{"topic":{"id":15304,"title":"当你想翻墙而不暴露该 IP 绑定的域名时","slug":"topic","categoryId":4,"createdAt":"2025-12-29 14:38:12.669849","bumpedAt":"2025-12-29 23:34:10.08485","views":159,"postsCount":2,"highestPostNumber":2,"likeCount":1,"closed":false,"pinned":false,"excerpt":"Let's Encrypt 正式支持给 IP 签发证书。但是目前的 Caddy 支持并不好。但是你可以用 acme.sh 自动签发证书给 caddy 用 [wrap=placeholder key=\"YOURIP\" description=\"YOUR IP\" default=\"115.154.4.8\"][/wrap] 首先关闭所有占用 80/443 端口的软件，安装 socat，用 acme.sh 独立模式手动签发一次 acme.s…","deletedAt":null,"isAnonymous":false,"category":{"id":4,"name":"谈笑风生","slug":"general","color":"25AAE2"},"author":{"id":7075,"username":"jbden","name":null,"avatarUrl":"/uploads/image/1e/8b/1e8bab3b6f297391fe23ceb66e7a57cad9bc903396007c9a08d6536889e5dcfe.avif"},"tags":[]},"posts":[{"id":69449,"postNumber":1,"raw":"[Let's Encrypt 正式支持给 IP 签发证书。](https://letsencrypt.org/2025/07/01/issuing-our-first-ip-address-certificate)\n\n[但是目前的 Caddy 支持并不好。](https://github.com/caddyserver/caddy/issues/7399)\n\n[但是你可以用 acme.sh 自动签发证书给 caddy 用](https://u.sb/acme-sh-ip-ssl/)\n\n[wrap=placeholder key=\"YOURIP\" description=\"YOUR IP\" default=\"115.154.4.8\"][/wrap]\n\n首先关闭所有占用 80/443 端口的软件，安装 socat，用 acme.sh 独立模式手动签发一次\n\nacme.sh --issue \\\\\n-d =YOURIP= \\\\\n-\\-standalone \\\\\n-\\-server letsencrypt \\\\\n-\\-certificate-profile shortlived \\\\\n-\\-days 3\n\n然后配置 caddy：\nmkdir -p /etc/caddy/certs\nchown caddy:caddy /etc/caddy/certs\nchmod 700 /etc/caddy/certs\n \n\n/etc/caddy/Caddyfile：\n```\n{\n auto_https off\n servers {\n protocols h1 h2\n }\n order forward_proxy before file_server\n}\n:80 {\n handle /.well-known/acme-challenge/* {\n root * /var/www/letsencrypt\n file_server\n }\n\n handle {\n redir https://{host}{uri} permanent\n }\n}\n\n:443 {\n tls /etc/caddy/certs/fullchain.pem /etc/caddy/certs/key.pem {\n protocols tls1.2 tls1.3\n }\n forward_proxy {\n basic_auth ussername password\n hide_ip\n hide_via\n probe_resistance\n }\n\n respond \"OK\"\n}\n```\n\n然后用 acme.sh 安装证书到指定位置\n\nacme.sh --install-cert \\\\\n -d =YOURIP= \\\\\n -\\-cert-file /etc/caddy/certs/cert.pem \\\\\n -\\-key-file /etc/caddy/certs/key.pem \\\\\n -\\-fullchain-file /etc/caddy/certs/fullchain.pem \\\\\n -\\-reloadcmd \"chown caddy:caddy -R /etc/caddy/certs; systemctl reload cd \"\n\n重启 caddy，然后配置 acme.sh 用 webroot 方式后续自动签发证书\nacme.sh --issue --server letsencrypt \\\\\n -d =YOURIP= \\\\\n -w /var/www/letsencrypt \\\\\n -\\-certificate-profile shortlived \\\\\n -\\-days 3\n \n以上操作后理论上你可以用 TCP 方式翻墙（[naiveproxy](https://github.com/klzgrad/naiveproxy)）\n需要用 xcaddy 编译带 forwardproxy 模块儿的 caddy \n```\ngo install github.com/caddyserver/xcaddy/cmd/xcaddy@latest\n~/go/bin/xcaddy build --with github.com/caddyserver/forwardproxy=github.com/klzgrad/forwardproxy@naive\n```\n\n当然 UDP 方式性能会更高（[tuic](https://github.com/Itsusinn/tuic)）\n参考 https://github.com/Itsusinn/tuic/tree/main/tuic-server 安装配置：\n```\ncargo install --git https://github.com/Itsusinn/tuic.git tuic-server\ntuic-server --init\n```\n\nconfig.toml 里需要修改的地方：\nserver = \"[::]:443\"\ndata_dir = \"/etc/tuics\"\n[users]\nself_sign = false\ncertificate = \"/etc/caddy/certs/fullchain.pem\"\nprivate_key = \"/etc/caddy/certs/key.pem\"\nalpn = [\"h3\"]\nhostname = \"=YOURIP=\"\nauto_ssl = false\n\n\n服务器推荐 [Hosthatch](https://hosthatch.com/) 🇰🇷首尔\n4$/month 1C2G\n通过 LG_DACOM 接入三网，<80ms 低延迟，晚高峰低丢包率（最高的中国电信也不过 10%）\nGeekbench5 单核 1000 分（和 Hetzner 的 CPX22 一样）\n可以跑满你的带宽\n[yt-dlp](https://github.com/yt-dlp/yt-dlp) 不在 IP 黑名单。","cooked":"

[wrap=placeholder key=\"YOURIP\" description=\"YOUR IP\" default=\"115.154.4.8\"][/wrap]

首先关闭所有占用 80/443 端口的软件，安装 socat，用 acme.sh 独立模式手动签发一次

acme.sh --issue \\
\n-d =YOURIP= \\
\n--standalone \\
\n--server letsencrypt \\
\n--certificate-profile shortlived \\
\n--days 3

然后配置 caddy：
\nmkdir -p /etc/caddy/certs
\nchown caddy:caddy /etc/caddy/certs
\nchmod 700 /etc/caddy/certs

/etc/caddy/Caddyfile：

{\n        auto_https off\n        servers {\n                protocols h1 h2\n        }\n        order forward_proxy before file_server\n}\n:80 {\n        handle /.well-known/acme-challenge/* {\n                root * /var/www/letsencrypt\n                file_server\n        }\n\n        handle {\n                redir https://{host}{uri} permanent\n        }\n}\n\n:443 {\n        tls /etc/caddy/certs/fullchain.pem /etc/caddy/certs/key.pem {\n                protocols tls1.2 tls1.3\n        }\n        forward_proxy {\n                basic_auth ussername password\n                hide_ip\n                hide_via\n                probe_resistance\n        }\n\n        respond \"OK\"\n}\n

然后用 acme.sh 安装证书到指定位置

acme.sh --install-cert \\
\n-d =YOURIP= \\
\n--cert-file /etc/caddy/certs/cert.pem \\
\n--key-file /etc/caddy/certs/key.pem \\
\n--fullchain-file /etc/caddy/certs/fullchain.pem \\
\n--reloadcmd \"chown caddy:caddy -R /etc/caddy/certs; systemctl reload cd \"

重启 caddy，然后配置 acme.sh 用 webroot 方式后续自动签发证书
\nacme.sh --issue --server letsencrypt \\
\n-d =YOURIP= \\
\n-w /var/www/letsencrypt \\
\n--certificate-profile shortlived \\
\n--days 3

以上操作后理论上你可以用 TCP 方式翻墙（naiveproxy）
\n需要用 xcaddy 编译带 forwardproxy 模块儿的 caddy

go install github.com/caddyserver/xcaddy/cmd/xcaddy@latest\n~/go/bin/xcaddy build   --with github.com/caddyserver/forwardproxy=github.com/klzgrad/forwardproxy@naive\n

当然 UDP 方式性能会更高（tuic）
\n参考 https://github.com/Itsusinn/tuic/tree/main/tuic-server 安装配置：

cargo install --git https://github.com/Itsusinn/tuic.git tuic-server\ntuic-server --init\n

config.toml 里需要修改的地方：
\nserver = \"[::]:443\"
\ndata_dir = \"/etc/tuics\"
\n[users]
\nself_sign = false
\ncertificate = \"/etc/caddy/certs/fullchain.pem\"
\nprivate_key = \"/etc/caddy/certs/key.pem\"
\nalpn = [\"h3\"]
\nhostname = \"=YOURIP=\"
\nauto_ssl = false

服务器推荐 Hosthatch 🇰🇷首尔
\n4$/month 1C2G
\n通过 LG_DACOM 接入三网，<80ms 低延迟，晚高峰低丢包率（最高的中国电信也不过 10%）
\nGeekbench5 单核 1000 分（和 Hetzner 的 CPX22 一样）
\n可以跑满你的带宽
\nyt-dlp 不在 IP 黑名单。

\n","createdAt":"2025-12-29 14:38:12.789555","updatedAt":"2026-02-27 00:31:05.900592","replyToPostNumber":null,"replyCount":0,"likeCount":1,"wordCount":412,"liked":false,"bookmarked":false,"polls":[],"reactions":[{"reaction":"❤️","count":1,"users":[{"id":7830,"username":"stateless_trash_can","name":"无状态垃圾桶"}],"hasReacted":false}],"wiki":false,"version":5,"publicVersion":4,"deletedAt":null,"isAnonymous":false,"user":{"id":7075,"username":"jbden","name":null,"avatarUrl":"/uploads/image/1e/8b/1e8bab3b6f297391fe23ceb66e7a57cad9bc903396007c9a08d6536889e5dcfe.avif","admin":false,"moderator":false,"signatureRaw":null,"signatureCooked":null}},{"id":69464,"postNumber":2,"raw":"TIL，最近正好在研究这个","cooked":"

TIL，最近正好在研究这个

\n","createdAt":"2025-12-29 23:34:10.08485","updatedAt":"2026-05-28 00:51:29.07159","replyToPostNumber":null,"replyCount":0,"likeCount":0,"wordCount":10,"liked":false,"bookmarked":false,"polls":[],"reactions":[],"wiki":false,"version":3,"publicVersion":3,"deletedAt":null,"isAnonymous":false,"user":{"id":7830,"username":"stateless_trash_can","name":"无状态垃圾桶","avatarUrl":"/uploads/image/f4/69/f469375c27cd72c6970425e94b999be00fed8fe6234b977b14f5bdb65da24b4e.avif","admin":false,"moderator":false,"signatureRaw":"

","signatureCooked":"

"}}],"hasMore":false,"lastReadPostNumber":1,"hasUrlPostNumber":false}