fix: verify backup and HTTPS proxy certificates with custom CA support

agent/utils/cloud_storage/client/ali.go

@@ -2,7 +2,6 @@ package client
 
 import (
 	"context"
-	"crypto/tls"
 	"encoding/json"
 	"errors"
 	"fmt"
@@ -11,8 +10,6 @@ import (
 	"os"
 	"path"
 	"strings"
-
-	"github.com/go-resty/resty/v2"
 )
 
 type aliClient struct {
@@ -58,10 +55,7 @@ func (a aliClient) Delete(pathItem string) (bool, error) {
 	if err != nil {
 		return false, err
 	}
-	client := resty.New()
-	client.SetTLSClientConfig(&tls.Config{
-		InsecureSkipVerify: true,
-	})
+	client := newALIHTTPClient()
 	data := map[string]interface{}{
 		"drive_id": a.driveID,
 		"file_id":  fileInfo.FileID,
@@ -108,10 +102,7 @@ func (a aliClient) Upload(ctx context.Context, src, target string) (bool, error)
 		"size":            fileInfo.Size(),
 		"check_name_mode": "auto_rename",
 	}
-	client := resty.New()
-	client.SetTLSClientConfig(&tls.Config{
-		InsecureSkipVerify: true,
-	})
+	client := newALIHTTPClient()
 	url := "https://api.alipan.com/v2/file/create"
 
 	resp, err := client.R().
@@ -146,10 +137,7 @@ func (a aliClient) Download(src, target string) (bool, error) {
 	if err != nil {
 		return false, err
 	}
-	client := resty.New()
-	client.SetTLSClientConfig(&tls.Config{
-		InsecureSkipVerify: true,
-	})
+	client := newALIHTTPClient()
 	if fileInfo.Size > 100*1024*1024 {
 		return false, fmt.Errorf("The translation file %s exceeds 100MB, please download it through the client.", src)
 	}
@@ -266,10 +254,7 @@ func (a aliClient) loadDirWithPath(path string) ([]fileInfo, error) {
 }
 
 func (a aliClient) loadFileWithParentID(parentID string) ([]fileInfo, error) {
-	client := resty.New()
-	client.SetTLSClientConfig(&tls.Config{
-		InsecureSkipVerify: true,
-	})
+	client := newALIHTTPClient()
 	data := map[string]interface{}{
 		"drive_id":       a.driveID,
 		"fields":         "*",
@@ -338,10 +323,7 @@ func (a aliClient) mkdirWithPath(target string) (string, error) {
 }
 
 func (a aliClient) mkdir(parentID, name string) (string, error) {
-	client := resty.New()
-	client.SetTLSClientConfig(&tls.Config{
-		InsecureSkipVerify: true,
-	})
+	client := newALIHTTPClient()
 	data := map[string]interface{}{
 		"drive_id":       a.driveID,
 		"name":           name,
@@ -472,10 +454,7 @@ func (a aliClient) handleDownload(uri string, target string) error {
 }
 
 func (a *aliClient) completeUpload(ctx context.Context, uploadID, fileID string) error {
-	client := resty.New()
-	client.SetTLSClientConfig(&tls.Config{
-		InsecureSkipVerify: true,
-	})
+	client := newALIHTTPClient()
 	data := map[string]interface{}{
 		"drive_id":  a.driveID,
 		"upload_id": uploadID,
@@ -504,10 +483,7 @@ type tokenResp struct {
 }
 
 func loadToken(refresh_token string) (string, error) {
-	client := resty.New()
-	client.SetTLSClientConfig(&tls.Config{
-		InsecureSkipVerify: true,
-	})
+	client := newALIHTTPClient()
 	data := map[string]interface{}{
 		"grant_type":    "refresh_token",
 		"refresh_token": refresh_token,
@@ -536,10 +512,7 @@ func RefreshALIToken(varMap map[string]interface{}) (string, error) {
 	if len(refresh_token) == 0 {
 		return "", errors.New("no such refresh token find in db")
 	}
-	client := resty.New()
-	client.SetTLSClientConfig(&tls.Config{
-		InsecureSkipVerify: true,
-	})
+	client := newALIHTTPClient()
 	data := map[string]interface{}{
 		"grant_type":    "refresh_token",
 		"refresh_token": refresh_token,

agent/utils/cloud_storage/client/minio.go

@@ -2,10 +2,8 @@ package client
 
 import (
 	"context"
-	"crypto/tls"
 	"fmt"
 	"io"
-	"net/http"
 	"os"
 	"strings"
 
@@ -29,14 +27,10 @@ func NewMinIoClient(vars map[string]interface{}) (*minIoClient, error) {
 		return nil, buserr.WithDetail("ErrInvalidParams", "ssl", fmt.Errorf("no such proto in ssl: %s", ssl))
 	}
 
-	secure := false
-	tlsConfig := &tls.Config{}
-	if ssl == "https" {
-		secure = true
-		tlsConfig.InsecureSkipVerify = true
-	}
-	var transport http.RoundTripper = &http.Transport{
-		TLSClientConfig: tlsConfig,
+	secure := ssl == "https"
+	transport, err := newStorageHTTPTransport(vars)
+	if err != nil {
+		return nil, err
 	}
 	client, err := minio.New(strings.ReplaceAll(endpoint, ssl+"://", ""), &minio.Options{
 		Creds:     credentials.NewStaticV4(accessKeyID, secretAccessKey, ""),

agent/utils/cloud_storage/client/s3.go

@@ -2,8 +2,6 @@ package client
 
 import (
 	"context"
-	"crypto/tls"
-	"net/http"
 	"os"
 	"strings"
 	"time"
@@ -48,14 +46,10 @@ func NewS3Client(vars map[string]interface{}) (*s3Client, error) {
 	}
 
 	ssl := strings.Split(endpoint, ":")[0]
-	secure := false
-	tlsConfig := &tls.Config{}
-	if ssl == "https" {
-		secure = true
-		tlsConfig.InsecureSkipVerify = true
-	}
-	var transport http.RoundTripper = &http.Transport{
-		TLSClientConfig: tlsConfig,
+	secure := ssl == "https"
+	transport, err := newStorageHTTPTransport(vars)
+	if err != nil {
+		return nil, err
 	}
 
 	endpoint = strings.TrimPrefix(endpoint, ssl+"://")

agent/utils/cloud_storage/client/tls.go

@@ -0,0 +1,57 @@
+package client
+
+import (
+	"bytes"
+	"crypto/tls"
+	"crypto/x509"
+	"encoding/pem"
+	"errors"
+	"fmt"
+	"net/http"
+
+	"github.com/go-resty/resty/v2"
+)
+
+func newStorageHTTPTransport(vars map[string]interface{}) (*http.Transport, error) {
+	config := &tls.Config{}
+	value, exists := vars["caCertPEM"]
+	if !exists || value == nil {
+		return &http.Transport{TLSClientConfig: config}, nil
+	}
+	certificatePEM, ok := value.(string)
+	if !ok {
+		return nil, errors.New("caCertPEM must be a PEM certificate string")
+	}
+	rest := bytes.TrimSpace([]byte(certificatePEM))
+	if len(rest) == 0 {
+		return &http.Transport{TLSClientConfig: config}, nil
+	}
+	roots, err := x509.SystemCertPool()
+	if err != nil {
+		roots = x509.NewCertPool()
+	}
+	for len(rest) > 0 {
+		if !bytes.HasPrefix(rest, []byte("-----BEGIN CERTIFICATE-----")) {
+			return nil, errors.New("caCertPEM must contain only PEM certificates")
+		}
+		block, remaining := pem.Decode(rest)
+		if block == nil || block.Type != "CERTIFICATE" || len(block.Headers) != 0 {
+			return nil, errors.New("caCertPEM contains an invalid PEM certificate")
+		}
+		if bytes.Count(rest[:len(rest)-len(remaining)], []byte("-----BEGIN CERTIFICATE-----")) != 1 {
+			return nil, errors.New("caCertPEM contains an invalid PEM certificate")
+		}
+		certificate, err := x509.ParseCertificate(block.Bytes)
+		if err != nil {
+			return nil, fmt.Errorf("caCertPEM contains an invalid certificate: %w", err)
+		}
+		roots.AddCert(certificate)
+		rest = bytes.TrimSpace(remaining)
+	}
+	config.RootCAs = roots
+	return &http.Transport{TLSClientConfig: config}, nil
+}
+
+func newALIHTTPClient() *resty.Client {
+	return resty.New().SetTLSClientConfig(&tls.Config{})
+}

agent/utils/cloud_storage/client/webdav.go

@@ -2,13 +2,10 @@ package client
 
 import (
 	"context"
-	"crypto/tls"
 	"fmt"
 	"io"
-	"net/http"
 	"os"
 	"path"
-	"strings"
 
 	"github.com/1Panel-dev/1Panel/agent/constant"
 	"github.com/1Panel-dev/1Panel/agent/utils/cloud_storage/client/helper/webdav"
@@ -39,12 +36,9 @@ func newWebDAVClient(ctx context.Context, vars map[string]interface{}) (*webDAVC
 		url = address
 	}
 	client := webdav.NewClient(url, username, password)
-	tlsConfig := &tls.Config{}
-	if strings.HasPrefix(address, "https") {
-		tlsConfig.InsecureSkipVerify = true
-	}
-	var transport http.RoundTripper = &http.Transport{
-		TLSClientConfig: tlsConfig,
+	transport, err := newStorageHTTPTransport(vars)
+	if err != nil {
+		return nil, err
 	}
 	client.SetTransport(transport)
 	if err := client.ConnectWithContext(ctx); err != nil {

agent/utils/req_helper/external_http.go

@@ -1,39 +0,0 @@
-package req_helper
-
-import (
-	"crypto/tls"
-	"errors"
-	"net/http"
-	"time"
-)
-
-func newExternalHTTPClient(transport *http.Transport, timeout time.Duration) *http.Client {
-	if transport == nil {
-		transport = http.DefaultTransport.(*http.Transport)
-	}
-	verified := transport.Clone()
-	if verified.TLSClientConfig == nil {
-		verified.TLSClientConfig = &tls.Config{}
-	} else {
-		verified.TLSClientConfig = verified.TLSClientConfig.Clone()
-	}
-	verified.TLSClientConfig.InsecureSkipVerify = false
-	verified.TLSClientConfig.ServerName = ""
-	verified.DialTLS = nil
-	verified.DialTLSContext = nil
-	return &http.Client{
-		Timeout:       timeout,
-		Transport:     verified,
-		CheckRedirect: checkExternalRedirect,
-	}
-}
-
-func checkExternalRedirect(req *http.Request, via []*http.Request) error {
-	if len(via) >= 10 {
-		return errors.New("stopped after 10 redirects")
-	}
-	if len(via) > 0 && via[len(via)-1].URL.Scheme == "https" && req.URL.Scheme != "https" {
-		return errors.New("refusing HTTPS redirect to an insecure scheme")
-	}
-	return nil
-}

agent/utils/req_helper/request.go

@@ -2,6 +2,7 @@ package req_helper
 
 import (
 	"context"
+	"crypto/tls"
 	"errors"
 	"io"
 	"net"
@@ -20,7 +21,10 @@ import (
 )
 
 func HandleGet(url string) (*http.Response, error) {
-	client := newExternalHTTPClient(loadRequestTransport(), time.Second*300)
+	client := &http.Client{
+		Timeout: time.Second * 300,
+	}
+	client.Transport = loadRequestTransport()
 	defer client.CloseIdleConnections()
 
 	req, err := http.NewRequestWithContext(context.Background(), "GET", url, nil)
@@ -49,9 +53,8 @@ func HandleGet(url string) (*http.Response, error) {
 
 func HandleRequest(url, method string, timeout int) (int, []byte, error) {
 	transport := xpack.MultiNodeProvider.LoadRequestTransport()
-	client := newExternalHTTPClient(transport, time.Duration(timeout)*time.Second)
-	defer client.CloseIdleConnections()
-	return HandleRequestWithClient(client, url, method, timeout)
+	client := http.Client{Timeout: time.Duration(timeout) * time.Second, Transport: transport}
+	return HandleRequestWithClient(&client, url, method, timeout)
 }
 
 func HandleRequestWithClient(client *http.Client, url, method string, timeout int) (int, []byte, error) {
@@ -133,8 +136,7 @@ func RequestFile(url, method string, timeout int) (io.ReadCloser, context.Cancel
 		}
 	}()
 	transport := xpack.MultiNodeProvider.LoadRequestTransport()
-	client := newExternalHTTPClient(transport, time.Duration(timeout)*time.Second)
-	defer client.CloseIdleConnections()
+	client := http.Client{Timeout: time.Duration(timeout) * time.Second, Transport: transport}
 	ctx, cancel := context.WithTimeout(context.Background(), time.Duration(timeout)*time.Second)
 	request, err := http.NewRequestWithContext(ctx, method, url, nil)
 	if err != nil {
@@ -154,6 +156,7 @@ func RequestFile(url, method string, timeout int) (io.ReadCloser, context.Cancel
 
 func loadRequestTransport() *http.Transport {
 	return &http.Transport{
+		TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
 		DialContext: (&net.Dialer{
 			Timeout:   60 * time.Second,
 			KeepAlive: 60 * time.Second,

core/utils/cloud_storage/refresh_token.go

@@ -35,10 +35,7 @@ func RefreshALIToken(varMap map[string]interface{}) (string, error) {
 	if len(refresh_token) == 0 {
 		return "", errors.New("no such refresh token find in db")
 	}
-	client := resty.New()
-	client.SetTLSClientConfig(&tls.Config{
-		InsecureSkipVerify: true,
-	})
+	client := newALITokenHTTPClient()
 	data := map[string]interface{}{
 		"grant_type":    "refresh_token",
 		"refresh_token": refresh_token,
@@ -62,6 +59,10 @@ func RefreshALIToken(varMap map[string]interface{}) (string, error) {
 	return respItem.RefreshToken, nil
 }
 
+func newALITokenHTTPClient() *resty.Client {
+	return resty.New().SetTLSClientConfig(&tls.Config{})
+}
+
 func RefreshToken(grantType string, tokenType string, varMap map[string]interface{}) (string, error) {
 	data := url.Values{}
 	isCN := loadParamFromVars("isCN", varMap)

core/utils/req_helper/external_http.go

@@ -1,39 +0,0 @@
-package req_helper
-
-import (
-	"crypto/tls"
-	"errors"
-	"net/http"
-	"time"
-)
-
-func newExternalHTTPClient(transport *http.Transport, timeout time.Duration) *http.Client {
-	if transport == nil {
-		transport = http.DefaultTransport.(*http.Transport)
-	}
-	verified := transport.Clone()
-	if verified.TLSClientConfig == nil {
-		verified.TLSClientConfig = &tls.Config{}
-	} else {
-		verified.TLSClientConfig = verified.TLSClientConfig.Clone()
-	}
-	verified.TLSClientConfig.InsecureSkipVerify = false
-	verified.TLSClientConfig.ServerName = ""
-	verified.DialTLS = nil
-	verified.DialTLSContext = nil
-	return &http.Client{
-		Timeout:       timeout,
-		Transport:     verified,
-		CheckRedirect: checkExternalRedirect,
-	}
-}
-
-func checkExternalRedirect(req *http.Request, via []*http.Request) error {
-	if len(via) >= 10 {
-		return errors.New("stopped after 10 redirects")
-	}
-	if len(via) > 0 && via[len(via)-1].URL.Scheme == "https" && req.URL.Scheme != "https" {
-		return errors.New("refusing HTTPS redirect to an insecure scheme")
-	}
-	return nil
-}

core/utils/req_helper/requset.go

@@ -2,6 +2,7 @@ package req_helper
 
 import (
 	"context"
+	"crypto/tls"
 	"errors"
 	"io"
 	"net"
@@ -16,6 +17,7 @@ import (
 
 func HandleRequest(url, method string, timeout int) (int, []byte, error) {
 	transport := &http.Transport{
+		TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
 		DialContext: (&net.Dialer{
 			Timeout:   60 * time.Second,
 			KeepAlive: 60 * time.Second,
@@ -40,8 +42,7 @@ func handleRequestWithTransport(url, method string, transport *http.Transport, t
 		}
 	}()
 
-	client := newExternalHTTPClient(transport, time.Duration(timeout)*time.Second)
-	defer client.CloseIdleConnections()
+	client := http.Client{Timeout: time.Duration(timeout) * time.Second, Transport: transport}
 	ctx, cancel := context.WithTimeout(context.Background(), time.Duration(timeout)*time.Second)
 	defer cancel()
 	request, err := http.NewRequestWithContext(ctx, method, url, nil)
@@ -64,6 +65,7 @@ func handleRequestWithTransport(url, method string, transport *http.Transport, t
 
 func HandleGet(url string) (*http.Response, error) {
 	transport := &http.Transport{
+		TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
 		DialContext: (&net.Dialer{
 			Timeout:   60 * time.Second,
 			KeepAlive: 60 * time.Second,
@@ -81,7 +83,10 @@ func HandleGetWithProxy(url string) (*http.Response, error) {
 }
 
 func handleGetWithTransport(url string, transport *http.Transport) (*http.Response, error) {
-	client := newExternalHTTPClient(transport, time.Second*300)
+	client := &http.Client{
+		Timeout: time.Second * 300,
+	}
+	client.Transport = transport
 	defer client.CloseIdleConnections()
 
 	req, err := http.NewRequestWithContext(context.Background(), "GET", url, nil)

core/utils/ssh/http.go

@@ -3,6 +3,7 @@ package ssh
 import (
 	"bufio"
 	"crypto/tls"
+	"crypto/x509"
 	"encoding/base64"
 	"fmt"
 	"net"
@@ -20,17 +21,25 @@ type HTTPProxyDialer struct {
 }
 
 func HTTPDial(dialer HTTPProxyDialer, network, addr string) (net.Conn, error) {
+	return dialHTTPProxy(dialer, network, addr, nil)
+}
+
+func dialHTTPProxy(dialer HTTPProxyDialer, network, addr string, rootCAs *x509.CertPool) (net.Conn, error) {
 	var conn net.Conn
 	var err error
 
 	global.LOG.Debugf("Dialing HTTP proxy %s for %s", dialer.URL, addr)
 	dialer.URL = strings.TrimPrefix(dialer.URL, dialer.Type+"://")
 	if dialer.Type == "https" {
+		host, _, splitErr := net.SplitHostPort(dialer.URL)
+		if splitErr != nil {
+			return nil, splitErr
+		}
 		conn, err = tls.DialWithDialer(
 			&net.Dialer{Timeout: 30 * time.Second},
 			network,
 			dialer.URL,
-			&tls.Config{InsecureSkipVerify: true},
+			&tls.Config{RootCAs: rootCAs, ServerName: host},
 		)
 	} else {
 		conn, err = net.DialTimeout(network, dialer.URL, 30*time.Second)

frontend/src/lang/modules/en.ts

@@ -3870,6 +3870,9 @@ const message = {
             'If a cloud provider is compatible with the S3 protocol, you can directly use Amazon S3 for backup. ',
         domain: 'Accelerate domain',
         backupAccount: 'Backup account | Backup accounts',
+        backupCACert: 'CA certificate (PEM)',
+        backupCACertHelp:
+            'Leave empty to use system CAs. For self-hosted HTTPS storage, paste its CA certificate. Certificate verification remains enabled.',
         loadBucket: 'Get bucket',
         accountName: 'Account name',
         accountKey: 'Account key',

frontend/src/lang/modules/es-es.ts

@@ -3947,6 +3947,9 @@ const message = {
             'Si un proveedor de nube es compatible con el protocolo S3, puedes usar Amazon S3 directamente para el respaldo. ',
         domain: 'Dominio de aceleración',
         backupAccount: 'Cuenta de respaldo | Cuentas de respaldo',
+        backupCACert: 'Certificado CA (PEM)',
+        backupCACertHelp:
+            'Déjelo vacío para usar las CA del sistema. Para almacenamiento HTTPS propio, pegue su certificado CA. La verificación de certificados permanece activa.',
         loadBucket: 'Obtener bucket',
         accountName: 'Nombre de la cuenta',
         accountKey: 'Clave de la cuenta',

frontend/src/lang/modules/fa.ts

@@ -3830,6 +3830,9 @@ const message = {
             'اگر یک ارائه‌دهنده ابری با پروتکل S3 سازگار است، می‌توانید مستقیماً از آمازون S3 برای پشتیبان‌گیری استفاده کنید.',
         domain: 'دامنه شتاب‌دهنده',
         backupAccount: 'حساب پشتیبان | حساب‌های پشتیبان',
+        backupCACert: 'گواهی CA (PEM)',
+        backupCACertHelp:
+            'برای استفاده از CAهای سیستم خالی بگذارید. برای فضای ذخیره‌سازی HTTPS خودمیزبان، گواهی CA را وارد کنید. اعتبارسنجی گواهی همیشه فعال است.',
         loadBucket: 'دریافت سطل',
         accountName: 'نام حساب',
         accountKey: 'کلید حساب',

frontend/src/lang/modules/ja.ts

@@ -3822,6 +3822,9 @@ const message = {
             '理論的には、クラウドプロバイダーがS3プロトコルに対応していれば、現行のAmazon S3クラウドストレージを使ってバックアップできます。具体的な設定については、',
         domain: 'ドメインを加速します',
         backupAccount: 'バックアップアカウント|バックアップアカウント',
+        backupCACert: 'CA 証明書（PEM）',
+        backupCACertHelp:
+            '空欄の場合はシステムの CA を使用します。自前の HTTPS ストレージには CA 証明書を貼り付けてください。証明書の検証は常に有効です。',
         loadBucket: 'バケツを入手してください',
         accountName: 'アカウント名',
         accountKey: 'アカウントキー',

frontend/src/lang/modules/ko.ts

@@ -3764,6 +3764,9 @@ const message = {
         backupAlert: 'S3 프로토콜을 지원하는 클라우드 공급자는 Amazon S3 를 사용하여 백업할 수 있습니다.',
         domain: '가속 도메인',
         backupAccount: '백업 계정 | 백업 계정',
+        backupCACert: 'CA 인증서(PEM)',
+        backupCACertHelp:
+            '비워 두면 시스템 CA를 사용합니다. 자체 호스팅 HTTPS 저장소의 CA 인증서를 붙여 넣으세요. 인증서 검증은 항상 활성화됩니다.',
         loadBucket: '버킷 가져오기',
         accountName: '계정 이름',
         accountKey: '계정 키',

frontend/src/lang/modules/lo.ts

@@ -3754,6 +3754,9 @@ const message = {
         backupAlert: 'ຫາກຜູ້ໃຫ້ບໍລິການຄລາວຮອງຮັບໂປຣໂຕຄໍ S3, ທ່ານສາມາດໃຊ້ Amazon S3 ໃນການສຳຮອງຂໍ້ມູນໄດ້ໂດຍກົງ.',
         domain: 'ໂດເມນເລັ່ງຄວາມໄວ',
         backupAccount: 'ບັນຊີສຳຮອງ',
+        backupCACert: 'ໃບຢັ້ງຢືນ CA (PEM)',
+        backupCACertHelp:
+            'ປ່ອຍວ່າງເພື່ອໃຊ້ CA ຂອງລະບົບ. ສຳລັບບ່ອນເກັບຂໍ້ມູນ HTTPS ທີ່ໂຮສເອງ ໃຫ້ວາງໃບຢັ້ງຢືນ CA. ການກວດສອບໃບຢັ້ງຢືນຈະເປີດຢູ່ສະເໝີ.',
         loadBucket: 'ຮັບ Bucket',
         accountName: 'ຊື່ບັນຊີ',
         accountKey: 'Account key',

frontend/src/lang/modules/ms.ts

@@ -3913,6 +3913,9 @@ const message = {
             'Jika penyedia awan serasi dengan protokol S3, anda boleh menggunakan Amazon S3 secara langsung untuk sandaran.',
         domain: 'Domain pemecutan',
         backupAccount: 'Akaun sandaran | Akaun sandaran',
+        backupCACert: 'Sijil CA (PEM)',
+        backupCACertHelp:
+            'Biarkan kosong untuk menggunakan CA sistem. Untuk storan HTTPS yang dihos sendiri, tampal sijil CA. Pengesahan sijil sentiasa diaktifkan.',
         loadBucket: 'Dapatkan baldi',
         accountName: 'Nama akaun',
         accountKey: 'Kunci akaun',

frontend/src/lang/modules/pt-br.ts

@@ -3918,6 +3918,9 @@ const message = {
             'Se um provedor de nuvem for compatível com o protocolo S3, você pode usar diretamente o Amazon S3 para backup.',
         domain: 'Domínio de aceleração',
         backupAccount: 'Conta de backup | Contas de backup',
+        backupCACert: 'Certificado de CA (PEM)',
+        backupCACertHelp:
+            'Deixe em branco para usar as CAs do sistema. Para armazenamento HTTPS próprio, cole o certificado da CA. A verificação de certificados permanece ativa.',
         loadBucket: 'Obter bucket',
         accountName: 'Nome da conta',
         accountKey: 'Chave da conta',

frontend/src/lang/modules/ru.ts

@@ -3892,6 +3892,9 @@ const message = {
             'Если облачный провайдер совместим с протоколом S3, вы можете напрямую использовать Amazon S3 для резервного копирования.',
         domain: 'Домен ускорения',
         backupAccount: 'Аккаунт резервного копирования | Аккаунты резервного копирования',
+        backupCACert: 'Сертификат CA (PEM)',
+        backupCACertHelp:
+            'Оставьте поле пустым, чтобы использовать системные CA. Для собственного HTTPS-хранилища вставьте сертификат CA. Проверка сертификатов всегда включена.',
         loadBucket: 'Получить корзину',
         accountName: 'Имя аккаунта',
         accountKey: 'Ключ аккаунта',

frontend/src/lang/modules/tr.ts

@@ -3918,6 +3918,9 @@ const message = {
             'Bir bulut sağlayıcısı S3 protokolüyle uyumluysa, yedekleme için doğrudan Amazon S3 kullanılabilir.',
         domain: 'Hızlandırma alanı',
         backupAccount: 'Yedekleme hesabı | Yedekleme hesapları',
+        backupCACert: 'CA sertifikası (PEM)',
+        backupCACertHelp:
+            "Sistem CA'larını kullanmak için boş bırakın. Kendi HTTPS depolamanız için CA sertifikasını yapıştırın. Sertifika doğrulaması her zaman etkindir.",
         loadBucket: 'Kova al',
         accountName: 'Hesap adı',
         accountKey: 'Hesap anahtarı',

frontend/src/lang/modules/zh-Hant.ts

@@ -3617,6 +3617,8 @@ const message = {
         backupAlert: '理論上只要雲廠商相容 S3 協議，就可以用現有的亞馬遜 S3 雲端儲存來備份，詳細設定請參考 ',
         domain: '加速域名',
         backupAccount: '備份帳號',
+        backupCACert: 'CA 憑證（PEM）',
+        backupCACertHelp: '留空時使用系統信任的 CA。自架 HTTPS 儲存服務可貼上 CA 憑證，憑證驗證始終開啟。',
         loadBucket: '取得桶',
         accountName: '帳戶名稱',
         accountKey: '帳戶金鑰',

frontend/src/lang/modules/zh.ts

@@ -3643,6 +3643,8 @@ const message = {
         backupAlert: '理论上只要云厂商兼容 S3 协议，就可以用现有的亚马逊 S3 云存储来备份，具体配置参考',
         domain: '加速域名',
         backupAccount: '备份账号',
+        backupCACert: 'CA 证书（PEM）',
+        backupCACertHelp: '留空时使用系统信任的 CA。自建 HTTPS 存储可粘贴其 CA 证书，证书校验始终开启。',
         loadBucket: '获取桶',
         accountName: '账户名称',
         accountKey: '账户密钥',

frontend/src/views/setting/backup-account/operate/index.vue

@@ -184,6 +184,15 @@
                     </template>
                 </el-input>
             </el-form-item>
+            <el-form-item v-if="supportsCustomCA" :label="$t('setting.backupCACert')" prop="varsJson.caCertPEM">
+                <el-input
+                    v-model="dialogData.rowData!.varsJson['caCertPEM']"
+                    type="textarea"
+                    :rows="5"
+                    :spellcheck="false"
+                />
+                <span class="input-help">{{ $t('setting.backupCACertHelp') }}</span>
+            </el-form-item>
             <el-form-item v-if="hasAccessKey()" label="Bucket" prop="bucket" :rules="Rules.requiredInput">
                 <el-checkbox v-model="dialogData.rowData!.bucketInput" :label="$t('container.input')" />
                 <el-input clearable v-if="dialogData.rowData!.bucketInput" v-model="dialogData.rowData!.bucket" />
@@ -452,10 +461,27 @@ const dialogData = ref<DialogProps>({
     title: '',
 });
 
+const supportsCustomCA = computed(() => {
+    const row = dialogData.value.rowData;
+    if (!row) return false;
+    if (row.type === 'S3' || row.type === 'MINIO') return domainProto.value === 'https';
+    return row.type === 'WebDAV' && /^https:\/\//i.test(String(row.varsJson?.['address'] || '').trim());
+});
+
 const formWatcher = computed(() => {
     const { type, isPublic, accessKey, bucket, credential, backupPath, bucketInput, varsJson } =
         dialogData.value.rowData || {};
-    return { type, isPublic, accessKey, bucket, credential, backupPath, bucketInput, varsJson };
+    return {
+        type,
+        isPublic,
+        accessKey,
+        bucket,
+        credential,
+        backupPath,
+        bucketInput,
+        varsJson,
+        protocol: domainProto.value,
+    };
 });
 const startWatcher = () => {
     if (stopWatch.value) {