自动化证书管理国际标准和前沿研究综述

李龙鑫; 闫峥; 王海光; 李铁岩

doi:10.11959/j.issn.2096-109x.AQ24264

您当前的位置：

首页 >

文章列表页 >

自动化证书管理国际标准和前沿研究综述

综述 | 更新时间：2026-05-11

- 自动化证书管理国际标准和前沿研究综述
- Overview of international standards and cutting-edge research on automated certificate management
- 网络与信息安全学报 2026年12卷第2期页码：1-21
- 作者机构：
  
  1.西安电子科技大学广州研究院，广东广州 510555
  2.西安电子科技大学网络与信息安全学院，陕西西安 710126
  3.华为技术有限公司可信技术实验室谢尔德实验室，新加坡 486035
- 作者简介：
  
  [ "李龙鑫（2000- ），男，西安电子科技大学硕士生，主要研究方向为网络安全、区块链、公钥基础设施证书管理等。" ]
  [ "闫峥（1972- ），女，博士，西安电子科技大学教授、博士生导师，主要研究方向为信任管理、可信AI、隐私保护、网络安全等。" ]
  [ "王海光（1973- ），男，博士，华为技术有限公司高级研究员，主要研究方向为5G/6G网络安全技术、可信网络、公钥基础设施证书管理等。" ]
  [ "李铁岩（1971- ），男，博士，华为技术有限公司高级技术专家，主要研究方向为网络安全、数字身份与数据空间安全等。" ]
- 基金信息：
  
  国家自然科学基金(U23A20300;62072351)
- DOI：10.11959/j.issn.2096-109x.AQ24264
  中图分类号： TP393
- 收稿：2025-10-26，
  
  修回：2026-02-26，
  
  纸质出版：2026-04-25
- 稿件说明：
移动端阅览
李龙鑫, 闫峥, 王海光, 等. 自动化证书管理国际标准和前沿研究综述[J]. 网络与信息安全学报, 2026, 12(2): 1-21.

Li Longxin, Yan Zheng, Wang Haiguang, et al. Overview of international standards and cutting-edge research on automated certificate management[J]. Chinese Journal of Network and Information Security, 2026, 12(2): 1-21.
李龙鑫, 闫峥, 王海光, 等. 自动化证书管理国际标准和前沿研究综述[J]. 网络与信息安全学报, 2026, 12(2): 1-21. DOI： 10.11959/j.issn.2096-109x.AQ24264.

Li Longxin, Yan Zheng, Wang Haiguang, et al. Overview of international standards and cutting-edge research on automated certificate management[J]. Chinese Journal of Network and Information Security, 2026, 12(2): 1-21. DOI： 10.11959/j.issn.2096-109x.AQ24264.

摘要

随着全球数字化浪潮的推进，全球网民数量和互联网服务访问量激增。与此同时，钓鱼邮件、网络窃听和身份伪造等网络攻击行为也日益增多，严重威胁互联网的生态安全。为解决这一问题，公钥基础设施被广泛用于构建互联网通信双方之间的信任关系。近年来，随着公钥证书需求量的激增，证书管理效率低成为核心瓶颈。自动证书管理技术的出现，标志着公钥基础设施进入一个新的发展阶段，提升了公钥证书管理的效率，推动了互联网安全加密通信的普及。然而，目前尚未有综述对自动化证书管理相关研究进行系统性讨论和总结。为此，围绕自动化证书管理环境（ACME）技术的发展情况展开全面调研，对自动化证书管理技术的相关国际标准和学术研究等文献（涵盖2019年至今的相关标准和学术研究等文献）进行了梳理，呈现了自动化证书管理技术的发展时间线，并对现有文献进行了分类和归纳。此外，提出了一套针对自动化证书管理研究的评价体系，涵盖功能性、安全性、可用性和性能4个维度。基于这一评价体系，对相关研究工作进行了分析与对比。最后，探讨了现有自动化证书管理技术的主要问题和未来的研究方向。

Abstract

With the advancement of global digitalization

there has been a significant increase in the number of internet users and internet service traffic worldwide. Concurrently

cyber-attack behaviors such as phishing emails

network eavesdropping

and identity forgery have become more prevalent

posing severe threats to Internet security. To address this issue

public key infrastructure is widely used to establish a trust relationship between the two parties of internet communication. In recent years

with the surge in the demand for public key certificates

the efficiency of certificate management has become a core bottleneck. The emergence of automatic certificate management technology marks the entry of public key infrastructure into a new stage of development

improving the efficiency of public key certificate management and promoting the popularization of secure encrypted communication on the internet. However

there is currently no comprehensive review that systematically discusses and summarizes the research related to automatic certificate management. Therefore

a comprehensive investigation was conducted on the development of ACME technology

and the relevant international standards and academic research on automatic certificate management technologies (covering relevant standards and academic research from 2019 to the present) were sorted out. The development timeline of automatic certificate management technology was presented

and the existing literature was classified and summarized. In addition

a set of evaluation system for automatic certificate management research was proposed

covering four dimensions: functionality

security

usability

and performance. Based on this evaluation system

the related research work was analyzed and compared. Finally

the main problems of the existing automatic certificate management technologies and future research directions were discussed.

关键词

Keywords

references

Krombholz K , Mayer W , Schmiedecker M , et al . "I have no idea what I'm doing": on the usability of deploying HTTPS [C ] // Proceedings of the 26th USENIX Conference on Security Symposium (SEC'17) . Berkeley : USENIX Association , 2017 : 1339 - 1356 .

Khan S , Luo F , Zhang Z J , et al . A survey on X.509 public-key infrastructure, certificate revocation, and their modern implementation on blockchain and ledger technologies [J ] . IEEE Communications Surveys & Tutorials , 2023 , 25 ( 4 ): 2529 - 2568 .

Kohnfelder L M . Towards a practical public-key cryptosystem [D ] . Cambridge : Massachusetts Institute of Technology , 1978 .

X . 509(11/88): The directory-authentication framework [S ] .

Aas J , Barnes R , Case B , et al . Let’s Encrypt: an automated certificate authority to encrypt the entire web [C ] // Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security . New York : ACM , 2019 : 2473 - 2487 .

Kfoury E F , Khoury D , Alsabeh A , et al . A blockchain-based method for decentralizing the ACME protocol to enhance trust in PKI [C ] // Proceedings of the 2020 43rd International Conference on Telecommunications and Signal Processing (TSP) . Piscataway : IEEE Press , 2020 : 461 - 465 .

Mueller T , Michalek A . Let'’s create! automated certificate management for end-users [C ] // Proceedings of the 2021 International Conference on Software, Telecommunications and Computer Networks (SoftCOM) . Piscataway : IEEE Press , 2021 : 1 - 6 .

Khoury D , Balian P , Kfoury E . Implementation of blockchain domain control verification (B-DCV) [C ] // Proceedings of the 2022 45th International Conference on Telecommunications and Signal Processing (TSP) . Piscataway : IEEE Press , 2022 : 17 - 22 .

Sujatanagarjuna A , Bochem A , Leiding B . Formalizing and safeguarding blockchain-based BlockVoke protocol as an ACME extension for fast certificate revocation [J ] . Cryptography , 2022 , 6 ( 4 ): 63 .

ITU . Proposal for new work item X .dpki-acme: framework and methodologies for the automation of domain name certificate management based on DLT: ITU-T SG17[EB ] . 2023 .

3GPP. 3rd generation partnership project; technical specification group services and system aspects; study on automated certificate management in service-based architecture (SBA) (Release 18): 3GPP TR 33.876 [R ] . 2023 .

Morales D A C , Wazan A S , Chadwick D W , et al . Enhancing the ACME protocol to automate the management of all X.509 web certificates [M ] // ICT systems security and privacy protection . Cham : Springer Nature Switzerland , 2024 : 265 - 278 .

Newman Z . Reducing trust in automated certificate authorities via proofs-of-authentication [PP ] . ( 2023-07-17 )[ 2025-10-26 ] . arXiv: arXiv. 2307 . 08201 .

Giron A A , Schardong F , Perin L P , et al . Automated issuance of post-quantum certificates: a new challenge [M ] // Applied cryptography and network security . Cham : Springer Nature Switzerland , 2024 : 3 - 23 .

Rivest R L . Can we eliminate certificate revocation lists? [M ] // Financial cryptography . Berlin, Heidelberg : Springer , 1998 : 178 - 183 .

Jimenez-Peris R , Patino-Martinez M , Alonso G , et al . How to select a replication protocol according to scalability, availability and communication overhead [C ] // Proceedings 20th IEEE Symposium on Reliable Distributed Systems . Piscataway : IEEE Press , 2001 : 24 - 33 .

Gallais A , Carle J , Simplot-Ryl D , et al . Localized sensor area coverage with low communication overhead [J ] . IEEE Transactions on Mobile Computing , 2008 , 7 ( 5 ): 661 - 672 .

Wendlandt D , Andersen D G , Perrig A . Perspectives: improving SSH-style host authentication with multi-path probing [C ] // Proceedings of the USENIX 2008 Annual Technical Conference (ATC'08) . Berkeley : USENIX Association , 2008 : 321 - 334 .

Garba A , Bochem A , Leiding B . BlockVoke-fast, blockchain-based certificate revocation for PKIs and the web of trust [M ] // Information security . Cham : Springer International Publishing , 2020 : 315 - 333 .

Guillou L C , Quisquater J J . A practical zero-knowledge protocol fitted to security microprocessor minimizing both transmission and memory [M ] // Advances in Cryptology-EUROCRYPT’88 . Berlin : Springer , 1988 : 123 - 128 .

Newman Z , Meyers J S , Torres-Arias S . Sigstore: software signing for everybody [C ] // Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security . New York : ACM , 2022 : 2353 - 2367 .

Bernstein D J , Lange T . Post-quantum cryptography [J ] . Nature , 2017 , 549 ( 7671 ): 188 - 194 .

Stebila D , Mosca M . Post-quantum key exchange for the Internet and the open quantum safe project [M ] // Selected Areas in Cryptography-SAC 2016 . Cham : Springer International Publishing , 2017 : 14 - 37 .

Sedlmeir J , Smethurst R , Rieger A , et al . Digital identities and verifiable credentials [J ] . Business & Information Systems Engineering , 2021 , 63 ( 5 ): 603 - 613 .

Shor P W . Algorithms for quantum computation: discrete logarithms and factoring [C ] // Proceedings 35th Annual Symposium on Foundations of Computer Science . Piscataway : IEEE Press , 1994 : 124 - 134 .

刘峰 , 杨杰 , 齐佳音 . 区块链密码学隐私保护技术综述 [J ] . 网络与信息安全学报 , 2022 , 8 ( 4 ): 29 - 44 .

Liu F , Yang J , Qi J Y . Survey on blockchain privacy protection techniques in cryptography [J ] . Chinese Journal of Network and Information Security , 2022 , 8 ( 4 ): 29 - 44 .

唐海波 , 张焕 , 张召 , 等 . 区块链分片技术研究进展 [J ] . 软件学报 , 2025 , 36 ( 3 ): 1040 - 1064 .

Tang H B , Zhang H , Zhang Z , et al . Research progress on blockchain sharding technology [J ] . Journal of Software , 2025 , 36 ( 3 ): 1040 - 1064 .

蔡振华 , 林嘉韵 , 刘芳 . 区块链存储: 技术与挑战 [J ] . 网络与信息安全学报 , 2020 , 6 ( 5 ): 11 - 20 .

Cai Z H , Lin J Y , Liu F . Blockchain storage: technologies and challenges [J ] . Chinese Journal of Network and Information Security , 2020 , 6 ( 5 ): 11 - 20 .

苗美霞 , 武盼汝 , 王贇玲 . 密码累加器研究进展及应用 [J ] . 西安电子科技大学学报 , 2022 , 49 ( 1 ): 78 - 91 .

Miao M X , Wu P R , Wang Y L . Research progress and applications of cryptographic accumulators [J ] . Journal of Xidian University , 2022 , 49 ( 1 ): 78 - 91 .

浏览量

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

基于区块链的高透明度PKI认证协议

基于改进PBFT算法的PKI跨域认证方案