mirror of
https://github.com/fatedier/frp.git
synced 2026-05-15 08:05:49 -06:00
[GH-ISSUE #2000] 开启tls only失败，读取证书问题 #1591
Labels
No labels
In Progress
WIP
WaitingForInfo
bug
doc
duplicate
easy
enhancement
future
help wanted
invalid
lifecycle/stale
need-issue-template
need-usage-help
no plan
proposal
pull-request
question
todo
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/frp#1591
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @limaofu on GitHub (Sep 22, 2020).
Original GitHub issue: https://github.com/fatedier/frp/issues/2000
Originally assigned to: @yuyulei on GitHub.
C:\Users\Administrator\Documents\frp_0.34.0_windows_amd64>frpc.exe -c frpc.ini
2020/09/22 09:53:17 [W] [service.go:102] login to server failed: x509: certificate
relies on legacy Common Name field, use SANs or temporarily enable
Common Name matching with GODEBUG=x509ignoreCN=0
x509: certificate relies on legacy Common Name field, use SANs or temporarily
enable Common Name matching with GODEBUG=x509ignoreCN=0
@limaofu commented on GitHub (Sep 22, 2020):
客户端：
[common]
server_addr =s.qq.com
server_port = 9833
token = 18xxxx6xx
tls_enable = true
tls_cert_file = c.qq.com.crt
tls_key_file = c.qq.com.key
tls_trusted_ca_file = frp_ca.crt
[testTls]
type = tcp
local_ip = 127.0.0.1
local_port = 3389
remote_port = 9844
@limaofu commented on GitHub (Sep 22, 2020):
0.34.0的新版本，
@limaofu commented on GitHub (Sep 22, 2020):
客户端证书
@limaofu commented on GitHub (Sep 22, 2020):
证书都是v3的版本，客户端和服务端的证书都是由同一ca去签名的。客户端本地也做了hosts指向s.qq.com到服务端ip，但服务端没有指向c.qq.com到客户端ip,因为客户端没有公网ip
@blizard863 commented on GitHub (Sep 22, 2020):
这个我测试下。
@blizard863 commented on GitHub (Sep 22, 2020):
可以提供下 frps 的日志。
@limaofu commented on GitHub (Sep 22, 2020):
客户端日志：
[W] [service.go:102] login to server failed: x509: certificate
relies on legacy Common Name field, use SANs or temporarily enable
Common Name matching with GODEBUG=x509ignoreCN=0
x509: certificate relies on legacy Common Name field, use SANs or temporarily
enable Common Name matching with GODEBUG=x509ignoreCN=0
@fatedier commented on GitHub (Sep 22, 2020):
@limaofu 执行 frpc 的时候加上提示的环境变量吧，
GODEBUG=x509ignoreCN=0，这个是 go1.15 的变化。relies on legacy Common Name field这个方式后面会逐渐废弃。@fatedier commented on GitHub (Sep 22, 2020):
@yuyulei
@limaofu commented on GitHub (Sep 22, 2020):
OK了，加了环境变量名GODEBUG值为x509ignoreCN=0然后就行了。
不过要求使用证书里的域名，然后不是真实的域名的话，要在本地添加hosts文件解析
@fatedier commented on GitHub (Sep 22, 2020):
@limaofu 恩，这个问题我们再看一下，感觉可能是之前签证书的方法不规范，在新版本 go 里面开始不支持了。
@zzustu commented on GitHub (Sep 22, 2020):
如果不配环境变量，自签证书，怎么签才不报错呀
@yuyulei commented on GitHub (Sep 23, 2020):
CommonName 在 2000 年的时候已经开始废弃。RFC 6125 把 CommonName 作为一个可选项，关于使用方式详见：https://tools.ietf.org/html/rfc6125#section-6.4.4，与之前 go 版本处理方式是一致的。如果生成证书的时候没有提供其他Identity信息（比如说，DNS-ID, SRV-ID, URI-ID等），最后会选取 CommonName。
但是在最新 1.15 版本里面，官方正式废弃了 CommonName，也正是因此出现了上述报错。
x509: certificate relies on legacy Common Name field, use SANs or temporarily enable Common Name matching with GODEBUG=x509ignoreCN=0稍后，我们会在文档中心给一个证书生成示例。
@zzustu commented on GitHub (Sep 23, 2020):
NICE
@yuyulei commented on GitHub (Sep 23, 2020):
文档链接：https://gofrp.org/docs/features/common/network/network-tls/
@limaofu commented on GitHub (Sep 23, 2020):
使用了带san扩展的证书后，去掉GODEBUG环境变量，也成功了