对短期证书方案的改进及其实现

Improved Design of Short-lived Certificates Solution

文章对短期证书方案在安全性、灵活性和证书失效管理方面存在的问题进行了分析，提出了一种改进方案，用固定证书体现员工角色及其固定职责，在Ｉｎｔｒａｎｅｔ外使用临时证书提高安全性，利用目录服务进行证书失效和访问控制管理。

The problems in short-lived certificate solution in respect of security, mobility and certificate revocation are analyzed in this paper. An improved solution is presented,in which long-lived certificate is used inside Intranet to identify employee role and responsibility, short-lived certificate is used outside Intranet to improve security, and directory service is used to achieve the management of certificate revocation and access control information.