TWI815750B - Automatic domain verification system, certificate issuance method and computer-readable medium - Google Patents

Abstract

An automatic domain verification system, a certificate issuance method and a computer-readable medium are provided, which perform the automatic verification of the ownership or the right of control of the domain name after receiving a certificate application without manual interaction with the contact window of the applicant, so as to avoid information security problems or certificate mis-issue due to human error.

Description

Automatic domain verification system, certificate issuance method and computer-readable media

The present invention relates to network domain verification technology, and in particular, to an automatic network domain verification system and its corresponding certificate issuance method and computer-readable media.

As the application of multiple cloud services becomes increasingly popular, network security continues to be valued by all parties. Current trust mechanisms are generally maintained under the framework of Web Public Key Infrastructure (Web PKI). Under this architecture, the need for web servers to import PKI has become normal. In order to provide external services, web servers need to set up Secure Sockets Layer (SSL)/Transport Layer Security (TLS). The certificate is in its configuration settings, so the web server needs to apply for an SSL certificate from a legal certificate center.

However, during the certificate issuance process, erroneous certificates may be issued due to human error by the certificate registration verification personnel of the registration center or the verification window of the specific domain verification method. Furthermore, if the erroneous certificate is publicly disclosed by anyone, it will further affect the legitimacy of the certificate center itself, the compliance of the application to join the root certificate program of major browsers, and the results of regularly performed external audits.

At present, the domain verification methods commonly used by SSL certificate users include emailing the domain name contact person, sending the domain name contact person via a constructed email, and Domain Name System (DNS). To change, verify that the applicant is the domain name contact person, send an email to the domain name contact person of the Certification Authority Authorization (CAA) of the domain name system, send an email to the DNS text (TXT) record Domain name contact person, agreed changes to specific web page content, etc. However, the above methods all require manual confirmation. At this time, if there are changes in personnel and the handover is incomplete, it will cause inconvenience. Furthermore, the personnel may perform intentional or unintentional operations when performing the confirmation, which may lead to unexpected errors in the record. Therefore, it is easy to produce erroneous vouchers in the voucher issuance workflow.

In order to solve the above problems, the present invention provides an automatic domain verification system, including: a registration center module for receiving the certificate application file and identity certification information submitted for the web server; a domain verification module for Automatic domain verification is performed based on the certificate application file and the identification information. The automatic domain verification includes the domain name registration information of the web server, the domain name system certificate issuing authority record and/or the domain name system text. Record verification; and the certificate center module is used to issue the terminal entity certificate for the web server based on the certificate application file after the automatic domain verification is successful.

The present invention also provides a certificate issuance method, including: receiving a certificate application file and identity certification information submitted by a web server; performing automatic domain verification based on the certificate application file and the identity certification information, wherein the automatic network domain verification Including the verification of the domain name registration information of the web server, the authorization record of the domain name system certificate issuing authority and/or the domain name system text record; and in After the automatic domain verification is successful, a terminal entity certificate for the web server is issued based on the certificate application file.

The present invention also provides a computer-readable medium, which is used in computers, servers, or electronic devices and stores instructions to execute the above-mentioned certificate issuance method.

This invention is based on the latest version of the domain ownership verification specifications of the Certificate Authority (CA) and the Browser Forum (Browser Forum). In the certificate issuance workflow, when receiving the certificate application request from the SSL certificate user, the network domain Automated verification of name ownership or control to effectively avoid the above-mentioned human risks that lead to information security issues or mis-issuance of certificates.

1: Automatic domain verification system

11:Certificate Center Module

12: Registration center module

13: Verification center module

14:Domain verification module

21:SSL certificate user

22:Registration center verification staff

31:TLS web server

32:Domain Name Server

33:Global domain name query system

41:Certificate Center Database

42: Verification center database

3: Voucher issuance method

S31, S32, S33-a, S33-b, S33-c, S34-a, S34-b, S35-a, S35-b: steps

Figure 1 is a schematic diagram of the architecture and application environment of an automatic domain verification system according to an embodiment of the present invention.

Figure 2 is a schematic flow chart of a voucher issuance method according to an embodiment of the present invention.

Figure 1 is a schematic diagram of the architecture and application environment of the automatic domain verification system 1 according to an embodiment of the present invention. The automatic domain verification system 1 includes a certificate center module 11 , a registration center module 12 , a verification center module 13 and a domain verification module 14 .

In one embodiment, the certificate center module 11 is communicatively connected with the registration center module 12 and the verification center module 13; the registration center module 12 is connected with the certificate center module 11, the verification center module 13 and the domain verification module. Group 14 communication connection; Verification Center Module 13 and Credential Center Module 11, registering The network domain verification module 14 is connected to the registration center module 12 and the verification center module 13 through communication.

In an embodiment, the certificate center module 11, the registration center module 12, the verification center module 13 and the domain verification module 14 can be software, firmware or hardware. If the above module is software or firmware, it may include program instructions and data that can be executed or read by a processing unit, processor, computer or server, and may be installed on the same hardware device or distributed on multiple different hardware devices. Device; if the above module is hardware, it can be a computer, server, or other electronic device including memory and a processing unit or processor with data processing and computing capabilities.

The automatic domain verification system is implemented based on changes in domain application-related information to achieve the goal of automated verification of ownership or control of domain names. In this embodiment, the certificate format of the certificate service application received by the automatic domain verification system 1 is locked to the SSL certificate in the context of Web PKI, but is not limited to a specific SSL certificate category. The current SSL certificate includes Organization Validated , OV) SSL certificate, Personal Validation (Individual Validation, IV) SSL certificate, Domain Validation (DV) SSL certificate and Extended Validation (EV) SSL certificate and other categories.

The certificate center module 11 is used to receive the SSL certificate service application packet verified by the registration center module 12 from the registration center module 12, so as to return the SSL certificate to the registration after executing the certificate application process of the SSL certificate service application packet. Center Module 12. The main functions of the voucher center module 11 include voucher application, voucher revocation, voucher extension, voucher change, etc. In addition, during the voucher service processing process, relevant verification service application packets such as signature verification, certificate format confirmation, and certificate status verification will be submitted to the verification center module 13.

In one embodiment, the certificate center module 11 can issue an Online Certificate Status Protocol (OCSP) response message and a Certificate Revocation List (CRL) to announce the status information of the issuance of the official certificate.

The registration center module 12 is used to receive the SSL certificate service application packet from the SSL certificate user 21, and after executing the identity recognition and authentication verification process of the certificate user, if the application process is successful, it will return the SSL certificate to the SSL certificate user 21. .

The main functions of the registration center module 12 include certificate subject identity verification, certificate service application packet format and content verification, etc. When the relevant verification is completed, the certificate service application packet will be submitted to the certificate center module 11. In addition, the verification service application packets related to signature verification, certificate format confirmation, and certificate status verification in the certificate service processing process will be submitted to the verification center module 13.

In one embodiment, the certificate subject identity verification performed by the registration center module 12 is performed in accordance with the certificate service operating standards set by different certificate centers, and different levels of identity authentication mechanisms are implemented according to different certificate assurance levels.

The verification center module 13 is used to receive verification service application packets such as relevant signature verification, certificate format confirmation, and certificate status verification from the certificate center module 11, the registration center module 12, and the domain verification module 14, so as to process After determining and executing the requested verification service, the verification service processing result is returned to the module that requested the verification service. In addition, the verification center module 13 will also verify and record the domain verification result packet from the domain verification module 14 to complete the binding of the SSL certificate application form and the domain verification result.

In one embodiment, according to different certificate types, the verification center module 13 will apply different certificate format confirmation modes.

The domain verification module 14 is used to receive the domain verification service application packet from the registration center module 12, and provides multiple domain verification services, and complies with the requirements allowed by the certificate center and the browser forum. Various domain ownership verification methods, such as verifying that the applicant is the domain name contact person, agreed changes to specific web page content, changes to the domain name system, and other domain verification services. After determining and executing the requested domain verification service, the domain verification module 14 submits the domain verification service processing result to the verification center module 13 .

In one embodiment, the domain verification module 14 provides an automated verification service of ownership or control of a domain name to avoid manual intervention in the verification window, which may lead to erroneous issuance of certificates.

As shown in Figure 1, users of the automatic domain verification system 1 may include SSL certificate users 21 and registration center verification personnel 22. The SSL certificate user 21 can be an individual or an organization; the systems, servers and databases externally connected to the automatic domain verification system 1 include a TLS web server 31, a domain name server 32, a global domain name query system 33, Certificate center database 41 and/or verification center database 42.

In one embodiment, the SSL certificate user 21 and the registration center verification personnel 22 are connected to the registration center module 12 through communication; the certificate center database 41 is connected through communication to the certificate center module 11; and the verification center database 42 is connected through communication to the verification center module 13. ; In addition, the TLS web server 31, the domain name server 32 and the global domain name query system 33 are all communicatively connected to the domain verification module 14.

FIG. 2 is a schematic flow chart of the certificate issuance method 3 executed by the automatic domain verification system 1 according to an embodiment of the present invention.

First, in order for the SSL certificate user 21 to enable its TLS web server 31 to provide external services, the SSL certificate user 21 needs to set the SSL certificate in the configuration settings of the TLS web server 31 .

Therefore, in order to obtain the SSL certificate, in step S31, the SSL certificate user 21 uses electronic devices such as mobile phones or computers to connect to the web interface of the registration center module 12 of the automatic domain verification system 1 to request certificate services. Through the web interface, after the SSL certificate user 21 agrees to the terms agreed by the user, he submits the certificate application file and identity proof information (such as the scanned ID card of the SSL certificate user 21 and other certification documents). file) is included in the SSL certificate service application packet, and then sent to the registration center module 12 through a secure channel, and the certificate center module 11 is designated as the authorized issuing unit. The certificate application file is signed by the SSL certificate user 21 with a self-produced key (that is, the private key of the SSL certificate user 21), and the certificate application file includes the identity information of the SSL certificate user 21 and the TLS web server 31 Domain name.

Step S32 is the identification and authentication of the certificate subject. In this embodiment, the "certificate subject" refers to the SSL certificate user 21. This step performs the identity recognition and authentication verification process of the SSL certificate user 21 in accordance with the specifications of the certificate service operating standards, which mainly includes certificate subject identity verification, certificate service application packet format and content verification, etc. Among them, the certificate subject identity verification is performed by the registration center The verification personnel 22 manually verify the certificate application file and identity verification information submitted by the SSL certificate user 21, and the verification of the certificate service application packet format and content is automatically performed by the registration center module 12. In addition, the registration center module 12 will generate a corresponding SSL certificate application form based on the certificate application file.

The certificate subject identity verification process varies according to the type of SSL certificate applied for, and will correspond to different identity authentication assurance levels. In addition, the verification service application packets included in the certificate application process, such as signature verification, certificate format confirmation, and certificate status verification, will be submitted by the registration center module 12 to the verification center module 13. When the relevant identity recognition and authentication verification procedures are confirmed to be correct, the registration center module 12 will generate a domain verification service application packet, and submit the domain verification service application packet to the domain after signing it with the private key of the registration center module 12 Verification Module 14.

Step S33 is to perform automated domain verification. This step includes the following three verification mechanisms (or three sub-steps): Verify domain name registration information S33-a (This mechanism is to verify and bind domain hosting information to the return information of the global domain name query system 33 ), verify domain name system certificate issuing authority authorization record S33-b (this mechanism is to verify and bind domain hosting information to domain name system certificate issuing authority authorization record), and verify domain name system TXT record S33- c (This mechanism is for verification And bind the domain hosting information to the domain name system TXT record). The above three verification mechanisms can be executed simultaneously under different execution threads of the domain verification module 14. If any verification mechanism successfully passes, the other two verification mechanisms can be suspended without continuing, and the process can enter the S34-b domain verification success situation. If the above three verification mechanisms fail, the process will enter the S34-a domain verification failure situation. The above three verification mechanisms are explained as follows:

Verify domain name registration information S33-a: The domain verification module 14 uses the public key of the registration center module 12 to verify the domain verification service application packet to confirm that the identity recognition and authentication verification process of the SSL certificate user 21 has been registered The central module 12 processing is completed. At this time, the status of the SSL certificate application form will be converted to domain pending verification. Next, the domain verification module 14 uses the domain name of the TLS web server 31 submitted by the SSL certificate user 21 to query the global domain name query system 33 for the domain name registrant mailbox information of the TLS web server 31. The domain verification module 14 will compare whether the domain name registrant's mailbox information is consistent with the technical contact's mailbox information in the identity certification information of the SSL certificate user 21, and the comparison result will be bound to the SSL certificate application form. At this time, the domain verification module 14 queries the domain name server 32 and the global domain name query system 33 respectively for the domain hosting unit information of the TLS web server 31. Specifically, the domain hosting unit information returned by the global domain name query system 33 is the domain of the domain hosting unit itself. The domain verification module 14 will input the domain into the domain name server 32 to query the URL corresponding to the domain, such as an Internet Protocol address (IP address). If the URL can be queried through the domain name server 32, it means that the domain hosting unit information is a compliant domain. In addition, the domain verification module 14 will check whether the domain hosting organization is a trusted organization. If the domain hosting unit is recorded in the trust list of the automatic domain verification system 1, the domain hosting unit is a trusted unit. If the domain hosting unit information is a compliant domain and the domain hosting unit is a trusted unit, the domain verification module 14 automatically determines that the ownership of the domain of the TLS web server 31 is compliant, that is, the domain hosting unit is a compliant domain. Domain hosting organization Verification of information successful. If the domain name registrant mailbox information of the aforementioned TLS web server 31 is consistent with the technical contact mailbox information of the SSL certificate user 21, and the verification of the domain hosting unit information is successful, the domain verification module 14 automatically determines Verification mechanism S33-a has been successfully passed, eliminating the need for manual verification through the verification window specified by the domain name registrant's mailbox. After the domain verification mechanism S33-a is successfully passed, the status of the SSL certificate application form will enter Verified and Pending Acceptance. Then, the information related to the domain verification result is further bound to the SSL certificate application form. The domain verification module 14 uses its own private key to send the SSL certificate application form (including status information, and the status at this time is verified and pending acceptance. ), the domain name registrant's mailbox information, and the verification results of the domain verification mechanism S33-a are further bound and signed before being submitted to the verification center module 13. After the verification center module 13 experience chapter is correct, the binding result is written into the verification center database 42. Even if the result of the verification mechanism S33-a is failed, the domain verification module 14 will still generate the binding result, and the verification center module 13 will still write the binding result into the verification center data after verifying that the seal is correct. Library 42, the same applies when the other two verification mechanisms S33-b and S33-c below fail. After that, if the SSL certificate application form needs to be re-verified in batches, the binding result previously written into the verification center database 42 can be used, and the status of the SSL certificate application form in the binding result can be used. continue processing without having to start over.

Verify the authorization record of the domain name system certificate issuing authority S33-b: The domain verification module 14 uses the public key of the registration center module 12 to verify the domain verification service application packet to confirm the identity and authentication of the SSL certificate user 21 The procedure has been completed by the registration center module 12. At this time, the status of the SSL certificate application form will be converted to domain pending verification. Next, the domain verification module 14 uses the domain name of the TLS web server 31 submitted by the SSL certificate user 21, and uses the domain information search tool to query the domain setting information of the TLS web server 31, and then obtains the domain name from the TLS web server 31. After filtering out the domain setting information of the documentary segment authorized by the certificate issuing organization, find the authorized contact email of the certificate issuing organization. Information, the domain verification module 14 will compare whether the email address of the authorized contact person of the certificate issuing organization is consistent with the technical contact email information in the identity certificate information of the SSL certificate user 21. The comparison result will be bound to the SSL certificate application form. . At this time, the domain verification module 14 automatically determines whether the ownership of the domain of the TLS web server 31 is compliant, that is, whether the verification of the domain hosting unit information of the TLS web server 31 is successful (the details are the same as the aforementioned verification Mechanism S33-a). If the aforementioned authorized contact mailbox information of the certificate issuing authority is consistent with the technical contact mailbox information of the SSL certificate user 21, and the verification of the domain hosting unit information is successful, the domain verification module 14 automatically determines the verification mechanism S33-b. has been successfully passed, without the need for manual verification through the verification window specified by the email address of the authorized contact person of the certificate issuing authority. After the domain verification mechanism S33-b is successfully passed, the status of the SSL certificate application form will enter Verified and Pending Acceptance. Then, the information related to the domain verification result is further bound to the SSL certificate application form. The domain verification module 14 uses its own private key to send the SSL certificate application form (including status information, and the status at this time is verified and pending acceptance. ), the email address information of the authorized contact person of the certificate issuing agency, and the verification result of the domain verification mechanism S33-b are further bound and signed before being submitted to the verification center module 13. After the experience stamp of the verification center module 13 is correct, the verification result will be bound The determination result is written into the verification center database 42.

Verify the domain name system TXT record S33-c: The domain verification module 14 uses the public key of the registration center module 12 to verify the domain verification service application packet to confirm that the identity identification and authentication verification process of the SSL certificate user 21 has been completed by Registration center module 12 processing is completed. At this time, the status of the SSL certificate application form will be converted to domain pending verification. Next, the domain verification module 14 uses the domain name of the TLS web server 31 submitted by the SSL certificate user 21, and uses the domain information search tool to query the domain setting information of the TLS web server 31 to limit the search verification. After the information is filtered, the setting information of the domain name system TXT documentary segment can be obtained, and then the domain name system TXT record contact mailbox information can be found. The domain verification module 14 will compare it with the domain name system TXT record contact person Whether the mailbox information is consistent with the technical contact person's mailbox information in the identification information of the SSL certificate user 21, the comparison result will be bound to the SSL certificate application form. At this time, the domain verification module 14 automatically determines whether the ownership of the domain of the TLS web server 31 is compliant, that is, whether the verification of the domain hosting unit information of the TLS web server 31 is successful (the details are the same as the aforementioned verification Mechanism S33-a). If the aforementioned domain name system TXT record contact mailbox information is consistent with the technical contact mailbox information of the SSL certificate user 21, and the verification of the domain hosting unit information is successful, the domain verification module 14 automatically determines the verification mechanism S33 -c has been successfully passed, and there is no need to manually verify through the verification window specified by the domain name system TXT record contact mailbox. After the domain verification mechanism S33-c is successfully passed, the status of the SSL certificate application form will enter Verified and Pending Acceptance. Then, the information related to the domain verification result is further bound to the SSL certificate application form. The domain verification module 14 uses its own private key to send the SSL certificate application form (including status information, and the status at this time is verified and pending acceptance. ), the domain name system TXT record contact mailbox information, and the verification results of the domain verification mechanism S33-c are further bound and signed and submitted to the verification center module 13. After the verification center module 13 experience stamp is correct, the The pen binding result is written into the verification center database 42 .

Step S34 is executed by the domain verification module 14, and is divided into two situations, namely domain verification failure S34-a and domain verification success S34-b, or two sub-steps. If the situation is domain verification failure S34-a, that is, global domain name query system 33 return information verification (S33-a), domain name system certificate issuing authority authorization record verification (S33-b), or domain name system The mailbox information comparison result in TXT record verification (S33-c) is inconsistent, or the domain hosting unit information verification fails (that is, the domain hosting unit information is not a compliant domain, or the domain hosting unit is not Trusted organization), the SSL certificate application form will start batch re-verification according to the scheduled time period. If the number of failed re-verifications still fails after reaching the limited number, the process will lead to step S35-a to start. Voucher revocation process. If the situation is domain verification successful S34- b, that is, if at least one of the three domain verification mechanisms S33-a, S33-b and S33-c successfully passes, the process will lead to step S35-b to start the certificate acceptance process.

Step S35 is divided into two sub-steps: the initial voucher revocation process S35-a and the initial voucher acceptance process S35-b. Step S35-a is to enable the certificate revocation process. In this certificate revocation process, the verification center module 13 will notify the certificate center module 11 to revoke the pre-signed certificate of the SSL certificate application form, and is not allowed to retain the SSL certificate application form. personal information. If the SSL certificate application does not have a pre-signed certificate, step S35-a can be omitted.

Step S35-b is the initial voucher acceptance process. First, the domain verification module 14 will notify the certificate center module 11. Then, the certificate center module 11 issues the terminal based on the certificate application file submitted by the SSL certificate user 21 in step S31 and uses the private key of the certificate center module 11. The entity certificate (that is, the SSL certificate applied for by the SSL certificate user 21 in step S31) is then returned to the registration center module 12. After receiving the terminal entity certificate, the registration center module 12 will use the public key of the certificate center module 11 to verify the signature and certificate chain of the certificate center module 11 in the certificate. After passing the verification, the registration center module 12 starts the certificate acceptance process for the SSL certificate user 21 to download the terminal entity certificate and perform final confirmation, such as confirming the type and format of the terminal entity certificate or the identity information in the terminal entity certificate. All are correct. After confirmation, the process of voucher issuance method 3 can be ended. The certificate issuance result will be stored in the certificate center database 41 by the certificate center module 11. In addition, the certificate center module 11 can provide an online certificate status protocol query service for SSL certificate users 21 to query certificate status related information.

The invention also provides a computer-readable medium, such as a memory, a floppy disk, a hard disk or an optical disk. The computer-readable medium can be applied to a computer, a server, an electronic device, or the automatic domain verification system 1 shown in Figure 1, and stores instructions to execute the certificate issuance method 3 shown in Figure 2.

This invention automatically performs automated verification of the ownership or control of a network domain name after receiving a certificate application without having to manually interact with the applicant's contact window. This can avoid human errors that may lead to information security issues or mis-issuance of certificates. . In addition, the present invention can achieve the above purposes and effects without significantly changing the existing certificate service application process.

The above embodiments are only illustrative to illustrate the principles and effects of the present invention, but are not intended to limit the present invention. Anyone with ordinary knowledge in this technical field can modify and change the above embodiments without departing from the spirit and scope of the present invention. Therefore, the protection scope of the present invention should be as listed in the patent application scope described below.

3: Voucher issuance method

S31, S32, S33-a, S33-b, S33-c, S34-a, S34-b, S35-a, S35-b: steps

Claims (10)

An automated domain verification system that includes: The registration center module is used to receive certificate application files and identity proof information submitted for the web server; The domain verification module is used to perform automatic domain verification based on the certificate application file and the identity certification information. The automatic domain verification includes the domain name registration information of the web server and the domain name system certificate issuing authority. Verification of authorization records and/or domain name system text records; and The certificate center module is used to issue a terminal entity certificate for the web server based on the certificate application file after the automatic domain verification is successful. The automatic domain verification system as described in request item 1, wherein if at least one of the domain name registration information, the domain name system certificate issuing authority record and/or the domain name system text record passes verification , then the domain verification module determines that the automatic domain verification is successful. The automatic domain verification system as described in request item 1, wherein the verification of the domain name registration information includes: Use the domain name of the web server included in the certificate application file to query the domain name registrant information of the web server; and Compare the domain name registrant information with the technical contact information in the identity certification information to bind the domain name registrant information and the result of the comparison to the application form of the terminal entity certificate. The automatic domain verification system as described in request item 1, wherein the verification of the domain name system certificate issuing authority's authorization record includes: Use the domain name of the web server included in the certificate application file to query the authorized contact information of the certificate issuing authority in the domain setting information of the web server; and Compare the authorized contact person information of the certificate issuing institution with the technical contact information in the identity certification information to bind the authorized contact person information of the certificate issuing institution and the result of the comparison to the application form of the terminal entity certificate. The automatic domain verification system as described in request 1, wherein the verification of the domain name system text record includes: Use the domain name of the web server included in the certificate application file to query the domain name system text record contact information in the domain configuration information of the web server; and Compare the domain name system textual record contact information with the technical contact information in the identification information to bind the domain name system textual record contact information and the result of the comparison to the application for the terminal entity certificate single. The automatic domain verification system as described in request item 1, wherein the automatic domain verification includes: Query the global domain name query system for information about the domain hosting unit of the web server; Determine whether the information is a compliant domain; and Determine whether the domain hosting organization is a trusted organization. The automatic domain verification system as described in request item 1, wherein the domain verification module is reused to combine the application form of the terminal entity certificate, the technical contact information that has passed the automatic domain verification, and the automatic domain After the verification result is bound, it is signed with the private key to generate a binding result, and the automatic domain verification system includes: The verification center module is used to verify the binding result, and after the seal verification is correct, write the binding result into the database. The automatic domain verification system as described in request item 7, wherein the domain verification module is reused in the domain name registration information, the domain name system certificate issuing authority authorization record, or the domain name system text When the recorded verification fails, the time period is set according to the schedule to perform re-verification of the automatic domain verification based on the status information of the application form in the binding result in the database. A method of issuing certificates, including: Receive certificate application files and identity proof information submitted for the web server; Automatic domain verification is performed based on the certificate application file and the identity certificate information. The automatic domain verification includes the domain name registration information of the web server, the domain name system certificate issuing agency authorization record and/or the domain name. Verification of system text records; and After the automatic domain verification is successful, a terminal entity certificate for the web server is issued based on the certificate application file. A computer-readable medium, used in computers, servers, or electronic devices, stores instructions to execute the certificate issuance method described in claim 9.

Images