github-starred/frp

Fork 0

mirror of https://github.com/fatedier/frp.git synced 2026-05-15 08:05:49 -06:00

[GH-ISSUE #2489] tls-only is always true if tls_trusted_ca_file is set #1977

New issue

Closed

opened 2026-05-05 13:16:27 -06:00 by gitea-mirror · 3 comments

gitea-mirror commented

2026-05-05 13:16:27 -06:00

Owner

Originally created by @trananhtuan on GitHub (Jul 21, 2021).
Original GitHub issue: https://github.com/fatedier/frp/issues/2489

[REQUIRED] hat version of frp are you using

Version: 0.37.0

[REQUIRED] What operating system and processor architecture are you using
OS: Windows, Linux
CPU architecture: x86

[REQUIRED] description of errors
If tls_trusted_ca_file is set, server will reject non-TLS connections despite both tls_only and tls_enable are set to false.

I want TLS to be optional. When setting tls_enable = true and tls_only = false on frps.ini, client should be able to connect with tls_enable is either true or false.

confile

server:

[common]
bind_addr = 0.0.0.0
bind_port = 7000
vhost_http_port = 8080
log_level = trace

tls_only = false

tls_enable = false
#tls_cert_file = certs-local/server.crt
#tls_key_file = certs-local/server.key
tls_trusted_ca_file = certs-local/ca.crt

client:

[common]
server_addr = 127.0.0.1
server_port = 7000
log_level = debug
protocol = tcp

tls_enable = false

[web]
type = http
local_ip = 127.0.0.1
local_port = 80
custom_domains = localhost

log file

server:

D:\frp_0.37.0_windows_amd64>frps -c frps.ini
2021/07/21 11:13:28 [I] [root.go:200] frps uses config file: frps.ini
2021/07/21 11:13:28 [I] [service.go:192] frps tcp listen on 0.0.0.0:7000
2021/07/21 11:13:28 [I] [service.go:235] http service listen on 0.0.0.0:8080
2021/07/21 11:13:28 [I] [root.go:209] frps started successfully
2021/07/21 11:13:32 [T] [service.go:396] start check TLS connection...
2021/07/21 11:13:32 [W] [service.go:400] CheckAndEnableTLSServerConnWithTimeout error: non-TLS connection received on a TlsOnly server

client:

D:\frp_0.37.0_windows_amd64>frpc -c frpc.ini
2021/07/21 11:17:58 [W] [service.go:104] login to server failed: EOF
EOF

Steps to reproduce the issue

In frps.ini: set tls_trusted_ca_file value. Set tls_only and tls_enable to false.
In frpc.ini set tls_enable: false.
Start server and client. Server will reject non-tls connections.

Supplementary information

Can you guess what caused this issue

Checklist:

I included all information required in the sections above
I made sure there are no duplicates of this report (Use Search)

Originally created by @trananhtuan on GitHub (Jul 21, 2021). Original GitHub issue: https://github.com/fatedier/frp/issues/2489     **[REQUIRED] hat version of frp are you using**  Version: 0.37.0 **[REQUIRED] What operating system and processor architecture are you using** OS: Windows, Linux CPU architecture: x86 **[REQUIRED] description of errors** If `tls_trusted_ca_file` is set, server will reject non-TLS connections despite both `tls_only` and `tls_enable` are set to `false`. I want TLS to be optional. When setting `tls_enable = true` and `tls_only = false` on frps.ini, client should be able to connect with `tls_enable` is either `true` or `false`. **confile**  server: ``` [common] bind_addr = 0.0.0.0 bind_port = 7000 vhost_http_port = 8080 log_level = trace tls_only = false tls_enable = false #tls_cert_file = certs-local/server.crt #tls_key_file = certs-local/server.key tls_trusted_ca_file = certs-local/ca.crt ``` client: ``` [common] server_addr = 127.0.0.1 server_port = 7000 log_level = debug protocol = tcp tls_enable = false [web] type = http local_ip = 127.0.0.1 local_port = 80 custom_domains = localhost ``` **log file**  server: ``` D:\frp_0.37.0_windows_amd64>frps -c frps.ini 2021/07/21 11:13:28 [I] [root.go:200] frps uses config file: frps.ini 2021/07/21 11:13:28 [I] [service.go:192] frps tcp listen on 0.0.0.0:7000 2021/07/21 11:13:28 [I] [service.go:235] http service listen on 0.0.0.0:8080 2021/07/21 11:13:28 [I] [root.go:209] frps started successfully 2021/07/21 11:13:32 [T] [service.go:396] start check TLS connection... 2021/07/21 11:13:32 [W] [service.go:400] CheckAndEnableTLSServerConnWithTimeout error: non-TLS connection received on a TlsOnly server ``` client: ``` D:\frp_0.37.0_windows_amd64>frpc -c frpc.ini 2021/07/21 11:17:58 [W] [service.go:104] login to server failed: EOF EOF ``` **Steps to reproduce the issue** 1. In frps.ini: set `tls_trusted_ca_file` value. Set `tls_only` and `tls_enable` to `false`. 2. In frpc.ini set `tls_enable: false`. 3. Start server and client. Server will reject non-tls connections. **Supplementary information** **Can you guess what caused this issue** **Checklist**:  - [x] I included all information required in the sections above - [x] I made sure there are no duplicates of this report [(Use Search)](https://github.com/fatedier/frp/issues?q=is%3Aissue)

gitea-mirror

2026-05-05 13:16:27 -06:00

closed this issue
added the
lifecycle/stale
label

gitea-mirror commented

2026-05-05 13:16:29 -06:00

Author

Owner

@fatedier commented on GitHub (Jul 21, 2021):

It's designed to be used in this way.

We add tls_only for compatible reason and it maybe removed in future release. If you enable TLS，it will reject all nonTLS connections.

@fatedier commented on GitHub (Jul 21, 2021): It's designed to be used in this way. We add `tls_only` for compatible reason and it maybe removed in future release. If you enable TLS，it will reject all nonTLS connections.

gitea-mirror commented

2026-05-05 13:16:30 -06:00

Author

Owner

@trananhtuan commented on GitHub (Jul 21, 2021):

But why? TLS is cool but certificate management is a burden, and performance might be an issue. I would rather to enable TLS only for plain http traffic and leave everything else unencrypted. This way I can use nginx with certificates to further protect traffic serving from vhost.

@trananhtuan commented on GitHub (Jul 21, 2021): But why? TLS is cool but certificate management is a burden, and performance might be an issue. I would rather to enable TLS only for plain http traffic and leave everything else unencrypted. This way I can use nginx with certificates to further protect traffic serving from vhost.

gitea-mirror commented

2026-05-05 13:16:31 -06:00

Author

Owner

@github-actions[bot] commented on GitHub (Aug 21, 2021):

Issues go stale after 30d of inactivity. Stale issues rot after an additional 7d of inactivity and eventually close.

@github-actions[bot] commented on GitHub (Aug 21, 2021): Issues go stale after 30d of inactivity. Stale issues rot after an additional 7d of inactivity and eventually close.