[{"data":1,"prerenderedAt":793},["ShallowReactive",2],{"navigation_docs":3,"-extension-basics-tls":380,"-extension-basics-tls-surround":788},[4,9,41,108,185,312,328,370,375],{"title":5,"path":6,"stem":7,"icon":8},"首页","\u002Fwhat-is-lolia","1.what-is-lolia","i-lucide-house",{"title":10,"icon":11,"path":12,"stem":13,"children":14,"page":40},"开始之前","i-lucide-list-check","\u002Fbefore-start","2.before-start",[15,20,25,30,35],{"title":16,"path":17,"stem":18,"icon":19},"入门阅读","\u002Fbefore-start\u002Fintroduction","2.before-start\u002F1.introduction","i-lucide-book",{"title":21,"path":22,"stem":23,"icon":24},"常见问题","\u002Fbefore-start\u002Ffaq","2.before-start\u002F2.faq","i-lucide-badge-question-mark",{"title":26,"path":27,"stem":28,"icon":29},"实名认证","\u002Fbefore-start\u002Fkyc","2.before-start\u002F3.kyc","i-lucide-user-check",{"title":31,"path":32,"stem":33,"icon":34},"安全提示","\u002Fbefore-start\u002Fsecurity","2.before-start\u002F4.security","i-lucide-shield-alert",{"title":36,"path":37,"stem":38,"icon":39},"大流量内容","\u002Fbefore-start\u002Fbig-traffic-contents","2.before-start\u002F5.big-traffic-contents","i-lucide-zap",false,{"title":42,"icon":43,"path":44,"stem":45,"children":46,"page":40},"面板","i-lucide-panels-top-left","\u002Fweb-management","3.web-management",[47,52,66,76,94],{"title":48,"path":49,"stem":50,"icon":51},"仪表盘","\u002Fweb-management\u002Fdashboard","3.web-management\u002F1.dashboard","i-lucide-gauge",{"title":53,"icon":54,"path":55,"stem":56,"children":57,"page":40},"隧道","i-lucide-chevrons-left-right-ellipsis","\u002Fweb-management\u002Ftunnel","3.web-management\u002F2.tunnel",[58,62],{"title":59,"path":60,"stem":61},"隧道管理","\u002Fweb-management\u002Ftunnel\u002Ftunnel-management","3.web-management\u002F2.tunnel\u002F1.tunnel-management",{"title":63,"path":64,"stem":65},"隧道创建","\u002Fweb-management\u002Ftunnel\u002Fcreate-tunnel","3.web-management\u002F2.tunnel\u002F2.create-tunnel",{"title":67,"icon":68,"path":69,"stem":70,"children":71,"page":40},"域名管理","i-lucide-globe-code","\u002Fweb-management\u002Fdomain-management","3.web-management\u002F3.domain-management",[72],{"title":73,"path":74,"stem":75},"域名白名单","\u002Fweb-management\u002Fdomain-management\u002Fwhitelist","3.web-management\u002F3.domain-management\u002F1.whitelist",{"title":77,"icon":78,"path":79,"stem":80,"children":81,"page":40},"OAuth","i-lucide-key-round","\u002Fweb-management\u002Foauth","3.web-management\u002F4.oauth",[82,86,90],{"title":83,"path":84,"stem":85},"应用管理","\u002Fweb-management\u002Foauth\u002Fapp-management","3.web-management\u002F4.oauth\u002F1.app-management",{"title":87,"path":88,"stem":89},"创建应用","\u002Fweb-management\u002Foauth\u002Fcreate-app","3.web-management\u002F4.oauth\u002F2.create-app",{"title":91,"path":92,"stem":93},"授权管理","\u002Fweb-management\u002Foauth\u002Fauthorizations","3.web-management\u002F4.oauth\u002F3.authorizations",{"title":95,"icon":96,"path":97,"stem":98,"children":99,"page":40},"账户设置","i-lucide-user-cog","\u002Fweb-management\u002Fsettings","3.web-management\u002F5.settings",[100,104],{"title":101,"path":102,"stem":103},"基础设置","\u002Fweb-management\u002Fsettings\u002Fsettings","3.web-management\u002F5.settings\u002F1.settings",{"title":105,"path":106,"stem":107},"安全性","\u002Fweb-management\u002Fsettings\u002Fsecurity","3.web-management\u002F5.settings\u002F2.security",{"title":109,"icon":110,"path":111,"stem":112,"children":113,"page":40},"客户端","i-lucide-laptop","\u002Fclient","4.client",[114,157,171],{"title":115,"icon":116,"path":117,"stem":118,"children":119,"page":40},"图形化客户端","i-lucide-app-window-mac","\u002Fclient\u002Fgui","4.client\u002F1.gui",[120,141,153],{"title":121,"path":122,"stem":123,"children":124,"page":40},"LoliaFrpClient","\u002Fclient\u002Fgui\u002Floliafrpclient","4.client\u002F1.gui\u002F1.loliafrpclient",[125,129,133,137],{"title":126,"path":127,"stem":128},"简介","\u002Fclient\u002Fgui\u002Floliafrpclient\u002Fintroduction","4.client\u002F1.gui\u002F1.loliafrpclient\u002F1.introduction",{"title":130,"path":131,"stem":132},"Windows","\u002Fclient\u002Fgui\u002Floliafrpclient\u002Fwindows","4.client\u002F1.gui\u002F1.loliafrpclient\u002F2.Windows",{"title":134,"path":135,"stem":136},"Linux","\u002Fclient\u002Fgui\u002Floliafrpclient\u002Flinux","4.client\u002F1.gui\u002F1.loliafrpclient\u002F3.Linux",{"title":138,"path":139,"stem":140},"Android","\u002Fclient\u002Fgui\u002Floliafrpclient\u002Fandroid","4.client\u002F1.gui\u002F1.loliafrpclient\u002F4.Android",{"title":142,"path":143,"stem":144,"children":145,"page":40},"LoliaShizuku","\u002Fclient\u002Fgui\u002Floliashizuku","4.client\u002F1.gui\u002F2.loliashizuku",[146,149],{"title":126,"path":147,"stem":148},"\u002Fclient\u002Fgui\u002Floliashizuku\u002Floliashizuku","4.client\u002F1.gui\u002F2.loliashizuku\u002F1.loliashizuku",{"title":150,"path":151,"stem":152},"快速入门","\u002Fclient\u002Fgui\u002Floliashizuku\u002Fusage","4.client\u002F1.gui\u002F2.loliashizuku\u002F2.usage",{"title":154,"path":155,"stem":156},"Kairo","\u002Fclient\u002Fgui\u002Fkairo","4.client\u002F1.gui\u002F3.kairo",{"title":158,"icon":159,"path":160,"stem":161,"children":162,"page":40},"命令行客户端","i-lucide-square-terminal","\u002Fclient\u002Fcli","4.client\u002F2.cli",[163,167],{"title":164,"path":165,"stem":166},"Lolia CLI","\u002Fclient\u002Fcli\u002Fcli","4.client\u002F2.cli\u002F1.cli",{"title":168,"path":169,"stem":170},"参考","\u002Fclient\u002Fcli\u002Freference","4.client\u002F2.cli\u002F2.reference",{"title":172,"icon":173,"path":174,"stem":175,"children":176,"page":40},"面板客户端","i-lucide-app-window","\u002Fclient\u002Fweb","4.client\u002F3.web",[177,181],{"title":178,"path":179,"stem":180},"MCSManager FRP模板","\u002Fclient\u002Fweb\u002Fmcsm","4.client\u002F3.web\u002F1.mcsm",{"title":182,"path":183,"stem":184},"MSLX 面板插件","\u002Fclient\u002Fweb\u002Fmslx","4.client\u002F3.web\u002F2.mslx",{"title":186,"icon":187,"path":188,"stem":189,"children":190,"page":40},"配置指南","i-lucide-sliders-horizontal","\u002Ftutorials","5.tutorials",[191,210,261,286],{"title":192,"icon":193,"path":194,"stem":195,"children":196,"page":40},"常见应用","i-lucide-toolbox","\u002Ftutorials\u002Fapp","5.tutorials\u002F1.app",[197],{"title":198,"path":199,"stem":200,"children":201,"page":40},"RDP远程桌面","\u002Ftutorials\u002Fapp\u002Frdp","5.tutorials\u002F1.app\u002F1.rdp",[202,206],{"title":203,"path":204,"stem":205},"通用配置","\u002Ftutorials\u002Fapp\u002Frdp\u002Fintroduction","5.tutorials\u002F1.app\u002F1.rdp\u002F1.introduction",{"title":207,"path":208,"stem":209},"以服务模式运行LoliaFRP","\u002Ftutorials\u002Fapp\u002Frdp\u002Fcli-tutorial","5.tutorials\u002F1.app\u002F1.rdp\u002F2.cli-tutorial",{"title":211,"icon":212,"path":213,"stem":214,"children":215,"page":40},"游戏应用","i-lucide-gamepad-2","\u002Ftutorials\u002Fgame","5.tutorials\u002F2.game",[216,257],{"title":217,"path":218,"stem":219,"children":220,"page":40},"Minecraft","\u002Ftutorials\u002Fgame\u002Fminecraft","5.tutorials\u002F2.game\u002F1.minecraft",[221,225,229,233,237,241,245,249,253],{"title":222,"path":223,"stem":224},"Java 版局域网联机","\u002Ftutorials\u002Fgame\u002Fminecraft\u002Fmcjavalan","5.tutorials\u002F2.game\u002F1.minecraft\u002F1.mcjavalan",{"title":226,"path":227,"stem":228},"Java 版独立服务器","\u002Ftutorials\u002Fgame\u002Fminecraft\u002Fmcjavaserver","5.tutorials\u002F2.game\u002F1.minecraft\u002F2.mcjavaserver",{"title":230,"path":231,"stem":232},"Simple Voice Chat","\u002Ftutorials\u002Fgame\u002Fminecraft\u002Fsimplevoicechat","5.tutorials\u002F2.game\u002F1.minecraft\u002F3.simplevoicechat",{"title":234,"path":235,"stem":236},"外置登录联机教程","\u002Ftutorials\u002Fgame\u002Fminecraft\u002Fauthlib-injector","5.tutorials\u002F2.game\u002F1.minecraft\u002F4.authlib-injector",{"title":238,"path":239,"stem":240},"基岩版服务器（BDS）","\u002Ftutorials\u002Fgame\u002Fminecraft\u002Fbedrock-nethernet","5.tutorials\u002F2.game\u002F1.minecraft\u002F5.bedrock-nethernet",{"title":242,"path":243,"stem":244},"旧版基岩版（RakNet）","\u002Ftutorials\u002Fgame\u002Fminecraft\u002Fbedrock-raknet","5.tutorials\u002F2.game\u002F1.minecraft\u002F6.bedrock-raknet",{"title":246,"path":247,"stem":248},"Geyser 互通服","\u002Ftutorials\u002Fgame\u002Fminecraft\u002Fgeysermc","5.tutorials\u002F2.game\u002F1.minecraft\u002F7.geysermc",{"title":250,"path":251,"stem":252},"旧版 Geyser（RakNet）","\u002Ftutorials\u002Fgame\u002Fminecraft\u002Fgeyser-raknet","5.tutorials\u002F2.game\u002F1.minecraft\u002F8.geyser-raknet",{"title":254,"path":255,"stem":256},"SRV 解析","\u002Ftutorials\u002Fgame\u002Fminecraft\u002Fsrv-record","5.tutorials\u002F2.game\u002F1.minecraft\u002F9.srv-record",{"title":258,"path":259,"stem":260},"星露谷物语多人联机","\u002Ftutorials\u002Fgame\u002Fstardew-valley","5.tutorials\u002F2.game\u002F2.stardew-valley",{"title":262,"icon":263,"path":264,"stem":265,"children":266,"page":40},"网页应用","i-lucide-link-2","\u002Ftutorials\u002Fweb","5.tutorials\u002F3.web",[267,270,274,278,282],{"title":150,"path":268,"stem":269},"\u002Ftutorials\u002Fweb\u002Fquick-start","5.tutorials\u002F3.web\u002F1.quick-start",{"title":271,"path":272,"stem":273},"DNS 配置","\u002Ftutorials\u002Fweb\u002Fdns-config","5.tutorials\u002F3.web\u002F2.dns-config",{"title":275,"path":276,"stem":277},"Apache","\u002Ftutorials\u002Fweb\u002Fapache","5.tutorials\u002F3.web\u002F3.apache",{"title":279,"path":280,"stem":281},"NGINX","\u002Ftutorials\u002Fweb\u002Fnginx","5.tutorials\u002F3.web\u002F4.nginx",{"title":283,"path":284,"stem":285},"获取访客真实IP","\u002Ftutorials\u002Fweb\u002Fget-realip","5.tutorials\u002F3.web\u002F5.get-realip",{"title":287,"icon":288,"path":289,"stem":290,"children":291,"page":40},"进阶配置","i-lucide-file-cog","\u002Ftutorials\u002Fadvanced","5.tutorials\u002F4.advanced",[292,296,300,304,308],{"title":293,"path":294,"stem":295},"配置PROXY protocol","\u002Ftutorials\u002Fadvanced\u002Fproxy-protocol","5.tutorials\u002F4.advanced\u002F1.proxy-protocol",{"title":297,"path":298,"stem":299},"双栈网络配置","\u002Ftutorials\u002Fadvanced\u002Fmixed-v4-v6","5.tutorials\u002F4.advanced\u002F2.mixed-v4-v6",{"title":301,"path":302,"stem":303},"AutoTLS","\u002Ftutorials\u002Fadvanced\u002Fautotls","5.tutorials\u002F4.advanced\u002F3.autotls",{"title":305,"path":306,"stem":307},"多个隧道创建和使用","\u002Ftutorials\u002Fadvanced\u002Fmulti-tunnel","5.tutorials\u002F4.advanced\u002F4.multi-tunnel",{"title":309,"path":310,"stem":311},"使用自己的域名","\u002Ftutorials\u002Fadvanced\u002Fcname","5.tutorials\u002F4.advanced\u002F5.cname",{"title":313,"icon":314,"defaultOpen":40,"path":315,"stem":316,"children":317,"page":40},"开发者","i-lucide-folder-code","\u002Fdevelopers","6.developers",[318,323],{"title":319,"path":320,"stem":321,"icon":322},"LoliaFRP Open API","\u002Fdevelopers\u002Fopenapi","6.developers\u002F1.openapi","i-lucide-webhook",{"title":324,"path":325,"stem":326,"icon":327},"OAuth2 鉴权","\u002Fdevelopers\u002Foauth","6.developers\u002F2.oauth","i-lucide-fingerprint-pattern",{"title":329,"icon":330,"defaultOpen":40,"path":331,"stem":332,"children":333,"page":40},"扩展阅读","i-lucide-book-open-text","\u002Fextension","7.extension",[334,338,360],{"title":126,"path":335,"stem":336,"icon":337},"\u002Fextension\u002Fabout","7.extension\u002F1.about","i-lucide-text-initial",{"title":339,"icon":340,"defaultOpen":40,"path":341,"stem":342,"children":343,"page":40},"相关原理","i-lucide-monitor-cloud","\u002Fextension\u002Fbasics","7.extension\u002F2.basics",[344,348,352,356],{"title":345,"path":346,"stem":347},"frp 的工作基础","\u002Fextension\u002Fbasics\u002Ffrp-base","7.extension\u002F2.basics\u002F1.frp-base",{"title":349,"path":350,"stem":351},"TLS 与证书","\u002Fextension\u002Fbasics\u002Ftls","7.extension\u002F2.basics\u002F2.tls",{"title":353,"path":354,"stem":355},"密码学基础","\u002Fextension\u002Fbasics\u002Fcrypto","7.extension\u002F2.basics\u002F3.crypto",{"title":357,"path":358,"stem":359},"HTTP 虚拟主机","\u002Fextension\u002Fbasics\u002Fhttp-vhost","7.extension\u002F2.basics\u002F4.http-vhost",{"title":361,"icon":362,"defaultOpen":40,"path":363,"stem":364,"children":365,"page":40},"疑难解答","i-lucide-bug-off","\u002Fextension\u002Fapplications","7.extension\u002F3.applications",[366],{"title":367,"path":368,"stem":369},"Minecraft Java SRV与forced hosts搭配","\u002Fextension\u002Fapplications\u002Fminecraft-srv-forced-hosts","7.extension\u002F3.applications\u002F1.minecraft-srv-forced-hosts",{"title":371,"path":372,"stem":373,"icon":374},"社区","\u002Fcommunity","8.community","i-lucide-users",{"title":376,"path":377,"stem":378,"icon":379},"参与贡献","\u002Fcontributing","9.contributing","i-lucide-git-pull-request-arrow",{"id":381,"title":349,"body":382,"description":781,"extension":782,"links":783,"meta":784,"navigation":785,"path":350,"seo":786,"stem":351,"__hash__":787},"docs\u002F7.extension\u002F2.basics\u002F2.tls.md",{"type":383,"value":384,"toc":768},"minimark",[385,396,401,405,427,430,434,437,489,496,499,504,518,521,593,596,600,603,665,668,694,698,701,717,720,724,734,741,745],[386,387,388,389,392,393,395],"tip",{},"本文只讲原理，不涉及配置。启用 HTTPS 请见 ",[390,391,301],"a",{"href":302},"；密码套件、密钥交换等算法细节见",[390,394,353],{"href":354},"。",[397,398,400],"h2",{"id":399},"_1-加密与身份","1. 加密与身份",[402,403,404],"p",{},"TLS 同时解决两件事：",[406,407,408,416],"ul",{},[409,410,411,415],"li",{},[412,413,414],"strong",{},"加密","：链路被截获也读不出内容，被篡改也能发现",[409,417,418,421,422,426],{},[412,419,420],{},"身份","：向访客证明「连接的确实是 ",[423,424,425],"code",{},"example.com","」，而不是冒充它的中间设备",[402,428,429],{},"两者是分开的。任何一对公私钥都能协商出加密通道，自签证书同样可以；证书只负责身份。所以「自签不安全」的准确含义是「没人能确认它是谁」，而不是「流量没有加密」。",[397,431,433],{"id":432},"_2-证书","2. 证书",[402,435,436],{},"证书是一份由 CA 签名的文件，核心内容如下：",[438,439,440,453],"table",{},[441,442,443],"thead",{},[444,445,446,450],"tr",{},[447,448,449],"th",{},"内容",[447,451,452],{},"作用",[454,455,456,465,473,481],"tbody",{},[444,457,458,462],{},[459,460,461],"td",{},"域名",[459,463,464],{},"这张证书代表哪些名字，格式见 2.1",[444,466,467,470],{},[459,468,469],{},"公钥",[459,471,472],{},"与私钥配对，用于握手",[444,474,475,478],{},[459,476,477],{},"有效期",[459,479,480],{},"到期即失效，需要重新签发",[444,482,483,486],{},[459,484,485],{},"签发者与签名",[459,487,488],{},"让客户端能从内置的根证书验到它",[402,490,491,492,495],{},"私钥不在证书里，与证书分开保存。",[412,493,494],{},"谁终止 TLS，私钥就在谁手里","：证书可以公开，私钥泄露等于身份被冒用。",[402,497,498],{},"验证是一条链：客户端从操作系统或浏览器内置的根证书出发，用签发者的公钥逐级验签，直到这张证书。链上少一环——例如只部署了域名证书、漏掉中间证书——验证就不成立，部分客户端会直接报证书无效。",[500,501,503],"h3",{"id":502},"_21-subject-alternative-name","2.1 Subject Alternative Name",[402,505,506,507,510,511,514,515,517],{},"证书里列出域名的字段是 ",[423,508,509],{},"Subject Alternative Name","（SAN）。客户端只看这一项，",[423,512,513],{},"CN"," 已被忽略，只填 ",[423,516,513],{}," 的证书在现代客户端上不会被接受。",[402,519,520],{},"匹配规则：",[438,522,523,533],{},[441,524,525],{},[444,526,527,530],{},[447,528,529],{},"规则",[447,531,532],{},"说明",[454,534,535,543,565,573,581],{},[444,536,537,540],{},[459,538,539],{},"逐字匹配",[459,541,542],{},"访问的域名要与 SAN 中某一项完全一致（大小写不敏感）",[444,544,545,548],{},[459,546,547],{},"通配符",[459,549,550,551,554,555,558,559,561,562],{},"只能位于最左一个标签，且只覆盖一级：",[423,552,553],{},"*.example.com"," 含 ",[423,556,557],{},"a.example.com","，不含 ",[423,560,425],{},"，也不含 ",[423,563,564],{},"a.b.example.com",[444,566,567,570],{},[459,568,569],{},"多个名字",[459,571,572],{},"一个 SAN 可以列出多个域名，一张证书服务多个站点",[444,574,575,578],{},[459,576,577],{},"IP 地址",[459,579,580],{},"IP 也能写进 SAN，用 IP 直连时客户端校验的是这一项",[444,582,583,586],{},[459,584,585],{},"非 ASCII",[459,587,588,589,592],{},"证书里写 punycode 形式（",[423,590,591],{},"xn--"," 开头）",[402,594,595],{},"名字写死在证书里，所以换域名就意味着重新签发；用 IP 访问只签了域名的证书，同样校验不过。",[397,597,599],{"id":598},"_3-握手","3. 握手",[402,601,602],{},"以 TLS 1.3 为例：",[604,605,606,618,630,651,659],"ol",{},[409,607,608,613,614,617],{},[412,609,610],{},[423,611,612],{},"ClientHello","：访客报出支持的版本与密码套件、一个随机数（",[423,615,616],{},"client_random","），并附上自己的临时公钥；SNI 与 ALPN 也在这里。整条消息都是明文",[409,619,620,625,626,629],{},[412,621,622],{},[423,623,624],{},"ServerHello","：服务器选定一套密码套件，回一个随机数（",[423,627,628],{},"server_random","）和自己的临时公钥。此刻双方的共享秘密已经成立，握手密钥随之导出",[409,631,632,635,636,639,640,643,644,647,648],{},[412,633,634],{},"此后全部加密","：",[423,637,638],{},"EncryptedExtensions","（ALPN 结果等）→ ",[423,641,642],{},"Certificate","（证书链）→ ",[423,645,646],{},"CertificateVerify","（用证书私钥对握手记录签名）→ ",[423,649,650],{},"Finished",[409,652,653,658],{},[412,654,655,656],{},"客户端回 ",[423,657,650],{},"：校验通过后才开始发送应用数据",[409,660,661,664],{},[412,662,663],{},"应用数据","：用协商出的会话密钥对称加密",[402,666,667],{},"几点值得注意：",[406,669,670,681,686,691],{},[409,671,672,673,676,677,680],{},"证书链在 1.3 里是密钥成立",[412,674,675],{},"之后","才发出，且已经加密；TLS 1.2 则是证书与 ",[423,678,679],{},"ServerKeyExchange"," 同一趟明文送出",[409,682,683,684],{},"明文只剩第一条消息，其中的 SNI 正是节点能在不解密的情况下按域名选路的依据，见 ",[390,685,357],{"href":358},[409,687,688,690],{},[423,689,646],{}," 用私钥签名，把证书与本次握手绑定在一起；只看证书链验不出私钥在谁手里",[409,692,693],{},"默认一次往返完成握手；会话恢复可以 0-RTT，代价是 0-RTT 数据有重放风险",[397,695,697],{"id":696},"_4-双向认证mtls","4. 双向认证（mTLS）",[402,699,700],{},"默认流程里只有服务器出示证书，访客验证它，这叫单向认证。**双向认证（mTLS）**要求访客也出示证书，服务器同样验它的签名链，并确认它由自己信任的 CA 签发。",[402,702,703,704,707,708,710,711,713,714,716],{},"在 TLS 1.3 里，服务器发出 ",[423,705,706],{},"CertificateRequest","，客户端回应自己的 ",[423,709,642],{}," 与 ",[423,712,646],{},"，握手其余部分不变；TLS 1.2 的 ",[423,715,706],{}," 位置靠前一些，本质相同。",[402,718,719],{},"两边的证书通常来自不同地方：服务器证书要能被不特定的客户端信任，由公开 CA 签发；客户端证书一般由自己架的 CA 签发，只把该 CA 的证书交给服务器校验即可。",[397,721,723],{"id":722},"_5-签发","5. 签发",[402,725,726,727,733],{},"签发是 CA 用自己的私钥为证书签名。公开 CA 不能凭空相信一个域名，签发前要求申请人先证明自己控制着它，证明方式有几种，区别只在于把证明放在哪里，详见 ",[390,728,732],{"href":729,"rel":730},"https:\u002F\u002Fletsencrypt.org\u002Fzh-cn\u002Fdocs\u002Fchallenge-types\u002F",[731],"nofollow","Let's Encrypt 的挑战类型说明","。自签不需要证明，代价是没有任何客户端会信任它，除非手动把这张证书或自建的根证书导入信任列表，所以只适合自用测试。",[402,735,736,737,740],{},"Lolia 的 AutoTLS 用的是 Let's Encrypt 的 TLS-ALPN-01，并且在 ",[412,738,739],{},"frpc 本地","完成签发与续期：验证流量先到达节点，再按域名交给 frpc。",[397,742,744],{"id":743},"_6-结论","6. 结论",[406,746,747,750,753,756,759,762,765],{},[409,748,749],{},"加密与身份是两件事，自签能加密但证明不了身份",[409,751,752],{},"客户端只认 SAN 与信任链，名字对不上或链断了都视为无效",[409,754,755],{},"TLS 1.3 先用临时公钥成立密钥，证书在加密之后才送达",[409,757,758],{},"证书与私钥成对，谁终止 TLS 谁持有私钥",[409,760,761],{},"签发的是域名而不是机器，域名变了就要重签",[409,763,764],{},"双向认证让访客也出示证书，但它只证明身份，授权仍在应用层",[409,766,767],{},"签发发生在本地，验证流量要能经节点到达 frpc",{"title":769,"searchDepth":770,"depth":770,"links":771},"",2,[772,773,777,778,779,780],{"id":399,"depth":770,"text":400},{"id":432,"depth":770,"text":433,"children":774},[775],{"id":502,"depth":776,"text":503},3,{"id":598,"depth":770,"text":599},{"id":696,"depth":770,"text":697},{"id":722,"depth":770,"text":723},{"id":743,"depth":770,"text":744},"TLS 如何证明服务器身份、证书的 SAN 匹配规则、TLS 1.3 的握手流程与双向认证（mTLS）","md",null,{},true,{"title":349,"description":781},"0Q7yDFbYCIwJ8Zq7wY0dOgYPhhjxjqzPCkr9nDS9TXk",[789,791],{"title":345,"path":346,"stem":347,"description":790,"children":-1},"frps 与 frpc 如何建立连接，隧道按什么层级把访客请求转发到本地服务",{"title":353,"path":354,"stem":355,"description":792,"children":-1},"TLS 用到的两类密码：密钥交换与前向保密、AEAD、密钥派生，以及密码套件名字的读法",1793537051472]