首页Home 产品Product 解决方案Solutions 资源Resources 关于我们About 联系我们Contact
申请演示Request Demo
证书自动化:发现 · 签发 · 部署 · 验证Certificate automation: discover · issue · deploy · verify

让每一张证书
都自动续期、自动部署、可审计
Make every certificate discovered, renewed, deployed, and audited

护词(HuKey)是面向企业的证书全生命周期自动化平台:自动发现网络中的每一张证书,统一对接 ACME、Microsoft AD CS 与离线 CA 签发,推送到服务器与网络设备并验证生效,彻底告别证书过期事故。同一平台也提供机密与密钥管理能力。HuKey is an enterprise certificate lifecycle automation platform: it discovers every certificate on your network, issues through ACME, Microsoft AD CS and offline CAs, deploys to servers and network devices and verifies the result — ending certificate-expiry outages. Secrets and key management are available on the same platform.

4 类
证书发现来源Certificate discovery sources
15 分钟min
SSH 证书有效期SSH certificate lifetime
<30 分钟min
证书批量轮换耗时Bulk certificate rotation time
01 证书发现 · 持续扫描Certificate Discovery · Scanning
02 自动续期Auto-renewal
03 审计日志 · 已同步Audit Log · Synced
HUKEY / CERT-LIFECYCLE / SCHEMATIC-01
受金融、政企与云原生行业客户信赖 Trusted across finance, government & cloud-native industries
国有银行State-Owned Bank 省级政务云Provincial Gov. Cloud 电信运营商Telecom Operator 智能制造集团Manufacturing Group 互联网医疗平台Health-Tech Platform 跨境支付平台Cross-Border Payments
核心能力Core Capabilities

从发现到验证,证书全程自动化From discovery to verification — certificates, automated

先看见,再签发,再部署,最后验证。每一步都有审批、变更窗口与审计记录。See it, issue it, deploy it, verify it — with approvals, change windows and an audit record at every step.

01

证书发现Certificate Discovery

网络扫描、加密套件扫描、证书透明度(CT)监控与 Nessus 结果导入,四类来源持续发现影子证书、即将过期与弱算法证书,并按严重程度排序。Network scans, cipher scans, Certificate Transparency monitoring and Nessus import — four sources that surface shadow, expiring and weak-algorithm certificates, ranked by severity.

Network ScanCT LogsNessus
02

多源签发Multi-source Issuance

对接 ACME(DigiCert、Let’s Encrypt)、Microsoft AD CS 与离线 CA,也可使用内置 CA;沿用你现有的 PKI,无需推倒重来。Connect ACME (DigiCert, Let’s Encrypt), Microsoft AD CS and offline CAs, or use the built-in CA — keep your existing PKI, no rip-and-replace.

ACMEAD CSOffline CA
03

部署与验证Deploy & Verify

通过设备插件完成预检、备份、安装与重载,并确认设备已使用新证书;失败自动回滚。Device plugins run preflight, backup, install and reload, then confirm the device serves the new certificate — rolling back on failure.

PluginsRollback
04

审批与变更窗口Approvals & Change Windows

续期前锁定设备、走审批、等变更窗口,再执行,避免证书更换变成一次新的事故。Lock the devices, get approval and wait for the change window before executing — so a renewal never becomes a new incident.

ApprovalChange Window
05

安全设计Secure by Design

SSH 证书仅 15 分钟有效;代理不开放入站端口;敏感变更需第二位管理员确认;全部操作留痕。SSH certificates last 15 minutes; agents open no inbound ports; sensitive changes need a second admin; every action is logged.

SSH CAAudit

机密与密钥管理Secrets & Key Management

同一平台支持机密存储、加密即服务、身份访问控制,以及动态机密与 AI Agent 身份令牌。The same platform offers secret storage, encryption as a service and identity-based access control, with dynamic secrets and AI-agent identity tokens supported too.

SecretsEaaS
工作方式How it works

为什么选择 HuKeyWhy teams choose HuKey

HuKey 把发现、签发、部署和验证串成一条受控的自动化流水线,对接你已有的 CA 与设备,而不是要求你重建 PKI。HuKey chains discovery, issuance, deployment and verification into one controlled automation pipeline that works with the CAs and devices you already have — not a rebuilt PKI.

  • 闭环自动化:发现、续期、部署、验证,无需逐台手工替换Closed-loop automation: discover, renew, deploy, verify — no device-by-device manual swaps
  • 兼容现有 CA:ACME、Microsoft AD CS、离线 CA 与内置 CAWorks with your CAs: ACME, Microsoft AD CS, offline CAs and a built-in CA
  • 支持私有化部署,数据不出域;信创环境适配推进中On-premises deployment keeps data in your domain; Xinchuang adaptation in progress
  • 提供 API,便于接入 CI/CD 与现有运维自动化API available for CI/CD and existing operations automation
1 · 计划并锁定1 · Plan & lock — 锁定目标设备lock the target devices
↓
2 · 审批2 · Approval
↓
3 · 变更窗口3 · Change window
↓
4 · 签发4 · Issue — ACME · AD CS · 离线 CA · 内置 CAoffline CA · built-in CA
↓
5 · 部署5 · Deploy — 预检 · 备份 · 安装 · 重载preflight · backup · install · reload
↓ 确认设备已使用新证书confirm the new certificate is served
6 · 验证6 · Verify
↓
通过 → 8 · 关闭并释放锁;失败 → 7 · 回滚pass → 8 · close & release locks; fail → 7 · rollback
LLM / Agent 运行时LLM / Agent Runtime
↓ 申请令牌requests a token
HuKey 身份令牌引擎HuKey Identity Token Engine — 颁发永久或一次性令牌issues permanent or one-time tokens
↓ 携带令牌调用token-scoped call
工具调用 · 其他 Agent · A2A / MCP 协议Tool calls · other agents · A2A / MCP protocols
↓ 全程审计continuously audited
统一身份审计与即时吊销Unified identity audit & instant revocation
AI 安全AI Security

让每一个 AI Agent 都拥有可信身份Give every AI agent a verifiable identity

大模型与自动化 Agent 正在成为新的"特权用户"——它们调用工具、访问数据、与其他 Agent 协作决策。HuKey 作为统一的令牌保险库,为每一个 LLM、Agent 与工具调用颁发并托管身份凭据,无论是 A2A(Agent-to-Agent)协作还是工具调用(Tool Calling)场景,都能做到可信、可控、可审计。LLMs and autonomous agents are becoming a new class of privileged user — calling tools, accessing data, and coordinating with other agents. HuKey acts as a unified token vault, issuing and custodying identity credentials for every LLM, agent, and tool call — so A2A (agent-to-agent) collaboration and tool-calling stay trusted, controlled, and auditable.

  • 支持永久身份令牌与一次性(Just-in-Time)令牌,按场景选择最小权限凭据Issues both permanent identity tokens and one-time, just-in-time tokens — matching credential scope to each scenario's minimum privilege
  • 覆盖 A2A 协作、MCP / 工具调用、RAG 数据访问等主流 Agent 集成模式Covers A2A collaboration, MCP / tool-calling, and RAG data access — the mainstream agent integration patterns
  • 令牌绑定精细化 ACL 与命名空间,防止 Agent 权限蔓延与越权调用Tokens are bound to fine-grained ACLs and namespaces, preventing agent privilege sprawl and out-of-scope calls
  • 完整记录每一次 Agent 身份签发、使用与吊销,满足 AI 治理与审计要求Logs every agent credential issuance, use, and revocation — supporting AI governance and audit requirements
A2A MCP Tool Calling LLM Runtime 一次性令牌One-Time Token
部署与高可用Deployment & High Availability

本地站点高可用,无需外部数据库Local-site high availability, no external database

3 节点nodes
主备集群,Raft 复制Active/standby cluster, Raft-replicated
0
外部数据库依赖,无需 Postgres / etcdExternal database dependencies — no Postgres or etcd
1.5–3 s
故障切换时间Failover time
6 小时h
自动备份周期Automatic backup interval
行业解决方案Industry Solutions

面向重点行业的证书与密钥安全方案Certificate and key security for regulated industries

从金融到政企、从电信到云原生,HuKey 提供贴合场景的落地方案。From finance to government, telecom to cloud-native — HuKey adapts to how each industry actually operates.

金融行业Financial Services

满足金融行业证书与密钥管理的高可用、高合规要求。Meets the high-availability and compliance bar for certificate and key management in finance.

政企与政务云Government & Public Cloud

支持信创环境私有化部署,满足数据不出域与国产化要求。On-premises deployment for Xinchuang environments, meeting data-sovereignty and localization requirements.

云原生 / DevOpsCloud-Native / DevOps

与 Kubernetes、CI/CD 流水线集成,证书自动签发续期,机密不落盘。Integrates with Kubernetes and CI/CD pipelines — automated certificate issuance and renewal, secrets never written to disk.

电信与运营商Telecom & Carriers

大规模终端与网元证书的集中发现、签发、轮换与生命周期管理。Centralized discovery, issuance, rotation, and lifecycle management for certificates across massive device and network-element fleets.

查看完整解决方案View All Solutions→
生态合作Partner Ecosystem

分销商与经销商,共建安全生态Distributor and reseller partners, building the ecosystem together

HuKey 通过分销商与经销商,把证书与密钥安全能力带给更多企业客户。HuKey reaches more enterprise customers through its distributor and reseller partners.

分销商Distributor
Exclusive Networks

Exclusive Networks

全球网络安全专业增值分销商,业务覆盖 50 多个国家,可服务 170 多个国家和地区,拥有 3,000 多名网络安全专业人员;香港办公室位于九龙观塘。A global cybersecurity specialist and value-added distributor with offices in 50+ countries, able to serve customers in 170+ countries, and 3,000+ cybersecurity professionals. Its Hong Kong office is in Kwun Tong, Kowloon.

  • HuKey 在香港市场的分销合作伙伴HuKey’s distribution partner for the Hong Kong market
  • 连接 HuKey 与区域内的渠道经销商Connects HuKey with channel resellers across the region
访问官网Visit website→
经销商Reseller
KBQuest

KBQuest

成立于 2000 年的全球数字化转型咨询公司,在香港、洛杉矶与上海设有枢纽,专注云计算、数据分析、生成式 AI 与网络安全,服务全球企业客户。Founded in 2000, KBQuest is a global digital transformation consulting firm with hubs in Hong Kong, Los Angeles, and Shanghai — focused on cloud, analytics, generative AI, and cybersecurity for enterprise clients worldwide.

  • 联合为企业客户提供云安全与证书管理集成方案Joint cloud security and certificate-management integration for enterprise clients
  • 覆盖香港、洛杉矶与上海市场Coverage across Hong Kong, Los Angeles, and Shanghai

成为合作伙伴Become a Partner

加入 HuKey 合作伙伴生态,成为经销商,与我们共同拓展市场、服务更多企业客户。Join the HuKey partner ecosystem as a reseller and grow the market together with us.

联系我们Contact Us

"引入 HuKey 后,我们将证书过期引发的生产事故降为零,密钥轮换从人工操作变成了全自动流程。" "After adopting HuKey, certificate-expiry incidents in production dropped to zero, and key rotation went from a manual chore to a fully automated process."

技术负责人Head of Engineering · 某金融科技公司(案例信息已做匿名化处理)A fintech company (anonymized case reference)
安全与合规Security & Compliance

安全设计与合规路径Security by design & compliance roadmap

认证与评测事项为规划中,具体进度以官方发布为准。Certifications and evaluations below are on our roadmap — refer to official announcements for current status.

MLPS 等保三级
评测中Under evaluation
信创兼容认证Xinchuang Compatibility
适配中In adaptation
双人审批Two-person approval
敏感变更需第二位管理员Second admin for sensitive changes
<1 季度quarter

CVE 修复承诺CVE Remediation Commitment

作为一家专注软件与软件支持服务的公司,我们承诺:针对中危(Medium)及以上级别的 CVE 漏洞,为所有客户在一个季度内提供修复方案。As a company focused on software and software support, we commit to delivering a fix for every CVE rated Medium or above, for all clients, within one quarter.

准备好告别证书过期事故了吗?Ready to end certificate-expiry outages?

预约一次演示,看看 HuKey 如何发现你网络中的每一张证书,并自动完成续期与部署。Book a demo to see how HuKey finds every certificate on your network and automates renewal and deployment.