Mxmilu666/frp
1
1
Fork 1
mirror of https://github.com/fatedier/frp.git synced 2026-10-19 01:13:27 +08:00
Code Issues Packages Projects Releases Wiki Activity

feat(client): add useSystemCa and combine it with trustedCaFile (#5572)

Browse Source 
Move the frpc-only TLS option into the shared TLSConfig as
transport.tls.useSystemCa, replacing the unpublished useSystemRoots.
When set, frpc verifies the server with the system CAs; when
trustedCaFile is also set, its CAs are appended to the system pool so
both are trusted. Failures to load either source abort the connection
instead of falling back. Enabling the option without effective TLS is a
configuration error, and the field is rejected in frps transport.tls
and in both webServer.tls sections.

Fixes #5545
This commit is contained in:
fatedier
2026-10-18 16:00:02 +08:00
committed by GitHub
parent 7441443134
commit 26742060b1
13 changed files with 395 additions and 93 deletions
Download Patch File Download Diff File Expand all files Collapse all files
conf/frpc_full_example.toml
+5 -3
View File
@@ -131,9 +131,11 @@ transport.tls.enable = true
# transport.tls.trustedCaFile = "ca.crt"
# transport.tls.serverName = "example.com"
# If useSystemRoots is true and trustedCaFile is not set, frpc verifies the server certificate
# against the host's root store.
# transport.tls.useSystemRoots = false
# If useSystemCa is true, frpc verifies the server certificate using system CAs.
# If trustedCaFile is also set, its CA certificates are added to the system CA pool.
# Only supported in frpc transport.tls; requires tls.enable = true unless protocol is wss.
# CA loading or certificate verification failures cause the connection to fail.
# transport.tls.useSystemCa = false
# If the disableCustomTLSFirstByte is set to false, frpc will establish a connection with frps using the
# first custom byte when tls is enabled.