雷池/LeCDN使用证书ID而非域名进行证书替换更新,前端重新编译 - #542
Open
sweetsky123 wants to merge 4 commits into
Open
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
在LeCDN中,使用证书ID进行更新的好处是:更新证书后,所有绑定该证书的域名/站点都会一起替换,不需要一个一个站点替换证书,减少出错率和大量部署时间。AllinSSL的原逻辑是一个一个站点进行替换,并且每次替换时都需要重新登录,如图:

多个站点需要重复登录多次,比如我拥有四个站点四个不同子域但共用同一个泛域名证书时,部署这四个站点AllinSSL就需要重复登录四次,导致可能登录会被拦截致使执行失败,如图:


多个站点多次登录的设计行不通。
所以为了确保”一次登录,全部操作“,我对LeCDN的逻辑和前端进行了修改,这也是为什么我前端要重新编译的原因。
在修改后的逻辑为通过将指定ID的证书进行替换从而让绑定该证书的域名的证书进行全部替换,从而实现”一次登录,全部操作“,同时支持多个证书ID同时替换,通过逗号(无空格)进行连接,如333,334,335,如图:
接下来是雷池WAF


后端通过 siteName(站点名称) 查询站点,再通过查询到的站点读取站点现有的 cert_id(证书ID) ,再通过证书ID更新;前端也只暴露了 siteName(站点名称)。这点只要仅仅通过查找日志就很容易看出来:
那么,为什么要多此一举呢?直接让用户填证书ID进行替换不就好了
修改后:
可能会有人问雷池的证书ID在哪里看?在雷池中可以至通用设置——控制台管理——雷池控制台证书中查看证书ID,这点忘记在前端标注了
