gitea-mirror commented

Owner

Originally created by @yuzi-ska on GitHub (May 24, 2025).
Original GitHub issue: https://github.com/fatedier/frp/issues/4812

Bug Description

主机结构大致如下

在FRPS开启ca证书验证后访问出现ERR_SSL_UNRECOGNIZED_NAME_ALERT，证书文件使用opensll单独验证是通过的，双端证书均为https://gofrp.org/zh-cn/docs/features/common/network/network-tls/ 示例中生成，其中DNS改为所需的泛域名地址，IP改为服务器公网IP地址，不开启FRPS的ca证书验证进行单向验证可正常访问，但任然会在随机时间无法验证（较频繁），防火墙未拦截，非DNS问题，大约十分钟后正常，在FRPS服务无法验证期间使用客户端自带的公网进行直接连接是可以正常连接，应该可以说明并非客户端证书以及服务错误。
只需将frps的ca证书验证去除所以服务均正常访问，日志内没有报错提示，无法了解具体出现在哪，望解答，感谢。

frpc Version

0.61.1

frps Version

0.61.1

System Architecture

linux/amd64

Configurations

FRPS 服务器端配置

绑定监听地址
bindAddr = "0.0.0.0"

服务器监听端口
bindPort = 7000
quicBindPort = 7000

HTTP 端口（用于内网 HTTP 代理穿透）
vhostHTTPPort = 80

HTTPS 端口（用于内网 HTTPS 代理穿透）
vhostHTTPSPort = 443

log.to = "/frps/fprs.log"
log.level = "trace"

认证方式
auth.method = "token"

Token 认证
auth.token = "xxxxx"

transport.tls.certFile = "/frps/ssl/server.crt"
transport.tls.keyFile = "/frps/ssl/server.key"
transport.tls.trustedCaFile = "/frps/ssl/ca.crt"

FRPC 服务器端配置

[common]
server_addr = ip地址
server_port = 7000
token = "xxxx"
transport.tls.certFile = "/client.crt"
transport.tls.keyFile = "/client.key"
transport.tls.trustedCaFile = "/cer/ca.crt"
transport.protocol = "quic"

[http]
type = http
local_ip = 127.0.0.1
local_port = 80
custom_domains = *.my.domain
transport.useCompression = true

[https]
type = https
local_ip = 127.0.0.1
local_port = 443
custom_domains = *.my.domain
transport.useCompression = true

CA

cat > my-openssl.cnf << EOF
[ ca ]
default_ca = CA_default
[ CA_default ]
x509_extensions = usr_cert
[ req ]
default_bits = 2048
default_md = sha256
default_keyfile = privkey.pem
distinguished_name = req_distinguished_name
attributes = req_attributes
x509_extensions = v3_ca
string_mask = utf8only
[ req_distinguished_name ]
[ req_attributes ]
[ usr_cert ]
basicConstraints = CA:FALSE
nsComment = "OpenSSL Generated Certificate"
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid,issuer
[ v3_ca ]
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer
basicConstraints = CA:true
EOF

openssl genrsa -out ca.key 2048
openssl req -x509 -new -nodes -key ca.key -subj "/CN=example.ca.com" -days 5000 -out ca.crt

服务端

openssl genrsa -out server.key 2048

openssl req -new -sha256 -key server.key
-subj "/C=XX/ST=DEFAULT/L=DEFAULT/O=DEFAULT/CN=server.com"
-reqexts SAN
-config <(cat my-openssl.cnf <(printf "\n[SAN]\nsubjectAltName=DNS:my.domain,IP:服务器IP,DNS:*.my.doamin"))
-out server.csr

openssl x509 -req -days 365 -sha256
-in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial
-extfile <(printf "subjectAltName=DNS:my.domain,IP:服务端IP,DNS:*.my.domain")
-out server.crt

客户端

openssl genrsa -out client.key 2048

openssl req -new -sha256 -key client.key
-subj "/C=XX/ST=DEFAULT/L=DEFAULT/O=DEFAULT/CN=client.com"
-reqexts SAN
-config <(cat my-openssl.cnf <(printf "\n[SAN]\nsubjectAltName=DNS:*.my.domain"))
-out client.csr

openssl x509 -req -days 365 -sha256
-in client.csr -CA ca.crt -CAkey ca.key -CAcreateserial
-extfile <(printf "subjectAltName=DNS:*.my.domain")
-out client.crt

Logs

client login info: ip [frpc ip地址:17363] version [0.61.1] hostname [] os [linux] arch [amd64]

client exit success

无其他显示日志

Steps to reproduce

...

Affected area

Docs
Installation
Performance and Scalability
Security
User Experience
Test and Release
Developer Infrastructure
Client Plugin
Server Plugin
Extensions
Others

Originally created by @yuzi-ska on GitHub (May 24, 2025). Original GitHub issue: https://github.com/fatedier/frp/issues/4812 ### Bug Description 主机结构大致如下 ![Image](https://github.com/user-attachments/assets/3c5aa49f-237d-46d9-914e-a97f52f7e5b1) 在FRPS开启ca证书验证后访问出现ERR_SSL_UNRECOGNIZED_NAME_ALERT，证书文件使用opensll单独验证是通过的，双端证书均为https://gofrp.org/zh-cn/docs/features/common/network/network-tls/ 示例中生成，其中DNS改为所需的泛域名地址，IP改为服务器公网IP地址，不开启FRPS的ca证书验证进行单向验证可正常访问，但任然会在随机时间无法验证（较频繁），防火墙未拦截，非DNS问题，大约十分钟后正常，在FRPS服务无法验证期间使用客户端自带的公网进行直接连接是可以正常连接，应该可以说明并非客户端证书以及服务错误。只需将frps的ca证书验证去除所以服务均正常访问，日志内没有报错提示，无法了解具体出现在哪，望解答，感谢。 ### frpc Version 0.61.1 ### frps Version 0.61.1 ### System Architecture linux/amd64 ### Configurations # FRPS 服务器端配置绑定监听地址 bindAddr = "0.0.0.0" 服务器监听端口 bindPort = 7000 quicBindPort = 7000 HTTP 端口（用于内网 HTTP 代理穿透） vhostHTTPPort = 80 HTTPS 端口（用于内网 HTTPS 代理穿透） vhostHTTPSPort = 443 log.to = "/frps/fprs.log" log.level = "trace" 认证方式 auth.method = "token" Token 认证 auth.token = "xxxxx" transport.tls.certFile = "/frps/ssl/server.crt" transport.tls.keyFile = "/frps/ssl/server.key" transport.tls.trustedCaFile = "/frps/ssl/ca.crt" # FRPC 服务器端配置 [common] server_addr = ip地址 server_port = 7000 token = "xxxx" transport.tls.certFile = "/client.crt" transport.tls.keyFile = "/client.key" transport.tls.trustedCaFile = "/cer/ca.crt" transport.protocol = "quic" [http] type = http local_ip = 127.0.0.1 local_port = 80 custom_domains = *.my.domain transport.useCompression = true [https] type = https local_ip = 127.0.0.1 local_port = 443 custom_domains = *.my.domain transport.useCompression = true # CA cat > my-openssl.cnf << EOF [ ca ] default_ca = CA_default [ CA_default ] x509_extensions = usr_cert [ req ] default_bits = 2048 default_md = sha256 default_keyfile = privkey.pem distinguished_name = req_distinguished_name attributes = req_attributes x509_extensions = v3_ca string_mask = utf8only [ req_distinguished_name ] [ req_attributes ] [ usr_cert ] basicConstraints = CA:FALSE nsComment = "OpenSSL Generated Certificate" subjectKeyIdentifier = hash authorityKeyIdentifier = keyid,issuer [ v3_ca ] subjectKeyIdentifier = hash authorityKeyIdentifier = keyid:always,issuer basicConstraints = CA:true EOF openssl genrsa -out ca.key 2048 openssl req -x509 -new -nodes -key ca.key -subj "/CN=example.ca.com" -days 5000 -out ca.crt # 服务端 openssl genrsa -out server.key 2048 openssl req -new -sha256 -key server.key \ -subj "/C=XX/ST=DEFAULT/L=DEFAULT/O=DEFAULT/CN=server.com" \ -reqexts SAN \ -config <(cat my-openssl.cnf <(printf "\n[SAN]\nsubjectAltName=DNS:my.domain,IP:服务器IP,DNS:*.my.doamin")) \ -out server.csr openssl x509 -req -days 365 -sha256 \ -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial \ -extfile <(printf "subjectAltName=DNS:my.domain,IP:服务端IP,DNS:*.my.domain") \ -out server.crt # 客户端 openssl genrsa -out client.key 2048 openssl req -new -sha256 -key client.key \ -subj "/C=XX/ST=DEFAULT/L=DEFAULT/O=DEFAULT/CN=client.com" \ -reqexts SAN \ -config <(cat my-openssl.cnf <(printf "\n[SAN]\nsubjectAltName=DNS:*.my.domain")) \ -out client.csr openssl x509 -req -days 365 -sha256 \ -in client.csr -CA ca.crt -CAkey ca.key -CAcreateserial \ -extfile <(printf "subjectAltName=DNS:*.my.domain") \ -out client.crt ### Logs client login info: ip [frpc ip地址:17363] version [0.61.1] hostname [] os [linux] arch [amd64] client exit success 无其他显示日志 ### Steps to reproduce 1. 2. 3. ... ### Affected area - [ ] Docs - [ ] Installation - [ ] Performance and Scalability - [ ] Security - [x] User Experience - [ ] Test and Release - [ ] Developer Infrastructure - [ ] Client Plugin - [ ] Server Plugin - [ ] Extensions - [ ] Others

gitea-mirror

2026-05-05 14:25:57 -06:00

closed this issue
added the
lifecycle/stale
label

gitea-mirror commented

2026-05-05 14:26:00 -06:00

Author

Owner

@Vekixx commented on GitHub (May 24, 2025):

给你参考一下：

文件路径使用挂载后的相对路径，（也应该可以使用绝对完整路径未验证）
docker-compose文件

    volumes:
      - ./frps.toml:/etc/frp/frps.toml
      - ./ssl:/etc/frp/ssl

frps.toml

transport.tls.certFile = "/etc/frp/ssl/server.crt"
transport.tls.keyFile = "/etc/frp/ssl/server.key"
transport.tls.trustedCaFile = "/etc/frp/ssl/ca.crt"

2.生成client证书时少了个dns

openssl req -new -sha256 -key client.key
-subj "/C=XX/ST=DEFAULT/L=DEFAULT/O=DEFAULT/CN=client.com"
-reqexts SAN
# 你的
-config <(cat my-openssl.cnf <(printf "\n[SAN]\nsubjectAltName=DNS:*.my.domain"))
#应该是
-config <(cat my-openssl.cnf <(printf "\n[SAN]\nsubjectAltName=DNS:*.my.domain,DNS:*.my.domain"))  
-out client.csr

openssl x509 -req -days 365 -sha256
-in client.csr -CA ca.crt -CAkey ca.key -CAcreateserial
# 你的
-extfile <(printf "subjectAltName=DNS:*.my.domain")
#应该是
-extfile <(printf "subjectAltName=DNS:*.my.domain,DNS:*.my.domain")   
-out client.crt

不知道能否解决问题

@Vekixx commented on GitHub (May 24, 2025): 给你参考一下： 1. 文件路径使用挂载后的相对路径，（也应该可以使用绝对完整路径未验证） docker-compose文件 ```yaml volumes: - ./frps.toml:/etc/frp/frps.toml - ./ssl:/etc/frp/ssl ``` frps.toml ```toml transport.tls.certFile = "/etc/frp/ssl/server.crt" transport.tls.keyFile = "/etc/frp/ssl/server.key" transport.tls.trustedCaFile = "/etc/frp/ssl/ca.crt" ``` 2.生成client证书时少了个dns ```bash openssl req -new -sha256 -key client.key -subj "/C=XX/ST=DEFAULT/L=DEFAULT/O=DEFAULT/CN=client.com" -reqexts SAN # 你的 -config <(cat my-openssl.cnf <(printf "\n[SAN]\nsubjectAltName=DNS:*.my.domain")) #应该是 -config <(cat my-openssl.cnf <(printf "\n[SAN]\nsubjectAltName=DNS:*.my.domain,DNS:*.my.domain")) -out client.csr openssl x509 -req -days 365 -sha256 -in client.csr -CA ca.crt -CAkey ca.key -CAcreateserial # 你的 -extfile <(printf "subjectAltName=DNS:*.my.domain") #应该是 -extfile <(printf "subjectAltName=DNS:*.my.domain,DNS:*.my.domain") -out client.crt ``` 不知道能否解决问题

gitea-mirror commented

2026-05-05 14:26:01 -06:00

Author

Owner

@yuzi-ska commented on GitHub (May 24, 2025):

给你参考一下：

文件路径使用挂载后的相对路径，（也应该可以使用绝对完整路径未验证）
docker-compose文件

volumes:

./frps.toml:/etc/frp/frps.toml

./ssl:/etc/frp/ssl
frps.toml

transport.tls.certFile = "/etc/frp/ssl/server.crt"
transport.tls.keyFile = "/etc/frp/ssl/server.key"
transport.tls.trustedCaFile = "/etc/frp/ssl/ca.crt"
2.生成client证书时少了个dns

openssl req -new -sha256 -key client.key
-subj "/C=XX/ST=DEFAULT/L=DEFAULT/O=DEFAULT/CN=client.com"
-reqexts SAN

你的

-config <(cat my-openssl.cnf <(printf "\n[SAN]\nsubjectAltName=DNS:.my.domain"))
#应该是
-config <(cat my-openssl.cnf <(printf "\n[SAN]\nsubjectAltName=DNS:.my.domain,DNS:*.my.domain"))
-out client.csr

openssl x509 -req -days 365 -sha256
-in client.csr -CA ca.crt -CAkey ca.key -CAcreateserial

你的

-extfile <(printf "subjectAltName=DNS:.my.domain")
#应该是
-extfile <(printf "subjectAltName=DNS:.my.domain,DNS:*.my.domain")
-out client.crt
不知道能否解决问题

1.使用的是当时在releases下载打包好的文件，并未使用docker部署。
2.添加后问题依旧，无法解决

@yuzi-ska commented on GitHub (May 24, 2025): > 给你参考一下： > > 1. 文件路径使用挂载后的相对路径，（也应该可以使用绝对完整路径未验证） > docker-compose文件 > > volumes: > - ./frps.toml:/etc/frp/frps.toml > - ./ssl:/etc/frp/ssl > frps.toml > > transport.tls.certFile = "/etc/frp/ssl/server.crt" > transport.tls.keyFile = "/etc/frp/ssl/server.key" > transport.tls.trustedCaFile = "/etc/frp/ssl/ca.crt" > 2.生成client证书时少了个dns > > openssl req -new -sha256 -key client.key > -subj "/C=XX/ST=DEFAULT/L=DEFAULT/O=DEFAULT/CN=client.com" > -reqexts SAN > # 你的 > -config <(cat my-openssl.cnf <(printf "\n[SAN]\nsubjectAltName=DNS:*.my.domain")) > #应该是 > -config <(cat my-openssl.cnf <(printf "\n[SAN]\nsubjectAltName=DNS:*.my.domain,DNS:*.my.domain")) > -out client.csr > > openssl x509 -req -days 365 -sha256 > -in client.csr -CA ca.crt -CAkey ca.key -CAcreateserial > # 你的 > -extfile <(printf "subjectAltName=DNS:*.my.domain") > #应该是 > -extfile <(printf "subjectAltName=DNS:*.my.domain,DNS:*.my.domain") > -out client.crt > 不知道能否解决问题 1.使用的是当时在releases下载打包好的文件，并未使用docker部署。 2.添加后问题依旧，无法解决

gitea-mirror commented

2026-05-05 14:26:02 -06:00

Author

Owner

@github-actions[bot] commented on GitHub (Jun 8, 2025):

Issues go stale after 14d of inactivity. Stale issues rot after an additional 3d of inactivity and eventually close.

@github-actions[bot] commented on GitHub (Jun 8, 2025): Issues go stale after 14d of inactivity. Stale issues rot after an additional 3d of inactivity and eventually close.

gitea-mirror referenced this issue

2026-05-05 14:49:35 -06:00

[PR #3801] [MERGED] optimize some code #4832

gitea-mirror referenced this issue

2026-05-05 14:49:51 -06:00

[PR #3845] [MERGED] bump version to v0.53.0 #4845