github-starred/frp

Fork 0

mirror of https://github.com/fatedier/frp.git synced 2026-05-15 08:05:49 -06:00

[GH-ISSUE #4375] FRP 的双向验证设置应当使用相同的证书吗？ #3455

New issue

Closed

opened 2026-05-05 14:13:25 -06:00 by gitea-mirror · 3 comments

gitea-mirror commented

2026-05-05 14:13:25 -06:00

Owner

Originally created by @MironChen on GitHub (Aug 9, 2024).
Original GitHub issue: https://github.com/fatedier/frp/issues/4375

Bug Description

我在运行 frps 的VPS上使用acme.sh（via let's encrypt）生成了 server.crt server.key 和 ca.crt (使用域名 frp.example.com）然后在本地运行的群晖 DSM里用相同的方式生成了三份证书。但在连接时提示 x509: certificate has expired or is not yet valid.

此时，VPS上的CA证书由E6签发（let's encrypt)，DSM 上的证书由E5签发。

在更新两份CA均为 E5 签发后，问题消失。

frpc Version

0.59

frps Version

0.59

System Architecture

linux/amd64

Configurations

As description

Logs

No response

Steps to reproduce

No response

Originally created by @MironChen on GitHub (Aug 9, 2024). Original GitHub issue: https://github.com/fatedier/frp/issues/4375 ### Bug Description 我在运行 frps 的VPS上使用acme.sh（via let's encrypt）生成了 server.crt server.key 和 ca.crt (使用域名 frp.example.com）然后在本地运行的群晖 DSM里用相同的方式生成了三份证书。但在连接时提示 `x509: certificate has expired or is not yet valid.` 此时，VPS上的CA证书由E6签发（let's encrypt)，DSM 上的证书由E5签发。在更新两份CA均为 E5 签发后，问题消失。 ### frpc Version 0.59 ### frps Version 0.59 ### System Architecture linux/amd64 ### Configurations As description ### Logs _No response_ ### Steps to reproduce _No response_

gitea-mirror closed this issue

2026-05-05 14:13:25 -06:00

gitea-mirror commented

2026-05-05 14:13:27 -06:00

Author

Owner

@xqzr commented on GitHub (Aug 10, 2024):

尝试 fullchain.cer

@xqzr commented on GitHub (Aug 10, 2024): 尝试 `fullchain.cer`

gitea-mirror commented

2026-05-05 14:13:28 -06:00

Author

Owner

@MironChen commented on GitHub (Aug 11, 2024):

# frpc.toml
transport.tls.certFile = "/to/cert/path/client.crt"
transport.tls.keyFile = "/to/key/path/client.key"
transport.tls.trustedCaFile = "/to/ca/path/ca.crt"

# frps.toml
transport.tls.certFile = "/to/cert/path/server.crt"
transport.tls.keyFile = "/to/key/path/server.key"
transport.tls.trustedCaFile = "/to/ca/path/ca.crt"

按照 frp 提供的官方文档，似乎只提供了分别使用三个文件的方法？

@MironChen commented on GitHub (Aug 11, 2024): ``` # frpc.toml transport.tls.certFile = "/to/cert/path/client.crt" transport.tls.keyFile = "/to/key/path/client.key" transport.tls.trustedCaFile = "/to/ca/path/ca.crt" # frps.toml transport.tls.certFile = "/to/cert/path/server.crt" transport.tls.keyFile = "/to/key/path/server.key" transport.tls.trustedCaFile = "/to/ca/path/ca.crt" ``` 按照 frp 提供的官方文档，似乎只提供了分别使用三个文件的方法？

gitea-mirror commented

2026-05-05 14:13:29 -06:00

Author

Owner

@fatedier commented on GitHub (Aug 12, 2024):

一般来说需要相同的 CA 签发。

@fatedier commented on GitHub (Aug 12, 2024): 一般来说需要相同的 CA 签发。

gitea-mirror referenced this issue

2026-05-05 14:48:03 -06:00

[PR #3455] [MERGED] format import package name #4752

gitea-mirror referenced this issue

2026-05-05 14:48:15 -06:00