Closed
Conversation
Member
|
我理解必须使用fullchain.cer 不是一个问题。。还有就是以后编码中间证书的可维护性太低了。。 |
Member
Author
确实不是什么问题 拿出来提一下的级别 就是踩的人有一点点多 维护性的话 这些证书全部放在一个文件夹下面 一个证书一个.crt 这东西一般几年一换 数量也不多 谷歌两个LE四个zero大概只有一个 仁者见仁智者见智吧 |
Member
|
我记得以前做网站的时候，服务端不用 fullchain 的话有些手机浏览器也会出问题，所以正常网站都用 fullchain，不是大问题 |
Member
|
就是说既然 Xray 都要加载证书，没有必要为了方便用户而增加这样的维护工作量 况且也没更方便，都只是填个路径，为什么不填 fullchain |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
自古以来就有acme必须使用fullchain.cer不能直接用cer的问题 因为gotls好像没有处理中间证书的方法
稍微研究一下之后个人觉得最简单的办法是在核心hard code常用CA的中间证书(御三家 LE google zero) 这样就能正常处理了 因为其他方式可能还需要联网获取 这样的事情还是越少越好 而且gotls好像不方便进行这样的操作
一些其他说明：
这只是个用于讨论的示例 所以只加了谷歌的两个CA做演示 如果没有问题后续可以补全
核心在添加证书之前会尝试用本地根证书验证这些证书是否有效 不是则跳过 不会造成安全问题