From 4e532fa93b04b0c7fe467c412a9bebb0dce51da2 Mon Sep 17 00:00:00 2001 From: Z User Date: Mon, 31 Aug 2026 06:42:20 +0000 Subject: [PATCH] fix(tls): regenerate full cert pair when only key or cert is present Half-filled TLS material blocked autofill and left TUIC/AnyTLS without a usable certificate. Clear the partial pair and issue a new self-signed certificate+key together. fix(tls): regenerate full cert pair when only key or cert is present Half-filled TLS material blocked autofill and left TUIC/AnyTLS without a usable certificate. Clear the partial pair and issue a new self-signed certificate+key together. fix(tls): regenerate full cert pair when only key or cert is present Half-filled TLS material blocked autofill and left TUIC/AnyTLS without a usable certificate. Clear the partial pair and issue a new self-signed certificate+key together. fix(tls): regenerate full cert pair when only key or cert is present Half-filled TLS material blocked autofill and left TUIC/AnyTLS without a usable certificate. Clear the partial pair and issue a new self-signed certificate+key together. fix(tls): regenerate full cert pair when only key or cert is present Half-filled TLS material blocked autofill and left TUIC/AnyTLS without a usable certificate. Clear the partial pair and issue a new self-signed certificate+key together. fix(tls): regenerate full cert pair when only key or cert is present Half-filled TLS material blocked autofill and left TUIC/AnyTLS without a usable certificate. Clear the partial pair and issue a new self-signed certificate+key together. fix(tls): regenerate full cert pair when only key or cert is present Half-filled TLS material blocked autofill and left TUIC/AnyTLS without a usable certificate. Clear the partial pair and issue a new self-signed certificate+key together. fix(tls): regenerate full cert pair when only key or cert is present Half-filled TLS material blocked autofill and left TUIC/AnyTLS without a usable certificate. Clear the partial pair and issue a new self-signed certificate+key together. fix(tls): regenerate full cert pair when only key or cert is present Half-filled TLS material blocked autofill and left TUIC/AnyTLS without a usable certificate. Clear the partial pair and issue a new self-signed certificate+key together. fix(tls): regenerate full cert pair when only key or cert is present Half-filled TLS material blocked autofill and left TUIC/AnyTLS without a usable certificate. Clear the partial pair and issue a new self-signed certificate+key together. fix(tls): regenerate full cert pair when only key or cert is present Half-filled TLS material blocked autofill and left TUIC/AnyTLS without a usable certificate. Clear the partial pair and issue a new self-signed certificate+key together. fix(tls): regenerate full cert pair when only key or cert is present Half-filled TLS material blocked autofill and left TUIC/AnyTLS without a usable certificate. Clear the partial pair and issue a new self-signed certificate+key together. --- backend/internal/mihomo/config/tls_ensure.go | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/backend/internal/mihomo/config/tls_ensure.go b/backend/internal/mihomo/config/tls_ensure.go index 4422a92..498fe13 100644 --- a/backend/internal/mihomo/config/tls_ensure.go +++ b/backend/internal/mihomo/config/tls_ensure.go @@ -47,9 +47,11 @@ func ensureListenerTLSMaterial(protocol string, cfg map[string]interface{}) erro delete(cfg, "allow-insecure") return nil } - // Partial cert/key — leave for validator; do not invent half a pair. + // Partial pair (only cert or only key) cannot work — drop and regenerate. if strings.TrimSpace(cert) != "" || strings.TrimSpace(key) != "" { - return nil + delete(cfg, "certificate") + delete(cfg, "private-key") + delete(cfg, "private_key") } if !listenerProtocolNeedsCert(proto, cfg) { return nil