xinyin025/3x-ui
1
0
Fork 0
mirror of https://github.com/MHSanaei/3x-ui.git synced 2026-08-23 19:37:13 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(tls): default OCSP stapling to off for new inbound certs

Browse Source 
Certs without an OCSP responder URL (e.g. Let's Encrypt, which dropped OCSP in 2025) made xray log 'ignoring invalid OCSP: no OCSP server specified in cert' on every refresh. Default the per-cert ocspStapling interval to 0 (disabled) so new inbounds stay quiet; the field is kept for certs that do support stapling.
This commit is contained in:
MHSanaei
2026-06-21 19:15:57 +02:00
parent 3aa76ea05b
commit 39774a6a38
5 changed files with 10 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
frontend/src/lib/xray/inbound-tls-defaults.ts
+1 -1
View File
@@ -7,7 +7,7 @@ function defaultCertificate(): Record<string, unknown> {
keyFile: '', keyFile: '',
certificate: [], certificate: [],
key: [], key: [],
ocspStapling: 3600, ocspStapling: 0,
oneTimeLoading: false, oneTimeLoading: false,
usage: 'encipherment', usage: 'encipherment',
buildChain: false, buildChain: false,
frontend/src/pages/inbounds/form/security/tls.tsx
+1 -1
View File
@@ -132,7 +132,7 @@ export default function TlsForm({
keyFile: '', keyFile: '',
certificate: [], certificate: [],
key: [], key: [],
ocspStapling: 3600, ocspStapling: 0,
oneTimeLoading: false, oneTimeLoading: false,
usage: 'encipherment', usage: 'encipherment',
buildChain: false, buildChain: false,
frontend/src/schemas/protocols/security/tls.ts
+2 -2
View File
@@ -39,7 +39,7 @@ export type TlsCertUsage = z.infer<typeof TlsCertUsageSchema>;
export const TlsCertFileSchema = z.object({ export const TlsCertFileSchema = z.object({
certificateFile: z.string().min(1), certificateFile: z.string().min(1),
keyFile: z.string().min(1), keyFile: z.string().min(1),
ocspStapling: z.number().default(3600), ocspStapling: z.number().default(0),
oneTimeLoading: z.boolean().default(false), oneTimeLoading: z.boolean().default(false),
usage: TlsCertUsageSchema.default('encipherment'), usage: TlsCertUsageSchema.default('encipherment'),
buildChain: z.boolean().default(false), buildChain: z.boolean().default(false),
@@ -47,7 +47,7 @@ export const TlsCertFileSchema = z.object({
export const TlsCertInlineSchema = z.object({ export const TlsCertInlineSchema = z.object({
certificate: z.array(z.string()), certificate: z.array(z.string()),
key: z.array(z.string()), key: z.array(z.string()),
ocspStapling: z.number().default(3600), ocspStapling: z.number().default(0),
oneTimeLoading: z.boolean().default(false), oneTimeLoading: z.boolean().default(false),
usage: TlsCertUsageSchema.default('encipherment'), usage: TlsCertUsageSchema.default('encipherment'),
buildChain: z.boolean().default(false), buildChain: z.boolean().default(false),
frontend/src/test/__snapshots__/inbound-full.test.ts.snap
+5 -5
View File
@@ -57,7 +57,7 @@ exports[`InboundSchema (full) fixtures > parses hysteria-v1-tls byte-stably 1`]
"buildChain": false, "buildChain": false,
"certificateFile": "/etc/ssl/certs/hysteria.crt", "certificateFile": "/etc/ssl/certs/hysteria.crt",
"keyFile": "/etc/ssl/private/hysteria.key", "keyFile": "/etc/ssl/private/hysteria.key",
"ocspStapling": 3600, "ocspStapling": 0,
"oneTimeLoading": false, "oneTimeLoading": false,
"usage": "encipherment", "usage": "encipherment",
}, },
@@ -201,7 +201,7 @@ exports[`InboundSchema (full) fixtures > parses trojan-ws-tls byte-stably 1`] =
"buildChain": false, "buildChain": false,
"certificateFile": "/etc/ssl/certs/trojan.crt", "certificateFile": "/etc/ssl/certs/trojan.crt",
"keyFile": "/etc/ssl/private/trojan.key", "keyFile": "/etc/ssl/private/trojan.key",
"ocspStapling": 3600, "ocspStapling": 0,
"oneTimeLoading": false, "oneTimeLoading": false,
"usage": "encipherment", "usage": "encipherment",
}, },
@@ -379,7 +379,7 @@ exports[`InboundSchema (full) fixtures > parses vless-ws-tls byte-stably 1`] = `
"buildChain": false, "buildChain": false,
"certificateFile": "/etc/ssl/certs/cdn.example.test.crt", "certificateFile": "/etc/ssl/certs/cdn.example.test.crt",
"keyFile": "/etc/ssl/private/cdn.example.test.key", "keyFile": "/etc/ssl/private/cdn.example.test.key",
"ocspStapling": 3600, "ocspStapling": 0,
"oneTimeLoading": false, "oneTimeLoading": false,
"usage": "encipherment", "usage": "encipherment",
}, },
@@ -471,7 +471,7 @@ exports[`InboundSchema (full) fixtures > parses vless-ws-tls-pinned byte-stably
"buildChain": false, "buildChain": false,
"certificateFile": "/etc/ssl/certs/cdn.example.test.crt", "certificateFile": "/etc/ssl/certs/cdn.example.test.crt",
"keyFile": "/etc/ssl/private/cdn.example.test.key", "keyFile": "/etc/ssl/private/cdn.example.test.key",
"ocspStapling": 3600, "ocspStapling": 0,
"oneTimeLoading": false, "oneTimeLoading": false,
"usage": "encipherment", "usage": "encipherment",
}, },
@@ -570,7 +570,7 @@ exports[`InboundSchema (full) fixtures > parses vmess-tcp-tls byte-stably 1`] =
"buildChain": false, "buildChain": false,
"certificateFile": "/etc/ssl/certs/vmess.crt", "certificateFile": "/etc/ssl/certs/vmess.crt",
"keyFile": "/etc/ssl/private/vmess.key", "keyFile": "/etc/ssl/private/vmess.key",
"ocspStapling": 3600, "ocspStapling": 0,
"oneTimeLoading": false, "oneTimeLoading": false,
"usage": "encipherment", "usage": "encipherment",
}, },
frontend/src/test/__snapshots__/security.test.ts.snap
+1 -1
View File
@@ -51,7 +51,7 @@ exports[`SecuritySettingsSchema fixtures > parses tls-cert-file byte-stably 1`]
"buildChain": false, "buildChain": false,
"certificateFile": "/etc/ssl/certs/cdn.example.test.crt", "certificateFile": "/etc/ssl/certs/cdn.example.test.crt",
"keyFile": "/etc/ssl/private/cdn.example.test.key", "keyFile": "/etc/ssl/private/cdn.example.test.key",
"ocspStapling": 3600, "ocspStapling": 0,
"oneTimeLoading": false, "oneTimeLoading": false,
"usage": "encipherment", "usage": "encipherment",
}, },