[GH-ISSUE #2957] x509: certificate signed by unknown authority (possibly because of "x509: cannot verify signature: insecure algorithm SHA1-RSA (temporarily override with GODEBUG=x509sha1=1)" while trying to verify candidate authority certificate "exam…

gitea-mirror commented

2026-05-05 13:31:16 -06:00

Owner

Originally created by @Yellowpal on GitHub (May 28, 2022).
Original GitHub issue: https://github.com/fatedier/frp/issues/2957

Bug Description

根据文档https://gofrp.org/docs/features/common/network/network-tls/ 生成证书，只改了server生成时的IP地址，客户端启动就报这个错。没找到有人遇到这个问题，是我的证书生成有问题？

frpc Version

0.41.0

frps Version

0.41.0

System Architecture

linux/amd64

Configurations

frpc.ini
[common]
server_addr = xxxxxx
server_port = 7001
protocol = kcp
tls_enable = true
tls_cert_file = client.crt
tls_key_file = client.key
tls_trusted_ca_file = ca.crt

frps.ini
[common]
bind_port = 7001
kcp_bind_port = 7001
log_file = /tmp/frp.log
tls_cert_file = /usr/local/frp/ca/server.crt
tls_key_file = /usr/local/frp/ca/server.key
tls_trusted_ca_file = /usr/local/frp/ca/ca.crt
tls_enable = true

Logs

2022/05/28 19:26:07 [W] [service.go:105] login to server failed: x509: certificate signed by unknown authority (possibly because of "x509: cannot verify signature: insecure algorithm SHA1-RSA (temporarily override with GODEBUG=x509sha1=1)" while trying to verify candidate authority certificate "example.ca.com")
x509: certificate signed by unknown authority (possibly because of "x509: cannot verify signature: insecure algorithm SHA1-RSA (temporarily override with GODEBUG=x509sha1=1)" while trying to verify candidate authority certificate "example.ca.com")

Steps to reproduce

No response

Affected area

Docs
Installation
Performance and Scalability
Security
User Experience
Test and Release
Developer Infrastructure
Client Plugin
Server Plugin
Extensions
Others

Originally created by @Yellowpal on GitHub (May 28, 2022). Original GitHub issue: https://github.com/fatedier/frp/issues/2957 ### Bug Description 根据文档https://gofrp.org/docs/features/common/network/network-tls/ 生成证书，只改了server生成时的IP地址，客户端启动就报这个错。没找到有人遇到这个问题，是我的证书生成有问题？ ### frpc Version 0.41.0 ### frps Version 0.41.0 ### System Architecture linux/amd64 ### Configurations frpc.ini [common] server_addr = xxxxxx server_port = 7001 protocol = kcp tls_enable = true tls_cert_file = client.crt tls_key_file = client.key tls_trusted_ca_file = ca.crt frps.ini [common] bind_port = 7001 kcp_bind_port = 7001 log_file = /tmp/frp.log tls_cert_file = /usr/local/frp/ca/server.crt tls_key_file = /usr/local/frp/ca/server.key tls_trusted_ca_file = /usr/local/frp/ca/ca.crt tls_enable = true ### Logs 2022/05/28 19:26:07 [W] [service.go:105] login to server failed: x509: certificate signed by unknown authority (possibly because of "x509: cannot verify signature: insecure algorithm SHA1-RSA (temporarily override with GODEBUG=x509sha1=1)" while trying to verify candidate authority certificate "example.ca.com") x509: certificate signed by unknown authority (possibly because of "x509: cannot verify signature: insecure algorithm SHA1-RSA (temporarily override with GODEBUG=x509sha1=1)" while trying to verify candidate authority certificate "example.ca.com") ### Steps to reproduce _No response_ ### Affected area - [ ] Docs - [X] Installation - [ ] Performance and Scalability - [ ] Security - [ ] User Experience - [ ] Test and Release - [ ] Developer Infrastructure - [ ] Client Plugin - [ ] Server Plugin - [ ] Extensions - [ ] Others

gitea-mirror

2026-05-05 13:31:16 -06:00

closed this issue
added the
lifecycle/stale
label

gitea-mirror commented

2026-05-05 13:31:20 -06:00

Author

Owner

@iGuan7u commented on GitHub (Jun 18, 2022):

我也遇到了这个问题，最后发现是生成出来的 server.crt 以及 client.crt 文件默认采用了 sha1 的算法，只要在生成 *.crt 文件命令强制使用 sha256 算法即可。如 client.crt：

openssl x509 -req -days 365 -sha256\
    -in client.csr -CA ca.crt -CAkey ca.key -CAcreateserial \
	-extfile <(printf "subjectAltName=DNS:client.com,DNS:example.client.com") \
	-out client.crt

@iGuan7u commented on GitHub (Jun 18, 2022): 我也遇到了这个问题，最后发现是生成出来的 `server.crt` 以及 `client.crt` 文件默认采用了 sha1 的算法，只要在生成 *.crt 文件命令强制使用 sha256 算法即可。如 `client.crt`： ``` openssl x509 -req -days 365 -sha256\ -in client.csr -CA ca.crt -CAkey ca.key -CAcreateserial \ -extfile <(printf "subjectAltName=DNS:client.com,DNS:example.client.com") \ -out client.crt ```

gitea-mirror commented

2026-05-05 13:31:20 -06:00

Author

Owner

@github-actions[bot] commented on GitHub (Jul 19, 2022):

Issues go stale after 30d of inactivity. Stale issues rot after an additional 7d of inactivity and eventually close.

@github-actions[bot] commented on GitHub (Jul 19, 2022): Issues go stale after 30d of inactivity. Stale issues rot after an additional 7d of inactivity and eventually close.

gitea-mirror commented

2026-05-05 13:31:21 -06:00

Author

Owner

@korenyoni commented on GitHub (Aug 16, 2022):

Ran into the same issue resolved by this comment. I believe the README should be updated to reflect this.

@korenyoni commented on GitHub (Aug 16, 2022): Ran into the same issue resolved by [this comment](https://github.com/fatedier/frp/issues/2957#issuecomment-1159350315). I believe the README should be updated to reflect this.