当证书过期时，将数字证书从服务器更新到许多客户端的最佳方法是什么？
我的一位朋友正在处理与更新过期数字证书相关的问题。
他正在开发 Java 应用程序（我猜是 Swings），该应用程序有 4000 个客户端。所有这些都需要数字证书才能连接到应用程序，并且该证书每年都会过期。 年底，他需要更新所有客户的证书凭据。目前，这是手动过程，通过本地或远程连接到 4000 个系统中的每一个来完成。
他的任务是将这个过程转换为自动化过程。
One of my friend is working on issue related to updating expired digital certificates.
He is working on Java application(Swings I guess), which has 4000 clients. All those need a digital certificate to connect to the application and this certificate expires every year.
At the end of year he needs to update the certificate credentials for all clients. Currently this is manual process, done by connecting to each of 4000 systems either locally or by remote connection.
He is got task to convert this process to be an automated process.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
通常，客户端证书（用于在服务器上验证客户端身份）需要物理地传递给客户端（在运营商上），否则，如果证书通过电子渠道发送，则存在很高的拦截风险。但如果使用安全连接，那么问题就变得不那么严重了。
因此，答案取决于客户端应用程序的构建方式。最简单的方法是添加直接从应用程序刷新证书（在过期之前）的功能。应用程序将从服务器请求新的证书。
如果没有内置此类功能并且无法添加它们，那么答案将取决于客户端应用程序存储用于身份验证的证书的位置。如果是某个文件，那么使用某些自动化工具自动进行远程桌面连接将是唯一的选择。
Normally the client-side certificate (used by authenticating the client on the server) needs to be passed to the client physically (on the carrier), otherwise, if the certificate is sent via electronic channels, there's a high risk of interception. But if secure connection is used, then the problem becomes less critical.
So the answer depends on how the client-side application is built. The easiest approach would be to add capabilities to refresh the certificate (before it expires) right from the application. The application would request fresh certificate from the server.
If no such capabilities are built-in and there's no way to add them, then the answer would depend on where the client-side application stores the certificate, used for authentication. If it's some file, then automating remote desktop connection using some automation tool would be the only choice.