[GH-ISSUE #2799] autocert support

gitea-mirror commented

2026-05-05 13:26:21 -06:00

Owner

Copy link

Originally created by @tcurdt on GitHub (Feb 14, 2022).
Original GitHub issue: https://github.com/fatedier/frp/issues/2799

Describe the feature request

A public facing https port needs a cert. It would be nice if the cert could automatically be obtained from letsencrypt.

Describe alternatives you've considered

I guess one could use caddy as another proxy in front - but that is less than ideal. It would be better to integrate

https://go-acme.github.io/lego/usage/library/

Affected area

Docs
Installation
Performance and Scalability
Security
User Experience
Test and Release
Developer Infrastructure
Client Plugin
Server Plugin
Extensions
Others

Originally created by @tcurdt on GitHub (Feb 14, 2022). Original GitHub issue: https://github.com/fatedier/frp/issues/2799 ### Describe the feature request A public facing https port needs a cert. It would be nice if the cert could automatically be obtained from letsencrypt. ### Describe alternatives you've considered I guess one could use caddy as another proxy in front - but that is less than ideal. It would be better to integrate https://go-acme.github.io/lego/usage/library/ ### Affected area - [X] Docs - [ ] Installation - [ ] Performance and Scalability - [ ] Security - [ ] User Experience - [X] Test and Release - [ ] Developer Infrastructure - [X] Client Plugin - [X] Server Plugin - [X] Extensions - [ ] Others

gitea-mirror added the

todo

label 2026-05-05 13:26:21 -06:00

gitea-mirror commented

2026-05-05 13:26:23 -06:00

Author

Owner

Copy link

@fatedier commented on GitHub (Feb 15, 2022):

Can you describe more about your configures?

@fatedier commented on GitHub (Feb 15, 2022): Can you describe more about your configures?

gitea-mirror commented

2026-05-05 13:26:24 -06:00

Author

Owner

Copy link

@tcurdt commented on GitHub (Feb 15, 2022):

Let's say I have a http service on the LAN and I want to expose that via https on the a public machine.

I guess one could use frp to create a tunnel and then use e.g. caddy as a reverse proxy to that. Or maybe use cert-manager in DNS mode to obtain letsencrypt certs. Both not ideal.

It seems frp already supports TLS - so why not support getting the cert via acme directly?

@tcurdt commented on GitHub (Feb 15, 2022): Let's say I have a http service on the LAN and I want to expose that via https on the a public machine. I guess one could use `frp` to create a tunnel and then use e.g. `caddy` as a reverse proxy to that. Or maybe use `cert-manager` in DNS mode to obtain letsencrypt certs. Both not ideal. It seems `frp` [already supports TLS](https://github.com/fatedier/frp#enable-https-for-local-https-service) - so why not support getting the cert via acme directly?

gitea-mirror commented

2026-05-05 13:26:25 -06:00

Author

Owner

Copy link

@fatedier commented on GitHub (Feb 15, 2022):

That makes sense.

I plan to support it in frp v2. Usage of HTTPS will be refactored future.

If it's easy to implement, i will add this in current release.

@fatedier commented on GitHub (Feb 15, 2022): That makes sense. I plan to support it in frp v2. Usage of HTTPS will be refactored future. If it's easy to implement, i will add this in current release.

gitea-mirror commented

2026-05-05 13:26:26 -06:00

Author

Owner

Copy link

@almereyda commented on GitHub (Sep 21, 2022):

In case one wanted to adopt implementation strategies from other approaches, there is boringproxy.io, which reuses caddyserver/certmagic for the task.

@almereyda commented on GitHub (Sep 21, 2022): In case one wanted to adopt implementation strategies from other approaches, there is [boringproxy.io](https://boringproxy.io/), which reuses [caddyserver/certmagic](https://github.com/caddyserver/certmagic) for the task.

gitea-mirror commented

2026-05-05 13:26:26 -06:00

Author

Owner

Copy link

@dest1n1s commented on GitHub (Aug 11, 2024):

Any progress on this? It'd be nice if frp supports automatic certificate renewal since it's cumbersome to have the certificates renewed on the relay server and then move them to the host.

@dest1n1s commented on GitHub (Aug 11, 2024): Any progress on this? It'd be nice if `frp` supports automatic certificate renewal since it's cumbersome to have the certificates renewed on the relay server and then move them to the host.

gitea-mirror commented

2026-05-05 13:26:27 -06:00

Author

Owner

Copy link

@trajche commented on GitHub (Dec 25, 2025):

@fatedier I took a stab at this over here: https://github.com/trajche/frp

It works but frpc proxies must be set to http. It does not use the ACME wildcard (DNS verification), only web server one.

I added "feature gates" as a concept to server too to enable this so it doesn't cause issues with the rest.

@trajche commented on GitHub (Dec 25, 2025): @fatedier I took a stab at this over here: https://github.com/trajche/frp It works but frpc proxies must be set to http. It does not use the ACME wildcard (DNS verification), only web server one. I added "feature gates" as a concept to server too to enable this so it doesn't cause issues with the rest.

gitea-mirror commented

2026-05-05 13:26:27 -06:00

Author

Owner

Copy link

@bbplatforma commented on GitHub (Mar 24, 2026):

Hi. Can this together be addressed, frps then will be near perfect :)

https://github.com/fatedier/frp/issues/2946

@bbplatforma commented on GitHub (Mar 24, 2026): Hi. Can this together be addressed, frps then will be near perfect :) https://github.com/fatedier/frp/issues/2946

No Branch/Tag specified