证书发现Certificate Discovery
01 · 先找出全部证书，再谈管理Find every certificate first
很多证书过期事故源于"没人知道它存在"。HuKey 通过四类来源持续发现证书，并按严重程度排序，把盲区变成待办清单。Many expiry outages start with a certificate nobody knew existed. HuKey discovers certificates from four sources and ranks the findings by severity, turning blind spots into a work list.
网络扫描Network Scan扫描指定网段与端口，识别正在提供服务的证书Scans chosen ranges and ports for certificates in active use
加密套件扫描Cipher Scan识别弱协议、弱算法与不合规的 TLS 配置Flags weak protocols, weak algorithms and non-compliant TLS settings
证书透明度（CT）监控Certificate Transparency Monitoring监控公共 CT 日志，发现为你的域名签发的未知证书Watches public CT logs for unknown certificates issued for your domains
Nessus 结果导入Nessus Import导入既有漏洞扫描结果，复用已有资产数据Imports existing scan results to reuse the asset data you already have
发现试用Discovery Trial试用许可可在界面中查看最多 50 张证书，快速评估网络现状A trial licence shows up to 50 certificates so you can assess your estate quickly
多源签发Multi-source Issuance
02 · 对接你已有的 CAWorks with the CAs you already use
HuKey 不强迫你更换 CA。公共 CA、Windows 域 CA、离线 CA 与内置 CA 在同一流程中统一管理，证书到期前自动触发续期。HuKey does not force you to change CAs. Public CAs, Windows domain CAs, offline CAs and the built-in CA are managed in one workflow, with renewal triggered automatically before expiry.
ACMEACME对接 DigiCert、Let’s Encrypt 等，基于 ACMEv2 自动申请与续期DigiCert, Let’s Encrypt and others over ACMEv2 for automated request and renewal
Microsoft AD CSMicrosoft AD CS通过 Windows 代理对接域内 CA，代理以组托管服务账户运行，无需保存 AD 密码Reach your domain CA through a Windows agent that runs as a group-managed service account — no AD password stored
离线 CAOffline CA支持离线根/中间 CA 的申请—签发—上传流程，如香港邮政 e-Cert 等Request, sign and upload workflow for offline CAs such as Hongkong Post e-Cert
内置 CABuilt-in CA内置多级 CA，可用于内部服务证书的签发A built-in multi-tier CA for internal service certificates
到期预警与清单Expiry Alerts & Inventory集中证书清单，临近到期主动提醒A central inventory with proactive alerts as expiry approaches
部署、验证与回滚Deploy, Verify & Roll Back
03 · 八步受控续期流程An eight-step controlled renewal
续期不是签发完就结束。HuKey 先锁定设备、走审批、等变更窗口，再签发并部署，确认设备确实使用了新证书后才关闭流程；任何一步失败都会回滚。Renewal does not end at issuance. HuKey locks the devices, gets approval and waits for the change window, then issues and deploys — and only closes once the device actually serves the new certificate. Any failed step rolls back.
计划与锁定Plan & Lock续期前锁定目标设备，避免并发变更Target devices are locked before renewal to prevent concurrent changes
审批与变更窗口Approval & Change Window审批通过并进入变更窗口后才执行Execution starts only after approval and inside the change window
部署Deploy预检、备份、安装、重载服务Preflight, backup, install and reload the service
验证Verify确认设备返回的是新证书序列号Confirms the device serves the new certificate serial number
回滚与关闭Rollback & Close部署或验证失败即回滚；成功后释放锁并关闭Deploy or verify failures roll back; on success the locks are released and the run closes
设备与平台支持Device & Platform Support
04 · 持续扩展的支持清单A continuously expanding support list
HuKey 通过设备插件，把公共 CA、企业 CA 或内部 CA 签发的证书自动部署到以下终端与应用平台，实现从签发到生效的全链路自动化续期。HuKey deploys certificates from public, enterprise or internal CAs to the endpoints and platforms below through device plugins — automating renewal from issuance to activation.
NginxApache HTTP ServerApache TomcatWindows IISF5 BIG-IP LTMHillstone StoneOSImpervaA10FortigatePalo AltoIBM HTTP Server (AIX)IBM MQ (AIX)IBM WebSphereOracle WebLogicMicrosoft ExchangeAD FS
// 支持清单持续更新，如需新增设备类型请联系我们// SUPPORT LIST CONTINUOUSLY UPDATED — CONTACT US TO REQUEST A NEW DEVICE TYPE
安全设计与审计Security Design & Audit
05 · 默认收紧的攻击面A deliberately small attack surface
证书平台本身也是高价值目标。HuKey 从短期凭据、最小网络暴露到双人规则逐层收紧，并记录每一次操作。A certificate platform is itself a high-value target. HuKey tightens it from short-lived credentials and minimal network exposure to two-person rules, and records every operation.
15 分钟 SSH 证书15-minute SSH Certificates运维访问使用短期 SSH 证书，到期自动失效Operator access uses short-lived SSH certificates that expire on their own
代理不开放入站端口No Inbound Agent Ports扫描与 Windows 代理主动向平台发起 HTTPS 连接Scan and Windows agents connect out to the platform over HTTPS
双人规则Two-person Rule敏感变更需第二位管理员确认Sensitive changes require confirmation from a second admin
全量审计Full Audit Trail记录请求方、时间、对象与结果Logs who, when, what and the outcome
日志转发与报表Log Forwarding & Reports支持转发至 SIEM，生成合规报表Forward to SIEM and generate compliance reports
机密与密钥管理Secrets & Key Management
06 · 同一平台提供，按需启用Available on the same platform, as needed
证书之外，HuKey 也可集中管理机密与密钥，覆盖存储、加密服务、动态机密与 AI Agent 身份。Beyond certificates, HuKey can centrally manage secrets and keys — covering storage, encryption services, dynamic secrets and AI-agent identity.
机密存储与访问控制Secret Storage & Access Control集中加密存储，基于策略与命名空间授权Centralized encrypted storage with policy- and namespace-based authorization
加密即服务Encryption as a Service通过 API 加解密、签名与验签，支持国密与国际算法Encrypt, sign and verify over an API, with national and international algorithms
动态机密Dynamic Secrets按需生成数据库、云平台凭据，租约到期自动吊销On-demand database and cloud credentials revoked automatically at lease expiry
AI Agent 身份令牌AI Agent Identity Tokens为 LLM 与 Agent 签发永久或一次性令牌，覆盖 A2A 与 MCP 场景Permanent or one-time tokens for LLMs and agents across A2A and MCP scenarios
API 与自动化API & AutomationREST API，便于接入 CI/CDREST API for CI/CD integration
本地站点高可用Local-site High Availability
07 · 无需外部数据库的三节点集群A three-node cluster with no external database
面向私有化部署的高可用设计：三节点主备，数据经 Raft 复制，无需 Postgres 或 etcd。High availability designed for on-premises deployments: three nodes in active/standby with Raft-replicated data and no Postgres or etcd.
主备与自动切换Active/Standby Failover故障切换约 1.5–3 秒Failover in about 1.5–3 seconds
自动备份Automatic Backups每 6 小时自动备份Automatic backups every 6 hours
访问入口Access Endpoint内置虚拟 IP，或使用客户自有负载均衡Built-in virtual IP, or your own load balancer