1
[req]
2
distinguished_name = req_distinguished_name
3
req_extensions = v3_req
4
prompt = no
5

6
[req_distinguished_name]
7
CN = example.com  # 随意填写，主要看下面的 SAN
8

9
[v3_req]
10
keyUsage = keyEncipherment, dataEncipherment
11
extendedKeyUsage = serverAuth, clientAuth
12
subjectAltName = @alt_names
13

14
[alt_names]
15
IP.1 = 1.2.3.4          # 替换为你的服务器公网 IP
16
DNS.1 = yourdomain.com  # 替换为你的域名（如果没有则删掉此行）

1
# 1. 生成 CA 根证书
2
openssl genrsa -out ca.key 2048
3
openssl req -x509 -new -nodes -key ca.key -subj "/CN=MyfrpCA" -days 3650 -out ca.crt
4

5
# 2. 生成服务端证书 (关联 openssl.cnf)
6
openssl genrsa -out server.key 2048
7
openssl req -new -key server.key -config openssl.cnf -out server.csr
8
openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out server.crt -days 3650 -extensions v3_req -extfile openssl.cnf
9

10
# 3. 生成客户端证书 (双向验证才需要)
11
openssl genrsa -out client.key 2048
12
openssl req -new -key client.key -subj "/CN=frp-client" -out client.csr
13
openssl x509 -req -in client.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out client.crt -days 3650

1
bindPort = 7000
2
auth.token = "your_token"
3

4
[transport.tls]
5
force = true
6
certFile = "/etc/frp/ssl/server.crt"
7
keyFile = "/etc/frp/ssl/server.key"
8
trustedCaFile = "/etc/frp/ssl/ca.crt" # 验证客户端证书

1
serverAddr = "1.2.3.4"
2
serverPort = 7000
3
auth.token = "your_token"
4

5
[transport.tls]
6
enable = true
7
certFile = "/etc/frp/ssl/client.crt"     # 客户端证书
8
keyFile = "/etc/frp/ssl/client.key"      # 客户端私钥
9
trustedCaFile = "/etc/frp/ssl/ca.crt"    # 验证服务端证书
10
serverName = "1.2.3.4"        # 必须与证书中的 IP.1 一致

1
bindPort = 7000
2
auth.token = "your_token"
3

4
[transport.tls]
5
force = true
6
certFile = "/etc/frp/ssl/server.crt"
7
keyFile = "/etc/frp/ssl/server.key"
8
# 单向验证：不要写 trustedCaFile

1
serverAddr = "yourdomain.com"
2
serverPort = 7000
3
auth.token = "your_token"
4

5
[transport.tls]
6
enable = true
7
trustedCaFile = "/etc/frp/ssl/ca.crt"    # 验证服务端域名证书
8
serverName = "yourdomain.com" # 必须与证书中的域名一致