name information based on the user's domain name information, domain name verification value, and the unique user identifier corresponding to the ACME account, and calls the corresponding DNS resolution platform to perform domain name resolution according to the type of DNS resolution platform.

[0063] Specifically, in this embodiment, the type of DNS resolution platform refers to whether it is a proprietary DNS resolution platform in the current cloud platform's hosting list. If it is a proprietary DNS resolution platform, the domain name resolution is added directly through the proprietary DNS resolution platform; if it is a hosted DNS resolution platform, the permissions of the hosted DNS resolution platform are obtained, and the domain name resolution is verified by connecting to the hosted DNS resolution platform.

[0064] Before accessing the managed DNS resolution platform for domain name resolution verification, the process includes pre-obtaining permissions to manage DNS resolution and adding an interface key for the managed cloud platform. This interface key is used to obtain permissions to manage domain name resolution on the managed DNS resolution platform. Specifically, obtaining permissions before accessing the managed DNS resolution platform involves acquiring a pre-configured interface key and then using that key to obtain domain name resolution permissions for the managed DNS resolution platform. In one specific implementation, the interface key can be an API key, where API stands for Application Programming Interface.

[0065] S104. Poll to check if the domain name resolution has taken effect. If the domain name resolution has taken effect, complete the domain name verification and issue a certificate.

[0066] The ACME server polls to check if the domain name resolution has taken effect. If the domain name resolution has taken effect, it notifies the ACME client that the domain name verification is complete, and the ACME server issues a certificate.

[0067] The embodiments of the present invention can reduce the security risks associated with domain name verification through cloud service providers, simplify the verification process, and improve the degree of automation of verification.

[0068] Please refer to Figures 2 and 3. The second embodiment of the ACME domain name automatic verification method in this invention includes:

[0069] S201. Generate a unique user identifier for the user, and initiate an EAB account creation request based on the unique user identifier;

[0070] In this embodiment, the cloud platform is a multi-tenant platform that supports multiple user registrations, and each user has a unique user identifier on the cloud platform; specifically, this unique user identifier can be an end User ID. In response to the aforementioned automation protocol with the user, the cloud platform generates a unique user identifier for the user. This automation protocol can be used to authorize the cloud platform to resolve domain names. Simultaneously, the cloud platform initiates an EAB account creation request to the ACME server based on the unique user identifier. ACME EAB is a feature that enhances security and control, allowing the association of an ACME account with a known external account when automating certificate management operations using the ACME (Automated Certificate Management Environment) protocol; in this embodiment, the ACME account and the user on the cloud platform are associated through the EAB account.

[0071] S202. Based on the EAB account creation request, create an EAB account bound to the unique user identifier;

[0072] The ACME client creates an EAB account based on the EAB account creation request, which is bound to the cloud platform and the unique user identifier. The information in the EAB account mainly includes the EAB Key ID and the EAB HMAC Key. Subsequently, the ACME client returns the EAB account and ACME directory address to the cloud platform. The cloud platform then sends the EAB account and ACME directory address to the user for display.

[0073] S203. Generate a user key and request to register an ACME account based on the user key and the information of the EAB account corresponding to the current user.

[0074] Users register ACME accounts using the ACME client. During registration, a user key is assigned to each account based on the information of the EAB account associated with each user. The ACME client then requests ACME account registration from the ACME server based on the user key and the information of the EAB account associated with the current user. The user key can be a public key.

[0075] S204. After receiving the ACME account registration request, parse the account registration request and check whether the EAB account corresponding to the ACME account registration request exists.

[0076] S205. If an EAB account exists, create an ACME account based on the EAB account, and associate the ACME account with the cloud platform corresponding to the EAB account and the unique user identifier.

[0077] After receiving the ACME account registration request, the ACME server parses the registration request and checks whether the corresponding EAB account exists.

[0078] If an EAB account exists, the ACME server stores the user key, creates an ACME account based on the EAB account, and associates the ACME account with the cloud platform corresponding to the EAB account and the unique user identifier; at the same time, it sends a feedback message to the ACME client indicating that the ACME account has been successfully created.

[0079] S206. Respond to and parse the certificate application request issued by the user, and obtain the user domain name information carried in the certificate application request;

[0080] S207. Based on the user domain name information, create an ACME order through the user's ACME account and randomly generate a domain name verification token, and generate a domain name verification value according to the user's public key corresponding to the ACME account;

[0081] The contents of steps S206-S207 in this embodiment are basically the same as those of steps S101-S102 in the previous embodiment, so they will not be repeated here.

[0082] S208. Identify the type of DNS resolution platform corresponding to the user domain name information, and call the corresponding DNS resolution platform to perform domain name resolution according to the type of DNS resolution platform;

[0083] In this embodiment, before accessing the managed DNS resolution platform for domain name resolution verification, the domain name needs to be configured in the cloud platform in advance. The type of the domain name is determined based on its origin; specifically, domain names are divided into two categories in this solution. The first type is a domain name belonging to the current cloud platform itself, in which case the cloud platform can directly operate on the domain name. The second type is a domain name not belonging to the current cloud platform itself; in this case, the user can manage the interface key of this domain name service provider on the cloud platform. The cloud platform can identify the DNS service provider of the domain name based on the NS record, thereby calling the corresponding interface key. The NS (Name Server) record is a domain name server record used to specify which DNS server resolves the domain name. In a specific implementation, the interface key can be an API key.

[0084] In practical examples, the mapping relationship between the NS server and the DNS provider in the NS record can be "domain name ns.example.com" as "cloud platform own", "domain name ns.example2.com" as "DNS service provider 1" and "domain name ns.example3.com" as "DNS service provider 2"; the mapping relationship can be "DNS service provider 1" corresponding to "DNS service provider key 1", "DNS service provider 2" corresponding to "DNS service provider key 2"; or other similar mapping methods.

[0085] Specifically, the type of DNS resolution platform refers to whether it is a proprietary DNS resolution platform. If it is a proprietary DNS resolution platform, the domain name resolution is added directly through the proprietary DNS resolution platform. If it is a managed DNS resolution platform, the permissions of the managed DNS resolution platform are obtained, and the domain name resolution verification is performed through the managed DNS resolution platform. If the domain name does not belong to either the proprietary DNS resolution platform or the managed DNS resolution platform, but to another DNS resolution platform, the domain name resolution verification request is sent to the user. The verification information is returned to the ACME client using the original ACME mode, employing a normal verification method. Through automatic degradation measures, the ACME verification process is ensured to proceed smoothly, preventing operation interruption.

[0086] S209. Poll to check if the domain name resolution has taken effect. If the domain name resolution has taken effect, complete the domain name verification and issue a certificate.

[0087] The ACME server polls to check if the domain name resolution has taken effect. If the domain name resolution has taken effect, it notifies the ACME client that the domain name verification is complete. The ACME client submits a CSR (Certificate Signing Request), and the ACME server responds with the specific content of the CSR to issue a certificate.

[0088] In one specific implementation, in step S206, before responding to and parsing the certificate application request issued by the user and obtaining the domain name corresponding to the certificate application request, the method further includes adding a callback address of the cloud platform; at this time, in step S207, after randomly generating the domain name verification token and calculating the domain name verification value based on the user's public key carried in the certificate application request, the method further includes informing the cloud platform of the domain name verification value, the domain name, and the corresponding unique user identifier through the callback address.

[0089] The method in this embodiment of the invention can pre-configure the DNS interface key, and select the target service provider for domain name verification according to the configuration of the specific DNS service provider when performing specific domain name verification. This can reduce the risk of DNS interface key leakage and reduce security risks. Furthermore, the solution in this embodiment can enable ACME to specify multiple DNS resolutions in the same automatic issuance. When cloud users use DNS resolutions from different cloud providers at the same time, it can effectively combine the automation solution with ACME.

[0090] The above describes the ACME domain name automatic verification method in the embodiments of the present invention. The following describes the ACME domain name automatic verification system in the embodiments of the present invention. Please refer to Figures 4 and 5. One embodiment of the ACME domain name automatic verification system in the embodiments of the present invention includes:

[0091] ACME server 401 is used to respond to and parse the certificate application request issued by the user, obtain the user domain name information carried in the certificate application request; based on the user domain name information, create an ACME order through the user's ACME account and randomly generate a domain name verification token, and generate a domain name verification value according to the user's public key corresponding to the ACME account.

[0092] Cloud platform 402 is used to identify the type of DNS resolution platform corresponding to the user domain name information, and to call the corresponding DNS resolution platform to perform domain name resolution according to the type of DNS resolution platform;

[0093] The ACME server 401 is also used to poll and check whether the domain name resolution has taken effect. If the domain name resolution verification has taken effect, the domain name verification is completed and a certificate is issued.

[0094] The embodiments of the present invention can reduce the security risks associated with domain name verification through cloud service providers, simplify the verification process, and improve the degree of automation of verification.

[0095] In another embodiment of this application, the domain name automatic verification system further includes an ACME client 403, which is used to generate user keys;

[0096] The ACME server 401 is also used to request the registration of an ACME account based on the user key and the information of the EAB account corresponding to the current user; after receiving the request to register an ACME account, it parses the request and checks whether the EAB account corresponding to the request exists; if the EAB account exists, it creates an ACME account based on the EAB account and associates the ACME account with the cloud platform 402 corresponding to the EAB account and the unique user identifier.

[0097] In another embodiment of this application, the cloud platform is further configured to generate a unique user identifier and initiate an EAB account creation request based on the unique user identifier;

[0098] The ACME client is also used to request the registration of an ACME account based on the user key and the information of the EAB account corresponding to the current user.

[0099] In another embodiment of this application, the cloud platform is specifically used for:

[0100] Based on the user's domain name information, domain name verification value, and the user's unique user identifier, query the NS record of the domain name;

[0101] The type of the DNS resolution platform identified is determined based on the NS record, wherein the type of the DNS resolution platform includes a proprietary DNS resolution platform and a managed DNS resolution platform;

[0102] If it is a proprietary DNS resolution platform, then add domain name resolution directly through the proprietary DNS resolution platform;

[0103] If it is a managed DNS resolution platform, then obtain the permissions of the managed DNS resolution platform and connect to the managed DNS resolution platform to verify the domain name resolution.

[0104] In another embodiment of this application, the cloud platform is further configured to obtain permission to manage DNS resolution, add an interface key for the hosted cloud platform, and obtain permission to manage the domain name resolution of the hosted DNS resolution platform through the interface key;

[0105] The method for obtaining permissions from the managed DNS resolution platform includes:

[0106] Obtain the interface key of the hosted DNS resolution platform, and obtain the domain name resolution permission of the hosted DNS resolution platform based on the interface key.

[0107] In another embodiment of this application, the type of DNS resolution platform also includes other DNS resolution platforms that are not owned DNS resolution platforms or managed DNS resolution platforms; the cloud platform is also used to send a domain name resolution verification request to the user if the domain name is another DNS resolution platform.

[0108] The method in this embodiment of the invention can pre-configure the DNS interface key, and select the target service provider for domain name verification according to the configuration of the specific DNS service provider when performing specific domain name verification. This can reduce the risk of DNS interface key leakage and reduce security risks. Furthermore, the solution in this embodiment can enable ACME to specify multiple DNS resolutions in the same automatic issuance. When cloud users use DNS resolutions from different cloud providers at the same time, it can effectively combine the automation solution with ACME.

[0109] Figures 4 and 5 above describe the ACME domain name automatic verification system in this embodiment of the invention from the perspective of modular functional entities. Based on the same inventive concept, this specification also provides an ACME domain name automatic verification device. The ACME domain name automatic verification device in this embodiment of the invention is described in detail below from the perspective of hardware processing.

[0110] Figure 6 is a schematic diagram of the structure of an electronic device provided in an embodiment of this specification. The electronic device 600 according to this embodiment of the present invention will now be described with reference to Figure 6. The electronic device 600 shown in Figure 6 is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments of the present invention.

[0111] As shown in Figure 6, the electronic device 600 is presented in the form of a general-purpose computing device. The components of the electronic device 600 may include, but are not limited to: at least one processing unit 610, at least one storage unit 620, a bus 630 connecting different system components (including storage unit 620 and processing unit 610), a display unit 640, etc.

[0112] The storage unit stores program code that can be executed by the processing unit 610, causing the processing unit 610 to perform the steps described in the processing method section of this specification according to various exemplary embodiments of the present invention. For example, the processing unit 610 can perform the steps shown in FIG1 or FIG2.

[0113] The storage unit 620 may include a readable medium in the form of a volatile storage unit, such as a random access memory unit (RAM) 6201 and / or a cache storage unit 6202, and may further include a read-only memory unit (ROM) 6203.

[0114] The storage unit 620 may also include a program / utility 6204 having a set (at least one) program module 6205, such program module 6205 including but not limited to: an operating system, one or more application programs, other program modules and program data, each or some combination of these examples may include an implementation of a network environment.

[0115] Bus 630 can represent one or more of several types of bus structures, including a memory cell bus or memory cell controller, a peripheral bus, a graphics acceleration port, a processing unit, or a local bus using any of the various bus structures.

[0116] Electronic device 600 can also communicate with one or more external devices 100 (e.g., keyboard, pointing device, Bluetooth device, etc.), and with one or more devices that enable a user to interact with electronic device 600, and / or with any device that enables electronic device 600 to communicate with one or more other computing devices (e.g., router, modem, etc.). This communication can be performed via input / output (I / O) interface 650. Furthermore, electronic device 600 can also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN), and / or public networks, such as the Internet) via network adapter 660. Network adapter 660 can communicate with other modules of electronic device 600 via bus 630. It should be understood that, although not shown in Figure 6, other hardware and / or software modules can be used in conjunction with electronic device 600, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0117] Through the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described in this invention can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this invention can be embodied in the form of a software product, which can be stored in a computer-readable storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, or network device, etc.) to execute the method described above according to this invention. When the computer program is executed by a data processing device, it enables the computer-readable medium to implement the method described above, i.e., the method shown in FIG1 or FIG2.

[0118] Figure 7 is a schematic diagram of a computer-readable medium provided in an embodiment of this specification.

[0119] A computer program implementing the method shown in Figure 1 or Figure 2 can be stored on one or more computer-readable media. The computer-readable medium can be a readable signal medium or a readable storage medium. A readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples (a non-exhaustive list) of readable storage media include: an electrical connection having one or more wires, a portable disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof.

[0120] The computer-readable storage medium may include data signals propagated in baseband or as part of a carrier wave, carrying readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. The readable storage medium may also be any readable medium other than a readable storage medium, capable of transmitting, propagating, or transmitting programs for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the readable storage medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical fiber, RF, etc., or any suitable combination thereof.

[0121] Program code for performing the operations of this invention can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java and C++, and conventional procedural programming languages ​​such as C or similar languages. The program code can execute entirely on the user's computing device, partially on the user's device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0122] In summary, this invention can be implemented in hardware, or as software modules running on one or more processors, or a combination thereof. Those skilled in the art will understand that in practice, general-purpose data processing devices such as microprocessors or digital signal processors (DSPs) can be used to implement some or all of the functions of some or all of the components according to the embodiments of the invention. The invention can also be implemented as a device or apparatus program (e.g., a computer program and computer program product) for performing part or all of the methods described herein. Such programs implementing the invention can be stored on a computer-readable medium or can take the form of one or more signals. Such signals can be downloaded from an Internet website, provided on a carrier signal, or provided in any other form.

[0123] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the present invention is not inherently related to any specific computer, virtual device, or electronic device, and various general-purpose devices can also implement the present invention. The above descriptions are merely specific embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

[0124] The various embodiments in this specification are described in a progressive manner. The same or similar parts between the various embodiments can be referred to each other. Each embodiment focuses on describing the differences from other embodiments.

[0125] The above description is merely an embodiment of this application and is not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. An automatic verification method for ACME domain names, characterized in that, include: Respond to and parse the certificate application request issued by the user, and obtain the user domain name information carried in the certificate application request; Based on the user's domain name information, an ACME order is created through the user's ACME account and a domain name verification token is randomly generated. A domain name verification value is then generated based on the user's public key corresponding to the ACME account. Identify the type of DNS resolution platform corresponding to the user's domain name information, and call the corresponding DNS resolution platform to perform domain name resolution according to the type of DNS resolution platform; The system polls to check if the domain name resolution is effective. If the domain name resolution is effective, the system completes the domain name verification and issues a certificate.

2. The ACME domain name automatic verification method according to claim 1, characterized in that, Before responding to and parsing the certificate request issued by the user, and obtaining the user domain name information carried in the certificate request, the method further includes: Generate a user key, and request to register an ACME account based on the user key and the information of the EAB account corresponding to the current user; Upon receiving an ACME account registration request, the request is parsed, and the existence of the corresponding EAB account is checked. If an EAB account exists, an ACME account is created based on the EAB account, and the ACME account is associated with the cloud platform corresponding to the EAB account and the unique user identifier.

3. The ACME domain name automatic verification method according to claim 2, characterized in that, Before generating the user key and requesting ACME account registration based on the user key and the EAB account information corresponding to the current user, the process also includes: Generate a unique user identifier for the user, and initiate an EAB account creation request based on the unique user identifier; Based on the EAB account creation request, create an EAB account and bind it to the unique user identifier.

4. The ACME domain name automatic verification method according to any one of claims 1-3, characterized in that, The step of identifying the type of DNS resolution platform corresponding to the user domain name information and calling the corresponding DNS resolution platform to perform domain name resolution according to the type of DNS resolution platform includes: Based on the user's domain name information, domain name verification value, and the user's unique user identifier, query the NS record of the domain name; The type of the DNS resolution platform identified is determined based on the NS record, wherein the type of the DNS resolution platform includes a proprietary DNS resolution platform and a managed DNS resolution platform; If it is a proprietary DNS resolution platform, then add domain name resolution directly through the proprietary DNS resolution platform; If it is a managed DNS resolution platform, then obtain the permissions of the managed DNS resolution platform and connect to the managed DNS resolution platform to verify the domain name resolution.

5. The ACME domain name automatic verification method according to claim 4, characterized in that, Before responding to and parsing the certificate request issued by the user, and obtaining the user domain name information carried in the certificate request, the method further includes: Obtain permission to manage DNS resolution, add the interface key of the managed cloud platform, and obtain permission to manage the domain name resolution of the managed DNS resolution platform through the interface key; The method for obtaining permissions from the managed DNS resolution platform includes: Obtain the interface key of the hosted DNS resolution platform, and obtain the domain name resolution permission of the hosted DNS resolution platform based on the interface key.

6. The ACME domain name automatic verification method according to claim 4, characterized in that, The types of DNS resolution platforms also include other DNS resolution platforms that are not owned DNS resolution platforms or managed DNS resolution platforms; The step of identifying the type of DNS resolution platform corresponding to the user domain name information, and calling the corresponding DNS resolution platform to perform domain name resolution verification according to the type of DNS resolution platform, further includes: If the domain name is from another DNS resolution platform, a domain name resolution verification request will be sent to the user to select the corresponding DNS resolution platform.

7. An ACME domain name automatic verification system, characterized in that, The ACME domain name automatic verification system includes: The ACME server is used to respond to and parse the certificate request sent by the user, and obtain the certificate. The application request carries user domain information; based on the user domain information, an ACME order is created through the user's ACME account and a domain verification token is randomly generated, and a domain verification value is generated according to the user's public key corresponding to the ACME account; The cloud platform is used to identify the type of DNS resolution platform corresponding to the user's domain name information, and to call the corresponding DNS resolution platform to perform domain name resolution according to the type of DNS resolution platform; The ACME service is also used to poll and check whether the domain name resolution has taken effect. If the domain name resolution verification has taken effect, the domain name verification is completed and a certificate is issued.

8. The ACME domain name automatic verification system according to claim 7, characterized in that: The cloud platform is also used to generate a unique user identifier and initiate an EAB account creation request based on the unique user identifier; The domain name automatic verification system also includes an ACME client, which is used to request the registration of an ACME account based on the user key and the information of the EAB account corresponding to the current user. The ACME server is also used to receive an ACME account registration request, parse the registration request, check whether the EAB account corresponding to the ACME account registration request exists; if the EAB account exists, create an ACME account based on the EAB account, and associate the ACME account with the cloud platform corresponding to the EAB account and the unique user identifier.

9. An ACME domain name automatic verification device, characterized in that, The ACME domain name automatic verification device includes: a memory and at least one processor, wherein the memory stores instructions; The at least one processor invokes the instructions in the memory to cause the ACME domain name autoverification device to perform the steps of the ACME domain name autoverification method as described in any one of claims 1-6.

10. A computer-readable storage medium storing instructions thereon, characterized in that, When the instruction is executed by the processor, it implements the steps of the ACME domain name automatic verification method as described in any one of claims 1-6.

Images