局域网 HTTPS 绿锁教程：用 PVE 内部 CA 给内网 IP 签证书（OpenWrt/AdGuard Home/爱快）

cat /etc/hosts                                  # 看 hosts 里写的 IP
ip -4 addr show | grep inet | grep -v 127.0.0.1 # 看网卡实际 IP
openssl x509 -in /etc/pve/local/pve-ssl.pem -noout -text | grep -A1 Alternative
# 看证书 SAN 里有没有"IP Address:你的实际IP"

# 备份 hosts，把老 IP 改成实际 IP（按你的实际情况替换 11.10 → 11.100）
cp /etc/hosts /root/hosts.bak.$(date +%Y%m%d)
sed -i 's/^192.168.11.10 /192.168.11.100 /' /etc/hosts

# 备份并重新生成节点自签证书
cp /etc/pve/local/pve-ssl.pem /root/pve-ssl.pem.bak.$(date +%Y%m%d)
cp /etc/pve/local/pve-ssl.key /root/pve-ssl.key.bak.$(date +%Y%m%d)
rm -f /etc/pve/local/pve-ssl.pem /etc/pve/local/pve-ssl.key
pvecm updatecerts --force

# 验证新证书的 SAN 已含当前 IP
openssl x509 -in /etc/pve/local/pve-ssl.pem -noout -text | grep -A1 Alternative
systemctl restart pveproxy

openssl verify -CAfile /etc/pve/pve-root-ca.pem /etc/pve/local/pve-ssl.pem
# 期望输出：/etc/pve/local/pve-ssl.pem: OK

scp root@192.168.11.100:/etc/pve/pve-root-ca.pem C:/Users/你的用户名/Desktop/pve-root-ca.cer

mkdir -p /root/253cert && cd /root/253cert

# SAN 按需修改：这里同时覆盖 IP 访问和域名访问
printf "subjectAltName=IP:192.168.11.253,DNS:a.997wan.comnkeyUsage=digitalSignature,keyEnciphermentnextendedKeyUsage=serverAuthn" > san.cnf

# 生成私钥和 CSR
openssl req -new -newkey rsa:2048 -nodes -keyout openwrt.key -subj "/CN=192.168.11.253" -out openwrt.csr

# 用 PVE 根 CA 签发（私钥路径是 /etc/pve/priv/pve-root-ca.key，不是 /etc/pve/ 下那个）
openssl x509 -req -in openwrt.csr -CA /etc/pve/pve-root-ca.pem 
  -CAkey /etc/pve/priv/pve-root-ca.key -CAcreateserial 
  -days 3000 -sha256 -extfile san.cnf -out openwrt.crt

# 验证
openssl verify -CAfile /etc/pve/pve-root-ca.pem openwrt.crt   # 期望 OK

scp root@192.168.11.100:/root/253cert/openwrt.crt .
scp root@192.168.11.100:/root/253cert/openwrt.key .
scp root@192.168.11.100:/etc/pve/pve-root-ca.pem ca.pem
scp openwrt.crt root@192.168.11.253:/etc/certs/lan253.crt
scp openwrt.key root@192.168.11.253:/etc/certs/lan253.key
scp ca.pem root@192.168.11.253:/etc/certs/lan-ca.pem     # 留在路由器上做验证用
md5sum openwrt.crt openwrt.key                            # 和路由器上 md5sum 对比确保没传坏

chmod 600 /etc/certs/lan253.key
uci show uhttpd.main | grep -E "cert|key" > /root/uhttpd-cert-rollback.txt  # 备份回滚信息
uci set uhttpd.main.cert='/etc/certs/lan253.crt'
uci set uhttpd.main.key='/etc/certs/lan253.key'
uci commit uhttpd
/etc/init.d/uhttpd restart

# 验证：IP 和域名两种访问都应 200
curl -s --cacert /etc/certs/lan-ca.pem -o /dev/null -w '%{http_code}n' https://192.168.11.253/
curl -s --cacert /etc/certs/lan-ca.pem --resolve a.997wan.com:443:192.168.11.253 
  -o /dev/null -w '%{http_code}n' https://a.997wan.com/

tls:
  enabled: true
  server_name: ""
  force_https: true          # http://IP:3000 自动跳转到 3443
  port_https: 3443           # 443 已被 uhttpd 占用，选 3443
  port_dns_over_tls: 0       # 不需要 DoT/DoQ，关掉
  port_dns_over_quic: 0
  port_dnscrypt: 0
  dnscrypt_config_file: ""
  allow_unencrypted_doh: false
  certificate_chain: ""
  private_key: ""
  certificate_path: /etc/certs/lan253.crt   # 用文件路径，证书更新自动重载
  private_key_path: /etc/certs/lan253.key
  strict_sni_check: false

cp /etc/AdGuardHome.yaml /etc/AdGuardHome.yaml.bak.tls-$(date +%Y%m%d)   # 先备份！
vi /etc/AdGuardHome.yaml     # 按 4.1 修改
/etc/init.d/AdGuardHome restart && sleep 5 && pidof AdGuardHome

# 验证：3000 应 307 跳到 3443，3443 应正常响应
curl -s -o /dev/null -w '%{http_code} %{redirect_url}n' http://192.168.11.253:3000/login.html
# 期望：307 https://192.168.11.253:3443/login.html
curl -s --cacert /etc/certs/lan-ca.pem -o /dev/null -w '%{http_code}n' https://192.168.11.253:3443/

cd /root/253cert
printf "subjectAltName=DNS:997wan.com,DNS:*.997wan.com,IP:192.168.11.1nkeyUsage=digitalSignature,keyEnciphermentnextendedKeyUsage=serverAuthn" > san-ikuai-all.cnf
openssl req -new -newkey rsa:2048 -nodes -keyout ikuai-all.key -subj "/CN=192.168.11.1" -out ikuai-all.csr
openssl x509 -req -in ikuai-all.csr -CA /etc/pve/pve-root-ca.pem 
  -CAkey /etc/pve/priv/pve-root-ca.key -CAcreateserial 
  -days 3000 -sha256 -extfile san-ikuai-all.cnf -out ikuai-all.crt
openssl verify -CAfile /etc/pve/pve-root-ca.pem ikuai-all.crt