TWI841232B - Automatic certificate application system, method and computer readable medium thereof - Google Patents

Abstract

The present invention is an automatic certificate application system and method thereof. The automatic certificate application system includes a certificate management module, a domain verification module and a certification authority module. The certificate management module is configured to confirm and register an automated service account. The domain verification module is configured to adopt a corresponding domain verification method according to a domain verification application packet sent by the certificate management module. The certification authority module is configured to decide whether to issue certificates based on domain verification results. Moreover, the domain verification method has a corresponding object identifier. Because the object identifier is bound with the relevant information of domain verification, it can provide a restriction mechanism for the domain verification method adopted, and the information security problem of the domain verification can be avoided. The present invention also provides a computer-readable medium for executing the method of the present invention.

Description

Automatic certificate application system, method and computer-readable medium thereof

The present invention relates to the technology of certificate application, and more particularly to an automatic certificate application system, method and computer-readable medium capable of limiting domain verification.

Under the framework of automated web page authentication, users must first purchase a Secure Sockets Layer (SSL) certificate from the system management terminal before installing the SSL certificate on the user's server. For the known automated web page authentication framework, building an automated certificate management environment for SSL certificates has become a trend. However, under the known framework, there is no restriction on the domain authentication method. Therefore, it is easy for malicious people to obtain SSL certificates through counterfeiting.

In view of the above problems, how to provide a certificate technology, especially to provide a restriction mechanism for the domain verification method for verification and make the certificate application process more secure, will become the goal that people in this technical field are eager to pursue.

In order to solve the above problems of the prior art, the present invention discloses an automatic certificate application system, which includes: a certificate management module, which receives an automated service account and a domain verification service application package submitted by a domain verification applicant, and after confirming and registering the automated service account, binds the domain verification service application package to the automated service account and initializes the domain verification form; a domain verification module, which receives the domain verification service application package from the certificate management module, and transmits the domain verification service application package to the automated service account; The domain verification is performed by using a domain verification method corresponding to the object identification code and the domain verification service application package, and after the domain verification, the domain verification result and the object identification code are stored and returned to the certificate management module, so that the certificate management module binds the object identification code, the domain verification form and the automated service account, and changes the status of the domain verification form to domain verification completion; and the certificate center module is used to issue a certificate based on the binding result of the domain verification form.

In one embodiment, the certificate management module registers the automated service account with a random number of a limited length.

In another embodiment, the domain verification applicant generates an account key pair before submitting the automated service account and the domain verification service application package, and signs the automated service account and the domain verification service application package respectively through the private key of the account key pair. When receiving the automated service account and the domain verification service application package, the certificate management module confirms the automated service account and the domain verification service application package through the public key of the account key pair, and after the certificate management module completes the registration of the automated service account, it signs the registration result of the automated service account through the private key of the certificate management module and returns it to the domain verification applicant.

In another embodiment, the automatic certificate application system further includes a registration center module for receiving a certificate service application package submitted by a certificate user and obtaining the binding result of the domain verification form from the certificate management module, and submitting the binding result of the domain verification form and the certificate service application package to the certificate center module after verification, so that the certificate center module issues the certificate accordingly, and then returns the certificate to the registration center module.

In another embodiment, the certificate user generates a user key before submitting the certificate service application package, so that the certificate service application package is signed by the user key and the account key of the domain verification applicant in sequence, and after the registration center module receives the certificate service application package, it verifies it by the account key of the domain verification applicant and the user key, and after verification, provides the binding result of the certificate service application package and the domain verification form to the certificate center module.

In another embodiment, the certificate center module extracts the object identification code from the binding result to write the object identification code into the certificate extension field of the certificate.

In another embodiment, the certificate management module is connected to a certificate management database, wherein the certificate management database is used by the certificate management module to store the registration result and the binding result of the automated service account.

In another embodiment, the certificate center module is connected to a certificate center database, wherein the certificate center database is used by the certificate center module to store certificate issuance results.

The present invention further discloses an automatic certificate application method, which is executed on a computer or server, and includes: allowing a certificate management module to receive an automated service account submitted by a domain verification applicant, and registering the account after confirmation; allowing the certificate management module to receive a domain verification service application packet submitted by the domain verification applicant, and after the automated service account is registered, binding the domain verification service application packet to the automated service account, and initially The domain verification form is configured to be a domain verification form; the domain verification module performs domain verification through a domain verification method corresponding to the domain verification service application package and stores and returns the domain verification result and the object identification code to the certificate management module after the domain verification, so that the certificate management module binds the object identification code, the domain verification form and the automated service account; and issues a certificate based on the binding result of the domain verification form.

In another embodiment, when the certificate management module receives the automated service account, the automated service account is registered by a random number of a limited length.

In another embodiment, the automated service account is first signed with an account key, so that when the certificate management module receives the automated service account and the domain authentication service application package, the account key is used for confirmation.

In another embodiment, before issuing the certificate, the certificate center module first extracts the object identification code from the binding result to write the object identification code into the certificate extension field of the certificate.

In another embodiment, the step of instructing the certificate center module to issue a certificate based on the binding result of the domain verification form includes: first receiving a certificate service application package submitted by a certificate user and obtaining the binding result from the certificate management module, and then issuing the certificate based on the binding result of the domain verification form and the certificate service application package after verification.

In another embodiment, the certificate service application package is first signed by the user key and the account key of the domain verification applicant, so that when the registration center module receives the certificate service application package, the account key of the domain verification applicant and the user key are used for verification.

The present invention further discloses a computer-readable medium, which is used in a computing device or a computer and stores instructions for executing the aforementioned automatic certificate application method.

As can be seen from the above, the automatic certificate application system, method and computer-readable medium of the present invention registers the automated service account of the domain verification applicant through the certificate management module, so that the domain verification module adopts the corresponding domain verification method according to the domain verification application packet, wherein the domain verification method has a corresponding object identification code, so that after executing the domain verification, the object identification code and the relevant information of the domain verification are bound, thereby providing a restriction mechanism for the adopted domain verification method, thereby avoiding the information security problem of the domain verification, and providing evidence for verification, so as to achieve the purpose of making the automatic certificate application process safe and reliable.

1: Automatic certificate application system

11: Certificate management module

12:Domain verification module

13: Certificate Center Module

14: Registration center module

21:Domain verification applicant

22: Certificate User

31:TLS web server

32:Domain name server

41: Certificate management database

42:Certificate Center Database

S310~S340: Process

S341~S343: Process

Figure 1 is a schematic diagram of the architecture of the automatic certificate application system of the present invention.

Figure 2 is a schematic diagram of the actual application of the automatic certificate application system of the present invention.

Figure 3 is a flow chart of the automatic certificate application method of the present invention.

Figure 4 is a flow chart of requesting certificate service in the automatic certificate application method of the present invention.

The following describes the technical content of the present invention through a specific concrete implementation form. People familiar with this technology can easily understand the advantages and effects of the present invention from the content disclosed in this manual. However, the present invention can also be implemented or applied through other different specific implementation forms.

The automatic certificate application system of the present invention is implemented based on the changes of registration information, order information, domain verification information and certificate field information to provide the function of domain verification method limitation mechanism in the certificate application process. In addition, the certificate format of the certificate service application received by the automatic certificate application system of the present invention is an SSL certificate in the context of Web PKI, but is not limited to a specific SSL certificate category, wherein SSL certificates include Organization Validated (OV) SSL certificates, Individual Validation (IV) SSL certificates, Domain Validation (DV) SSL certificates and Extended Validation (EV) SSL certificates.

FIG1 is a schematic diagram of the automatic certificate application system of the present invention. As shown in the figure, the automatic certificate application system 1 of the present invention includes a certificate management module 11, a domain verification module 12 and a certificate center module 13, and the certificate management module 11 communicates or is electrically connected with the domain verification module 12 and the certificate center module 13, wherein the certificate management module 11 is used to confirm and register the automated service account, and thereafter, the domain verification module 12 provides domain verification services according to the domain verification application packet transmitted by the certificate management module 11, and after the domain verification, the certificate center module 13 determines the issuance of the certificate according to the domain verification result, wherein the certificate can be an SSL certificate. The following is a further description of the automatic certificate application system 1 of the present invention.

The certificate management module 11 is used to register and verify the automated service account, verify the domain verification service application status management, and initialize the domain verification request.

Specifically, the certificate management module 11 receives the automated service account and confirms it. For example, the certificate management module 11 can use the key corresponding to the automated service account to confirm it, and after confirmation, perform the registration of the automated service account. In one embodiment, the certificate management module 11 registers the automated service account with a random number of a limited length, and stores the random number so that the registered automated service account meets the uniqueness.

After the automated service account is confirmed and registered, the certificate management module 11 receives the domain verification service application packet and binds the domain verification service application packet to the automated service account to initialize the domain verification form, and then sends the domain verification service application packet.

The domain verification module 12 has multiple domain verification methods. After receiving the domain verification service application packet from the certificate management module 11, the domain verification service application packet proposed for different domains has a limited domain verification method. In detail, the domain verification module 12 performs domain verification on the domain verification service application packet using the corresponding domain verification method, wherein the domain verification method has a corresponding object identification code as a limited value. Accordingly, after the domain verification, the domain verification result and the object identification code are stored. In addition, the domain verification module 12 also returns the domain verification result to the certificate management module 11, so that the certificate management module 11 binds the object identification code, the domain verification form and the automated service account, and changes the status of the domain verification form to domain verification completed.

The certificate center module 13 provides certificate application, certificate revocation, certificate extension and certificate change. Therefore, the certificate center module 13 can execute the certificate application service processing flow based on the binding result of the domain verification form to issue a certificate, wherein the certificate application service processing flow includes issuance verification, certificate format confirmation, and certificate status verification. Furthermore, the certificate center module 13 can issue an Online Certificate Status Protocol (OCSP) response message and a Certificate Revocation List (CRL) to announce the status information of the issued official certificate.

In one embodiment, the certificate center module 13 extracts the object identification code from the binding result of the domain verification form, and writes the object identification code into the certificate extension field of the certificate when the certificate is to be issued. Accordingly, the automatic certificate application system 1 of the present invention embeds the object identification code into the certificate policy certificate extension field through the certificate center module 13 to disclose the adopted domain verification method, so as to achieve the purpose of public inquiry by any third party.

As shown in FIG. 1 , the automatic certificate application system 1 of the present invention further includes a registration center module 14, which receives a certificate service application packet and verifies the certificate service application packet after waiting for the certificate management module 11 to complete account management, order management and report the domain verification result to be normal, and obtains the binding result of the domain verification form from the certificate management module 11 after verification, and transmits the binding result and the certificate to the certificate management module 11. The certificate service application package is submitted to the certificate center module 13, so that the certificate center module 13 issues the certificate according to the binding result and the certificate service application package, and then returns the certificate to the registration center module 14, wherein the binding result includes the information of the domain verification applicant's automated service account, the information of the domain verification service application form, and the information of the limited domain verification result.

FIG2 is a schematic diagram of the actual application of the automatic certificate application system of the present invention. As shown in the figure, the automatic certificate application system 1 of the present invention can be connected to system users and external interface systems or external interface servers, and can be connected to databases of different functions, wherein the system users include domain verification applicants 21 connected to the certificate management module 11 and certificate users 22 connected to the registration center module, and the external interface system or external interface server is connected to the domain verification module 12, such as a Transport Layer Security (TLS) web server 31 and a domain name server 32. In addition, the databases with different functions may include a certificate management database 41 connected to the certificate management module 11 and a certificate center database 42 connected to the certificate center module 13. The following further describes an embodiment of the automatic certificate application system 1 of the present invention in actual application.

In order for the TLS web server 31 to provide services to a specific domain, a certificate (such as an SSL certificate) needs to be set in its configuration settings. Before obtaining the certificate, the ownership of the domain by the TLS web server 31 must be proved. Therefore, the domain verification applicant 21 first connects to the automatic certificate application system 1 and submits a registration service application packet and a domain verification service application packet for the domain verification service to the certificate management module 11. The registration service application packet includes the automated service account of the domain verification applicant.

Specifically, the automated service account and the domain verification service application packet are submitted by the domain verification applicant 21. When the domain verification applicant 21 wishes to register the automated service account with the automated certificate application system 1, it connects to the certificate management module 11 and provides the automated service account by sending the registration service application packet, so that the certificate management module 11 confirms and registers the automated service account. Afterwards, when the domain verification is to be performed, the domain verification service application packet is submitted to the automated certificate application system 1.

In one embodiment, before submitting the automated service account, the domain verification applicant 21 first generates an account key pair, so that the automated service account and the domain verification service application package are signed respectively by the private key of the account key pair. In actual application, the domain verification applicant 21 uses the private key of the account key pair to sign the registration service application package for the domain verification service and including the automated service account of the domain verification applicant, and after signing, sends the registration service application to the certificate management module 11. Then, when receiving the automated service account, the certificate management module 11 confirms the automated service account through the public key of the account key pair, and after the automated service account is registered, the certificate management module 11 signs the registration result corresponding to the automated service account through the private key of the certificate management module 11 and returns it to the domain verification applicant 21.

When the domain verification applicant 21 receives the notification of the registration result and the verification stamp is confirmed to be correct, he can apply for the domain verification service to the certificate management module 11. At this time, the domain verification applicant 21 uses the private key of the account key pair to sign the domain verification service application package. After signing, the domain verification applicant 21 sends the application for the service to the certificate management module 11, that is, submits the domain verification service application package. The certificate management module 11 receives the application for the service. After the request, the public key of the account key pair is used to confirm the domain verification service application package. After the verification is passed, the certificate management module 11 binds the domain verification service application package to the corresponding automated service account, and writes the binding result into the certificate management database 41 connected to the certificate management module 11 and used for the certificate management module 11 to store the registration result of the automated service account and the binding result, and initializes the status of the SSL domain verification form.

In one embodiment, for the certificate management module 11, the receiving time point of the domain verification service application packet is when the certificate user 22 applies for the certificate for the first time or when the certificate is about to expire. At this time, the domain verification service applicant identity verification is required for the domain verification service application form submitted by the domain verification applicant 21, and the inspection record includes the process inspection result of whether the certificate user 22 reissues the request for certificate issuance within the specified period, and the status of the domain verification service application form is changed at each stage of the certificate application to complete the status change of the domain verification form.

After the automated service account is confirmed and registered, the certificate management module 11 sends a domain verification service application packet signed with the private key of the certificate management module 11 to the domain verification module 12 for the domain verification form. After the domain verification module 12 receives the domain verification service application packet for domain verification service application, it uses the public key of the certificate management module 11 to verify the domain verification service application packet. After passing the verification, it provides domain verification methods limited to various domain ownerships allowed by the certificate center and the browser forum. The method provides a multi-domain verification service, performs domain verification using a limited domain verification method, and connects to a TLS web server 31 and a domain name server 32 during the process. Various domain verification methods are distinguished by a unique object identifier, and each domain verification method that complies with the regulations is included in a domain verification method whitelist. Accordingly, if the domain verification method to be adopted is not included in the whitelist of the domain verification method, the domain verification method will not be adopted, so as to avoid the problem that the public specification does not limit the domain verification method. In addition, the whitelist can be further classified by a hash value mapping table.

After the domain verification module 12 completes the domain verification, the object identification code of the adopted domain verification method and the domain verification result are signed by the private key of the domain verification module 12, and the verification result is returned to the certificate management module 11. In detail, the result of domain verification can be divided into two situations, namely domain verification failure or domain verification success. When domain verification fails, the domain verification form will set the time period according to the schedule and start batch re-verification. If the number of re-verification failures reaches the specified number and the domain verification still fails, the domain verification module 12 will return the failed domain verification result to the certificate management module 11; in addition, if the domain verification result is successful, the successful domain verification result will be returned.

After receiving the domain verification result, the certificate management module 11 uses the public key of the domain verification module 12 to verify the seal. After the verification is passed, the status of the domain verification form is changed to domain verification completed, and the object identification code corresponding to the adopted domain verification method is bound to the domain verification form and the corresponding automated service account. The automated service account still uses the aforementioned random number (i.e., the random number used by the certificate management module 11 to register the automated service account with a random number of limited length) as a unique identification.

In summary, after the certificate management module 11 completes the binding of the object identification code, the domain verification form and the automated service account, it means that the domain verification applicant 21 has completed the verification of the ownership of the domain. The certificate management module 11 will sign the domain verification result with its private key and return it to the domain verification applicant 21. At this time, the domain verification applicant 21 can use the public key of the certificate management module 11 to verify the domain verification result to confirm the returned result.

If the domain verification result is successful, the certificate user 22 fills in the certificate application information and, after confirming the user agreed terms, transmits the certificate application information and related certification information to the registration center module 14. That is, the certificate user 22 submits the certificate service application package formed by the certificate application information and related certification information to the registration center module 14. Specifically, the certificate service application package is submitted by the certificate user 22, and the certificate user 22 will first generate a user key before submitting the application, so that the certificate service application package is signed by the user key, and then further signed with the account key of the domain verification applicant to provide the effect of double signatures, and when applying for a certificate, the certificate service application package is submitted to the registration center module 14 through a secure channel. In order to protect the personal information of the certificate user 22, the automatic certificate application system 1 shall not conduct any form of key generation activities or provide key hosting services.

After receiving the certificate service application package, the registration center module 14 performs verification through the account key of the domain verification applicant and the user key. After verification, the certificate management module 11 can access the domain verification form and related binding information corresponding to the domain verification applicant 21 in the certificate management database 41, and provide the certificate service application package and the binding result of the domain verification form to the certificate center module 13. In detail, the registration center module 14 performs the identity identification and authentication procedures of the certificate user according to the specifications of the certificate practice benchmark. The main functions of the registration center module 14 include the identity verification of the certificate subject, the format and content verification of the certificate service application package, etc. The certificate subject identity verification process varies according to the type of SSL certificate applied for, and corresponds to different identity authentication assurance levels. When the relevant identity identification and authentication verification procedures are confirmed to be correct, the certificate service application package and the binding information of the domain verification form are signed with the private key of the registration center module 14 and submitted to the certificate center module 13.

After receiving the information submitted by the registration center module 14, the certificate center module 13 uses the public key of the registration center module 14 for verification. After passing the verification, the certificate issuance process is carried out according to the content of the obtained certificate service application package. At this time, the certificate center module 13 takes out the object identifier of the domain verification method adopted in the domain verification form binding information and writes it into the certificate policy certificate extension field of the certificate to be issued. Among them, the written object identifier value and its corresponding domain verification method can also be further announced in the certificate practice benchmark to which the certificate center module 13 belongs, so as to be verified in subsequent inspections.

If the certificate center module 13 receives a domain verification result of failure or the certificate user's identity identification fails, the certificate center module 13 uses the same private key as when issuing the certificate to record the certificate serial number and the reason for the certificate application failure, etc., after digital signature, in the certificate center database 42 connected to the certificate center module 13 and used for the certificate center module 13 to store the certificate issuance result. At this time, since the certificate has not been issued, there is no need to record the relevant information in the certificate revocation list, nor is there a need to provide an online certificate status protocol query service to confirm the certificate revocation status.

If the certificate center module 13 receives the domain verification success and the certificate user's identity identification success, the certificate center module 13 will issue the terminal entity's certificate with its private key and return it to the registration center module 14. After receiving the certificate, the registration center module 14 will verify the signature of the certificate center module 13 and the certificate chain in the certificate. Only after the verification is passed can the certificate acceptance process be activated for the certificate user 22 to conduct the final confirmation. After the confirmation is completed, the certificate issuance process is terminated. Among them, the certificate issuance result will be written into the certificate center database 42 by the certificate center module 13. The certificate center module 13 can also provide an online certificate status protocol query service for the certificate user 22 to query the certificate status related information.

FIG3 is a method flow chart of the automatic certificate application method of the present invention. The automatic certificate application method of the present invention can be executed on a computer or a server. In this embodiment, the automatic certificate application method of the present invention is executed using the aforementioned automatic certificate application system. As shown in the figure, the method includes the following process.

In process S310, a registration service is requested. Specifically, the certificate management module of the automatic certificate application system receives the automated service account from the domain verification applicant for confirmation. After the confirmation, the automated service account is registered, wherein the certificate management module registers the automated service account of the domain verification applicant with a limited unique value (e.g., a random number of a limited length).

In one embodiment, the domain verification applicant first generates an account key by himself, and before sending the automated service account and the domain verification service application package, the automated service account and the domain verification service application package are signed by the account key, so that when the certificate management module receives the automated service account and the domain verification service application package, the account key can be used for confirmation, thereby confirming the identity of the domain verification applicant. The confirmation process using the account key is as described above, so it is not repeated here.

In one embodiment, when the certificate management module receives the automated service account, the automated service account is registered by a random number of a limited length, so that the automated service account is unique.

In process S320, request a service order. After registering the automatic certificate application system, the domain verification applicant can initiate a domain verification service application and send a domain verification service application packet to the certificate management module, so that it receives the domain verification service application packet, binds the domain verification service application packet to the registered automated service account, and initializes the domain verification order.

In process S330, domain verification is performed. Since the domain verification method is an open item and has diversity, the domain verification module limits the domain verification method used, and records the adopted domain verification method with the corresponding limit value in the database for use in subsequent processes. In detail, the domain verification module uses the domain verification method corresponding to the domain verification service application packet to perform domain verification, wherein the domain verification method has a corresponding object identifier, so that after the domain verification, the domain verification result and the object identifier are stored in the certificate management database. In addition, the domain verification result and the object identification code are returned to the certificate management module so that the certificate management module binds the object identification code, the domain verification form and the automated service account.

In process S340, a certificate service is requested. After the domain verification process is completed, the certificate center module can issue a certificate based on the binding result of the domain verification form.

Figure 4 is a flow chart of requesting certificate service in the automatic certificate application method of the present invention. As shown in the figure, the requesting certificate service includes the following process.

In process S341, apply for certificate service. In this process, the certificate applicant signs the certificate service application package with the user key generated by himself and the account key generated by the domain verification applicant in the above process, and then submits the signed certificate service application package. When the registration center module receives the certificate service application package, it uses the account key of the domain verification applicant and the user key to verify. After the verification is completed, the registration center module obtains the binding result from the certificate management module, wherein the binding result has the object identification code, the domain verification form and the automated service account, and then sends the binding result and the certificate service application package to the certificate center module.

In process S342, the certificate content is changed. In this process, the certificate center module performs verification after receiving the certificate service application package and the binding result, and after verification, issues the certificate according to the binding result of the domain verification form and the certificate service application package. In one embodiment, before issuing the certificate, the certificate center module first extracts the object identifier from the binding result, writes the object identifier into a specific certificate extension field of the certificate to be issued, and retains and publishes the relevant supporting information.

In process S343, the certificate issuance service is executed. In this process, after the certificate center module verifies the certificate service application package, if the verification result is a failure, the failed process and reason will be recorded, and the personal information of the application will not be allowed to be retained. If the verification result is successful, the certificate acceptance process must be activated and the certificate issuance workflow must be entered before the certificate can be issued.

In addition, the present invention also discloses a computer-readable medium, which is applied to a computing device or computer having a processor (e.g., CPU, GPU, etc.) and/or a memory, and stores instructions, and the computing device or computer can execute the computer-readable medium through the processor and/or memory to execute the above-mentioned method, steps and processes when executing the computer-readable medium.

In summary, the automatic certificate application system, method and computer-readable medium of the present invention improve the certificate center server side in the automatic certificate management environment when issuing SSL certificates. The key point is to achieve the certificate center server side receiving the certificate application by changing the registration information, order information, domain verification information and certificate field information. The certificate application process is automatically carried out, and a restriction mechanism is provided for the adopted domain verification method, which can avoid the information security issues extended by the misuse of the domain verification method. The proposed certificate change method can provide evidence to any third party for public inspection after the certificate is issued, making the automatic certificate application process safer and more reliable, thereby avoiding the production of misissued certificates due to manual replacement errors. In addition, the present invention does not need to change the existing workflow of the certificate applicant in the certificate service application process, and should be able to achieve the above purpose and effect without significantly changing the existing process.

The modules, units, devices, etc. of the present invention include a microprocessor and a memory, and algorithms, data, programs, etc. are stored in the memory or chip. The microprocessor can load data or algorithms or programs from the memory to perform data analysis or calculation, etc., which will not be elaborated here. In other words, the automatic certificate application system and method of the present invention can be executed on electronic devices, such as general computers, tablets or servers, and perform data analysis and calculations after receiving data. Therefore, the program performed by the automatic certificate application system and method of the present invention can be designed and constructed on electronic devices with components such as processors and memories through software to run on various types of electronic devices; in addition, each module or unit in the automatic certificate application system can be composed of independent components, such as designed as a calculator, memory, storage or firmware with a processing unit, which can all be used to implement the present invention, that is, the present invention can be presented in software programs, hardware or firmware architecture.

The above embodiments are only illustrative and not intended to limit the present invention. Anyone familiar with this technology may modify and change the above embodiments without violating the spirit and scope of the present invention. Therefore, the scope of protection of the present invention is defined by the scope of the patent application attached to the present invention. As long as it does not affect the effect and implementation purpose of the present invention, it should be covered by this public technical content.

1: Automatic certificate application system

11: Certificate management module

12:Domain verification module

13: Certificate Center Module

14: Registration center module

Claims (15)

An automatic certificate application system includes: a certificate management module, which receives an automated service account and a domain verification service application package submitted by a domain verification applicant, and after confirming and registering the automated service account, binds the domain verification service application package to the automated service account and initializes the domain verification form; a domain verification module, which receives the domain verification service application package from the certificate management module, identifies the domain verification service application package with a corresponding object, and The domain verification method corresponding to the domain verification service application package is used to perform domain verification, and after the domain verification, the domain verification result and the object identification code are stored and returned to the certificate management module, so that the certificate management module binds the object identification code, the domain verification form and the automated service account, and changes the status of the domain verification form to domain verification completed; and the certificate center module is used to issue a certificate based on the binding result of the domain verification form. The automatic certificate application system as described in claim 1, wherein the certificate management module registers the automated service account with a random number of a limited length. The automatic certificate application system as described in claim 1, wherein the domain verification applicant generates an account key pair before submitting the automatic service account and the domain verification service application package, and signs the automatic service account and the domain verification service application package respectively through the private key of the account key pair, and the certificate management module confirms the automatic service account and the domain verification service application package through the public key of the account key pair when receiving the automatic service account and the domain verification service application package, and after the certificate management module completes the registration of the automatic service account, the registration result of the automatic service account is signed by the private key of the certificate management module and returned to the domain verification applicant. The automatic certificate application system as described in claim 1 further includes a registration center module for receiving a certificate service application package submitted by a certificate user and obtaining the binding result of the domain verification form from the certificate management module, and submitting the binding result of the domain verification form and the certificate service application package to the certificate center module after verification, so that the certificate center module issues the certificate based on the certificate, and then returns the certificate to the registration center module. The automatic certificate application system as described in claim 4, wherein the certificate user generates a user key before submitting the certificate service application package, so that the certificate service application package is signed by the user key and the account key of the domain verification applicant in sequence, and after the registration center module receives the certificate service application package, it verifies it by the account key of the domain verification applicant and the user key, and after verification, provides the certificate service application package and the binding result of the domain verification form to the certificate center module. The automatic certificate application system as described in claim 1, wherein the certificate center module extracts the object identification code from the binding result to write the object identification code into the certificate extension field of the certificate. The automatic certificate application system as described in claim 1, wherein the certificate management module is connected to a certificate management database, and the certificate management database is used by the certificate management module to store the registration result and the binding result of the automated service account. An automatic certificate application system as described in claim 1, wherein the certificate center module is connected to a certificate center database, and the certificate center database is used by the certificate center module to store certificate issuance results. An automatic certificate application method includes: Let the certificate management module receive the automated service account submitted by the domain verification applicant, and register after confirmation; let the certificate management module receive the domain verification service application package submitted by the domain verification applicant, and after the automated service account is registered, bind the domain verification service application package to the automated service account and initialize the domain verification form; let the domain verification module Perform domain verification through a domain verification method corresponding to the object identification code and the domain verification service application package, so that after the domain verification, the domain verification result and the object identification code are stored and returned to the certificate management module, so that the certificate management module binds the object identification code, the domain verification form and the automated service account; and the certificate center module issues a certificate based on the binding result of the domain verification form. The automatic certificate application method as described in claim 9, wherein when the certificate management module receives the automated service account, the automated service account is registered by a random number of a limited length. The automatic certificate application method as described in claim 9, wherein the automated service account is first signed with an account key, so that when the certificate management module receives the automated service account and the domain verification service application package, the account key is used for confirmation. The automatic certificate application method as described in claim 9, wherein before issuing the certificate, the certificate center module first extracts the object identification code from the binding result to write the object identification code into the certificate extension field of the certificate. The automatic certificate application method as described in claim 9, wherein the step of instructing the certificate center module to issue a certificate based on the binding result of the domain verification form includes: first receiving a certificate service application package submitted by a certificate user and obtaining the binding result from the certificate management module, and then, after verification, issuing the certificate based on the binding result of the domain verification form and the certificate service application package. The automatic certificate application method as described in claim 13, wherein the certificate service application packet is first signed by the user key and the account key of the domain verification applicant, so that when the registration center module receives the certificate service application packet, the account key of the domain verification applicant and the user key are used for verification. A computer-readable medium, used in a computing device or a computer, stores instructions for executing the automatic certificate application method as described in any one of claims 9 to 14.

Images