fix: verify backup and HTTPS proxy certificates with custom CA support

agent/utils/cloud_storage/client/ali.go

@@ -2,7 +2,6 @@ package client
 
 import (
 	"context"
-	"crypto/tls"
 	"encoding/json"
 	"errors"
 	"fmt"
@@ -11,8 +10,6 @@ import (
 	"os"
 	"path"
 	"strings"
-
-	"github.com/go-resty/resty/v2"
 )
 
 type aliClient struct {
@@ -58,10 +55,7 @@ func (a aliClient) Delete(pathItem string) (bool, error) {
 	if err != nil {
 		return false, err
 	}
-	client := resty.New()
-	client.SetTLSClientConfig(&tls.Config{
-		InsecureSkipVerify: true,
-	})
+	client := newALIHTTPClient()
 	data := map[string]interface{}{
 		"drive_id": a.driveID,
 		"file_id":  fileInfo.FileID,
@@ -108,10 +102,7 @@ func (a aliClient) Upload(ctx context.Context, src, target string) (bool, error)
 		"size":            fileInfo.Size(),
 		"check_name_mode": "auto_rename",
 	}
-	client := resty.New()
-	client.SetTLSClientConfig(&tls.Config{
-		InsecureSkipVerify: true,
-	})
+	client := newALIHTTPClient()
 	url := "https://api.alipan.com/v2/file/create"
 
 	resp, err := client.R().
@@ -146,10 +137,7 @@ func (a aliClient) Download(src, target string) (bool, error) {
 	if err != nil {
 		return false, err
 	}
-	client := resty.New()
-	client.SetTLSClientConfig(&tls.Config{
-		InsecureSkipVerify: true,
-	})
+	client := newALIHTTPClient()
 	if fileInfo.Size > 100*1024*1024 {
 		return false, fmt.Errorf("The translation file %s exceeds 100MB, please download it through the client.", src)
 	}
@@ -266,10 +254,7 @@ func (a aliClient) loadDirWithPath(path string) ([]fileInfo, error) {
 }
 
 func (a aliClient) loadFileWithParentID(parentID string) ([]fileInfo, error) {
-	client := resty.New()
-	client.SetTLSClientConfig(&tls.Config{
-		InsecureSkipVerify: true,
-	})
+	client := newALIHTTPClient()
 	data := map[string]interface{}{
 		"drive_id":       a.driveID,
 		"fields":         "*",
@@ -338,10 +323,7 @@ func (a aliClient) mkdirWithPath(target string) (string, error) {
 }
 
 func (a aliClient) mkdir(parentID, name string) (string, error) {
-	client := resty.New()
-	client.SetTLSClientConfig(&tls.Config{
-		InsecureSkipVerify: true,
-	})
+	client := newALIHTTPClient()
 	data := map[string]interface{}{
 		"drive_id":       a.driveID,
 		"name":           name,
@@ -472,10 +454,7 @@ func (a aliClient) handleDownload(uri string, target string) error {
 }
 
 func (a *aliClient) completeUpload(ctx context.Context, uploadID, fileID string) error {
-	client := resty.New()
-	client.SetTLSClientConfig(&tls.Config{
-		InsecureSkipVerify: true,
-	})
+	client := newALIHTTPClient()
 	data := map[string]interface{}{
 		"drive_id":  a.driveID,
 		"upload_id": uploadID,
@@ -504,10 +483,7 @@ type tokenResp struct {
 }
 
 func loadToken(refresh_token string) (string, error) {
-	client := resty.New()
-	client.SetTLSClientConfig(&tls.Config{
-		InsecureSkipVerify: true,
-	})
+	client := newALIHTTPClient()
 	data := map[string]interface{}{
 		"grant_type":    "refresh_token",
 		"refresh_token": refresh_token,
@@ -536,10 +512,7 @@ func RefreshALIToken(varMap map[string]interface{}) (string, error) {
 	if len(refresh_token) == 0 {
 		return "", errors.New("no such refresh token find in db")
 	}
-	client := resty.New()
-	client.SetTLSClientConfig(&tls.Config{
-		InsecureSkipVerify: true,
-	})
+	client := newALIHTTPClient()
 	data := map[string]interface{}{
 		"grant_type":    "refresh_token",
 		"refresh_token": refresh_token,

agent/utils/cloud_storage/client/minio.go

@@ -2,10 +2,8 @@ package client
 
 import (
 	"context"
-	"crypto/tls"
 	"fmt"
 	"io"
-	"net/http"
 	"os"
 	"strings"
 
@@ -29,14 +27,10 @@ func NewMinIoClient(vars map[string]interface{}) (*minIoClient, error) {
 		return nil, buserr.WithDetail("ErrInvalidParams", "ssl", fmt.Errorf("no such proto in ssl: %s", ssl))
 	}
 
-	secure := false
-	tlsConfig := &tls.Config{}
-	if ssl == "https" {
-		secure = true
-		tlsConfig.InsecureSkipVerify = true
-	}
-	var transport http.RoundTripper = &http.Transport{
-		TLSClientConfig: tlsConfig,
+	secure := ssl == "https"
+	transport, err := newStorageHTTPTransport(vars)
+	if err != nil {
+		return nil, err
 	}
 	client, err := minio.New(strings.ReplaceAll(endpoint, ssl+"://", ""), &minio.Options{
 		Creds:     credentials.NewStaticV4(accessKeyID, secretAccessKey, ""),

agent/utils/cloud_storage/client/s3.go

@@ -2,8 +2,6 @@ package client
 
 import (
 	"context"
-	"crypto/tls"
-	"net/http"
 	"os"
 	"strings"
 	"time"
@@ -48,14 +46,10 @@ func NewS3Client(vars map[string]interface{}) (*s3Client, error) {
 	}
 
 	ssl := strings.Split(endpoint, ":")[0]
-	secure := false
-	tlsConfig := &tls.Config{}
-	if ssl == "https" {
-		secure = true
-		tlsConfig.InsecureSkipVerify = true
-	}
-	var transport http.RoundTripper = &http.Transport{
-		TLSClientConfig: tlsConfig,
+	secure := ssl == "https"
+	transport, err := newStorageHTTPTransport(vars)
+	if err != nil {
+		return nil, err
 	}
 
 	endpoint = strings.TrimPrefix(endpoint, ssl+"://")

agent/utils/cloud_storage/client/tls.go

@@ -0,0 +1,57 @@
+package client
+
+import (
+	"bytes"
+	"crypto/tls"
+	"crypto/x509"
+	"encoding/pem"
+	"errors"
+	"fmt"
+	"net/http"
+
+	"github.com/go-resty/resty/v2"
+)
+
+func newStorageHTTPTransport(vars map[string]interface{}) (*http.Transport, error) {
+	config := &tls.Config{}
+	value, exists := vars["caCertPEM"]
+	if !exists || value == nil {
+		return &http.Transport{TLSClientConfig: config}, nil
+	}
+	certificatePEM, ok := value.(string)
+	if !ok {
+		return nil, errors.New("caCertPEM must be a PEM certificate string")
+	}
+	rest := bytes.TrimSpace([]byte(certificatePEM))
+	if len(rest) == 0 {
+		return &http.Transport{TLSClientConfig: config}, nil
+	}
+	roots, err := x509.SystemCertPool()
+	if err != nil {
+		roots = x509.NewCertPool()
+	}
+	for len(rest) > 0 {
+		if !bytes.HasPrefix(rest, []byte("-----BEGIN CERTIFICATE-----")) {
+			return nil, errors.New("caCertPEM must contain only PEM certificates")
+		}
+		block, remaining := pem.Decode(rest)
+		if block == nil || block.Type != "CERTIFICATE" || len(block.Headers) != 0 {
+			return nil, errors.New("caCertPEM contains an invalid PEM certificate")
+		}
+		if bytes.Count(rest[:len(rest)-len(remaining)], []byte("-----BEGIN CERTIFICATE-----")) != 1 {
+			return nil, errors.New("caCertPEM contains an invalid PEM certificate")
+		}
+		certificate, err := x509.ParseCertificate(block.Bytes)
+		if err != nil {
+			return nil, fmt.Errorf("caCertPEM contains an invalid certificate: %w", err)
+		}
+		roots.AddCert(certificate)
+		rest = bytes.TrimSpace(remaining)
+	}
+	config.RootCAs = roots
+	return &http.Transport{TLSClientConfig: config}, nil
+}
+
+func newALIHTTPClient() *resty.Client {
+	return resty.New().SetTLSClientConfig(&tls.Config{})
+}

agent/utils/cloud_storage/client/webdav.go

@@ -2,13 +2,10 @@ package client
 
 import (
 	"context"
-	"crypto/tls"
 	"fmt"
 	"io"
-	"net/http"
 	"os"
 	"path"
-	"strings"
 
 	"github.com/1Panel-dev/1Panel/agent/constant"
 	"github.com/1Panel-dev/1Panel/agent/utils/cloud_storage/client/helper/webdav"
@@ -39,12 +36,9 @@ func newWebDAVClient(ctx context.Context, vars map[string]interface{}) (*webDAVC
 		url = address
 	}
 	client := webdav.NewClient(url, username, password)
-	tlsConfig := &tls.Config{}
-	if strings.HasPrefix(address, "https") {
-		tlsConfig.InsecureSkipVerify = true
-	}
-	var transport http.RoundTripper = &http.Transport{
-		TLSClientConfig: tlsConfig,
+	transport, err := newStorageHTTPTransport(vars)
+	if err != nil {
+		return nil, err
 	}
 	client.SetTransport(transport)
 	if err := client.ConnectWithContext(ctx); err != nil {

core/utils/cloud_storage/refresh_token.go

@@ -35,10 +35,7 @@ func RefreshALIToken(varMap map[string]interface{}) (string, error) {
 	if len(refresh_token) == 0 {
 		return "", errors.New("no such refresh token find in db")
 	}
-	client := resty.New()
-	client.SetTLSClientConfig(&tls.Config{
-		InsecureSkipVerify: true,
-	})
+	client := newALITokenHTTPClient()
 	data := map[string]interface{}{
 		"grant_type":    "refresh_token",
 		"refresh_token": refresh_token,
@@ -62,6 +59,10 @@ func RefreshALIToken(varMap map[string]interface{}) (string, error) {
 	return respItem.RefreshToken, nil
 }
 
+func newALITokenHTTPClient() *resty.Client {
+	return resty.New().SetTLSClientConfig(&tls.Config{})
+}
+
 func RefreshToken(grantType string, tokenType string, varMap map[string]interface{}) (string, error) {
 	data := url.Values{}
 	isCN := loadParamFromVars("isCN", varMap)

core/utils/ssh/http.go

@@ -3,6 +3,7 @@ package ssh
 import (
 	"bufio"
 	"crypto/tls"
+	"crypto/x509"
 	"encoding/base64"
 	"fmt"
 	"net"
@@ -20,17 +21,25 @@ type HTTPProxyDialer struct {
 }
 
 func HTTPDial(dialer HTTPProxyDialer, network, addr string) (net.Conn, error) {
+	return dialHTTPProxy(dialer, network, addr, nil)
+}
+
+func dialHTTPProxy(dialer HTTPProxyDialer, network, addr string, rootCAs *x509.CertPool) (net.Conn, error) {
 	var conn net.Conn
 	var err error
 
 	global.LOG.Debugf("Dialing HTTP proxy %s for %s", dialer.URL, addr)
 	dialer.URL = strings.TrimPrefix(dialer.URL, dialer.Type+"://")
 	if dialer.Type == "https" {
+		host, _, splitErr := net.SplitHostPort(dialer.URL)
+		if splitErr != nil {
+			return nil, splitErr
+		}
 		conn, err = tls.DialWithDialer(
 			&net.Dialer{Timeout: 30 * time.Second},
 			network,
 			dialer.URL,
-			&tls.Config{InsecureSkipVerify: true},
+			&tls.Config{RootCAs: rootCAs, ServerName: host},
 		)
 	} else {
 		conn, err = net.DialTimeout(network, dialer.URL, 30*time.Second)

frontend/package-lock.json

@@ -126,6 +126,7 @@
             "integrity": "sha512-RgHBCvtjbOK2gXSNBNIkNoEc9qoVEtau3hj8gEqKQuL3HZAibKarWFEI3Lfm6EYKkLalOh8eSrj9b+ch9H/VBA==",
             "dev": true,
             "license": "MIT",
+            "peer": true,
             "dependencies": {
                 "@babel/code-frame": "^7.29.7",
                 "@babel/generator": "^7.29.7",
@@ -1013,6 +1014,7 @@
             "cpu": [
                 "ppc64"
             ],
+            "dev": true,
             "license": "MIT",
             "optional": true,
             "os": [
@@ -1029,6 +1031,7 @@
             "cpu": [
                 "arm"
             ],
+            "dev": true,
             "license": "MIT",
             "optional": true,
             "os": [
@@ -1045,6 +1048,7 @@
             "cpu": [
                 "arm64"
             ],
+            "dev": true,
             "license": "MIT",
             "optional": true,
             "os": [
@@ -1061,6 +1065,7 @@
             "cpu": [
                 "x64"
             ],
+            "dev": true,
             "license": "MIT",
             "optional": true,
             "os": [
@@ -1077,6 +1082,7 @@
             "cpu": [
                 "arm64"
             ],
+            "dev": true,
             "license": "MIT",
             "optional": true,
             "os": [
@@ -1093,6 +1099,7 @@
             "cpu": [
                 "x64"
             ],
+            "dev": true,
             "license": "MIT",
             "optional": true,
             "os": [
@@ -1109,6 +1116,7 @@
             "cpu": [
                 "arm64"
             ],
+            "dev": true,
             "license": "MIT",
             "optional": true,
             "os": [
@@ -1125,6 +1133,7 @@
             "cpu": [
                 "x64"
             ],
+            "dev": true,
             "license": "MIT",
             "optional": true,
             "os": [
@@ -1141,6 +1150,7 @@
             "cpu": [
                 "arm"
             ],
+            "dev": true,
             "license": "MIT",
             "optional": true,
             "os": [
@@ -1157,6 +1167,7 @@
             "cpu": [
                 "arm64"
             ],
+            "dev": true,
             "license": "MIT",
             "optional": true,
             "os": [
@@ -1173,6 +1184,7 @@
             "cpu": [
                 "ia32"
             ],
+            "dev": true,
             "license": "MIT",
             "optional": true,
             "os": [
@@ -1189,6 +1201,7 @@
             "cpu": [
                 "loong64"
             ],
+            "dev": true,
             "license": "MIT",
             "optional": true,
             "os": [
@@ -1205,6 +1218,7 @@
             "cpu": [
                 "mips64el"
             ],
+            "dev": true,
             "license": "MIT",
             "optional": true,
             "os": [
@@ -1221,6 +1235,7 @@
             "cpu": [
                 "ppc64"
             ],
+            "dev": true,
             "license": "MIT",
             "optional": true,
             "os": [
@@ -1237,6 +1252,7 @@
             "cpu": [
                 "riscv64"
             ],
+            "dev": true,
             "license": "MIT",
             "optional": true,
             "os": [
@@ -1253,6 +1269,7 @@
             "cpu": [
                 "s390x"
             ],
+            "dev": true,
             "license": "MIT",
             "optional": true,
             "os": [
@@ -1269,6 +1286,7 @@
             "cpu": [
                 "x64"
             ],
+            "dev": true,
             "license": "MIT",
             "optional": true,
             "os": [
@@ -1285,6 +1303,7 @@
             "cpu": [
                 "arm64"
             ],
+            "dev": true,
             "license": "MIT",
             "optional": true,
             "os": [
@@ -1301,6 +1320,7 @@
             "cpu": [
                 "x64"
             ],
+            "dev": true,
             "license": "MIT",
             "optional": true,
             "os": [
@@ -1317,6 +1337,7 @@
             "cpu": [
                 "arm64"
             ],
+            "dev": true,
             "license": "MIT",
             "optional": true,
             "os": [
@@ -1333,6 +1354,7 @@
             "cpu": [
                 "x64"
             ],
+            "dev": true,
             "license": "MIT",
             "optional": true,
             "os": [
@@ -1349,6 +1371,7 @@
             "cpu": [
                 "arm64"
             ],
+            "dev": true,
             "license": "MIT",
             "optional": true,
             "os": [
@@ -1365,6 +1388,7 @@
             "cpu": [
                 "x64"
             ],
+            "dev": true,
             "license": "MIT",
             "optional": true,
             "os": [
@@ -1381,6 +1405,7 @@
             "cpu": [
                 "arm64"
             ],
+            "dev": true,
             "license": "MIT",
             "optional": true,
             "os": [
@@ -1397,6 +1422,7 @@
             "cpu": [
                 "ia32"
             ],
+            "dev": true,
             "license": "MIT",
             "optional": true,
             "os": [
@@ -1413,6 +1439,7 @@
             "cpu": [
                 "x64"
             ],
+            "dev": true,
             "license": "MIT",
             "optional": true,
             "os": [
@@ -1746,6 +1773,18 @@
                 "node": ">=6.0.0"
             }
         },
+        "node_modules/@jridgewell/source-map": {
+            "version": "0.3.11",
+            "resolved": "https://registry.npmjs.org/@jridgewell/source-map/-/source-map-0.3.11.tgz",
+            "integrity": "sha512-ZMp1V8ZFcPG5dIWnQLr3NSI1MiCU7UETdS/A0G8V/XWHvJv3ZsFqutJn1Y5RPmAPX6F3BiE397OqveU/9NCuIA==",
+            "dev": true,
+            "license": "MIT",
+            "optional": true,
+            "dependencies": {
+                "@jridgewell/gen-mapping": "^0.3.5",
+                "@jridgewell/trace-mapping": "^0.3.25"
+            }
+        },
         "node_modules/@jridgewell/sourcemap-codec": {
             "version": "1.5.5",
             "resolved": "https://registry.npmjs.org/@jridgewell/sourcemap-codec/-/sourcemap-codec-1.5.5.tgz",
@@ -1974,6 +2013,7 @@
             "version": "2.6.0",
             "resolved": "https://registry.npmjs.org/@parcel/watcher/-/watcher-2.6.0.tgz",
             "integrity": "sha512-7FNeNl8NCE7aINx7WXiKQrPYZWC/hvrTsmk6zmxbI7LTXE7hVek/n8AfVgpe2y82zl3w0HvCHN0bVKMBoJcC0w==",
+            "dev": true,
             "hasInstallScript": true,
             "license": "MIT",
             "optional": true,
@@ -2012,6 +2052,7 @@
             "cpu": [
                 "arm64"
             ],
+            "dev": true,
             "license": "MIT",
             "optional": true,
             "os": [
@@ -2032,6 +2073,7 @@
             "cpu": [
                 "arm64"
             ],
+            "dev": true,
             "license": "MIT",
             "optional": true,
             "os": [
@@ -2052,6 +2094,7 @@
             "cpu": [
                 "x64"
             ],
+            "dev": true,
             "license": "MIT",
             "optional": true,
             "os": [
@@ -2072,6 +2115,7 @@
             "cpu": [
                 "x64"
             ],
+            "dev": true,
             "license": "MIT",
             "optional": true,
             "os": [
@@ -2092,6 +2136,7 @@
             "cpu": [
                 "arm"
             ],
+            "dev": true,
             "license": "MIT",
             "optional": true,
             "os": [
@@ -2112,6 +2157,7 @@
             "cpu": [
                 "arm"
             ],
+            "dev": true,
             "license": "MIT",
             "optional": true,
             "os": [
@@ -2132,6 +2178,7 @@
             "cpu": [
                 "arm64"
             ],
+            "dev": true,
             "license": "MIT",
             "optional": true,
             "os": [
@@ -2152,6 +2199,7 @@
             "cpu": [
                 "arm64"
             ],
+            "dev": true,
             "license": "MIT",
             "optional": true,
             "os": [
@@ -2172,6 +2220,7 @@
             "cpu": [
                 "x64"
             ],
+            "dev": true,
             "license": "MIT",
             "optional": true,
             "os": [
@@ -2192,6 +2241,7 @@
             "cpu": [
                 "x64"
             ],
+            "dev": true,
             "license": "MIT",
             "optional": true,
             "os": [
@@ -2212,6 +2262,7 @@
             "cpu": [
                 "arm64"
             ],
+            "dev": true,
             "license": "MIT",
             "optional": true,
             "os": [
@@ -2232,6 +2283,7 @@
             "cpu": [
                 "x64"
             ],
+            "dev": true,
             "license": "MIT",
             "optional": true,
             "os": [
@@ -2276,6 +2328,7 @@
             "cpu": [
                 "arm64"
             ],
+            "dev": true,
             "license": "MIT",
             "optional": true,
             "os": [
@@ -2292,6 +2345,7 @@
             "cpu": [
                 "arm64"
             ],
+            "dev": true,
             "license": "MIT",
             "optional": true,
             "os": [
@@ -2308,6 +2362,7 @@
             "cpu": [
                 "x64"
             ],
+            "dev": true,
             "license": "MIT",
             "optional": true,
             "os": [
@@ -2324,6 +2379,7 @@
             "cpu": [
                 "x64"
             ],
+            "dev": true,
             "license": "MIT",
             "optional": true,
             "os": [
@@ -2340,6 +2396,7 @@
             "cpu": [
                 "arm"
             ],
+            "dev": true,
             "license": "MIT",
             "optional": true,
             "os": [
@@ -2356,6 +2413,7 @@
             "cpu": [
                 "arm64"
             ],
+            "dev": true,
             "license": "MIT",
             "optional": true,
             "os": [
@@ -2372,6 +2430,7 @@
             "cpu": [
                 "arm64"
             ],
+            "dev": true,
             "license": "MIT",
             "optional": true,
             "os": [
@@ -2388,6 +2447,7 @@
             "cpu": [
                 "ppc64"
             ],
+            "dev": true,
             "license": "MIT",
             "optional": true,
             "os": [
@@ -2404,6 +2464,7 @@
             "cpu": [
                 "s390x"
             ],
+            "dev": true,
             "license": "MIT",
             "optional": true,
             "os": [
@@ -2420,6 +2481,7 @@
             "cpu": [
                 "x64"
             ],
+            "dev": true,
             "license": "MIT",
             "optional": true,
             "os": [
@@ -2436,6 +2498,7 @@
             "cpu": [
                 "x64"
             ],
+            "dev": true,
             "license": "MIT",
             "optional": true,
             "os": [
@@ -2452,6 +2515,7 @@
             "cpu": [
                 "arm64"
             ],
+            "dev": true,
             "license": "MIT",
             "optional": true,
             "os": [
@@ -2468,6 +2532,7 @@
             "cpu": [
                 "arm64"
             ],
+            "dev": true,
             "license": "MIT",
             "optional": true,
             "os": [
@@ -2484,6 +2549,7 @@
             "cpu": [
                 "x64"
             ],
+            "dev": true,
             "license": "MIT",
             "optional": true,
             "os": [
@@ -2877,6 +2943,7 @@
             "resolved": "https://registry.npmjs.org/@types/lodash-es/-/lodash-es-4.17.12.tgz",
             "integrity": "sha512-0NgftHUcV4v34VhXm8QBSftKVXtbkBG3ViCjs6+eJ5a6y6Mi/jiFGPc1sC7QK+9BFhWrURE3EOggmWaSxL9OzQ==",
             "license": "MIT",
+            "peer": true,
             "dependencies": {
                 "@types/lodash": "*"
             }
@@ -2908,8 +2975,9 @@
             "version": "26.6.3",
             "resolved": "https://registry.npmjs.org/@types/node/-/node-26.6.3.tgz",
             "integrity": "sha512-dsqMQQoeTLqu9wynDD00q573mNzso3IdQOAfHRJqLCcmCFPoGo9A1bDpUcv/9tnKpErQWv9uKeGfl37EIS02Yg==",
-            "devOptional": true,
+            "dev": true,
             "license": "MIT",
+            "peer": true,
             "dependencies": {
                 "undici-types": "~8.9.0"
             }
@@ -2990,6 +3058,7 @@
             "integrity": "sha512-aTtmZjp/x3gsGHkDs04/1I8kNogBJkpQaeGaN0PfiG43NzDEmW2n+OP5im9wfsvyX0yP1UZWBrAGtDBfH9jEVw==",
             "dev": true,
             "license": "MIT",
+            "peer": true,
             "dependencies": {
                 "@typescript-eslint/scope-manager": "8.71.2",
                 "@typescript-eslint/types": "8.71.2",
@@ -3649,6 +3718,7 @@
             "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.18.0.tgz",
             "integrity": "sha512-lGq+9yr1/GuAWaVYIHRjvvySG5/4VfKIvC8EWxStPdcDh/Ka7FG3twP6v4d5BkravUilhIAsG4Qj83t02LWUPQ==",
             "license": "MIT",
+            "peer": true,
             "bin": {
                 "acorn": "bin/acorn"
             },
@@ -3905,6 +3975,7 @@
                 }
             ],
             "license": "MIT",
+            "peer": true,
             "dependencies": {
                 "baseline-browser-mapping": "^2.11.26",
                 "caniuse-lite": "^1.0.30001812",
@@ -3923,7 +3994,7 @@
             "version": "1.1.2",
             "resolved": "https://registry.npmjs.org/buffer-from/-/buffer-from-1.1.2.tgz",
             "integrity": "sha512-E+XQCRwSbaaiChtv6k6Dwgc+bx+Bs6vuKJHHl5kox/BaKbhiXzqQOwK4cO22yElGp2OCmjwVhT3HmxgyPGnJfQ==",
-            "devOptional": true,
+            "dev": true,
             "license": "MIT"
         },
         "node_modules/bundle-name": {
@@ -4166,6 +4237,7 @@
             "resolved": "https://registry.npmjs.org/codemirror/-/codemirror-6.0.2.tgz",
             "integrity": "sha512-VhydHotNW5w1UGK0Qj96BwSk/Zqbp9WbnyK2W/eVMv4QyF41INRGpjUhFJY7/uDNuudSc33a/PKr4iDqRduvHw==",
             "license": "MIT",
+            "peer": true,
             "dependencies": {
                 "@codemirror/autocomplete": "^6.0.0",
                 "@codemirror/commands": "^6.0.0",
@@ -5198,6 +5270,7 @@
             "devOptional": true,
             "hasInstallScript": true,
             "license": "MIT",
+            "peer": true,
             "bin": {
                 "esbuild": "bin/esbuild"
             },
@@ -5259,6 +5332,7 @@
             "integrity": "sha512-nuKKvN+oIBO0koN7Tm7dlkmnkc21mtt0QJLwAKzjLq14y6lRTdVG36MZHJ8eQHwdJMwZbQNMlPOYedMq/oVJvQ==",
             "dev": true,
             "license": "MIT",
+            "peer": true,
             "workspaces": [
                 "packages/*"
             ],
@@ -5318,6 +5392,7 @@
             "integrity": "sha512-82GZUjRS0p/jganf6q1rEO25VSoHH0hKPCTrgillPjdI/3bgBhAE1QzHrHTizjpRvy6pGAvKjDJtk2pF9NDq8w==",
             "dev": true,
             "license": "MIT",
+            "peer": true,
             "bin": {
                 "eslint-config-prettier": "bin/cli.js"
             },
@@ -5750,6 +5825,7 @@
             "version": "2.3.3",
             "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.3.tgz",
             "integrity": "sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw==",
+            "dev": true,
             "hasInstallScript": true,
             "license": "MIT",
             "optional": true,
@@ -6229,7 +6305,7 @@
             "version": "5.1.9",
             "resolved": "https://registry.npmjs.org/immutable/-/immutable-5.1.9.tgz",
             "integrity": "sha512-m8nVez3rwrgmWxtLMt1ZYXB2Lv7OKYn/disyxAlSDYAlKSlFoPPfIAmAM/M5xqL4m4C/wAPw7S2/CNaUii1Hxg==",
-            "devOptional": true,
+            "dev": true,
             "license": "MIT"
         },
         "node_modules/imurmurhash": {
@@ -6302,7 +6378,7 @@
             "version": "2.1.1",
             "resolved": "https://registry.npmjs.org/is-extglob/-/is-extglob-2.1.1.tgz",
             "integrity": "sha512-SbKbANkN603Vi4jEZv49LeVJMn4yGwsbzZworEoyEiutsN3nJYdbO36zfhGJ6QEDpOZIFkDtnq5JRxmvl3jsoQ==",
-            "devOptional": true,
+            "dev": true,
             "license": "MIT",
             "engines": {
                 "node": ">=0.10.0"
@@ -6312,7 +6388,7 @@
             "version": "4.0.3",
             "resolved": "https://registry.npmjs.org/is-glob/-/is-glob-4.0.3.tgz",
             "integrity": "sha512-xelSayHH36ZgE7ZWhli7pW34hNbNl8Ojv5KVmkJD4hBdD3th8Tfk9vYasLM+mXWOZhFkgZfxhLSnrwRr4elSSg==",
-            "devOptional": true,
+            "dev": true,
             "license": "MIT",
             "dependencies": {
                 "is-extglob": "^2.1.1"
@@ -6432,7 +6508,7 @@
             "version": "2.7.0",
             "resolved": "https://registry.npmjs.org/jiti/-/jiti-2.7.0.tgz",
             "integrity": "sha512-AC/7JofJvZGrrneWNaEnJeOLUx+JlGt7tNa0wZiRPT4MY1wmfKjt2+6O2p2uz2+skll8OZZmJMNqeke7kKbNgQ==",
-            "devOptional": true,
+            "dev": true,
             "license": "MIT",
             "bin": {
                 "jiti": "lib/jiti-cli.mjs"
@@ -7007,13 +7083,15 @@
             "version": "4.18.1",
             "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.18.1.tgz",
             "integrity": "sha512-dMInicTPVE8d1e5otfwmmjlxkZoUpiVLwyeTdUsi/Caj/gfzzblBcCE5sRHV/AsjuCmxWrte2TNGSYuCeCq+0Q==",
-            "license": "MIT"
+            "license": "MIT",
+            "peer": true
         },
         "node_modules/lodash-es": {
             "version": "4.18.1",
             "resolved": "https://registry.npmjs.org/lodash-es/-/lodash-es-4.18.1.tgz",
             "integrity": "sha512-J8xewKD/Gk22OZbhpOVSwcs60zhd95ESDwezOFuA3/099925PdHJ7OFHNTGtajL3AlZkykD32HykiMo+BIBI8A==",
-            "license": "MIT"
+            "license": "MIT",
+            "peer": true
         },
         "node_modules/lodash-unified": {
             "version": "1.0.3",
@@ -7081,9 +7159,9 @@
             }
         },
         "node_modules/markdown-it": {
-            "version": "14.3.3",
-            "resolved": "https://registry.npmjs.org/markdown-it/-/markdown-it-14.3.3.tgz",
-            "integrity": "sha512-L//tDAkjTjJCU6pBUSBTgs3Kg4InVaZuUZog/b6V12UKhcDQ7S78877ibbCanRExwPuYP1CZD7Gd2dxSy1GXRg==",
+            "version": "14.3.2",
+            "resolved": "https://registry.npmjs.org/markdown-it/-/markdown-it-14.3.2.tgz",
+            "integrity": "sha512-sHHjZ5fJKlgrG4qns2YwVcdNep35h5fERrfkD2YNsb9UFk0UIHarbiTaHKVMlPuWAoiilyK8Fv/jAm11slsY7Q==",
             "funding": [
                 {
                     "type": "github",
@@ -7095,6 +7173,7 @@
                 }
             ],
             "license": "MIT",
+            "peer": true,
             "dependencies": {
                 "argparse": "^2.0.1",
                 "entities": "^4.5.0",
@@ -7543,6 +7622,7 @@
             "version": "7.1.1",
             "resolved": "https://registry.npmjs.org/node-addon-api/-/node-addon-api-7.1.1.tgz",
             "integrity": "sha512-5m3bsyrjFWE1xf7nz7YXdN4udnVtXK6/Yfgn5qnahL6bCkf2yKt4k3nuTKAtT4r3IG8JNR2ncsIMdZuAzJjHQQ==",
+            "dev": true,
             "license": "MIT",
             "optional": true
         },
@@ -7805,6 +7885,7 @@
             "resolved": "https://registry.npmjs.org/pinia/-/pinia-3.0.4.tgz",
             "integrity": "sha512-l7pqLUFTI/+ESXn6k3nu30ZIzW5E2WZF/LaHJEpoq6ElcLD+wduZoB2kBN19du6K/4FDpPMazY2wJr+IndBtQw==",
             "license": "MIT",
+            "peer": true,
             "dependencies": {
                 "@vue/devtools-api": "^7.7.7"
             },
@@ -7885,6 +7966,7 @@
                 }
             ],
             "license": "MIT",
+            "peer": true,
             "dependencies": {
                 "nanoid": "^3.3.20",
                 "picocolors": "^1.1.1",
@@ -7996,6 +8078,7 @@
             "integrity": "sha512-OpN0zzVdiaiAhxpuuj5efpIS4sY9j7bY6uR5mnj5yPzGkdkjNKSJeUThPb60Jw29QuAZgA4o+/iB49kFiaBX6g==",
             "dev": true,
             "license": "MIT",
+            "peer": true,
             "bin": {
                 "prettier": "bin/prettier.cjs"
             },
@@ -8347,6 +8430,7 @@
             "integrity": "sha512-rn9wpmxplLf7NLNyCk9FyWh3FM43DbY8jOzCdEPzH7uflhTftRbCEpqi6Ly2osgoU8OwObtmavMbWLaWy4LX7A==",
             "devOptional": true,
             "license": "MIT",
+            "peer": true,
             "dependencies": {
                 "@oxc-project/types": "=0.143.0",
                 "@rolldown/pluginutils": "^1.0.0"
@@ -8443,8 +8527,9 @@
             "version": "1.105.0",
             "resolved": "https://registry.npmjs.org/sass/-/sass-1.105.0.tgz",
             "integrity": "sha512-4EjSuRTyG8M4yRXXY1PT9OUV5zz23xBxJkbIAprohKHqf6HOU4MCpE3U3vAC+iO1gxobBjESNbcj8rYAQZWnyA==",
-            "devOptional": true,
+            "dev": true,
             "license": "MIT",
+            "peer": true,
             "dependencies": {
                 "chokidar": "^5.0.0",
                 "immutable": "^5.1.5",
@@ -8627,6 +8712,29 @@
                 "node": ">=0.10.0"
             }
         },
+        "node_modules/source-map-support": {
+            "version": "0.5.21",
+            "resolved": "https://registry.npmjs.org/source-map-support/-/source-map-support-0.5.21.tgz",
+            "integrity": "sha512-uBHU3L3czsIyYXKX88fdrGovxdSCoTGDRZ6SYXtSRxLZUzHg5P/66Ht6uoUlHu9EZod+inXhKo3qQgwXUT/y1w==",
+            "dev": true,
+            "license": "MIT",
+            "optional": true,
+            "dependencies": {
+                "buffer-from": "^1.0.0",
+                "source-map": "^0.6.0"
+            }
+        },
+        "node_modules/source-map-support/node_modules/source-map": {
+            "version": "0.6.1",
+            "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.6.1.tgz",
+            "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==",
+            "dev": true,
+            "license": "BSD-3-Clause",
+            "optional": true,
+            "engines": {
+                "node": ">=0.10.0"
+            }
+        },
         "node_modules/spdx-correct": {
             "version": "3.2.0",
             "resolved": "https://registry.npmjs.org/spdx-correct/-/spdx-correct-3.2.0.tgz",
@@ -8961,6 +9069,34 @@
                 "url": "https://opencollective.com/webpack"
             }
         },
+        "node_modules/terser": {
+            "version": "5.44.1",
+            "resolved": "https://registry.npmjs.org/terser/-/terser-5.44.1.tgz",
+            "integrity": "sha512-t/R3R/n0MSwnnazuPpPNVO60LX0SKL45pyl9YlvxIdkH0Of7D5qM2EVe+yASRIlY5pZ73nclYJfNANGWPwFDZw==",
+            "dev": true,
+            "license": "BSD-2-Clause",
+            "optional": true,
+            "dependencies": {
+                "@jridgewell/source-map": "^0.3.3",
+                "acorn": "^8.15.0",
+                "commander": "^2.20.0",
+                "source-map-support": "~0.5.20"
+            },
+            "bin": {
+                "terser": "bin/terser"
+            },
+            "engines": {
+                "node": ">=10"
+            }
+        },
+        "node_modules/terser/node_modules/commander": {
+            "version": "2.20.3",
+            "resolved": "https://registry.npmjs.org/commander/-/commander-2.20.3.tgz",
+            "integrity": "sha512-GpVkmM8vF2vQUkj2LvZmD35JxeJOLCwJ9cUkugyk2nuhbv3+mJvpLYYt+0+USMxE+oj+ey/lJEnhZw75x/OMcQ==",
+            "dev": true,
+            "license": "MIT",
+            "optional": true
+        },
         "node_modules/text-extensions": {
             "version": "1.9.0",
             "resolved": "https://registry.npmjs.org/text-extensions/-/text-extensions-1.9.0.tgz",
@@ -9092,6 +9228,7 @@
             "integrity": "sha512-y2TvuxSZPDyQakkFRPZHKFm+KKVqIisdg9/CZwm9ftvKXLP8NRWj38/ODjNbr43SsoXqNuAisEf1GdCxqWcdBw==",
             "devOptional": true,
             "license": "Apache-2.0",
+            "peer": true,
             "bin": {
                 "tsc": "bin/tsc",
                 "tsserver": "bin/tsserver"
@@ -9130,7 +9267,7 @@
             "version": "8.9.0",
             "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-8.9.0.tgz",
             "integrity": "sha512-KTDyRTYX8sWmKXAikPHHSyc63CRPETMctyjKFupcC6OBLXT3xsN0e9aF7m+mIXutFWpUXuedtowG7iLOzp0kQg==",
-            "devOptional": true,
+            "dev": true,
             "license": "MIT"
         },
         "node_modules/unimport": {
@@ -9457,6 +9594,7 @@
             "integrity": "sha512-pn+CFpM0lwDeKwmOq1ZaBK/9sjorZcgqxki6MbY/jPEVd9vichIlmlD4HmQ5wdP5EgqQCFRaACBxMC7uEGc6lQ==",
             "devOptional": true,
             "license": "MIT",
+            "peer": true,
             "dependencies": {
                 "lightningcss": "^1.33.0",
                 "picomatch": "^4.0.5",
@@ -9721,6 +9859,7 @@
             "cpu": [
                 "arm64"
             ],
+            "dev": true,
             "license": "MPL-2.0",
             "optional": true,
             "os": [
@@ -9741,6 +9880,7 @@
             "cpu": [
                 "arm64"
             ],
+            "dev": true,
             "license": "MPL-2.0",
             "optional": true,
             "os": [
@@ -9761,6 +9901,7 @@
             "cpu": [
                 "x64"
             ],
+            "dev": true,
             "license": "MPL-2.0",
             "optional": true,
             "os": [
@@ -9781,6 +9922,7 @@
             "cpu": [
                 "x64"
             ],
+            "dev": true,
             "license": "MPL-2.0",
             "optional": true,
             "os": [
@@ -9801,6 +9943,7 @@
             "cpu": [
                 "arm"
             ],
+            "dev": true,
             "license": "MPL-2.0",
             "optional": true,
             "os": [
@@ -9821,6 +9964,7 @@
             "cpu": [
                 "arm64"
             ],
+            "dev": true,
             "license": "MPL-2.0",
             "optional": true,
             "os": [
@@ -9841,6 +9985,7 @@
             "cpu": [
                 "arm64"
             ],
+            "dev": true,
             "license": "MPL-2.0",
             "optional": true,
             "os": [
@@ -9861,6 +10006,7 @@
             "cpu": [
                 "x64"
             ],
+            "dev": true,
             "license": "MPL-2.0",
             "optional": true,
             "os": [
@@ -9881,6 +10027,7 @@
             "cpu": [
                 "x64"
             ],
+            "dev": true,
             "license": "MPL-2.0",
             "optional": true,
             "os": [
@@ -9901,6 +10048,7 @@
             "cpu": [
                 "arm64"
             ],
+            "dev": true,
             "license": "MPL-2.0",
             "optional": true,
             "os": [
@@ -9921,6 +10069,7 @@
             "cpu": [
                 "x64"
             ],
+            "dev": true,
             "license": "MPL-2.0",
             "optional": true,
             "os": [
@@ -9946,6 +10095,7 @@
             "resolved": "https://registry.npmjs.org/vue/-/vue-3.5.43.tgz",
             "integrity": "sha512-o5qZoksdnjIKvW1srZ3ab7pcDNYAerBjRe54D0LBLfRdCYFrSgBHVXokMas35czQc0//lmx4/tuY4ZNQ+Rf2Ng==",
             "license": "MIT",
+            "peer": true,
             "dependencies": {
                 "@vue/compiler-dom": "3.5.43",
                 "@vue/compiler-sfc": "3.5.43",
@@ -9999,6 +10149,7 @@
             "integrity": "sha512-nMZBOwuzabUO0nLgIcc6rycZEebF6eeUfaiQx9+WSk8e29IbLvPU9feI6tqW4kTo3hvoYAJkMh8n8D0fuISphg==",
             "hasInstallScript": true,
             "license": "MIT",
+            "peer": true,
             "bin": {
                 "vue-demi-fix": "bin/vue-demi-fix.js",
                 "vue-demi-switch": "bin/vue-demi-switch.js"
@@ -10025,6 +10176,7 @@
             "integrity": "sha512-Gk6gRDj0n/fkRa3C3l0bBheoBckUq/Rs0F/TvMWIS6nzzx67amAViMe9CkNgsP2tXyQONvGiHQESHwFtZ3aYDA==",
             "dev": true,
             "license": "MIT",
+            "peer": true,
             "dependencies": {
                 "debug": "^4.4.0",
                 "eslint-scope": "^8.2.0 || ^9.0.0",
@@ -10360,6 +10512,7 @@
             "version": "2.9.1",
             "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.9.1.tgz",
             "integrity": "sha512-3NxN8+78OdzbT7C/WjGsyfPAtJaN3FNDsWxv7Y7mcDsT/oOmgW8BpyQQFFBnvZE3j9Y2Sdz1ULFLezL7Eb2yFw==",
+            "dev": true,
             "license": "ISC",
             "optional": true,
             "bin": {

frontend/src/lang/modules/en.ts

@@ -3870,6 +3870,9 @@ const message = {
             'If a cloud provider is compatible with the S3 protocol, you can directly use Amazon S3 for backup. ',
         domain: 'Accelerate domain',
         backupAccount: 'Backup account | Backup accounts',
+        backupCACert: 'CA certificate (PEM)',
+        backupCACertHelp:
+            'Leave empty to use system CAs. For self-hosted HTTPS storage, paste its CA certificate. Certificate verification remains enabled.',
         loadBucket: 'Get bucket',
         accountName: 'Account name',
         accountKey: 'Account key',

frontend/src/lang/modules/es-es.ts

@@ -3947,6 +3947,9 @@ const message = {
             'Si un proveedor de nube es compatible con el protocolo S3, puedes usar Amazon S3 directamente para el respaldo. ',
         domain: 'Dominio de aceleración',
         backupAccount: 'Cuenta de respaldo | Cuentas de respaldo',
+        backupCACert: 'Certificado CA (PEM)',
+        backupCACertHelp:
+            'Déjelo vacío para usar las CA del sistema. Para almacenamiento HTTPS propio, pegue su certificado CA. La verificación de certificados permanece activa.',
         loadBucket: 'Obtener bucket',
         accountName: 'Nombre de la cuenta',
         accountKey: 'Clave de la cuenta',

frontend/src/lang/modules/fa.ts

@@ -3830,6 +3830,9 @@ const message = {
             'اگر یک ارائه‌دهنده ابری با پروتکل S3 سازگار است، می‌توانید مستقیماً از آمازون S3 برای پشتیبان‌گیری استفاده کنید.',
         domain: 'دامنه شتاب‌دهنده',
         backupAccount: 'حساب پشتیبان | حساب‌های پشتیبان',
+        backupCACert: 'گواهی CA (PEM)',
+        backupCACertHelp:
+            'برای استفاده از CAهای سیستم خالی بگذارید. برای فضای ذخیره‌سازی HTTPS خودمیزبان، گواهی CA را وارد کنید. اعتبارسنجی گواهی همیشه فعال است.',
         loadBucket: 'دریافت سطل',
         accountName: 'نام حساب',
         accountKey: 'کلید حساب',

frontend/src/lang/modules/ja.ts

@@ -3822,6 +3822,9 @@ const message = {
             '理論的には、クラウドプロバイダーがS3プロトコルに対応していれば、現行のAmazon S3クラウドストレージを使ってバックアップできます。具体的な設定については、',
         domain: 'ドメインを加速します',
         backupAccount: 'バックアップアカウント|バックアップアカウント',
+        backupCACert: 'CA 証明書（PEM）',
+        backupCACertHelp:
+            '空欄の場合はシステムの CA を使用します。自前の HTTPS ストレージには CA 証明書を貼り付けてください。証明書の検証は常に有効です。',
         loadBucket: 'バケツを入手してください',
         accountName: 'アカウント名',
         accountKey: 'アカウントキー',

frontend/src/lang/modules/ko.ts

@@ -3764,6 +3764,9 @@ const message = {
         backupAlert: 'S3 프로토콜을 지원하는 클라우드 공급자는 Amazon S3 를 사용하여 백업할 수 있습니다.',
         domain: '가속 도메인',
         backupAccount: '백업 계정 | 백업 계정',
+        backupCACert: 'CA 인증서(PEM)',
+        backupCACertHelp:
+            '비워 두면 시스템 CA를 사용합니다. 자체 호스팅 HTTPS 저장소의 CA 인증서를 붙여 넣으세요. 인증서 검증은 항상 활성화됩니다.',
         loadBucket: '버킷 가져오기',
         accountName: '계정 이름',
         accountKey: '계정 키',

frontend/src/lang/modules/lo.ts

@@ -3754,6 +3754,9 @@ const message = {
         backupAlert: 'ຫາກຜູ້ໃຫ້ບໍລິການຄລາວຮອງຮັບໂປຣໂຕຄໍ S3, ທ່ານສາມາດໃຊ້ Amazon S3 ໃນການສຳຮອງຂໍ້ມູນໄດ້ໂດຍກົງ.',
         domain: 'ໂດເມນເລັ່ງຄວາມໄວ',
         backupAccount: 'ບັນຊີສຳຮອງ',
+        backupCACert: 'ໃບຢັ້ງຢືນ CA (PEM)',
+        backupCACertHelp:
+            'ປ່ອຍວ່າງເພື່ອໃຊ້ CA ຂອງລະບົບ. ສຳລັບບ່ອນເກັບຂໍ້ມູນ HTTPS ທີ່ໂຮສເອງ ໃຫ້ວາງໃບຢັ້ງຢືນ CA. ການກວດສອບໃບຢັ້ງຢືນຈະເປີດຢູ່ສະເໝີ.',
         loadBucket: 'ຮັບ Bucket',
         accountName: 'ຊື່ບັນຊີ',
         accountKey: 'Account key',

frontend/src/lang/modules/ms.ts

@@ -3913,6 +3913,9 @@ const message = {
             'Jika penyedia awan serasi dengan protokol S3, anda boleh menggunakan Amazon S3 secara langsung untuk sandaran.',
         domain: 'Domain pemecutan',
         backupAccount: 'Akaun sandaran | Akaun sandaran',
+        backupCACert: 'Sijil CA (PEM)',
+        backupCACertHelp:
+            'Biarkan kosong untuk menggunakan CA sistem. Untuk storan HTTPS yang dihos sendiri, tampal sijil CA. Pengesahan sijil sentiasa diaktifkan.',
         loadBucket: 'Dapatkan baldi',
         accountName: 'Nama akaun',
         accountKey: 'Kunci akaun',

frontend/src/lang/modules/pt-br.ts

@@ -3918,6 +3918,9 @@ const message = {
             'Se um provedor de nuvem for compatível com o protocolo S3, você pode usar diretamente o Amazon S3 para backup.',
         domain: 'Domínio de aceleração',
         backupAccount: 'Conta de backup | Contas de backup',
+        backupCACert: 'Certificado de CA (PEM)',
+        backupCACertHelp:
+            'Deixe em branco para usar as CAs do sistema. Para armazenamento HTTPS próprio, cole o certificado da CA. A verificação de certificados permanece ativa.',
         loadBucket: 'Obter bucket',
         accountName: 'Nome da conta',
         accountKey: 'Chave da conta',

frontend/src/lang/modules/ru.ts

@@ -3892,6 +3892,9 @@ const message = {
             'Если облачный провайдер совместим с протоколом S3, вы можете напрямую использовать Amazon S3 для резервного копирования.',
         domain: 'Домен ускорения',
         backupAccount: 'Аккаунт резервного копирования | Аккаунты резервного копирования',
+        backupCACert: 'Сертификат CA (PEM)',
+        backupCACertHelp:
+            'Оставьте поле пустым, чтобы использовать системные CA. Для собственного HTTPS-хранилища вставьте сертификат CA. Проверка сертификатов всегда включена.',
         loadBucket: 'Получить корзину',
         accountName: 'Имя аккаунта',
         accountKey: 'Ключ аккаунта',

frontend/src/lang/modules/tr.ts

@@ -3918,6 +3918,9 @@ const message = {
             'Bir bulut sağlayıcısı S3 protokolüyle uyumluysa, yedekleme için doğrudan Amazon S3 kullanılabilir.',
         domain: 'Hızlandırma alanı',
         backupAccount: 'Yedekleme hesabı | Yedekleme hesapları',
+        backupCACert: 'CA sertifikası (PEM)',
+        backupCACertHelp:
+            "Sistem CA'larını kullanmak için boş bırakın. Kendi HTTPS depolamanız için CA sertifikasını yapıştırın. Sertifika doğrulaması her zaman etkindir.",
         loadBucket: 'Kova al',
         accountName: 'Hesap adı',
         accountKey: 'Hesap anahtarı',

frontend/src/lang/modules/zh-Hant.ts

@@ -3617,6 +3617,8 @@ const message = {
         backupAlert: '理論上只要雲廠商相容 S3 協議，就可以用現有的亞馬遜 S3 雲端儲存來備份，詳細設定請參考 ',
         domain: '加速域名',
         backupAccount: '備份帳號',
+        backupCACert: 'CA 憑證（PEM）',
+        backupCACertHelp: '留空時使用系統信任的 CA。自架 HTTPS 儲存服務可貼上 CA 憑證，憑證驗證始終開啟。',
         loadBucket: '取得桶',
         accountName: '帳戶名稱',
         accountKey: '帳戶金鑰',

frontend/src/lang/modules/zh.ts

@@ -3643,6 +3643,8 @@ const message = {
         backupAlert: '理论上只要云厂商兼容 S3 协议，就可以用现有的亚马逊 S3 云存储来备份，具体配置参考',
         domain: '加速域名',
         backupAccount: '备份账号',
+        backupCACert: 'CA 证书（PEM）',
+        backupCACertHelp: '留空时使用系统信任的 CA。自建 HTTPS 存储可粘贴其 CA 证书，证书校验始终开启。',
         loadBucket: '获取桶',
         accountName: '账户名称',
         accountKey: '账户密钥',

frontend/src/views/setting/backup-account/operate/index.vue

@@ -184,6 +184,15 @@
                     </template>
                 </el-input>
             </el-form-item>
+            <el-form-item v-if="supportsCustomCA" :label="$t('setting.backupCACert')" prop="varsJson.caCertPEM">
+                <el-input
+                    v-model="dialogData.rowData!.varsJson['caCertPEM']"
+                    type="textarea"
+                    :rows="5"
+                    :spellcheck="false"
+                />
+                <span class="input-help">{{ $t('setting.backupCACertHelp') }}</span>
+            </el-form-item>
             <el-form-item v-if="hasAccessKey()" label="Bucket" prop="bucket" :rules="Rules.requiredInput">
                 <el-checkbox v-model="dialogData.rowData!.bucketInput" :label="$t('container.input')" />
                 <el-input clearable v-if="dialogData.rowData!.bucketInput" v-model="dialogData.rowData!.bucket" />
@@ -452,10 +461,27 @@ const dialogData = ref<DialogProps>({
     title: '',
 });
 
+const supportsCustomCA = computed(() => {
+    const row = dialogData.value.rowData;
+    if (!row) return false;
+    if (row.type === 'S3' || row.type === 'MINIO') return domainProto.value === 'https';
+    return row.type === 'WebDAV' && /^https:\/\//i.test(String(row.varsJson?.['address'] || '').trim());
+});
+
 const formWatcher = computed(() => {
     const { type, isPublic, accessKey, bucket, credential, backupPath, bucketInput, varsJson } =
         dialogData.value.rowData || {};
-    return { type, isPublic, accessKey, bucket, credential, backupPath, bucketInput, varsJson };
+    return {
+        type,
+        isPublic,
+        accessKey,
+        bucket,
+        credential,
+        backupPath,
+        bucketInput,
+        varsJson,
+        protocol: domainProto.value,
+    };
 });
 const startWatcher = () => {
     if (stopWatch.value) {