From 9404d7f9c86a8ec4c373eb0e798ef2ae51a0d852 Mon Sep 17 00:00:00 2001
From: smail <likb_blue@163.com>
Date: Sun, 6 Sep 2026 08:58:08 +0800
Subject: [PATCH] =?UTF-8?q?=E4=BF=AE=E5=A4=8DSSL=E6=8C=91=E6=88=98?=
 =?UTF-8?q?=E6=96=B9=E5=BC=8F=E9=85=8D=E7=BD=AE=E8=BF=81=E7=A7=BB?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 backend/config/config.go                    | 5 +++++
 backend/config/migrate.go                   | 6 ++++++
 backend/config/model.go                     | 1 +
 backend/config/partitioned_compatibility.go | 6 +++++-
 backend/config/validator.go                 | 3 +++
 5 files changed, 20 insertions(+), 1 deletion(-)

diff --git a/backend/config/config.go b/backend/config/config.go
index dc8d5ad..968a34f 100644
--- a/backend/config/config.go
+++ b/backend/config/config.go
@@ -121,6 +121,11 @@ func (c *Config) SetSetupPort(setupPort int) {
 const DBTypeMySQL = "mysql"
 const DBTypeSQLite = "sqlite"
 const DBTypePostgres = "postgres"
+
+const (
+	SSLChallengeHTTP = "http"
+	SSLChallengeDNS  = "dns"
+)
 const SSLTypeAutoHTTP = "0" //自动生成证书
 const SSLTypeAutoDNS = "2"  //自动生成证书，DNS api验证
 const SSLTypeUser = "1"     //用户上传证书
diff --git a/backend/config/migrate.go b/backend/config/migrate.go
index a04ed37..838f979 100644
--- a/backend/config/migrate.go
+++ b/backend/config/migrate.go
@@ -737,6 +737,12 @@ func legacySSLConfig(legacy legacyMigrationConfig) (SSLConfig, []string) {
 	certificateRef, certificateOK := legacyControlledReference(legacy.SSLPublicKeyPath)
 	privateKeyRef, privateKeyOK := legacyControlledReference(legacy.SSLPrivateKeyPath)
 	ssl := SSLConfig{Mode: ManagedSSLModeDefault, DefaultDirectory: "config/ssl"}
+	switch legacy.SSLType {
+	case SSLTypeAutoDNS:
+		ssl.Challenge = SSLChallengeDNS
+	case SSLTypeAutoHTTP:
+		ssl.Challenge = SSLChallengeHTTP
+	}
 	if legacy.SSLType == SSLTypeUser {
 		ssl.Mode = ManagedSSLModeUpload
 		ssl.CustomDirectory = "config/ssl"
diff --git a/backend/config/model.go b/backend/config/model.go
index b69f563..0cb9754 100644
--- a/backend/config/model.go
+++ b/backend/config/model.go
@@ -107,6 +107,7 @@ type SSLConfig struct {
 	Mode             string `json:"mode"`
 	DefaultDirectory string `json:"defaultDirectory"`
 	CustomDirectory  string `json:"customDirectory,omitempty"`
+	Challenge        string `json:"challenge,omitempty"`
 	CertificateRef   string `json:"certificateRef,omitempty"`
 	PrivateKeyRef    string `json:"privateKeyRef,omitempty"`
 }
diff --git a/backend/config/partitioned_compatibility.go b/backend/config/partitioned_compatibility.go
index 93d9024..e4683d0 100644
--- a/backend/config/partitioned_compatibility.go
+++ b/backend/config/partitioned_compatibility.go
@@ -74,7 +74,11 @@ func loadPartitionedCompatibility() (*Config, error) {
 	}
 	tls := runtime.SSL.TLS
 	if tls.Mode == ManagedSSLModeDefault {
-		cfg.SSLType = SSLTypeAutoHTTP
+		if tls.Challenge == SSLChallengeDNS {
+			cfg.SSLType = SSLTypeAutoDNS
+		} else {
+			cfg.SSLType = SSLTypeAutoHTTP
+		}
 	}
 	// 迁移器保留的旧证书引用仍走严格的只读文件校验；新托管引用沿用托管解析器。
 	if strings.HasPrefix(tls.CertificateRef, managedSSLRelativeRoot+"/") {
diff --git a/backend/config/validator.go b/backend/config/validator.go
index 0b6c58e..41c122d 100644
--- a/backend/config/validator.go
+++ b/backend/config/validator.go
@@ -186,6 +186,9 @@ func validateSSL(ssl SSLConfig) error {
 	if !isControlledRelativePath(ssl.DefaultDirectory) {
 		return ErrInvalidSSL
 	}
+	if ssl.Challenge != "" && ssl.Challenge != SSLChallengeHTTP && ssl.Challenge != SSLChallengeDNS {
+		return ErrInvalidSSL
+	}
 	activeDirectory := ssl.DefaultDirectory
 	switch ssl.Mode {
 	case ManagedSSLModeDefault, "default":