From c68ca8116ffd752010cdfe9c6ce624913db2a55f Mon Sep 17 00:00:00 2001 From: smail Date: Tue, 22 Sep 2026 05:18:52 +0800 Subject: [PATCH] =?UTF-8?q?=E5=AE=8C=E6=88=90SSL=E5=AE=89=E5=85=A8?= =?UTF-8?q?=E5=91=8A=E8=AD=A6=E6=94=B6=E6=95=9B?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- backend/services/setup/ssl/dns_automatic.go | 4 ++-- backend/services/setup/ssl/ssl.go | 11 ++--------- 2 files changed, 4 insertions(+), 11 deletions(-) diff --git a/backend/services/setup/ssl/dns_automatic.go b/backend/services/setup/ssl/dns_automatic.go index 35c985d6..43fb6713 100644 --- a/backend/services/setup/ssl/dns_automatic.go +++ b/backend/services/setup/ssl/dns_automatic.go @@ -3,7 +3,7 @@ package ssl import ( "crypto/hmac" "crypto/rand" - "crypto/sha1" + "crypto/sha1" // #nosec G505 -- 阿里云 DNS RPC API 要求 HMAC-SHA1 "encoding/base64" "encoding/hex" "encoding/json" @@ -199,7 +199,7 @@ func (provider *aliDNSChallenge) call(action string, values url.Values, target a canonical := strings.ReplaceAll(values.Encode(), "+", "%20") // 阿里云 DNS RPC API 的当前签名协议固定使用 HMAC-SHA1；此处不能自行替换为 SHA-256， // 否则服务商会拒绝请求。请求通过 HTTPS 发送，密钥只用于内存中的签名计算。 - mac := hmac.New(sha1.New, []byte(provider.secretKey+"&")) // #nosec G505 -- 阿里云 DNS RPC API 要求 HMAC-SHA1 + mac := hmac.New(sha1.New, []byte(provider.secretKey+"&")) _, _ = mac.Write([]byte("POST&%2F&" + aliDNSPercentEncode(canonical))) values.Set("Signature", base64.StdEncoding.EncodeToString(mac.Sum(nil))) request, err := http.NewRequest(http.MethodPost, provider.endpoint, strings.NewReader(values.Encode())) diff --git a/backend/services/setup/ssl/ssl.go b/backend/services/setup/ssl/ssl.go index e5be5544..fc85cea1 100644 --- a/backend/services/setup/ssl/ssl.go +++ b/backend/services/setup/ssl/ssl.go @@ -551,15 +551,8 @@ func GenSSL(update bool) error { } if !update { - privatePath, publicPath, pathErr := config.ResolveRuntimeSSLPaths(cfg) - privateFile, errpi := os.ReadFile(privatePath) - public, errpu := os.ReadFile(publicPath) - if pathErr != nil { - errpi = pathErr - errpu = pathErr - } - // 当前存在证书数据，就不生成了 - if errpi == nil && errpu == nil && len(privateFile) > 0 && len(public) > 0 { + // 只有当前受控证书完整有效时才跳过申请，避免仅凭路径读取结果复用不安全文件。 + if _, err := config.LoadRuntimeTLSCertificate(cfg); err == nil { return nil } }