CN113810501B - HTTPS certificate management method - Google Patents
HTTPS certificate management method Download PDFInfo
- Publication number
- CN113810501B CN113810501B CN202111112476.0A CN202111112476A CN113810501B CN 113810501 B CN113810501 B CN 113810501B CN 202111112476 A CN202111112476 A CN 202111112476A CN 113810501 B CN113810501 B CN 113810501B
- Authority
- CN
- China
- Prior art keywords
- certificate
- domain name
- interface
- information
- visa
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 238000007726 management method Methods 0.000 title description 5
- 238000000034 method Methods 0.000 claims abstract description 33
- 230000001360 synchronised effect Effects 0.000 claims abstract description 3
- 238000013475 authorization Methods 0.000 claims description 16
- 238000012217 deletion Methods 0.000 claims description 8
- 230000037430 deletion Effects 0.000 claims description 8
- 230000009191 jumping Effects 0.000 claims description 4
- 238000012360 testing method Methods 0.000 claims description 3
- 238000010586 diagram Methods 0.000 description 4
- 238000012795 verification Methods 0.000 description 3
- 238000001514 detection method Methods 0.000 description 2
- 230000003203 everyday effect Effects 0.000 description 2
- 238000010200 validation analysis Methods 0.000 description 2
- 230000009286 beneficial effect Effects 0.000 description 1
- 230000007547 defect Effects 0.000 description 1
- 230000003111 delayed effect Effects 0.000 description 1
- 230000000977 initiatory effect Effects 0.000 description 1
- 238000011160 research Methods 0.000 description 1
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L67/00—Network arrangements or protocols for supporting network services or applications
- H04L67/01—Protocols
- H04L67/02—Protocols based on web technology, e.g. hypertext transfer protocol [HTTP]
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
- H04L63/0823—Network architectures or network communication protocols for network security for authentication of entities using certificates
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Storage Device Security (AREA)
- Management, Administration, Business Operations System, And Electronic Commerce (AREA)
Abstract
The invention discloses a method for HTTPS certificate management, which comprises the following steps: new certificate issuing operation: the API interface is used for connecting a server to analyze and verify the domain name, and then issuing a certificate; certificate renewing operation: setting a system timing task to renew the expired certificate; certificate distribution operation: setting system timing task synchronous domain name certificate information and validating the certificate. The visa and renewing process of the invention realizes automation, does not need a great amount of manual intervention, and greatly improves the efficiency. The automatic certificate distribution also avoids a great deal of manual login business server operation, and increases the security. And the certificates are automatically managed, and visa is automatically signed when the expiration time is close, so that the loss caused by the inaccessible site due to the expiration of the certificates is avoided.
Description
Technical Field
The invention is applied to the field of WEB application, in particular to a method for managing HTTPS certificates.
Background
Let's encrypter is a non-profit Certificate Authority (CA) that is served by the internet security research group (ISRG abbreviation) and is supported by the mainstream browser. The Let's encrypter uses ACME protocol to make the application certificate complete automatic verification of domain name ownership, but also needs to manually configure DNS analysis and trigger each step operation according to the requirement of the Let's encrypter, and the text content of the domain name certificate can be obtained after visa is completed; because of the policy requirements of the Let's encryptions, the longest validity period of each domain name certificate is 3 months.
In the new certificate issuing operation, the conventional certificate issuing tool needs to manually analyze and verify to a DNS analysis server in the step of verifying the DNS ownership, and needs to be repeated for a plurality of times when issuing a plurality of domain names, thereby not only being time-consuming and labor-consuming, but also being easy to make mistakes. In the operation of certificate renewing, the renewing of the domain name certificate and the new certificate issuing are the same flow, but the existing certificate issuing tool does not have the function of judging whether the domain name certificate needs to be renewed or not. In the certificate distribution link, after the existing certificate issuing tool completes visa, certificate information is stored in a local disk of a certificate server, and is distributed to other servers, manual copying is needed, and the workload of copying the certificate files in a large number of server environments is huge and is easy to make mistakes.
Disclosure of Invention
The invention aims to solve the technical problem of providing a method for managing HTTPS certificates, aiming at the defects of the prior art.
To solve the above technical problems, a method for HTTPS certificate management according to the present invention includes:
new certificate issuing operation: the API interface is used for connecting a server to analyze and verify the domain name, and then issuing a certificate;
certificate renewing operation: setting a system timing task to renew the expired certificate;
certificate distribution operation: setting system timing task synchronous domain name certificate information and validating the certificate.
As a possible option, further, the new certificate issuing operation specifically includes the following steps:
S101, acquiring data information of a user;
s102, analyzing the data information of the user, and inquiring and judging whether visa information of the data information exists in a database; if not, continuing to execute the step S103; if yes, judging whether the visa information period of the data information exceeds a threshold value, if not, exiting the certificate issuing process, and if yes, transferring to a subsequent certificate renewing operation;
s103, generating and storing corresponding private key information, and creating a CSR file added with user data information;
s104, acquiring an API interface, reading an account KEY file and logging in a server;
S105, applying for creating a new visa order, judging whether the order is created successfully, if so, exiting the visa, and if so, continuing to execute the step S106;
s106, calling a domain name authentication interface to acquire a random character string;
s107, calling a related DNS interface to analyze the domain name according to the requirement;
S108, the loop verifies whether DNS domain name resolution is effective;
s109, the server verifies whether the DNS of the domain name is valid or not so as to verify ownership of the domain name;
s110, calling an interface to obtain final visa text information, and storing the final visa text information in a database to complete visa.
As a possible option, further, the API interface obtained in step S104 specifically includes: new sign-up order interface newOrder, create new account interface newAccount, and certificate revocation interface revokeCert.
As a possible option, further, the step S105 specifically includes: placing the domain name needing visa into a domains list, organizing POST data, calling a newOrder interface through a POST method, judging whether the order is successfully created or not through a state code and a state text returned by the newOrder interface, and judging that the order is failed to be created if the state code is 201 and the status state is not pending or ready; if the status is 403, it is determined that the creation of the order fails to exit the visa, and the creation is successful and the step S106 is continued.
As a possible option, further, the step S106 specifically includes: after creating an order successfully through the newOrder interface, a authorizations list is obtained, and a certificate text interface finalize is obtained; circulating authorizations the list to acquire one domain name authentication interface authz; and requesting authz an interface, judging the state of interface call through the returned state code and state text, wherein if the state code is not 200, the interface call fails, if the state code is 200 and status is valid, the domain name is already verified, the interface call fails or the domain name is already verified, and jumping to a circulation authorizations list to continue the next circulation, otherwise, continuing to execute step S107.
As a possible option, further, the step S107 specifically includes: analyzing challengeUrl through information returned by authz interfaces; domain name domain; the DNS analyzes the TXT value and splices the domain name needing authentication; and calling a domain name resolution deletion function, inputting dnsrrDomain values, judging that the SDK corresponding to the resolution service business call where the domain name is located executes deletion, calling a domain name resolution addition function, inputting dnsrrDomain values and TXT values, judging that the SDK corresponding to the resolution service business call where the domain name is located adds domain name resolution, wherein the resolution value is the TXT value, and the resolution type is the TXT type.
As a possible option, further, the step S108 specifically includes: python initializes dns, resolver, and is configured nameserver to 8.8.8.8, and the loop verifies that dns resolution is valid, initiates a test every 5 seconds, and checks 60 total times.
As a possible option, further, the step S110 specifically includes: after the domain name is verified, text information of the CSR file is transmitted, a finalize interface is called, final visa text information is obtained, and the final visa text information is stored in domainPubFile; encrypting domainKeyFile the text information, domainPubFile the text information using AES; MD5 fingerprint information and expiration time information of domainPubFile are calculated, and the information is stored in a database; all information in the database is acquired, encrypted by AES in JSON format and stored in KEYFILE files, and visa is completed.
As a possible option, further, the certificate renewing operation specifically includes the following steps:
s201, setting a system timing task in a renewal service;
s202, acquiring domain name information which exists in the database in the step S102 and has a visa information term exceeding a threshold value, and storing the domain name information in a list RENEWALLIST;
s203, circulating RENEWALLIST the list, and calling a certificate visa function until all domain name renewing is completed.
As a possible option, further, the certificate distribution operation specifically includes the following steps:
S301, setting a timing task in a server;
S302, accessing the content of the KEYFILE file acquired by the NGINX by the certificate updating program, and decrypting KEYFILE text content;
s303, reading local cache matching KEYFILE, if the domain name certificate does not exist, storing the domain name certificate into a designated certificate directory, and updating the local cache;
S304, reading local cache matching KEYFILE, and if MD5 changes, updating a local certificate file and a local cache;
S305, judging whether the local cache is changed, restarting the WEB container if the local cache is changed, and completing certificate distribution if the local cache is not changed.
The invention adopts the technical scheme and has the following beneficial effects: the visa and renewing process of the invention realizes automation, does not need a great amount of manual intervention, and greatly improves the efficiency. The automatic certificate distribution also avoids a great deal of manual login business server operation, and increases the security. And the certificates are automatically managed, and visa is automatically signed when the expiration time is close, so that the loss caused by the inaccessible site due to the expiration of the certificates is avoided.
Drawings
The invention is described in further detail below with reference to the attached drawings and detailed description:
FIG. 1 is a schematic diagram of the principles of the present invention;
FIG. 2 is a schematic diagram of a visa flow according to an embodiment of the present invention;
FIG. 3 is a diagram illustrating a continuous signing process according to an embodiment of the present invention;
fig. 4 is a schematic diagram of a certificate distribution flow according to an embodiment of the present invention.
Detailed Description
In order to make the objects, technical solutions and advantages of the embodiments of the present invention more apparent, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention.
Example 1
As shown in fig. 1, the present invention provides a method for HTTPS certificate management, which includes:
new certificate issuing operation: the API interface is used for connecting a server to analyze and verify the domain name, and then issuing a certificate; the method specifically comprises the following steps:
S101, acquiring data information of a user;
s102, analyzing the data information of the user, and inquiring and judging whether visa information of the data information exists in a database; if not, continuing to execute the step S103; if yes, judging whether the visa information period of the data information exceeds a threshold value, if not, exiting the certificate issuing process, and if yes, transferring to a subsequent certificate renewing operation;
s103, generating and storing corresponding private key information, and creating a CSR file added with user data information;
s104, acquiring an API interface, reading an account KEY file and logging in a server; the API interface obtained in step S104 specifically includes: new sign-up order interface newOrder, create new account interface newAccount, and certificate revocation interface revokeCert.
S105, applying for creating a new visa order, judging whether the order is created successfully, if so, exiting the visa, and if so, continuing to execute the step S106; the step S105 specifically includes: placing the domain name needing visa into a domains list, organizing POST data, calling a newOrder interface through a POST method, judging whether the order is successfully created or not through a state code and a state text returned by the newOrder interface, and judging that the order is failed to be created if the state code is 201 and the status state is not pending or ready; if the status is 403, it is determined that the creation of the order fails to exit the visa, and the creation is successful and the step S106 is continued.
S106, calling a domain name authentication interface to acquire a random character string; the step S106 specifically includes: after creating an order successfully through the newOrder interface, a authorizations list is obtained, and an interface finalize is obtained; circulating authorizations the list to acquire one domain name authentication interface authz; and requesting authz an interface, judging the state of interface call through the returned state code and state text, wherein if the state code is not 200, the interface call fails, if the state code is 200 and status is valid, the domain name is already verified, the interface call fails or the domain name is already verified, and jumping to a circulation authorizations list to continue the next circulation, otherwise, continuing to execute step S107.
S107, calling a related DNS interface to analyze the domain name according to the requirement; the step S107 specifically includes: analyzing challengeUrl through information returned by authz interfaces; domain name domain; the DNS analyzes the TXT value and splices the domain name needing authentication; and calling a domain name resolution deletion function, inputting dnsrrDomain values, judging that the SDK corresponding to the resolution service business call where the domain name is located executes deletion, calling a domain name resolution addition function, inputting dnsrrDomain values and TXT values, judging that the SDK corresponding to the resolution service business call where the domain name is located adds domain name resolution, wherein the resolution value is the TXT value, and the resolution type is the TXT type.
S108, the loop verifies whether DNS domain name resolution is effective; the step S108 specifically includes: python initializes dns, resolver, and is configured nameserver to 8.8.8.8, and the loop verifies that dns resolution is valid, initiates a test every 5 seconds, and checks 60 total times.
S109, the server verifies whether the DNS of the domain name is valid or not so as to verify ownership of the domain name;
s110, calling an interface to obtain final visa text information, and storing the final visa text information in a database to complete visa. The step S110 specifically includes: after the domain name is verified, text information of the CSR file is transmitted, a finalize interface is called, final visa text information is obtained, and the final visa text information is stored in domainPubFile; encrypting domainKeyFile the text information, domainPubFile the text information using AES; MD5 fingerprint information and expiration time information of domainPubFile are calculated, and the information is stored in a database; all information in the database is acquired, encrypted by AES in JSON format and stored in KEYFILE files, and visa is completed.
Certificate renewing operation: setting a system timing task to renew the expired certificate;
The method specifically comprises the following steps:
s201, setting a system timing task in a renewal service;
s202, acquiring domain name information which exists in the database in the step S102 and has a visa information term exceeding a threshold value, and storing the domain name information in a list RENEWALLIST;
s203, circulating RENEWALLIST the list, and calling a certificate visa function until all domain name renewing is completed.
Certificate distribution operation: the system timing task is set to synchronize domain name certificate information and validate the certificate,
The method specifically comprises the following steps:
S301, setting a timing task in a server;
S302, accessing the content of the KEYFILE file acquired by the NGINX by the certificate updating program, and decrypting KEYFILE text content;
s303, reading local cache matching KEYFILE, if the domain name certificate does not exist, storing the domain name certificate into a designated certificate directory, and updating the local cache;
S304, reading local cache matching KEYFILE, and if MD5 changes, updating a local certificate file and a local cache;
S305, judging whether the local cache is changed, restarting the WEB container if the local cache is changed, and completing certificate distribution if the local cache is not changed.
Example 2
As shown in fig. 2, visa is performed:
s1, acquiring a domain name INPUTDOMAIN input by a user through a command line.
S2, python adds tldextract an expansion library, analyzes domain name information input by a user, and obtains subdomain, domain and unification information.
S3, inquiring whether the database already has INPUTDOMAIN visa information. If the certificate exists and the expiration time of the certificate is less than 20 days, the certificate is valid, and the process is exited. If not, the following steps are continued.
S4, python adds paramiko expansion libraries, generates 1024-bit or 2048-bit private key information (paramiko. RSAKey. Generation (2048)), and stores the generated private key information in domainKeyFile.
S5, creating a CSR file, and adding user input INPUTDOMAIN into the CSR file ('openssl req-new-sha256-key％s-subj"/"-addext"subjectAltName＝DNS:*.％s,DNS:％s"-out％s'％(domainKeyFile,singDomain,singDomain,domainCsrFile)).
S6, acquiring the latest API interface of the Let' S encrypter through the interface, obtaining a new visa order interface newOrder, creating a new account interface newAccount and a certificate revocation interface revokeCert.
S7, reading the Let 'S encrypter account KEY file, and logging in the Let' S encrypter service. If the account KEY file does not exist, a new KEY is created and a new Let's encryption account is registered and logged in through newAccount interface.
S8, placing the domain name needing visa into a domain list, and organizing POST data ({ "identifiers" [ { "type": "dns", "value": domain } for domain in domains ] }) to call a newOrder interface through a POST method.
S9, judging whether the order is successfully created or not through a status code and a status text returned by a newOrder interface, and judging that the order is failed to be created if the status code is 201 and the status state is not pending or ready; if the status is 403, it is determined that the order creation has failed. The creation continues successfully to the following steps.
S10, after creating an order through a newOrder interface, a authorizations list is obtained; the final result obtains interface finalize. authorizations list is an authentication interface for each domain name, e.g ['https://acme-staging-v02.api.letsencrypt.org/acme/authz-v3/481907568','https://acme-staging-v02.api.letsencrypt.org/acme/authz-v3/481907578'].
S11, circulating authorizations the list, and acquiring one domain name authentication interface authz (for authz in authorizations).
S12, requesting authz an interface, and judging the state of interface call through the returned state code and state text. If the status code is not 200 then the interface call fails, if the status code is 200 and status is valid then the domain name has been validated. If the interface call fails or the domain name passes verification, the step is skipped to S11 to continue the next cycle, otherwise, the following steps are continued to be executed.
S13, analyzing challengeUrl (challengeUrl = challenges [0 ]) through information returned by the authz interfaces; domain name domain (authorization [ "identifier" ] value "]; the DNS resolves the TXT value and concatenates the domain names that need to be authenticated (dnsrrDomain = "_acme-change {0 }". Format (domain);).
S14, calling a domain name resolution deletion function, inputting dnsrrDomain values, judging that the resolution service business where the domain name is located calls the corresponding SDK to execute deletion, for example, if the domain name resolution service is an ali cloud, calling the ali cloud SDK to delete domain name resolution, and if the domain name resolution service is a Ten cloud, calling the Ten-news SDK to delete.
S15, calling a domain name resolution adding function, transmitting dnsrrDomain values and TXT values, judging that a resolution service business where the domain name is located calls a corresponding SDK to add domain name resolution, wherein the resolution value is the TXT value, and the resolution type is the TXT type.
S16, python initializes dns and resolvers, and is configured nameserver to 8.8.8.8, and the steps of circularly verifying whether dns analysis is effective, initiating detection once every 5 seconds, and performing detection 60 times in total.
S17, after detecting that DNS analysis is effective, invoking challengeUrl to request the Let' S Encrypt server to verify whether the DNS of the domain name is effective or not so as to verify the ownership of the domain name.
And S18, if the authorizations list is not sequentially executed, jumping to S11 to analyze the next loop until all domain names in authorizations are verified.
And S19, after verification of all domain names is completed, text information of the CSR file is transmitted, a finalize interface is called, final visa text information is obtained, and the final visa text information is stored in domainPubFile.
S20, encrypting domainKeyFile the text information and domainPubFile the text information by using AES; MD5 fingerprint information, expiration time, etc. of domainPubFile are calculated and the information is saved in a database. The visa process is completed.
S21, acquiring all information in a database, storing the information in KEYFILE files after being encrypted by AES in a JSON format, and providing the capability of accessing KEYFILE files by NGINX.
As shown in fig. 3, certificate renewal is performed
S22, setting a system timing task in the renewal service, for example, executing certificate renewal at 1 am every day.
S23, obtaining domain name information with the expiration time of the certificate smaller than 20 days in the database, and storing the domain name information in the list RENEWALLIST.
S24, circulating RENEWALLIST the list, calling a certificate visa function, and executing from S1 until all domain name renewing is completed.
As shown in fig. 4, certificate distribution is performed
S25, setting a timing task in the server, for example, executing certificate updating at 2 a.m. every day.
S26, the certificate updating program accesses the content of the NGINX acquisition KEYFILE file, and decrypts KEYFILE text content.
S27, reading the local cache match KEYFILE, if the domain name certificate does not exist, saving the domain name certificate to a specified certificate directory, and updating the local cache.
S28, reading the local cache match KEYFILE, if the MD5 has a change, updating the local certificate file and updating the local cache.
S29, judging whether the local cache is changed, and restarting the WEB container, such as NGINX, TOMCAT and the like, if the local cache is changed. Certificate distribution is completed.
Solves the following problems in the prior art:
1. The prior art calls the Let's Encrypt interface according to ACME protocol, and the following steps are determined according to the interface call condition, which is complicated.
2. In the process of interacting with the Let's Encrypt interface, DNS analysis is required to be configured, in the process, a third party DNS analysis service provider needs to be logged in to operate, if the number of visa domain names is too large, the workload is greatly increased, and the visa domain names are easy to make mistakes, for example, 100 domain names of the visa need to be frequently analyzed, and 100 DNS configuration needs to be deleted and analyzed.
3. Because of the delayed nature of the global validation of DNS, it is necessary to continuously determine whether DNS resolution is validated, and call the Let's encryption interface to complete subsequent operations according to the validation of DNS. In the secondary process, the condition that the global DNS is effective needs to be queried continuously by manpower, and the time and the labor are extremely consumed.
4. The operations of checking the domain name contained in the certificate, the expiration time of the certificate and the like in the subsequent certificate management certificate and the like are all needed to analyze the certificate content, so that the operations are extremely troublesome and time-consuming.
5. The certificate is difficult to distribute after the certification is completed, and the certificates need to be manually copied to different service servers.
6. The validity period of the domain name certificate is 3 months, frequent renewal operation is required, otherwise, the certificate is expired, so that the site cannot be accessed.
While the foregoing is directed to embodiments of the present invention, other and further embodiments of the invention may be devised without departing from the basic scope thereof, and the scope thereof is determined by the claims that follow.
Claims (7)
1. A method of HTTPS certificate management, comprising:
new certificate issuing operation: the API interface is used for connecting a server to analyze and verify the domain name, and then issuing a certificate; the method specifically comprises the following steps:
S101, acquiring data information of a user; the method comprises the following steps: acquiring a domain name INPUTDOMAIN input by a user through a command line;
s102, analyzing the data information of the user, and inquiring and judging whether visa information of the data information exists in a database; if not, continuing to execute the step S103; if yes, judging whether the visa information period of the data information exceeds a threshold value, if not, exiting the certificate issuing process, and if yes, transferring to a subsequent certificate renewing operation;
s103, generating and storing corresponding private key information, and creating a CSR file added with user data information;
s104, acquiring a latest API interface of the Let' S encrypter through an interface to obtain a new signing order interface newOrder, creating a new account interface newAccount and a certificate revocation interface revokeCert; reading an account KEY file of the Let's encryptions and logging in the server, if the account KEY file does not exist, creating a new KEY and registering a new Let's encryptions account number through a newAccount interface and logging in;
S105, applying for creating a new visa order, judging whether the order is created successfully, if so, exiting the visa, and if so, continuing to execute the step S106; the method comprises the following steps: placing the domain name needing visa into a domains list, organizing POST data, calling a newOrder interface through a POST method, judging whether the order is successfully created or not through a state code and a state text returned by the newOrder interface, and judging that the order is failed to be created if the state code is 201 and the status state is not pending or ready; if the state is 403, judging that the creation of the order fails to exit the visa, and continuing to execute the step S106 if the creation is successful;
s106, calling a domain name authentication interface to acquire a random character string;
s107, calling a related DNS interface to analyze the domain name according to the requirement;
S108, the loop verifies whether DNS domain name resolution is effective;
s109, the server verifies whether the DNS of the domain name is valid or not so as to verify ownership of the domain name;
s110, calling an interface to obtain final visa text information, and storing the final visa text information in a database to complete visa;
certificate renewing operation: setting a system timing task to renew the expired certificate;
certificate distribution operation: setting system timing task synchronous domain name certificate information and validating the certificate.
2. The method of HTTPS certificate management according to claim 1, wherein: the step S106 specifically includes: after creating an order successfully through the newOrder interface, a authorizations list is obtained, and an interface finalize is obtained; circulating authorizations the list to acquire one domain name authentication interface authz; and requesting authz an interface, judging the state of interface call through the returned state code and state text, wherein if the state code is not 200, the interface call fails, if the state code is 200 and status is valid, the domain name is already verified, the interface call fails or the domain name is already verified, and jumping to a circulation authorizations list to continue the next circulation, otherwise, continuing to execute step S107.
3. The method of HTTPS certificate management according to claim 2, wherein: the step S107 specifically includes: analyzing challengeUrl, domain name domain and TXT value analyzed by DNS through the information returned by authz interface, and splicing the domain name to be authenticated; and calling a domain name resolution deletion function, inputting dnsrrDomain values, judging that the SDK corresponding to the resolution service business call where the domain name is located executes deletion, calling a domain name resolution addition function, inputting dnsrrDomain values and TXT values, judging that the SDK corresponding to the resolution service business call where the domain name is located adds domain name resolution, wherein the resolution value is the TXT value, and the resolution type is the TXT type.
4. A method of HTTPS certificate management according to claim 3, wherein: the step S108 specifically includes: python initializes dns, resolver, and is configured nameserver to 8.8.8.8, and the loop verifies that dns resolution is valid, initiates a test every 5 seconds, and checks 60 total times.
5. The method of HTTPS certificate management of claim 4, wherein: the step S110 specifically includes: after the domain name is verified, text information of the CSR file is transmitted, a finalize interface is called, final visa text information is obtained, and the final visa text information is stored in domainPubFile; encrypting domainKeyFile the text information, domainPubFile the text information using AES; MD5 fingerprint information and expiration time information of domainPubFile are calculated, and the information is stored in a database; all information in the database is acquired, encrypted by AES in JSON format and stored in KEYFILE files, and visa is completed.
6. The method of HTTPS certificate management according to claim 5, wherein: the certificate renewing operation specifically comprises the following steps:
s201, setting a system timing task in a renewal service;
s202, acquiring domain name information which exists in the database in the step S102 and has a visa information term exceeding a threshold value, and storing the domain name information in a list RENEWALLIST;
s203, circulating RENEWALLIST the list, and calling a certificate visa function until all domain name renewing is completed.
7. The method of HTTPS certificate management according to claim 6, wherein: the certificate distribution operation specifically comprises the following steps:
S301, setting a timing task in a server;
S302, accessing the content of the KEYFILE file acquired by the NGINX by the certificate updating program, and decrypting KEYFILE text content;
s303, reading local cache matching KEYFILE, if the domain name certificate does not exist, storing the domain name certificate into a designated certificate directory, and updating the local cache;
S304, reading local cache matching KEYFILE, and if MD5 changes, updating a local certificate file and a local cache;
S305, judging whether the local cache is changed, restarting the WEB container if the local cache is changed, and completing certificate distribution if the local cache is not changed.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202111112476.0A CN113810501B (en) | 2021-09-23 | 2021-09-23 | HTTPS certificate management method |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202111112476.0A CN113810501B (en) | 2021-09-23 | 2021-09-23 | HTTPS certificate management method |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN113810501A CN113810501A (en) | 2021-12-17 |
| CN113810501B true CN113810501B (en) | 2024-11-05 |
Family
ID=78940107
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202111112476.0A Active CN113810501B (en) | 2021-09-23 | 2021-09-23 | HTTPS certificate management method |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN113810501B (en) |
Families Citing this family (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN115334160B (en) * | 2022-08-03 | 2024-03-29 | 中国平安财产保险股份有限公司 | HTTPS certificate issuing method and related equipment thereof |
| CN115292683B (en) * | 2022-08-08 | 2024-01-23 | 国网江苏省电力有限公司泰州供电分公司 | Distribution automation terminal encryption certificate management system |
| CN115801426B (en) * | 2022-11-29 | 2023-06-23 | 杭州菲助科技有限公司 | Method, device and medium for batch detection of residual validity period of sub domain name ssl certificate |
| CN116436613B (en) * | 2023-03-13 | 2024-02-13 | 广州唯彩会网络科技有限公司 | Automatic renewal system of digital certificate |
| CN116684382B (en) * | 2023-07-28 | 2023-10-20 | 深圳市豪斯莱科技有限公司 | Domain name detection and automation application domain name certificate method, system and storage medium |
Citations (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111865992A (en) * | 2020-07-23 | 2020-10-30 | 亚数信息科技（上海）有限公司 | ACME centralized management system and load balancing method thereof |
Family Cites Families (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| JP6833658B2 (en) * | 2017-11-07 | 2021-02-24 | 株式会社東芝 | Server equipment, equipment, certificate issuing method, certificate requesting method, certificate issuing program and certificate requesting program |
| CN110225013B (en) * | 2019-05-30 | 2021-11-09 | 世纪龙信息网络有限责任公司 | Service certificate monitoring and updating system |
| CN111641615A (en) * | 2020-05-20 | 2020-09-08 | 深圳市今天国际物流技术股份有限公司 | Distributed identity authentication method and system based on certificate |
| CN111988150B (en) * | 2020-09-03 | 2023-04-18 | 深圳壹账通智能科技有限公司 | Block chain certificate updating method and device, computer equipment and storage medium |
-
2021
- 2021-09-23 CN CN202111112476.0A patent/CN113810501B/en active Active
Patent Citations (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111865992A (en) * | 2020-07-23 | 2020-10-30 | 亚数信息科技（上海）有限公司 | ACME centralized management system and load balancing method thereof |
Also Published As
| Publication number | Publication date |
|---|---|
| CN113810501A (en) | 2021-12-17 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN113810501B (en) | HTTPS certificate management method | |
| CN110268678B (en) | PKI-based login method for authentication agent user and server using same | |
| US11063767B2 (en) | Apparatus and method to perform secure data sharing in a distributed network by using a blockchain | |
| US8898764B2 (en) | Authenticating user through web extension using token based authentication scheme | |
| CN110535648B (en) | Electronic certificate generation and verification and key control method, device, system and medium | |
| US20240244046A1 (en) | Systems and methods for managing device association | |
| CN111526159B (en) | Method and device for establishing data connection, terminal equipment and storage medium | |
| US20240022571A1 (en) | Blockchain folding | |
| CN111753014B (en) | Identity authentication method and device based on block chain | |
| CN104573435A (en) | Method for terminal authority management and terminal | |
| CN109842616B (en) | Account binding method and device and server | |
| CN108234122B (en) | Token checking method and device | |
| EP2262165B1 (en) | User generated content registering method, apparatus and system | |
| CN111541542A (en) | Request sending and verifying method, device and equipment | |
| US9184919B2 (en) | Systems and methods for generating and using multiple pre-signed cryptographic responses | |
| Khieu et al. | CBPKI: cloud blockchain-based public key infrastructure | |
| WO2019178763A1 (en) | Certificate importing method and terminal | |
| WO2023093500A1 (en) | Access verification method and apparatus | |
| US20230082949A1 (en) | Systems and methods for implementing indirect certificate pinning | |
| US20130318353A1 (en) | Method for Creating and Installing a Digital Certificate | |
| KR20060031583A (en) | Time stamp service system, time stamp information verification server apparatus, and computer software | |
| CN112702419B (en) | Data processing method, device, equipment and storage medium based on block chain | |
| CN107276966B (en) | Control method and login system of distributed system | |
| WO2014038034A1 (en) | Information processing system, information processing method, and program | |
| CN112953720A (en) | Network request processing method, device, equipment and storage medium |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant |