feat: initial commit of clean multi-protocol singbox core script

2026-09-27 13:11:24 +08:00
commit 34565faa6b
10 changed files with 1475 additions and 0 deletions
@@ -0,0 +1,48 @@
+#!/usr/bin/env bash
+# ==============================================================================
+# 模块：TLS 证书自动化生成与管理 (支持 ECDSA 现代自签与自定义证书)
+# ==============================================================================
+
+CERT_DIR="${INSTALL_DIR}/cert"
+CERT_FILE="${CERT_DIR}/cert.pem"
+KEY_FILE="${CERT_DIR}/private.key"
+
+# 生成现代椭圆曲线 (prime256v1) 自签名证书
+generate_self_signed_cert() {
+    local sni="${1:-www.bing.com}"
+    mkdir -p "${CERT_DIR}"
+
+    # 如果证书已存在且有效期超过30天，直接复用
+    if [[ -f "${CERT_FILE}" && -f "${KEY_FILE}" ]]; then
+        if openssl x509 -checkend 2592000 -noout -in "${CERT_FILE}" >/dev/null 2>&1; then
+            log_info "现有 TLS 证书有效，直接复用: ${CERT_FILE}"
+            return 0
+        fi
+    fi
+
+    log_info "正在为伪装域名 [${sni}] 自动化生成 ECDSA (P-256) 高性能自签名 TLS 证书..."
+
+    # 生成 EC 私钥
+    openssl ecparam -name prime256v1 -genkey -noout -out "${KEY_FILE}" 2>/dev/null
+
+    # 生成 10 年有效期的自签名证书
+    openssl req -new -x509 -days 3650 \
+        -key "${KEY_FILE}" \
+        -out "${CERT_FILE}" \
+        -subj "/CN=${sni}" \
+        -addext "subjectAltName=DNS:${sni}" 2>/dev/null || \
+    openssl req -new -x509 -days 3650 \
+        -key "${KEY_FILE}" \
+        -out "${CERT_FILE}" \
+        -subj "/CN=${sni}" 2>/dev/null
+
+    chmod 600 "${KEY_FILE}" "${CERT_FILE}"
+
+    if [[ ! -s "${CERT_FILE}" || ! -s "${KEY_FILE}" ]]; then
+        log_error "TLS 自签名证书生成失败，请检查 openssl 环境！"
+        return 1
+    fi
+
+    log_success "TLS 证书自动化生成完成！"
+    return 0
+}