[GH-ISSUE #4634] SSL证书配置frp双向认证失败，单向认证中：frp客户端使用client.crt+client.key认证服务端的ca.crt成功，但是frp客户端使用ca.crt认证服务端的server.crt+server.key失败 #3660

New issue

Closed

opened 2026-05-05 14:20:57 -06:00 by gitea-mirror · 2 comments

gitea-mirror commented

2026-05-05 14:20:57 -06:00

Owner

Originally created by @Songs-YZS on GitHub (Jan 12, 2025).
Original GitHub issue: https://github.com/fatedier/frp/issues/4634

Bug Description

SSL证书配置frp双向认证失败，单向认证中：frp客户端使用client.crt+client.key认证服务端的ca.crt成功，但是frp客户端使用ca.crt认证服务端的server.crt+server.key失败。
成功图：

失败图：

但是我在openssl上验证过ca.crt认证server.crt+server.key是成功的：
验证证书没问题：
服务端启用server.crt+server.key开启8080端口：

客户端启用ca.crt成功连接8080端口：

frpc Version

0.61.1

frps Version

0.61.1

System Architecture

WInodw+Linux平台都试了

Configurations

Logs

No response

Steps to reproduce

...

Affected area

Docs
Installation
Performance and Scalability
Security
User Experience
Test and Release
Developer Infrastructure
Client Plugin
Server Plugin
Extensions
Others

Originally created by @Songs-YZS on GitHub (Jan 12, 2025). Original GitHub issue: https://github.com/fatedier/frp/issues/4634 ### Bug Description SSL证书配置frp双向认证失败，单向认证中：frp客户端使用client.crt+client.key认证服务端的ca.crt成功，但是frp客户端使用ca.crt认证服务端的server.crt+server.key失败。成功图： ![image](https://github.com/user-attachments/assets/8d547a37-29b7-4a71-a49d-e9269cb9c572) 失败图： ![image](https://github.com/user-attachments/assets/ff270553-6925-4b4c-8be6-acf2d37ce49b) 但是我在openssl上验证过ca.crt认证server.crt+server.key是成功的：验证证书没问题：服务端启用server.crt+server.key开启8080端口： ![image](https://github.com/user-attachments/assets/2924a4ab-05cd-4061-91fd-75e796644642) 客户端启用ca.crt成功连接8080端口： ![image](https://github.com/user-attachments/assets/d61cddbb-c20a-4bde-8fb3-28ed5f43be18) ![image](https://github.com/user-attachments/assets/a724f312-322a-4bb4-81cf-7a72670421d3) ### frpc Version 0.61.1 ### frps Version 0.61.1 ### System Architecture WInodw+Linux平台都试了 ### Configurations ~ ### Logs _No response_ ### Steps to reproduce 1. 2. 3. ... ### Affected area - [ ] Docs - [ ] Installation - [ ] Performance and Scalability - [ ] Security - [ ] User Experience - [ ] Test and Release - [ ] Developer Infrastructure - [ ] Client Plugin - [ ] Server Plugin - [ ] Extensions - [ ] Others

gitea-mirror

2026-05-05 14:20:57 -06:00

closed this issue
added the
lifecycle/stale
label

gitea-mirror commented

2026-05-05 14:21:00 -06:00

Author

Owner

@github-actions[bot] commented on GitHub (Jan 27, 2025):

Issues go stale after 14d of inactivity. Stale issues rot after an additional 3d of inactivity and eventually close.

@github-actions[bot] commented on GitHub (Jan 27, 2025): Issues go stale after 14d of inactivity. Stale issues rot after an additional 3d of inactivity and eventually close.

gitea-mirror commented

2026-05-05 14:21:00 -06:00

Author

Owner

@Vekixx commented on GitHub (May 22, 2025):

参照https://gofrp.org/zh-cn/docs/features/common/network/network-tls/#openssl-%E7%94%9F%E6%88%90%E8%AF%81%E4%B9%A6%E7%A4%BA%E4%BE%8B生成相应证书

生成server证书时将DNS:example.server.com改为DNS:域名，IP:127.0.0.1改为IP:服务器ip
生成client证书DNS:example.client.com改为DNS:域名

2.证书位置frps/c.toml同目录的ssl文件夹内
your_project_folder/
├── frps/c.toml
└── ssl/
└── .crt/.key

3.docker run/docker-compose.yml修改
增加-v {your_frp_folder}/ssl:/etc/frp/ssl 或者 volumes:下增加- ./ssl:/etc/frp/ssl

4.frps/c.toml内添加

transport.tls.certFile = "/etc/frp/ssl/server.crt"
transport.tls.keyFile = "/etc/frp/ssl/server.key"
transport.tls.trustedCaFile = "/etc/frp/ssl/ca.crt"

transport.tls.certFile = "./ssl/client.crt"
transport.tls.keyFile = "./ssl/client.key"
transport.tls.trustedCaFile = "./ssl/ca.crt"

@Vekixx commented on GitHub (May 22, 2025): 1. 参照[https://gofrp.org/zh-cn/docs/features/common/network/network-tls/#openssl-%E7%94%9F%E6%88%90%E8%AF%81%E4%B9%A6%E7%A4%BA%E4%BE%8B](https://gofrp.org/zh-cn/docs/features/common/network/network-tls/#openssl-%E7%94%9F%E6%88%90%E8%AF%81%E4%B9%A6%E7%A4%BA%E4%BE%8B)生成相应证书 > 生成server证书时将`DNS:example.server.com`改为`DNS:域名`，`IP:127.0.0.1`改为`IP:服务器ip` > 生成client证书`DNS:example.client.com`改为`DNS:域名` 2.证书位置frps/c.toml同目录的ssl文件夹内 your_project_folder/ ├── frps/c.toml └── ssl/ └── *.crt/*.key 3.docker run/docker-compose.yml修改增加`-v {your_frp_folder}/ssl:/etc/frp/ssl` 或者 `volumes:`下增加`- ./ssl:/etc/frp/ssl` 4.frps/c.toml内添加 ```toml transport.tls.certFile = "/etc/frp/ssl/server.crt" transport.tls.keyFile = "/etc/frp/ssl/server.key" transport.tls.trustedCaFile = "/etc/frp/ssl/ca.crt" ``` ```toml transport.tls.certFile = "./ssl/client.crt" transport.tls.keyFile = "./ssl/client.key" transport.tls.trustedCaFile = "./ssl/ca.crt" ```

gitea-mirror referenced this issue

2026-05-05 14:49:00 -06:00

[PR #3660] [MERGED] fix that transport.tls.disableCustomTLSFirstByte doesn't take effect #4800

gitea-mirror referenced this issue

2026-05-05 14:49:05 -06:00

[PR #3668] [MERGED] bump version to v0.52.1 #4806