[GH-ISSUE #3588] 按照文档进行TLS设置，连接失败

gitea-mirror commented

2026-05-05 13:51:13 -06:00

Owner

Originally created by @MMMMMoris on GitHub (Aug 27, 2023).
Original GitHub issue: https://github.com/fatedier/frp/issues/3588

Bug Description

我不是很懂非对称加密的原理或者过程，但我是根据文档操作的。

我用到的ca证书、ca.key等等完全是按文档中的OpenSSL 生成证书示例生成的，包括其中server.com，client.com等示例域名，因为我的客户端是没绑定域名的，我也不知道该用哪个域名，所以直接按照文档上给出的来。我想按照文档的做法开启双向验证，然而无论怎么尝试都不行。已知，在仅仅使用 token，不额外配置TLS的情况下，我的ssh连接是可以使用的。然而一旦加上这些TLS配置就用不了了。frpc、frps 配置和输出在下面。

frpc Version

0.51.3

frps Version

0.51.3

System Architecture

Linux/amd64

Configurations

frpc

[common]
server_addr = 123.123.123.123
server_port = 1234
token = test
tls_cert_file = /home/debian/frp/ssl/client.crt
tls_key_file = /home/debian/frp/ssl/client.key
tls_trusted_ca_file = /home/debian/frp/ssl/ca.crt
log_level = debug

[ssh]
type = tcp
local_ip = 127.0.0.1
local_port = 22
remote_port = 8888
use_compression = true

frps

[common]
bind_port = 1234
token = test
tls_only = true
tls_cert_file = /home/debian/programs/frp/ssl/server.crt
tls_key_file = /home/debian/programs/frp/ssl/server.key
tls_trusted_ca_file = /home/debian/programs/frp/ssl/ca.crt
log_level = debug


dashboard_addr = 0.0.0.0
dashboard_port = 6666
dashboard_user = debian
dashboard_pwd = test
enable_prometheus = ture

Logs

frpc[122614]: 2023/08/27 17:14:22 [I] [root.go:220] start frpc service for config file [/home/debian/programs/frp/frpc.ini]
frpc[122614]: 2023/08/27 17:14:22 [W] [service.go:133] login to server failed: session shutdown
frpc[122614]: 2023/08/27 17:14:22 [I] [root.go:236] frpc service for config file [/home/debian/programs/frp/frpc.ini] stopped

Steps to reproduce

按照以上配置运行程序

Affected area

Docs
Installation
Performance and Scalability
Security
User Experience
Test and Release
Developer Infrastructure
Client Plugin
Server Plugin
Extensions
Others

Originally created by @MMMMMoris on GitHub (Aug 27, 2023). Original GitHub issue: https://github.com/fatedier/frp/issues/3588 ### Bug Description 我不是很懂非对称加密的原理或者过程，但我是根据文档操作的。 ![image](https://github.com/fatedier/frp/assets/63332824/bda2a2a8-e608-40bf-b7ee-006718cd2b14) 我用到的ca证书、ca.key等等完全是按文档中的[OpenSSL 生成证书示例](https://gofrp.org/docs/features/common/network/network-tls/#openssl-%E7%94%9F%E6%88%90%E8%AF%81%E4%B9%A6%E7%A4%BA%E4%BE%8B)生成的，包括其中server.com，client.com等示例域名，因为我的客户端是没绑定域名的，我也不知道该用哪个域名，所以直接按照文档上给出的来。我想按照文档的做法开启[双向验证](https://gofrp.org/docs/features/common/network/network-tls/#%E5%8F%8C%E5%90%91%E9%AA%8C%E8%AF%81)，然而无论怎么尝试都不行。已知，在仅仅使用 token，不额外配置TLS的情况下，我的ssh连接是可以使用的。然而一旦加上这些TLS配置就用不了了。frpc、frps 配置和输出在下面。 ### frpc Version 0.51.3 ### frps Version 0.51.3 ### System Architecture Linux/amd64 ### Configurations frpc ``` [common] server_addr = 123.123.123.123 server_port = 1234 token = test tls_cert_file = /home/debian/frp/ssl/client.crt tls_key_file = /home/debian/frp/ssl/client.key tls_trusted_ca_file = /home/debian/frp/ssl/ca.crt log_level = debug [ssh] type = tcp local_ip = 127.0.0.1 local_port = 22 remote_port = 8888 use_compression = true ``` frps ``` [common] bind_port = 1234 token = test tls_only = true tls_cert_file = /home/debian/programs/frp/ssl/server.crt tls_key_file = /home/debian/programs/frp/ssl/server.key tls_trusted_ca_file = /home/debian/programs/frp/ssl/ca.crt log_level = debug dashboard_addr = 0.0.0.0 dashboard_port = 6666 dashboard_user = debian dashboard_pwd = test enable_prometheus = ture ``` ### Logs frpc[122614]: 2023/08/27 17:14:22 [I] [root.go:220] start frpc service for config file [/home/debian/programs/frp/frpc.ini] frpc[122614]: 2023/08/27 17:14:22 [W] [service.go:133] login to server failed: session shutdown frpc[122614]: 2023/08/27 17:14:22 [I] [root.go:236] frpc service for config file [/home/debian/programs/frp/frpc.ini] stopped ### Steps to reproduce 按照以上配置运行程序 ### Affected area - [ ] Docs - [ ] Installation - [ ] Performance and Scalability - [ ] Security - [X] User Experience - [ ] Test and Release - [ ] Developer Infrastructure - [ ] Client Plugin - [ ] Server Plugin - [ ] Extensions - [X] Others

gitea-mirror

2026-05-05 13:51:13 -06:00

closed this issue
added the
lifecycle/stale
label

gitea-mirror commented

2026-05-05 13:51:17 -06:00

Author

Owner

@cuitz commented on GitHub (Aug 28, 2023):

将生成 frps 证书命令中的 subjectAltName 的 IP 改为你的服务器公网 IP 试试。

@cuitz commented on GitHub (Aug 28, 2023): 将生成 frps 证书命令中的 subjectAltName 的 IP 改为你的服务器公网 IP 试试。

gitea-mirror commented

2026-05-05 13:51:18 -06:00

Author

Owner

@cuitz commented on GitHub (Aug 28, 2023):

另外如果 frps.ini 的 common 中 tls_trusted_ca_file 内容是有效的话，那么默认就会开启 tls_only = true

@cuitz commented on GitHub (Aug 28, 2023): 另外如果 frps.ini 的 common 中 tls_trusted_ca_file 内容是有效的话，那么默认就会开启 `tls_only = true`

gitea-mirror commented

2026-05-05 13:51:18 -06:00

Author

Owner

@github-actions[bot] commented on GitHub (Sep 28, 2023):

Issues go stale after 30d of inactivity. Stale issues rot after an additional 7d of inactivity and eventually close.

@github-actions[bot] commented on GitHub (Sep 28, 2023): Issues go stale after 30d of inactivity. Stale issues rot after an additional 7d of inactivity and eventually close.

gitea-mirror referenced this issue

2026-05-05 14:45:57 -06:00

[PR #2863] [MERGED] support tcp keepalive params #4643

gitea-mirror referenced this issue

2026-05-05 14:46:02 -06:00

[PR #2869] [MERGED] bump version to v0.41.0 #4646