WO2021078062A1 - Ssl证书校验方法、装置、设备及计算机存储介质 - Google Patents

Ssl证书校验方法、装置、设备及计算机存储介质 Download PDF

Info

Publication number
WO2021078062A1
WO2021078062A1 PCT/CN2020/121224 CN2020121224W WO2021078062A1 WO 2021078062 A1 WO2021078062 A1 WO 2021078062A1 CN 2020121224 W CN2020121224 W CN 2020121224W WO 2021078062 A1 WO2021078062 A1 WO 2021078062A1
Authority
WO
WIPO (PCT)
Prior art keywords
ssl certificate
certificate
path
configuration file
information
Prior art date
Application number
PCT/CN2020/121224
Other languages
English (en)
French (fr)
Inventor
姚朋波
Original Assignee
深圳前海微众银行股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 深圳前海微众银行股份有限公司 filed Critical 深圳前海微众银行股份有限公司
Publication of WO2021078062A1 publication Critical patent/WO2021078062A1/zh

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/382—Payment protocols; Details thereof insuring higher security of transaction
    • G06Q20/3825—Use of electronic signatures
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/382—Payment protocols; Details thereof insuring higher security of transaction
    • G06Q20/3829—Payment protocols; Details thereof insuring higher security of transaction involving key management
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q40/00—Finance; Insurance; Tax strategies; Processing of corporate or income taxes
    • G06Q40/04—Trading; Exchange, e.g. stocks, commodities, derivatives or currency exchange

Definitions

  • This application relates to the field of financial technology (Fintech) technology, in particular to SSL certificate verification methods, devices, equipment, and computer storage media.
  • the digital signature in some financial services is an SSL certificate.
  • Reasons such as SSL certificate expiration can cause communication failures. In severe cases, the service will be unavailable and cause losses. Therefore, the SSL certificate needs to be verified.
  • the current SSL certificate verification is through regular scanning. Regular scanning consumes resources and lacks real-time performance. For SSL certificates that require passwords, a password book needs to be manually operated, which means that the current SSL certificate verification is more troublesome. .
  • the main purpose of this application is to propose an SSL certificate verification method, device, equipment, and computer storage medium, which aims to solve the current technical problems of SSL certificate detection and verification that consume large resources and do not have real-time and flexibility.
  • this application provides an SSL certificate verification method, which includes the following steps:
  • the SSL certificate is verified according to the certificate information, and the verification result is output.
  • the steps of obtaining the configuration file path in the process information, parsing the configuration file corresponding to the configuration file path, and obtaining the configured SSL certificate path and password include:
  • the configuration file corresponding to the configuration file path is parsed, and the SSL certificate path corresponding to the path configuration item in the configuration file and the password corresponding to the password configuration item are obtained.
  • the steps of obtaining the configuration file path in the process information, parsing the configuration file corresponding to the configuration file path, and obtaining the configured SSL certificate path and password include:
  • process file contains preset keywords, construct a syntax tree according to the server.xml file corresponding to the process file;
  • the steps of obtaining the configuration file path in the process information, parsing the configuration file corresponding to the configuration file path, and obtaining the configured SSL certificate path and password include:
  • the configuration file corresponding to the configuration file path is parsed, and the SSL certificate path corresponding to the path configuration item in the configuration file and the password corresponding to the password configuration item are obtained.
  • the step of decrypting the SSL certificate corresponding to the SSL certificate path according to the password and obtaining certificate information in the SSL certificate includes:
  • the SSL certificate is of the jks type
  • the SSL certificate is parsed through the keystool command to obtain certificate information
  • the SSL certificate is parsed through the openssl command to obtain certificate information.
  • the step of verifying the SSL certificate according to the certificate information and outputting the verification result includes:
  • the method includes:
  • the updated SSL certificate is parsed, the certificate information in the updated SSL certificate is obtained, and the step of verifying the SSL certificate according to the certificate information and outputting the verification result is performed .
  • this application also provides an SSL certificate verification device, the SSL certificate verification device including:
  • the request receiving module is used to obtain the process information of the application process when the SSL certificate verification instruction is received;
  • the first parsing module is configured to obtain the configuration file path in the process information, parse the configuration file corresponding to the configuration file path, and obtain the configured SSL certificate path and password;
  • the second parsing module is configured to decrypt the SSL certificate corresponding to the SSL certificate path according to the password, and obtain certificate information in the SSL certificate;
  • the detection and judgment module is configured to verify the SSL certificate according to the certificate information and output the verification result.
  • this application also provides an SSL certificate verification device, the SSL certificate verification device including: a memory, a processor, and SSL stored on the memory and running on the processor A certificate verification program, which implements the steps of the above-mentioned SSL certificate verification method when the SSL certificate verification program is executed by the processor.
  • this application also provides a computer-readable storage medium with an SSL certificate verification program stored on the computer-readable storage medium, and when the SSL certificate verification program is executed by a processor, the implementation is as described above. The steps of the SSL certificate verification method described.
  • This application provides an SSL certificate verification method, device, equipment and computer storage medium.
  • the server obtains the process information of the application process when receiving the SSL certificate verification instruction; obtains the configuration file path of the application process according to the process information, parses the configuration file corresponding to the configuration file path, and obtains the configured SSL certificate path And the password; the server parses the SSL certificate corresponding to the SSL certificate path to obtain the certificate information in the SSL certificate; the server verifies the SSL certificate according to the certificate information, and outputs the verification result.
  • the server determines the configuration file by the process information, and then determines the SSL certificate by the configuration file.
  • the certificate information is obtained by parsing the SSL certificate to perform SSL certificate detection and judgment based on the certificate information, which realizes the real-time flexible detection and verification of the SSL certificate, which is effective This avoids the termination of the application process due to reasons such as the expiration of the SSL certificate.
  • FIG. 1 is a schematic diagram of a device structure of a hardware operating environment involved in a solution of an embodiment of the present application
  • FIG. 2 is a schematic flowchart of a first embodiment of a method for verifying an SSL certificate for applying for
  • FIG. 3 is a schematic diagram of functional modules of an embodiment of an apparatus for verifying an SSL certificate for an application.
  • the existing SSL certificate verification is through periodic scanning. Periodic scanning consumes resources and lacks real-time performance. For SSL certificates that require passwords, a password book needs to be manually operated, that is to say, the current SSL certificate verification It is more troublesome.
  • some users adopt another SSL certificate verification method, that is, users simulate normal customers, access business services regularly through the external network, pull the SSL certificate of the server, and then parse the content of the certificate to determine whether an alarm is required
  • Such an SSL certificate verification method can be applied to some business scenarios, but it is not applicable to the scenario of whitelist mutual access between institutions.
  • This application provides an SSL certificate verification method.
  • receive the SSL certificate verification instruction obtain the process information of the application process; obtain the configuration file path in the process information, and parse the configuration file corresponding to the configuration file path , Obtain the configured SSL certificate path and password; decrypt the SSL certificate corresponding to the SSL certificate path according to the password, and obtain certificate information in the SSL certificate; verify the SSL certificate according to the certificate information, And output the verification result.
  • the application also discloses an SSL certificate verification device, equipment and computer storage medium. This application realizes the real-time and flexible detection and verification of the SSL certificate, which effectively avoids the termination of the application process due to reasons such as the expiration of the SSL certificate.
  • FIG. 1 is a schematic diagram of the device structure of the hardware operating environment involved in the solution of the embodiment of the present application.
  • the SSL certificate verification device in this embodiment of the application may be a PC or a server.
  • the SSL certificate verification device may include: a processor 1001, such as a CPU, a network interface 1004, a user interface 1003, a memory 1005, and a communication bus 1002.
  • the communication bus 1002 is used to implement connection and communication between these components.
  • the user interface 1003 may include a display screen (Display) and an input unit such as a keyboard (Keyboard), and the optional user interface 1003 may also include a standard wired interface and a wireless interface.
  • the network interface 1004 may optionally include a standard wired interface and a wireless interface (such as a WI-FI interface).
  • the memory 1005 can be a high-speed RAM memory or a stable memory (non-volatile memory), such as disk storage.
  • the memory 1005 may also be a storage device independent of the aforementioned processor 1001.
  • FIG. 1 does not constitute a limitation on the device, and may include more or fewer components than those shown in the figure, or a combination of certain components, or different component arrangements.
  • the memory 1005 as a computer storage medium may include an operating system, a network communication module, a user interface module, and an SSL certificate verification program.
  • the network interface 1004 is mainly used to connect to the back-end server and communicate with the back-end server; the user interface 1003 is mainly used to connect to the client (user side) to communicate with the client; and the processor 1001 can be used to call the SSL certificate verification program stored in the memory 1005 and perform the operations in the following SSL certificate verification method.
  • the method implemented when the SSL certificate verification program running on the processor is executed can be Refer to the various embodiments of the SSL certificate verification method of this application, which will not be repeated here.
  • FIG. 2 is a schematic flowchart of a first embodiment of a method for verifying an SSL certificate for an application.
  • the method for verifying an SSL certificate includes:
  • Step S10 when receiving the SSL certificate verification instruction, obtain the process information of the application process.
  • the SSL certificate verification method in this embodiment is applied to an SSL certificate verification device (also called a server).
  • the server receives an SSL certificate verification instruction.
  • the triggering method of the SSL certificate verification instruction is not specifically limited, that is, the SSL certificate verification instruction It can be triggered by the user.
  • the user outputs the text "SSL certificate verification” on the display interface of the business node and clicks the "monitor" button to actively trigger the SSL certificate verification instruction, and the business node sends the SSL certificate verification instruction
  • the server receives the SSL certificate verification instruction; in addition, the SSL certificate verification instruction can also be automatically triggered by the server.
  • the server presets the trigger condition of the SSL certificate verification instruction: execute the specified service, and the server executes the specified service , The server automatically triggers the SSL certificate verification instruction.
  • the server When the server receives the SSL certificate verification instruction, the server obtains the process information of each application process.
  • the process information includes process identification (for example, process name), process-related process files, process description information, process type, and so on.
  • the server After the server obtains the process information of the application process, the server parses the process information of the application process to determine the SSL certificate involved in the application process, and determines the validity of the SSL certificate according to the certificate content of the SSL certificate, specifically:
  • Step S20 Obtain the configuration file path in the process information, parse the configuration file corresponding to the configuration file path, and obtain the configured SSL certificate path and password.
  • the server obtains the process information, the server traverses the files in the /proc/ directory in the process information one by one, the server finds all /proc/$ ⁇ PID ⁇ /exe information, and the server determines the process according to the found /proc/$ ⁇ PID ⁇ /exe information File type, the server parses the process file according to the type of the process file, obtains the configuration file path in the process file, and the server parses the configuration file under the configuration file path to obtain the configured SSL certificate path and password.
  • the type of the process file in this embodiment is not specifically limited.
  • the process file may be of nginx type, java type, jsvc type or httpd type, etc., specifically:
  • the server queries the configuration file path conf_file corresponding to the -p parameter or -c parameter in the process file. If the parameters of the process file do not include the -p parameter or the -c parameter, the server uses nginx -V to find the configuration file path in the process file.
  • the server parses the process file (also called /proc/$ ⁇ PID ⁇ /cmdline file), and the server determines whether the process file contains the keyword "org.apache.catalina.startup.Bootstrap", If the "org.apache.catalina.startup.Bootstrap" keyword is not included in the process file, the server determines that the application process does not involve data signature verification, and the server terminates the subsequent SSL certificate detection steps; if the process file contains "org.apache” ".catalina.startup.Bootstrap" keyword, the server determines that the application process is the tomcat program, the server searches for the tomcat server.xml file according to the /proc/$ ⁇ PID ⁇ /exe information, the server builds the syntax tree, and the server traverses the syntax tree To get Server ⁇ Service ⁇ Connector ⁇ keystoreFile
  • the server passes httpd -V configuration file path, the server parses the configuration file under the configuration file path, and the server finds the configured SSL certificate path and password according to the SSLCertificateFile configuration item.
  • the server parses the process file according to the type of the process file to obtain the configuration file path of the application process.
  • the server parses the configuration file corresponding to the configuration file path to obtain the configured SSL certificate path and password, without the need for the user to manually maintain a password book , Reducing the user’s operations, and the server flexibly performs SSL certificate processing according to the SSL certificate path and password, specifically:
  • Step S30 Decrypt the SSL certificate corresponding to the SSL certificate path according to the password, and obtain certificate information in the SSL certificate.
  • the server obtains the SSL certificate corresponding to the SSL certificate path.
  • the server decrypts the SSL certificate according to the password to obtain the decrypted SSL certificate.
  • the server obtains the certificate information from the decrypted SSL certificate, which specifically includes:
  • Step a1 decrypt the SSL certificate corresponding to the SSL certificate path according to the password, and obtain the type of the SSL certificate;
  • Step a2 when the SSL certificate is of the jks type, use the keystool command to parse the SSL certificate to obtain certificate information;
  • step a3 when the SSL certificate is not of the JKS type, the SSL certificate is parsed through the openssl command to obtain certificate information.
  • the server obtains the SSL certificate corresponding to the SSL certificate path, and the server decrypts the SSL certificate according to the password. After the SSL certificate is decrypted, the server obtains the type of the SSL certificate. If the SSL certificate is of the jks type, the server parses the SSL certificate through the keystool command Obtain certificate information; if the SSL certificate is not of the JKS type (the SSL certificate is a common type), the server uses the openssl command to parse the SSL certificate to obtain the certificate information.
  • the server parses the SSL certificate according to the type of the SSL certificate, obtains the certificate information in the SSL certificate, and makes a validity judgment based on the certificate information, specifically:
  • Step S40 Verify the SSL certificate according to the certificate information, and output the verification result.
  • the server obtains the validity period and certificate chain information in the certificate information, and the server inputs the validity period and certificate chain information into the rule engine to determine whether the SSL certificate is valid, specifically, including:
  • Step b1 extracting the validity period and certificate chain information from the certificate information, and judging whether the SSL certificate has expired according to the validity period;
  • Step b2 if the SSL certificate expires, output a verification result that the SSL certificate is invalid;
  • Step b3 if the SSL certificate has not expired, judge whether the SSL certificate meets the standards of the application process according to the certificate chain information;
  • Step b4 If the SSL certificate does not meet the standards of the application process, output a verification result that the SSL certificate is invalid.
  • the server extracts the validity period and certificate chain information from the certificate information.
  • the certificate chain information records the certificate authority and other information.
  • the server judges whether the SSL certificate has expired according to the validity period; if the SSL certificate expires, the server outputs the school with invalid SSL certificate. If the SSL certificate is not expired, the server judges whether the SSL certificate meets the application process standard based on the certificate chain information; that is, the server traces the certificate chain information to obtain the issuing authority of the SSL certificate. If the issuing authority of the SSL certificate has business Operation authority, the SSL certificate conforms to the standard of the application process; if the issuing authority of the SSL certificate does not have the business operation authority, then the SSL certificate meets the standard of the application process. When the server determines that the SSL certificate does not conform to the standard of the application process, the output SSL certificate is invalid Check the result.
  • the server can set different types of prompts according to the validity period and the certificate chain information. For example, if the SSL certificate has expired, the server will alarm; if the SSL certificate expires within one month, the server will set a first-level prompt. If it expires within a month, the server sets a first-level prompt. In addition, the server can also set different alarms according to whether it is a self-signed certificate, whether the certificate's CA is legal, and so on.
  • the server determines the configuration file by the process information, and then determines the SSL certificate by the configuration file.
  • the certificate information is obtained by parsing the SSL certificate to perform SSL certificate detection and judgment based on the certificate information, which realizes the real-time flexible detection and verification of the SSL certificate, which is effective This avoids the termination of the application process due to reasons such as the expiration of the SSL certificate.
  • This embodiment is a refinement of step S20 in the first embodiment.
  • the first specific implementation method for the server to obtain the configured SSL certificate path and password is given, including:
  • the configuration file corresponding to the configuration file path is parsed, and the SSL certificate path corresponding to the path configuration item in the configuration file and the password corresponding to the password configuration item are obtained.
  • the server traverses the process information to obtain the process file corresponding to the process information and the file type of the process file; if the process file is of the nginx type, the server determines whether the process file contains preset parameters (for example, the preset parameter is -p Parameter); if the process file contains preset parameters, the configuration file path in the process file is determined according to the preset parameters; for example, the server obtains the configuration file path corresponding to the -p parameter; if the process file does not contain preset parameters, then Determine the initial configuration path through nginx-v, the server judges whether the process file contains the -c parameter, if the process file does not contain the -c parameter, the server uses the initial configuration path as the configuration file path; if the process file contains the -c parameter, The server determines that the path of the configuration file path is a relative path, the server obtains the working path corresponding to the -c parameter, and the server concatenates the initial configuration path and the working path as the configuration file path in the process
  • the server parses the configuration file corresponding to the configuration file path, and the server obtains the SSL certificate path corresponding to the path configuration item in the configuration file and the password corresponding to the password configuration item; in this embodiment, the configuration file parsing time is reduced , Improve the efficiency of SSL certificate detection and judgment.
  • This embodiment is a refinement of step S20 in the first embodiment.
  • a second specific implementation method for the server to obtain the configured SSL certificate path and password is given, including:
  • process file contains preset keywords, construct a syntax tree according to the server.xml file corresponding to the process file;
  • the server obtains the process file in the process information. If the process file is a java or jsvc file, the server parses the process file (also called /proc/$ ⁇ PID ⁇ /cmdline file), and the server determines whether the process file contains " org.apache.catalina.startup.Bootstrap" keyword, where "org.apache.catalina.startup.Bootstrap" is the identification information of the SSL certificate associated information in the java or jsvc file, if the process file does not contain " org.apache.catalina.startup.Bootstrap" keyword, the server determines that the application process does not involve data signature verification, and the server terminates the subsequent SSL certificate detection steps; if the process file contains "org.apache.catalina.startup.Bootstrap" Keyword, the server determines that the application process is the tomcat program.
  • the process file contains "org.apache.catalina.startup.Bo
  • the server searches for the tomcat server.xml file according to the /proc/$ ⁇ PID ⁇ /exe information, the server builds the syntax tree, and the server traverses the syntax tree to obtain Server ⁇ Service ⁇ Connector ⁇ keystoreFile
  • the certificate path and container password are used as the configured SSL certificate path and password. In this embodiment, the time for parsing the configuration file is reduced, and the efficiency of SSL certificate detection and judgment is improved.
  • This embodiment is a refinement of step S20 in the first embodiment.
  • a third specific implementation method for the server to obtain the configured SSL certificate path and password is given, including:
  • the configuration file corresponding to the configuration file path is parsed, and the SSL certificate path corresponding to the path configuration item in the configuration file and the password corresponding to the password configuration item are obtained.
  • the server obtains the process file in the process information. If the process file is an httpd file, that is, the process file contains the keyword "httpd", the server extracts the configuration file path in the process file through httpd -V, and the server parses For the configuration file under the configuration file path, the server finds the configured SSL certificate path and password according to the SSLCertificateFile configuration item. In this embodiment, the time for parsing the configuration file is reduced, and the efficiency of SSL certificate detection and judgment is improved.
  • This embodiment is a step after step S40 in the first embodiment.
  • the difference between this embodiment and the foregoing embodiment lies in:
  • the updated SSL certificate is parsed, the certificate information in the updated SSL certificate is obtained, and the step of verifying the SSL certificate according to the certificate information and outputting the verification result is performed .
  • the user triggers the configuration file update instruction based on the configuration file.
  • the server receives the configuration file update instruction, the server detects the status of the configuration file.
  • the server parses the updated configuration file to obtain the updated configuration file.
  • the server When the server detects the SSL certificate update, the server parses the updated SSL certificate, the server obtains the certificate information in the updated SSL certificate, and executes step S40 in the first embodiment: verifying the SSL certificate according to the certificate information, And output the steps of the verification result.
  • the server when the server detects the configuration file or the SSL certificate update, it automatically parses the configuration file or the SSL certificate to obtain the certificate information of the SSL certificate, so as to realize the flexible detection and verification of the SSL certificate.
  • an embodiment of the present application further provides an SSL certificate verification device, and the SSL certificate verification device includes:
  • the request receiving module 10 is used to obtain the process information of the application process when the SSL certificate verification instruction is received;
  • the first parsing module 20 is configured to obtain the configuration file path in the process information, parse the configuration file corresponding to the configuration file path, and obtain the configured SSL certificate path and password;
  • the second parsing module 30 is configured to decrypt the SSL certificate corresponding to the SSL certificate path according to the password, and obtain certificate information in the SSL certificate;
  • the detection and judgment module 40 is configured to verify the SSL certificate according to the certificate information, and output the verification result.
  • the first analysis module 20 includes:
  • the parameter judgment unit is configured to obtain the process file in the process information, and if the process file is a file of nginx type, judge whether the process file contains preset parameters;
  • the first determining unit is configured to extract the configuration file path in the process file according to the preset parameters if the process file contains preset parameters;
  • the second determining unit is configured to extract the configuration file path in the process file through nginx-v if the preset parameter is not included in the process file;
  • the parsing and obtaining unit is configured to parse the configuration file corresponding to the configuration file path, and obtain the SSL certificate path corresponding to the path configuration item in the configuration file and the password corresponding to the password configuration item.
  • the first analysis module 20 includes:
  • the first determining unit is configured to obtain the process file in the process information, and if the process file is a java or jsvc file, then determine whether the process file contains a preset keyword;
  • a syntax tree construction unit configured to construct a syntax tree according to the server.xml file corresponding to the process file if the process file contains preset keywords;
  • the information obtaining unit is used to query the syntax tree to obtain the SSL certificate path corresponding to the path node in the syntax tree and the password corresponding to the cryptographic node.
  • the first analysis module 20 includes:
  • the second judgment unit is used to obtain the process file in the process information. If the process file is an httpd file, pass httpd -V extract the configuration file path in the process file;
  • the parsing and obtaining unit is configured to parse the configuration file corresponding to the configuration file path, and obtain the SSL certificate path corresponding to the path configuration item in the configuration file and the password corresponding to the password configuration item.
  • the second analysis module 30 includes:
  • a certificate obtaining unit configured to decrypt the SSL certificate corresponding to the SSL certificate path according to the password, and obtain the type of the SSL certificate
  • the first parsing unit is configured to parse the SSL certificate to obtain certificate information through the keystool command when the SSL certificate is of the jks type;
  • the second parsing unit is configured to parse the SSL certificate to obtain certificate information through the openssl command when the SSL certificate is not of the JKS type.
  • the detection and judgment module 40 includes:
  • An extraction judgment unit for extracting the validity period and certificate chain information from the certificate information, and judging whether the SSL certificate is expired according to the validity period;
  • the first output unit is configured to output a verification result that the SSL certificate is invalid if the SSL certificate expires;
  • the standard determination unit that meets the application process is configured to determine whether the SSL certificate meets the standard of the application process according to the certificate chain information if the SSL certificate is not expired;
  • the second output unit is configured to output a verification result that the SSL certificate is invalid if the SSL certificate does not meet the standards of the application process.
  • the SSL certificate verification device includes:
  • the first detection module is configured to, when the configuration file update is detected, parse the updated configuration file to obtain the SSL certificate path and password in the updated configuration file; and execute decryption of the SSL certificate path according to the password A corresponding SSL certificate, and the step of obtaining certificate information in the SSL certificate;
  • the second detection module is configured to, when the SSL certificate update is detected, parse the updated SSL certificate, obtain certificate information in the updated SSL certificate, and perform verification of the SSL certificate according to the certificate information, And output the steps of the verification result.

Landscapes

  • Business, Economics & Management (AREA)
  • Engineering & Computer Science (AREA)
  • Accounting & Taxation (AREA)
  • Finance (AREA)
  • Physics & Mathematics (AREA)
  • Strategic Management (AREA)
  • General Business, Economics & Management (AREA)
  • General Physics & Mathematics (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Development Economics (AREA)
  • Economics (AREA)
  • Marketing (AREA)
  • Technology Law (AREA)
  • Storage Device Security (AREA)

Abstract

本申请涉及金融科技（Fintech）技术领域，本申请公开了一种SSL证书校验方法，该方法包括：在接收到SSL证书校验指令时，获取应用进程的进程信息；获取所述进程信息中的配置文件路径，解析所述配置文件路径对应的配置文件，获得已配置的SSL证书路径和密码；根据所述密码解密所述SSL证书路径对应的SSL证书，并获取所述SSL证书中证书信息；根据所述证书信息对所述SSL证书进行校验，并输出校验结果。本申请还公开了一种SSL证书校验装置、设备及计算机存储介质。

Description

SSL证书校验方法、装置、设备及计算机存储介质
本申请要求于2019年10月24日申请的、申请号为201911017340.4、名称为“SSL证书校验方法、装置、设备及计算机存储介质”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及金融科技（Fintech）技术领域，尤其涉及SSL证书校验方法、装置、设备及计算机存储介质。
 背景技术
随着互联网技术，尤其是互联网金融科技（Fintech）的飞速发展，越来越多的技术（大数据、分布式、区块链Blockchain、人工智能等）应用在金融领域，金融业务的交互场景越来越多。
金融业务交互时交易双方需要使用数字签名来表明自己的身份，并使用数字签名来进行有关的交易操作。部分金融服务中的数字签名为SSL证书，SSL证书过期等原因会造成通信故障，严重时会导致服务不可用从而造成损失，因此需要对SSL证书进行校验。当前SSL证书校验是通过定期扫描的方式，定期扫描对资源的消耗大、缺乏实时性，并且对于需要密码的SSL证书，还需要人工运营一个密码本，也就是说当前SSL证书校验较为麻烦。
 技术解决方案
本申请的主要目的在于提出一种SSL证书校验方法、装置、设备及计算机存储介质，旨在解决当前SSL证书检测验证资源消耗大，不具有实时性和灵活性的技术问题。
为实现上述目的，本申请提供一种SSL证书校验方法，所述SSL证书校验方法包括如下步骤：
在接收到SSL证书校验指令时，获取应用进程的进程信息；
获取所述进程信息中的配置文件路径，解析所述配置文件路径对应的配置文件，获得已配置的SSL证书路径和密码；
根据所述密码解密所述SSL证书路径对应的SSL证书，并获取所述SSL证书中证书信息；
根据所述证书信息对所述SSL证书进行校验，并输出校验结果。
在一实施例中，所述获取所述进程信息中的配置文件路径，解析所述配置文件路径对应的配置文件，获得已配置的SSL证书路径和密码的步骤，包括：
获取所述进程信息中的进程文件，若所述进程文件为nginx类型的文件，则判断所述进程文件中是否包含预设参数；
若所述进程文件中包含预设参数，则根据所述预设参数提取所述进程文件中的配置文件路径；
若所述进程文件中不包含预设参数，则通过nginx-v提取所述进程文件中的配置文件路径；
解析所述配置文件路径对应的配置文件，获取所述配置文件中路径配置项对应的SSL证书路径和密码配置项对应的密码。
在一实施例中，所述获取所述进程信息中的配置文件路径，解析所述配置文件路径对应的配置文件，获得已配置的SSL证书路径和密码的步骤，包括：
获取所述进程信息中的进程文件，若所述进程文件为java类型或jsvc类型的文件，则判断所述进程文件中是否包含预设关键字；
若所述进程文件中包含预设关键字，则根据所述进程文件对应的server.xml文件构建语法树；
查询所述语法树，获得所述语法树中路径节点对应的SSL证书路径和密码节点对应的密码。
在一实施例中，所述获取所述进程信息中的配置文件路径，解析所述配置文件路径对应的配置文件，获得已配置的SSL证书路径和密码的步骤，包括：
获取所述进程信息中的进程文件，若所述进程文件为httpd类型的文件，则通过httpd -V提取所述进程文件中的配置文件路径；
解析所述配置文件路径对应的配置文件，获取所述配置文件中路径配置项对应的SSL证书路径和密码配置项对应的密码。
在一实施例中，所述根据所述密码解密所述SSL证书路径对应的SSL证书，并获取所述SSL证书中证书信息的步骤，包括：
根据所述密码解密所述SSL证书路径对应的SSL证书，并获取所述SSL证书的类型；
在所述SSL证书为jks类型时，则通过keystool命令解析所述SSL证书获得证书信息；
在所述SSL证书不是jks类型时，则通过openssl命令解析所述SSL证书获得证书信息。
在一实施例中，所述根据所述证书信息对所述SSL证书进行校验，并输出校验结果的步骤，包括：
提取所述证书信息中的有效期限和证书链信息，根据所述有效期限判断所述SSL证书是否超期；
若所述SSL证书超期，则输出SSL证书无效的校验结果；
若所述SSL证书没有超期，则根据所述证书链信息判断所述SSL证书是否符合所述应用进程的标准；
若所述SSL证书不符合所述应用进程的标准，则输出SSL证书无效的校验结果。
在一实施例中，所述根据所述证书信息对所述SSL证书进行校验，并输出校验结果的步骤之后，包括：
在检测到所述配置文件更新时，解析更新的配置文件，获得所述更新的配置文件中的SSL证书路径和密码；并执行根据所述密码解密所述SSL证书路径对应的SSL证书，并获取所述SSL证书中证书信息的步骤；
在检测到所述SSL证书更新时，解析更新的SSL证书，获取所述更新的SSL证书中证书信息，并执行根据所述证书信息对所述SSL证书进行校验，并输出校验结果的步骤。
此外，为实现上述目的，本申请还提供一种SSL证书校验装置，所述SSL证书校验装置包括：
请求接收模块，用于在接收到SSL证书校验指令时，获取应用进程的进程信息；
第一解析模块，用于获取所述进程信息中的配置文件路径，解析所述配置文件路径对应的配置文件，获得已配置的SSL证书路径和密码；
第二解析模块，用于根据所述密码解密所述SSL证书路径对应的SSL证书，并获取所述SSL证书中证书信息；
检测判断模块，用于根据所述证书信息对所述SSL证书进行校验，并输出校验结果。
此外，为实现上述目的，本申请还提供一种SSL证书校验设备，所述SSL证书校验设备包括：存储器、处理器及存储在所述存储器上并可在所述处理器上运行的SSL证书校验程序，所述SSL证书校验程序被所述处理器执行时实现如上所述的SSL证书校验方法的步骤。
此外，为实现上述目的，本申请还提供一种计算机可读存储介质，所述计算机可读存储介质上存储有SSL证书校验程序，所述SSL证书校验程序被处理器执行时实现如上所述的SSL证书校验方法的步骤。
本申请提供一种SSL证书校验方法、装置、设备及计算机存储介质。本申请实施例中服务器在接收到SSL证书校验指令时，获取应用进程的进程信息；根据进程信息获取应用进程的配置文件路径，解析配置文件路径对应的配置文件，获得已配置的SSL证书路径和密码；服务器解析SSL证书路径对应的SSL证书，获取SSL证书中证书信息；服务器根据证书信息对SSL证书进行校验，并输出校验结果。本实施例中服务器由进程信息确定配置文件，再由配置文件确定SSL证书，通过对SSL证书解析得到证书信息，以根据证书信息进行SSL证书检测判断，实现了SSL证书实时灵活检测校验，有效地避免了由于SSL证书过期等原因，导致的应用进程终止的情况发生。
 附图说明
图1是本申请实施例方案涉及的硬件运行环境的设备结构示意图；
图2为本申请SSL证书校验方法第一实施例的流程示意图；
图3为本申请SSL证书校验装置一实施例的功能模块示意图。
本申请目的的实现、功能特点及优点将结合实施例，参照附图做进一步说明。
 本发明的实施方式
应当理解，此处所描述的具体实施例仅仅用以解释本申请，并不用于限定本申请。
现有的SSL证书校验是通过定期扫描的方式，定期扫描对资源的消耗大、缺乏实时性，并且对于需要密码的SSL证书，还需要人工运营一个密码本，也就是说当前SSL证书校验较为麻烦，此外，部分用户采用另外一种SSL证书校验方式，即，用户模拟正常客户，通过外网定时访问业务服务，拉取到服务器的SSL证书，然后解析证书内容，判断是否需要进行告警，这样的SSL证书校验方式能够适用于一部分业务场景，但是对于机构与机构之间的这种白名单相互访问的场景，并不适用。
本申请提供了一种SSL证书校验方法，在接收到SSL证书校验指令时，获取应用进程的进程信息；获取所述进程信息中的配置文件路径，解析所述配置文件路径对应的配置文件，获得已配置的SSL证书路径和密码；根据所述密码解密所述SSL证书路径对应的SSL证书，并获取所述SSL证书中证书信息；根据所述证书信息对所述SSL证书进行校验，并输出校验结果。本申请还公开了一种SSL证书校验装置、设备及计算机存储介质。本申请实现了SSL证书实时灵活地检测校验，有效地避免了由于SSL证书过期等原因，导致的应用进程终止的情况发生。
如图1所示，图1是本申请实施例方案涉及的硬件运行环境的设备结构示意图。
本申请实施例SSL证书校验设备可以是PC机或服务器。
如图1所示，该SSL证书校验设备可以包括：处理器1001，例如CPU，网络接口1004，用户接口1003，存储器1005，通信总线1002。其中，通信总线1002用于实现这些组件之间的连接通信。用户接口1003可以包括显示屏（Display）、输入单元比如键盘（Keyboard），可选用户接口1003还可以包括标准的有线接口、无线接口。网络接口1004可选的可以包括标准的有线接口、无线接口（如WI-FI接口）。存储器1005可以是高速RAM存储器，也可以是稳定的存储器（non-volatile memory），例如磁盘存储器。存储器1005可选的还可以是独立于前述处理器1001的存储装置。
本领域技术人员可以理解，图1中示出的设备结构并不构成对设备的限定，可以包括比图示更多或更少的部件，或者组合某些部件，或者不同的部件布置。
如图1所示，作为一种计算机存储介质的存储器1005中可以包括操作***、网络通信模块、用户接口模块以及SSL证书校验程序。
在图1所示的设备中，网络接口1004主要用于连接后台服务器，与后台服务器进行数据通信；用户接口1003主要用于连接客户端（用户端），与客户端进行数据通信；而处理器1001可以用于调用存储器1005中存储的SSL证书校验程序，并执行下述SSL证书校验方法中的操作，在所述处理器上运行的SSL证书校验程序被执行时所实现的方法可参照本申请SSL证书校验方法各个实施例，此处不再赘述。
基于上述硬件结构，提出本申请SSL证书校验方法实施例。
参照图2，图2为本申请SSL证书校验方法第一实施例的流程示意图，所述SSL证书校验方法包括：
步骤S10，在接收到SSL证书校验指令时，获取应用进程的进程信息。
本实施例中的SSL证书校验方法应用于SSL证书校验设备（又叫服务器），服务器接收SSL证书校验指令，SSL证书校验指令的触发方式不作具体限定，即，SSL证书校验指令可以是用户主动触发的，例如，用户在业务节点的显示界面上，输出文字“SSL证书校验”并点击“监测”按键，主动触发SSL证书校验指令，业务节点将SSL证书校验指令发送至服务器，服务器接收SSL证书校验指令；此外，SSL证书校验指令还可以是服务器自动触发的，例如，服务器中预先设置SSL证书校验指令触发条件：执行指定业务，服务器在执行指定业务时，服务器自动触发SSL证书校验指令。
服务器在接收到SSL证书校验指令时，服务器获取各个应用进程的进程信息，进程信息包括进程标识（例如进程名称）、进程相关的进程文件、进程描述信息和进程类型等等。
服务器获取应用进程的进程信息之后，服务器解析应用进程的进程信息，以确定应用进程涉及到的SSL证书，并根据SSL证书的证书内容确定SSL证书的有效性，具体地：
步骤S20，获取所述进程信息中的配置文件路径，解析所述配置文件路径对应的配置文件，获得已配置的SSL证书路径和密码。
服务器获取进程信息，服务器逐个遍历进程信息中/proc/目录下的文件，服务器找到所有/proc/${PID}/exe信息，服务器根据查找到的/proc/${PID}/exe信息确定进程文件的类型，服务器根据进程文件的类型对进程文件进行解析，获取进程文件中的配置文件路径，服务器解析配置文件路径下的配置文件，获得已配置的SSL证书路径和密码。
本实施例中进程文件的类型不作具体限定，例如，进程文件可以是nginx类型、java类型、jsvc类型或者httpd类型等等，具体地：
若进程文件是nginx类型，服务器查询进程文件中-p参数或-c参数对应的配置文件路径conf_file。若进程文件的参数中不包含-p参数或-c参数，则服务器通过nginx -V找到进程文件中配置文件路径。
若进程文件是java类型或者jsvc类型，服务器解析进程文件（又叫/proc/${PID}/cmdline文件），服务器判断进程文件中是否包含"org.apache.catalina.startup.Bootstrap"关键字，若进程文件中不包含"org.apache.catalina.startup.Bootstrap"关键字，服务器确定应用进程不涉及到数据签名校验，服务器终止后续的SSL证书检测步骤；若进程文件中包含"org.apache.catalina.startup.Bootstrap"关键字，服务器判定应用进程为则为tomcat程序，服务器根据/proc/${PID}/exe信息，查找tomcat的server.xml文件，服务器构建语法树，服务器遍历语法树，以获取Server→Service→Connector→keystoreFile | keystorePass（服务器→服务→连接器→密钥存储库|密钥存储库），服务器将进程文件和keystoreFile集合，解析到SSL证书路径，并进一步地根据keystorePass指令找到容器密码，服务器将解析得到的SSL证书路径和容器密码作为已配置的SSL证书路径和密码。
若进程文件是httpd类型，服务器通过 httpd -V配置文件路径，服务器解析配置文件路径下的配置文件，服务器根据SSLCertificateFile  配置项，找到已配置的SSL证书路径和密码。
本实施例中服务器根据进程文件的类型解析进程文件，获取应用进程的配置文件路径，服务器解析配置文件路径对应的配置文件，获得已配置的SSL证书路径和密码，不需要用户人工维护一个密码本，减少了用户的操作，同时服务器灵活地根据SSL证书路径和密码进行SSL证书进行，具体地：
步骤S30，根据所述密码解密所述SSL证书路径对应的SSL证书，并获取所述SSL证书中证书信息。
服务器获取SSL证书路径对应的SSL证书，服务器根据密码对SSL证书进行解密操作，得到解密后的SSL证书，服务器从解密后SSL证书中获取证书信息，具体地，包括：
步骤a1，根据所述密码解密所述SSL证书路径对应的SSL证书，并获取所述SSL证书的类型；
步骤a2，在所述SSL证书为jks类型时，则通过keystool命令解析所述SSL证书获得证书信息；
步骤a3，在所述SSL证书不是jks类型时，则通过openssl命令解析所述SSL证书获得证书信息。
即，服务器获取SSL证书路径对应的SSL证书，服务器根据密码对SSL证书进行解密操作，在SSL证书解密之后，服务器获取SSL证书的类型，若 SSL证书为jks类型时，服务器通过keystool命令解析SSL证书获得证书信息；若SSL证书不是jks类型时（SSL证书为普通类型），服务器通过openssl命令解析SSL证书获得证书信息。
本实施例中，服务器根据SSL证书的类型解析SSL证书，获取SSL证书中的证书信息，以根据证书信息进行有效性判断，具体地：
步骤S40，根据所述证书信息对所述SSL证书进行校验，并输出校验结果。
服务器获取证书信息中的有效期限和证书链信息，服务器将有效期限和证书链信息输入至规则引擎，以判断SSL证书是否有效，具体地，包括：
步骤b1，提取所述证书信息中的有效期限和证书链信息，根据所述有效期限判断所述SSL证书是否超期；
步骤b2，若所述SSL证书超期，则输出SSL证书无效的校验结果；
步骤b3，若所述SSL证书没有超期，则根据所述证书链信息判断所述SSL证书是否符合所述应用进程的标准；
步骤b4，若所述SSL证书不符合所述应用进程的标准，则输出SSL证书无效的校验结果。
即，服务器提取证书信息中的有效期限和证书链信息，证书链信息中记录有证书的授权机构等信息，服务器根据有效期限判断SSL证书是否超期；若SSL证书超期，服务器输出SSL证书无效的校验结果；若SSL证书没有超期，服务器则根据证书链信息判断SSL证书是否符合应用进程的标准；即，服务器按照证书链信息进行追溯，得到SSL证书的签发机构，若SSL证书的签发机构具有业务操作权限，则SSL证书符合应用进程的标准；若SSL证书的签发机构不具有业务操作权限，则SSL证书你符合应用进程的标准，服务器确定SSL证书不符合应用进程的标准时，输出SSL证书无效的校验结果。
可以理解的是，服务器可以根据有效期限和证书链信息设置不同类型的提示，比如，若SSL证书已过期，服务器进行报警；若SSL证书一个月内过期，服务器设置一级提示，若SSL证书三个月内过期，服务器设置一级提示，此外，服务器还可以根据是否为自签名证书，证书的CA是否合法，等设置不同的告警。
本实施例中服务器由进程信息确定配置文件，再由配置文件确定SSL证书，通过对SSL证书解析得到证书信息，以根据证书信息进行SSL证书检测判断，实现了SSL证书实时灵活检测校验，有效地避免了由于SSL证书过期等原因，导致的应用进程终止的情况发生。
进一步地，基于本申请SSL证书校验方法第一实施例，提出了本申请SSL证书校验方法第二实施例。
本实施例是第一实施例中步骤S20的细化，本实施例中给出了第一种服务器获得已配置的SSL证书路径和密码的具体实现方式，包括：
获取所述进程信息中的进程文件，若所述进程文件为nginx类型的文件，则判断所述进程文件中是否包含预设参数；
若所述进程文件中包含预设参数，则根据所述预设参数提取所述进程文件中的配置文件路径；
若所述进程文件中不包含预设参数，则通过nginx-v提取所述进程文件中的配置文件路径；
解析所述配置文件路径对应的配置文件，获取所述配置文件中路径配置项对应的SSL证书路径和密码配置项对应的密码。
即，服务器遍历进程信息，以获取进程信息对应的进程文件，及进程文件的文件类型；若进程文件为nginx类型，服务器则判断进程文件中是否包含预设参数（例如，预设参数为-p参数）；若进程文件中包含预设参数，则根据预设参数确定进程文件中的配置文件路径；例如，服务器获取-p参数对应的配置文件路径；若进程文件中不包含预设参数，则通过nginx-v确定初始配置路径，服务器判断进程文件中是否包含-c参数，若进程文件中不包含-c参数，服务器则将初始配置路径作为配置文件路径；若进程文件中包含-c参数，服务器判定配置文件路径的路径为相对路径，服务器获取-c参数对应的工作路径，服务器将初始配置路径和工作路径拼接作为进程文件中的配置文件路径。
服务器在得到配置文件路径之后，服务器解析配置文件路径对应的配置文件，服务器获取配置文件中路径配置项对应的SSL证书路径和密码配置项对应的密码；本实施例中减少了配置文件解析的时间，提高了SSL证书检测判断的效率。
进一步地，基于本申请SSL证书校验方法上述实施例，提出了本申请SSL证书校验方法第三实施例。
本实施例是第一实施例中步骤S20的细化，本实施例中给出了第二种服务器根据获得已配置的SSL证书路径和密码的具体实现方式，包括：
获取所述进程信息中的进程文件，若所述进程文件为java类型或jsvc类型的文件，则判断所述进程文件中是否包含预设关键字；
若所述进程文件中包含预设关键字，则根据所述进程文件对应的server.xml文件构建语法树；
查询所述语法树，获得所述语法树中路径节点对应的SSL证书路径和密码节点对应的密码。
即，服务器获取进程信息中的进程文件，若进程文件是java类型或者jsvc类型的文件，服务器解析进程文件（又叫/proc/${PID}/cmdline文件），服务器判断进程文件中是否包含"org.apache.catalina.startup.Bootstrap"关键字，其中，"org.apache.catalina.startup.Bootstrap"为java类型或者jsvc类型的文件中SSL证书关联信息的标识信息，若进程文件中不包含"org.apache.catalina.startup.Bootstrap"关键字，服务器确定应用进程不涉及到数据签名校验，服务器终止后续的SSL证书检测步骤；若进程文件中包含"org.apache.catalina.startup.Bootstrap"关键字，服务器判定应用进程为则为tomcat程序，服务器根据/proc/${PID}/exe信息，查找tomcat的server.xml文件，服务器构建语法树，服务器遍历语法树，以获取Server→Service→Connector→keystoreFile | keystorePass（服务器→服务→连接器→密钥存储库|密钥存储库），服务器将进程文件和keystoreFile集合，解析到SSL证书路径，并进一步地根据keystorePass指令找到容器密码，服务器将解析得到的SSL证书路径和容器密码作为已配置的SSL证书路径和密码。本实施例中减少了配置文件解析的时间，提高了SSL证书检测判断的效率。
进一步地，基于本申请SSL证书校验方法上述实施例，提出了本申请SSL证书校验方法第四实施例。
本实施例是第一实施例中步骤S20的细化，本实施例中给出了第三种服务器获得已配置的SSL证书路径和密码的具体实现方式，包括：
获取所述进程信息中的进程文件，若所述进程文件为httpd类型的文件，则通过httpd -V提取所述进程文件中的配置文件路径；
解析所述配置文件路径对应的配置文件，获取所述配置文件中路径配置项对应的SSL证书路径和密码配置项对应的密码。
本实施例中服务器获取进程信息中的进程文件，若进程文件是httpd类型的文件，即，进程文件中包含关键字“httpd”，服务器通过 httpd –V提取进程文件中的配置文件路径，服务器解析配置文件路径下的配置文件，服务器根据SSLCertificateFile配置项，找到已配置的SSL证书路径和密码。本实施例中减少了配置文件解析的时间，提高了SSL证书检测判断的效率。
进一步地，基于本申请SSL证书校验方法上述实施例，提出本申请SSL证书校验方法第五实施例。
本实施例是第一实施例中步骤S40之后的步骤，本实施例与上述实施例的区别在于：
在检测到所述配置文件更新时，解析更新的配置文件，获得所述更新的配置文件中的SSL证书路径和密码；并执行根据所述密码解密所述SSL证书路径对应的SSL证书，并获取所述SSL证书中证书信息的步骤；
在检测到所述SSL证书更新时，解析更新的SSL证书，获取所述更新的SSL证书中证书信息，并执行根据所述证书信息对所述SSL证书进行校验，并输出校验结果的步骤。
本实施例中用户基于配置文件触发配置文件更新指令，服务器接收到配置文件更新指令时，服务器检测配置文件的状态，服务器在检测到配置文件更新时，解析更新的配置文件，获得更新的配置文件中的SSL证书路径和密码；并执行第一实施例中步骤S30：根据所述密码解密所述SSL证书路径对应的SSL证书，并获取所述SSL证书中证书信息。
服务器在检测到SSL证书更新时，服务器解析更新的SSL证书，服务器获取更新的SSL证书中证书信息，并执行第一实施例中步骤S40：根据所述证书信息对所述SSL证书进行校验，并输出校验结果的步骤。
本实施例中服务器在检测到配置文件或者SSL证书更新时，自动地对配置文件或者SSL证书进行解析，得到SSL证书的证书信息，以实现SSL证书的灵活检测校验。
参考图3，本申请实施例还提供一种SSL证书校验装置，所述SSL证书校验装置包括：
请求接收模块10，用于在接收到SSL证书校验指令时，获取应用进程的进程信息；
第一解析模块20，用于获取所述进程信息中的配置文件路径，解析所述配置文件路径对应的配置文件，获得已配置的SSL证书路径和密码；
第二解析模块30，用于根据所述密码解密所述SSL证书路径对应的SSL证书，并获取所述SSL证书中证书信息；
检测判断模块40，用于根据所述证书信息对所述SSL证书进行校验，并输出校验结果。
在一实施例中，所述第一解析模块20，包括：
参数判断单元，用于获取所述进程信息中的进程文件，若所述进程文件为nginx类型的文件，则判断所述进程文件中是否包含预设参数；
第一判定单元，用于若所述进程文件中包含预设参数，则根据所述预设参数提取所述进程文件中的配置文件路径；
第二判定单元，用于若所述进程文件中不包含预设参数，则通过nginx-v提取所述进程文件中的配置文件路径；
解析获取单元，用于解析所述配置文件路径对应的配置文件，获取所述配置文件中路径配置项对应的SSL证书路径和密码配置项对应的密码。
在一实施例中，所述第一解析模块20，包括：
第一判断单元，用于获取所述进程信息中的进程文件，若所述进程文件为java类型或jsvc类型的文件，则判断所述进程文件中是否包含预设关键字；
语法树构建单元，用于若所述进程文件中包含预设关键字，则根据所述进程文件对应的server.xml文件构建语法树；
信息获取单元，用于查询所述语法树，获得所述语法树中路径节点对应的SSL证书路径和密码节点对应的密码。
在一实施例中，所述第一解析模块20，包括：
第二判断单元，用于获取所述进程信息中的进程文件，若所述进程文件为httpd类型的文件，则通过httpd -V提取所述进程文件中的配置文件路径；
解析获取单元，用于解析所述配置文件路径对应的配置文件，获取所述配置文件中路径配置项对应的SSL证书路径和密码配置项对应的密码。
在一实施例中，所述第二解析模块30，包括：
证书获取单元，用于根据所述密码解密所述SSL证书路径对应的SSL证书，并获取所述SSL证书的类型；
第一解析单元，用于在所述SSL证书为jks类型时，则通过keystool命令解析所述SSL证书获得证书信息；
第二解析单元，用于在所述SSL证书不是jks类型时，则通过openssl命令解析所述SSL证书获得证书信息。
在一实施例中，所述检测判断模块40，包括：
提取判断单元，用于提取所述证书信息中的有效期限和证书链信息，根据所述有效期限判断所述SSL证书是否超期；
第一输出单元，用于若所述SSL证书超期，则输出SSL证书无效的校验结果；
符合所述应用进程的标准性判断单元，用于若所述SSL证书没有超期，则根据所述证书链信息判断所述SSL证书是否符合所述应用进程的标准；
第二输出单元，用于若所述SSL证书不符合所述应用进程的标准，则输出SSL证书无效的校验结果。
在一实施例中，所述的SSL证书校验装置，包括：
第一检测模块，用于在检测到所述配置文件更新时，解析更新的配置文件，获得所述更新的配置文件中的SSL证书路径和密码；并执行根据所述密码解密所述SSL证书路径对应的SSL证书，并获取所述SSL证书中证书信息的步骤；
第二检测模块，用于在检测到所述SSL证书更新时，解析更新的SSL证书，获取所述更新的SSL证书中证书信息，并执行根据所述证书信息对所述SSL证书进行校验，并输出校验结果的步骤。
上述各程序模块所执行的方法可参照本申请SSL证书校验方法各个实施例，此处不再赘述。
需要说明的是，在本文中，术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、方法、物品或者***不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种过程、方法、物品或者***所固有的要素。在没有更多限制的情况下，由语句“包括一个……”限定的要素，并不排除在包括该要素的过程、方法、物品或者***中还存在另外的相同要素。
上述本申请实施例序号仅仅为了描述，不代表实施例的优劣。
通过以上的实施方式的描述，本领域的技术人员可以清楚地了解到上述实施例方法可借助软件加必需的通用硬件平台的方式来实现，当然也可以通过硬件，但很多情况下前者是更佳的实施方式。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品存储在如上所述的一个存储介质(如ROM/RAM、磁碟、光盘)中，包括若干指令用以使得一台服务器设备(可以是手机，计算机，服务器，空调器，或者网络设备等)执行本申请各个实施例所述的方法。
以上仅为本申请的优选实施例，并非因此限制本申请的专利范围，凡是利用本申请说明书及附图内容所作的等效结构或等效流程变换，或直接或间接运用在其他相关的技术领域，均同理包括在本申请的专利保护范围内。

Claims (10)

  1. 一种SSL证书校验方法，其中，所述SSL证书校验方法包括如下步骤：
    在接收到SSL证书校验指令时，获取应用进程的进程信息；
    获取所述进程信息中的配置文件路径，解析所述配置文件路径对应的配置文件，获得已配置的SSL证书路径和密码；
    根据所述密码解密所述SSL证书路径对应的SSL证书，并获取所述SSL证书中证书信息；
    根据所述证书信息对所述SSL证书进行校验，并输出校验结果。
  2. 如权利要求1所述的SSL证书校验方法，其中，所述获取所述进程信息中的配置文件路径，解析所述配置文件路径对应的配置文件，获得已配置的SSL证书路径和密码的步骤，包括：
    获取所述进程信息中的进程文件，若所述进程文件为nginx类型的文件，则判断所述进程文件中是否包含预设参数；
    若所述进程文件中包含预设参数，则根据所述预设参数提取所述进程文件中的配置文件路径；
    若所述进程文件中不包含预设参数，则通过nginx-v提取所述进程文件中的配置文件路径；
    解析所述配置文件路径对应的配置文件，获取所述配置文件中路径配置项对应的SSL证书路径和密码配置项对应的密码。
  3. 如权利要求1所述的SSL证书校验方法，其中，所述获取所述进程信息中的配置文件路径，解析所述配置文件路径对应的配置文件，获得已配置的SSL证书路径和密码的步骤，包括：
    获取所述进程信息中的进程文件，若所述进程文件为java类型或jsvc类型的文件，则判断所述进程文件中是否包含预设关键字；
    若所述进程文件中包含预设关键字，则根据所述进程文件对应的server.xml文件构建语法树；
    查询所述语法树，获得所述语法树中路径节点对应的SSL证书路径和密码节点对应的密码。
  4. 如权利要求1所述的SSL证书校验方法，其中，所述获取所述进程信息中的配置文件路径，解析所述配置文件路径对应的配置文件，获得已配置的SSL证书路径和密码的步骤，包括：
    获取所述进程信息中的进程文件，若所述进程文件为httpd类型的文件，则通过httpd -V提取所述进程文件中的配置文件路径；
    解析所述配置文件路径对应的配置文件，获取所述配置文件中路径配置项对应的SSL证书路径和密码配置项对应的密码。
  5. 如权利要求1所述的SSL证书校验方法，其中，所述根据所述密码解密所述SSL证书路径对应的SSL证书，并获取所述SSL证书中证书信息的步骤，包括：
    根据所述密码解密所述SSL证书路径对应的SSL证书，并获取所述SSL证书的类型；
    在所述SSL证书为jks类型时，则通过keystool命令解析所述SSL证书获得证书信息；
    在所述SSL证书不是jks类型时，则通过openssl命令解析所述SSL证书获得证书信息。
  6. 如权利要求1所述的SSL证书校验方法，其中，所述根据所述证书信息对所述SSL证书进行校验，并输出校验结果的步骤，包括：
    提取所述证书信息中的有效期限和证书链信息，根据所述有效期限判断所述SSL证书是否超期；
    若所述SSL证书超期，则输出SSL证书无效的校验结果；
    若所述SSL证书没有超期，则根据所述证书链信息判断所述SSL证书是否符合所述应用进程的标准；
    若所述SSL证书不符合所述应用进程的标准，则输出SSL证书无效的校验结果。
  7. 如权利要求1至6任意一项所述的SSL证书校验方法，其中，所述根据所述证书信息对所述SSL证书进行校验，并输出校验结果的步骤之后，包括：
    在检测到所述配置文件更新时，解析更新的配置文件，获得所述更新的配置文件中的SSL证书路径和密码；并执行根据所述密码解密所述SSL证书路径对应的SSL证书，并获取所述SSL证书中证书信息的步骤；
    在检测到所述SSL证书更新时，解析更新的SSL证书，获取所述更新的SSL证书中证书信息，并执行根据所述证书信息对所述SSL证书进行校验，并输出校验结果的步骤。
  8. 一种SSL证书校验装置，其中，所述SSL证书校验装置包括：
    请求接收模块，用于在接收到SSL证书校验指令时，获取应用进程的进程信息；
    第一解析模块，用于获取所述进程信息中的配置文件路径，解析所述配置文件路径对应的配置文件，获得已配置的SSL证书路径和密码；
    第二解析模块，用于根据所述密码解密所述SSL证书路径对应的SSL证书，并获取所述SSL证书中证书信息；
    检测判断模块，用于根据所述证书信息对所述SSL证书进行校验，并输出校验结果。
  9. 一种SSL证书校验设备，其中，所述SSL证书校验设备包括：存储器、处理器及存储在所述存储器上并可在所述处理器上运行的SSL证书校验程序，所述SSL证书校验程序被所述处理器执行时实现如权利要求1至7中任一项所述的SSL证书校验方法的步骤。
  10. 一种计算机可读存储介质，其中，所述计算机可读存储介质上存储有SSL证书校验程序，所述SSL证书校验程序被处理器执行时实现如权利要求1至7中任一项所述的SSL证书校验方法的步骤。
PCT/CN2020/121224 2019-10-24 2020-10-15 Ssl证书校验方法、装置、设备及计算机存储介质 WO2021078062A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201911017340.4 2019-10-24
CN201911017340.4A CN110766409A (zh) 2019-10-24 2019-10-24 Ssl证书校验方法、装置、设备及计算机存储介质

Publications (1)

Publication Number Publication Date
WO2021078062A1 true WO2021078062A1 (zh) 2021-04-29

Family

ID=69333373

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/121224 WO2021078062A1 (zh) 2019-10-24 2020-10-15 Ssl证书校验方法、装置、设备及计算机存储介质

Country Status (2)

Country Link
CN (1) CN110766409A (zh)
WO (1) WO2021078062A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US12034874B2 (en) 2021-10-10 2024-07-09 International Business Machines Corporation Validating certificates

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110766409A (zh) * 2019-10-24 2020-02-07 深圳前海微众银行股份有限公司 Ssl证书校验方法、装置、设备及计算机存储介质
EP3985532B1 (de) * 2020-10-19 2023-02-22 Siemens Aktiengesellschaft Zertifikatsmanagement für technische anlagen
CN112738206B (zh) * 2020-12-25 2022-08-23 北京浪潮数据技术有限公司 一种分布式集群和云平台的对接方法及组件

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102638346A (zh) * 2012-05-12 2012-08-15 杭州迪普科技有限公司 一种用户数字证书的认证方法及装置
US9077546B1 (en) * 2012-11-27 2015-07-07 Symnatec Corporation Two factor validation and security response of SSL certificates
US9560038B2 (en) * 2014-06-20 2017-01-31 Adobe Systems Incorporated Method and apparatus for verifying an application to authorize content repository access using SSL certificates
CN107493174A (zh) * 2017-09-05 2017-12-19 成都知道创宇信息技术有限公司 基于cdn网络的ssl证书智能绑定与管理方法
CN110766409A (zh) * 2019-10-24 2020-02-07 深圳前海微众银行股份有限公司 Ssl证书校验方法、装置、设备及计算机存储介质

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103634324B (zh) * 2013-12-09 2017-10-31 飞天诚信科技股份有限公司 一种实时监控证书的方法
CN106230602B (zh) * 2016-09-09 2019-05-17 上海携程商务有限公司 数字证书的证书链的完整性检测***及方法
CN108270610A (zh) * 2017-02-16 2018-07-10 广州市动景计算机科技有限公司 数字证书监控的方法与装置
CN108989046B (zh) * 2018-07-18 2021-05-04 成都知道创宇信息技术有限公司 一种ssl证书链自动补全方法
CN110225013B (zh) * 2019-05-30 2021-11-09 世纪龙信息网络有限责任公司 服务证书的监控和更新***

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102638346A (zh) * 2012-05-12 2012-08-15 杭州迪普科技有限公司 一种用户数字证书的认证方法及装置
US9077546B1 (en) * 2012-11-27 2015-07-07 Symnatec Corporation Two factor validation and security response of SSL certificates
US9560038B2 (en) * 2014-06-20 2017-01-31 Adobe Systems Incorporated Method and apparatus for verifying an application to authorize content repository access using SSL certificates
CN107493174A (zh) * 2017-09-05 2017-12-19 成都知道创宇信息技术有限公司 基于cdn网络的ssl证书智能绑定与管理方法
CN110766409A (zh) * 2019-10-24 2020-02-07 深圳前海微众银行股份有限公司 Ssl证书校验方法、装置、设备及计算机存储介质

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
XI, FEIJIAN: "Digital Certificate Principle (HTTPS&SSL)", 22 January 2017 (2017-01-22), pages 1 - 6, XP009527569, Retrieved from the Internet <URL:https://blog.csdn.net/xifeijian/article/details/54668483> *

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US12034874B2 (en) 2021-10-10 2024-07-09 International Business Machines Corporation Validating certificates

Also Published As

Publication number Publication date
CN110766409A (zh) 2020-02-07

Similar Documents

Publication Publication Date Title
CN110493202B (zh) 登录令牌的生成及验证方法、装置和服务器
KR101850677B1 (ko) 웹사이트에 로그인하는 단말기가 모바일 단말기인지를 결정하기 위한 방법 및 시스템
CN110855676B (zh) 网络攻击的处理方法、装置及存储介质
JP4864289B2 (ja) ネットワークユーザ認証システムおよび方法
CN107196950B (zh) 校验方法、装置及服务端
US7571322B2 (en) Enhanced cookie management
US8869258B2 (en) Facilitating token request troubleshooting
WO2021078062A1 (zh) Ssl证书校验方法、装置、设备及计算机存储介质
Miculan et al. Formal analysis of Facebook Connect single sign-on authentication protocol
US11108803B2 (en) Determining security vulnerabilities in application programming interfaces
CN110602052A (zh) 微服务处理方法及服务器
CN111556006A (zh) 第三方应用***登录方法、装置、终端及sso服务平台
US20090031405A1 (en) Authentication system and authentication method
CN111444500A (zh) 鉴权方法、装置、设备及可读存储介质
CN109981680B (zh) 一种访问控制实现方法、装置、计算机设备及存储介质
CN113225351B (zh) 一种请求处理方法、装置、存储介质及电子设备
CN106911684A (zh) 一种鉴权方法及***
CN114338212A (zh) 身份验证令牌管理方法、装置、电子设备及可读存储介质
JP2008015733A (ja) ログ管理計算機
US11729192B2 (en) Malware detection using document object model inspection
CN111371811B (zh) 一种资源调用方法、资源调用装置、客户端及业务服务器
CN113645226A (zh) 一种基于网关层的数据处理方法、装置、设备及存储介质
CN114567446B (zh) 一种登录认证方法、装置、电子设备及存储介质
CN113992734A (zh) 会话连接方法及装置、设备
CN112748960A (zh) 一种进程控制方法、装置、电子设备及存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20879513

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 20879513

Country of ref document: EP

Kind code of ref document: A1