基于域名系统的证书验证系统研究与实现

Research and implementation of certificate validation system based on DNS

为解决当前不同CA(Certificate Authority)间证书验证过程的互操作问题,本文在分析当前证书撤销机制问题的基础上,结合域名系统(Domain Name System,DNS)的referral模式提出了一种新的证书验证系统DNS-OCSP,使用该系统可构建不同CA间统一的证书验证,给出了DNS-OCSP的系统结构,说明了DNS-OCSP的工作流程。该系统具有较好的可存取性和可扩展性。

For solving tile interoperability during current certificate validation process of different CAs, the new system DNS-OCSP was proposed by incorporating DNS-style referral, which can construct a unified certificate validation mechanism between different CAs. Tile architecture of DNS-OCSP was presented, and the workflow of DNS-OCSP was illuminated. It has been shown that the DNS-OCSP is more accessible and sealable.