Merge pull request #1056 from fudiwei:main

2026-06-30 21:05:12 +08:00 · 2025-11-28 22:26:47 +08:00 · 2025-11-28 22:26:47 +08:00 · bb1aecb16e
commit bb1aecb16e
parent ca77ad56bb dac169fabf
24 changed files with 125 additions and 19 deletions
--- a/internal/certacme/config.go
+++ b/internal/certacme/config.go
@ -18,6 +18,7 @@ var acmeDirUrls = map[string]string{
 	string(domain.CAProviderTypeActalisSSL):          "https://acme-api.actalis.com/acme/directory",
 	string(domain.CAProviderTypeGlobalSignAtlas):     "https://emea.acme.atlas.globalsign.com/directory",
 	string(domain.CAProviderTypeGoogleTrustServices): "https://dv.acme-v02.api.pki.goog/directory",
+	string(domain.CAProviderTypeLiteSSL):             "https://acme.litessl.com/acme/v2/directory",
 	string(domain.CAProviderTypeSSLCom):              "https://acme.ssl.com/sslcom-dv-rsa",
 	string(domain.CAProviderTypeSSLCom) + "RSA":      "https://acme.ssl.com/sslcom-dv-rsa",
 	string(domain.CAProviderTypeSSLCom) + "ECC":      "https://acme.ssl.com/sslcom-dv-ecc",
--- a/internal/domain/access.go
+++ b/internal/domain/access.go
@ -334,6 +334,10 @@ type AccessConfigForLinode struct {
 	AccessToken string `json:"accessToken"`
 }

+type AccessConfigForLiteSSL struct {
+	AccessConfigForACMEExternalAccountBinding
+}
+
 type AccessConfigForMattermost struct {
 	ServerUrl string `json:"serverUrl"`
 	Username  string `json:"username"`
--- a/internal/domain/provider.go
+++ b/internal/domain/provider.go
@ -72,6 +72,7 @@ const (
 	AccessProviderTypeLetsEncrypt         = AccessProviderType("letsencrypt")
 	AccessProviderTypeLetsEncryptStaging  = AccessProviderType("letsencryptstaging")
 	AccessProviderTypeLinode              = AccessProviderType("linode")
+	AccessProviderTypeLiteSSL             = AccessProviderType("litessl")
 	AccessProviderTypeLocal               = AccessProviderType("local")
 	AccessProviderTypeMattermost          = AccessProviderType("mattermost")
 	AccessProviderTypeNamecheap           = AccessProviderType("namecheap")
@ -128,6 +129,7 @@ const (
 	CAProviderTypeGoogleTrustServices = CAProviderType(AccessProviderTypeGoogleTrustServices)
 	CAProviderTypeLetsEncrypt         = CAProviderType(AccessProviderTypeLetsEncrypt)
 	CAProviderTypeLetsEncryptStaging  = CAProviderType(AccessProviderTypeLetsEncryptStaging)
+	CAProviderTypeLiteSSL             = CAProviderType(AccessProviderTypeLiteSSL)
 	CAProviderTypeSectigo             = CAProviderType(AccessProviderTypeSectigo)
 	CAProviderTypeSSLCom              = CAProviderType(AccessProviderTypeSSLCOM)
 	CAProviderTypeZeroSSL             = CAProviderType(AccessProviderTypeZeroSSL)
--- a/pkg/core/certifier/challengers/dns01/aws-route53/aws-route53.go
+++ b/pkg/core/certifier/challengers/dns01/aws-route53/aws-route53.go
@ -13,7 +13,7 @@ type ChallengerConfig struct {
 	AccessKeyId           string `json:"accessKeyId"`
 	SecretAccessKey       string `json:"secretAccessKey"`
 	Region                string `json:"region"`
-	HostedZoneId          string `json:"hostedZoneId"`
+	HostedZoneId          string `json:"hostedZoneId,omitempty"`
 	DnsPropagationTimeout int    `json:"dnsPropagationTimeout,omitempty"`
 	DnsTTL                int    `json:"dnsTTL,omitempty"`
 }
@ -27,7 +27,9 @@ func NewChallenger(config *ChallengerConfig) (certifier.ACMEChallenger, error) {
 	providerConfig.AccessKeyID = config.AccessKeyId
 	providerConfig.SecretAccessKey = config.SecretAccessKey
 	providerConfig.Region = config.Region
-	providerConfig.HostedZoneID = config.HostedZoneId
+	if config.HostedZoneId != "" {
+		providerConfig.HostedZoneID = config.HostedZoneId
+	}
 	if config.DnsPropagationTimeout != 0 {
 		providerConfig.PropagationTimeout = time.Duration(config.DnsPropagationTimeout) * time.Second
 	}
--- a/pkg/core/deployer/providers/aliyun-waf/aliyun_waf.go
+++ b/pkg/core/deployer/providers/aliyun-waf/aliyun_waf.go
@ -320,7 +320,7 @@ func (d *Deployer) deployToWAF3WithCNAME(ctx context.Context, cloudCertId string
 			RegionId:                       tea.String(d.config.Region),
 			InstanceId:                     tea.String(d.config.InstanceId),
 			CertId:                         tea.String(cloudCertId),
-			TLSVersion:                     tea.String("tlsv1"),
+			TLSVersion:                     tea.String("tlsv1.2"),
 			EnableTLSv3:                    tea.Bool(true),
 		}
 		if describeDefaultHttpsResp.Body != nil && describeDefaultHttpsResp.Body.DefaultHttps != nil {
--- a/pkg/core/deployer/providers/baotapanel-site/baotapanel_site.go
+++ b/pkg/core/deployer/providers/baotapanel-site/baotapanel_site.go
@ -96,7 +96,7 @@ func (d *Deployer) Deploy(ctx context.Context, certPEM, privkeyPEM string) (*dep

 	default:
 		{
-			// 遍历更新域名证书
+			// 遍历更新站点证书
 			var errs []error
 			for _, siteName := range d.config.SiteNames {
 				select {
--- a/pkg/core/deployer/providers/baotapanelgo-site/baotapanelgo_site.go
+++ b/pkg/core/deployer/providers/baotapanelgo-site/baotapanelgo_site.go
@ -73,7 +73,7 @@ func (d *Deployer) Deploy(ctx context.Context, certPEM, privkeyPEM string) (*dep
 		return nil, errors.New("config `siteNames` is required")
 	}

-	// 遍历更新域名证书
+	// 遍历更新站点证书
 	var errs []error
 	for _, siteName := range d.config.SiteNames {
 		select {
--- a/pkg/core/deployer/providers/baotawaf-site/baotawaf_site.go
+++ b/pkg/core/deployer/providers/baotawaf-site/baotawaf_site.go
@ -65,7 +65,7 @@ func (d *Deployer) Deploy(ctx context.Context, certPEM, privkeyPEM string) (*dep
 		return nil, errors.New("config `siteNames` is required")
 	}

-	// 遍历更新域名证书
+	// 遍历更新站点证书
 	var errs []error
 	for _, siteName := range d.config.SiteNames {
 		select {
--- a/pkg/core/deployer/providers/ratpanel-site/ratpanel_site.go
+++ b/pkg/core/deployer/providers/ratpanel-site/ratpanel_site.go
@ -62,7 +62,7 @@ func (d *Deployer) Deploy(ctx context.Context, certPEM, privkeyPEM string) (*dep
 		return nil, errors.New("config `siteNames` is required")
 	}

-	// 遍历更新域名证书
+	// 遍历更新站点证书
 	var errs []error
 	for _, siteName := range d.config.SiteNames {
 		select {
--- a/ui/public/imgs/providers/litessl.svg
+++ b/ui/public/imgs/providers/litessl.svg
--- a/ui/src/components/access/forms/AccessConfigFieldsProvider.tsx
+++ b/ui/src/components/access/forms/AccessConfigFieldsProvider.tsx
@ -61,6 +61,7 @@ import AccessConfigFieldsProviderKubernetes from "./AccessConfigFieldsProviderKu
 import AccessConfigFieldsProviderLarkBot from "./AccessConfigFieldsProviderLarkBot";
 import AccessConfigFieldsProviderLeCDN from "./AccessConfigFieldsProviderLeCDN";
 import AccessConfigFieldsProviderLinode from "./AccessConfigFieldsProviderLinode";
+import AccessConfigFieldsProviderLiteSSL from "./AccessConfigFieldsProviderLiteSSL";
 import AccessConfigFieldsProviderMattermost from "./AccessConfigFieldsProviderMattermost";
 import AccessConfigFieldsProviderNamecheap from "./AccessConfigFieldsProviderNamecheap";
 import AccessConfigFieldsProviderNameDotCom from "./AccessConfigFieldsProviderNameDotCom";
@ -163,6 +164,7 @@ const providerComponentMap: Partial<Record<AccessProviderType, React.ComponentTy
  [ACCESS_PROVIDERS.LECDN]: AccessConfigFieldsProviderLeCDN,
  [ACCESS_PROVIDERS.INFOMANIAK]: AccessConfigFieldsProviderInfomaniak,
  [ACCESS_PROVIDERS.LINODE]: AccessConfigFieldsProviderLinode,
+  [ACCESS_PROVIDERS.LITESSL]: AccessConfigFieldsProviderLiteSSL,
  [ACCESS_PROVIDERS.MATTERMOST]: AccessConfigFieldsProviderMattermost,
  [ACCESS_PROVIDERS.NAMECHEAP]: AccessConfigFieldsProviderNamecheap,
  [ACCESS_PROVIDERS.NAMEDOTCOM]: AccessConfigFieldsProviderNameDotCom,
--- a/ui/src/components/access/forms/AccessConfigFieldsProviderCloudflare.tsx
+++ b/ui/src/components/access/forms/AccessConfigFieldsProviderCloudflare.tsx
@ -31,6 +31,7 @@ const AccessConfigFormFieldsProviderCloudflare = () => {
        name={[parentNamePath, "zoneApiToken"]}
        initialValue={initialValues.zoneApiToken}
        label={t("access.form.cloudflare_zone_api_token.label")}
+        extra={<span dangerouslySetInnerHTML={{ __html: t("access.form.cloudflare_zone_api_token.help") }}></span>}
        rules={[formRule]}
        tooltip={<span dangerouslySetInnerHTML={{ __html: t("access.form.cloudflare_zone_api_token.tooltip") }}></span>}
      >
--- a/ui/src/components/access/forms/AccessConfigFieldsProviderLiteSSL.tsx
+++ b/ui/src/components/access/forms/AccessConfigFieldsProviderLiteSSL.tsx
@ -0,0 +1,63 @@
+import { getI18n, useTranslation } from "react-i18next";
+import { Form, Input } from "antd";
+import { createSchemaFieldRule } from "antd-zod";
+import { z } from "zod";
+
+import Tips from "@/components/Tips";
+
+import { useFormNestedFieldsContext } from "./_context";
+
+const AccessConfigFormFieldsProviderLiteSSL = () => {
+  const { i18n, t } = useTranslation();
+
+  const { parentNamePath } = useFormNestedFieldsContext();
+  const formSchema = z.object({
+    [parentNamePath]: getSchema({ i18n }),
+  });
+  const formRule = createSchemaFieldRule(formSchema);
+  const initialValues = getInitialValues();
+
+  return (
+    <>
+      <Form.Item name={[parentNamePath, "eabKid"]} initialValue={initialValues.eabKid} label={t("access.form.shared_acme_eab_kid.label")} rules={[formRule]}>
+        <Input autoComplete="new-password" placeholder={t("access.form.shared_acme_eab_kid.placeholder")} />
+      </Form.Item>
+
+      <Form.Item
+        name={[parentNamePath, "eabHmacKey"]}
+        initialValue={initialValues.eabHmacKey}
+        label={t("access.form.shared_acme_eab_hmac_key.label")}
+        rules={[formRule]}
+      >
+        <Input.Password autoComplete="new-password" placeholder={t("access.form.shared_acme_eab_hmac_key.placeholder")} />
+      </Form.Item>
+
+      <Form.Item>
+        <Tips message={<span dangerouslySetInnerHTML={{ __html: t("access.form.litessl_eab.guide") }}></span>} />
+      </Form.Item>
+    </>
+  );
+};
+
+const getInitialValues = (): Nullish<z.infer<ReturnType<typeof getSchema>>> => {
+  return {
+    eabKid: "",
+    eabHmacKey: "",
+  };
+};
+
+const getSchema = ({ i18n = getI18n() }: { i18n: ReturnType<typeof getI18n> }) => {
+  const { t } = i18n;
+
+  return z.object({
+    eabKid: z.string().nonempty(t("access.form.shared_acme_eab_kid.placeholder")),
+    eabHmacKey: z.string().nonempty(t("access.form.shared_acme_eab_hmac_key.placeholder")),
+  });
+};
+
+const _default = Object.assign(AccessConfigFormFieldsProviderLiteSSL, {
+  getInitialValues,
+  getSchema,
+});
+
+export default _default;
--- a/ui/src/components/workflow/WorkflowRunDetail.tsx
+++ b/ui/src/components/workflow/WorkflowRunDetail.tsx
@ -287,7 +287,14 @@ const WorkflowRunLogs = ({ runId, runStatus }: { runId: string; runStatus: strin
          group.records
            .map((record) => {
              const datetime = dayjs(record.timestamp).format("YYYY-MM-DDTHH:mm:ss.SSSZ");
-              const level = record.level;
+              const level =
+                record.level < WorkflowLogLevel.Info
+                  ? "DBUG"
+                  : record.level < WorkflowLogLevel.Warn
+                    ? "INFO"
+                    : record.level < WorkflowLogLevel.Error
+                      ? "WARN"
+                      : "ERRO";
              const message = record.message;
              const data = record.data && Object.keys(record.data).length > 0 ? JSON.stringify(record.data) : "";
              return `[${datetime}] [${level}] ${escape(message)} ${escape(data)}`.trim();
--- a/ui/src/components/workflow/designer/forms/BizApplyNodeConfigFieldsProviderAWSRoute53.tsx
+++ b/ui/src/components/workflow/designer/forms/BizApplyNodeConfigFieldsProviderAWSRoute53.tsx
@ -31,6 +31,7 @@ const BizApplyNodeConfigFieldsProviderAWSRoute53 = () => {
        name={[parentNamePath, "hostedZoneId"]}
        initialValue={initialValues.hostedZoneId}
        label={t("workflow_node.apply.form.aws_route53_hosted_zone_id.label")}
+        extra={t("workflow_node.apply.form.aws_route53_hosted_zone_id.help")}
        rules={[formRule]}
        tooltip={<span dangerouslySetInnerHTML={{ __html: t("workflow_node.apply.form.aws_route53_hosted_zone_id.tooltip") }}></span>}
      >
@ -43,7 +44,6 @@ const BizApplyNodeConfigFieldsProviderAWSRoute53 = () => {
 const getInitialValues = (): Nullish<z.infer<ReturnType<typeof getSchema>>> => {
  return {
    region: "us-east-1",
-    hostedZoneId: "",
  };
 };

@ -52,7 +52,7 @@ const getSchema = ({ i18n = getI18n() }: { i18n?: ReturnType<typeof getI18n> })

  return z.object({
    region: z.string().nonempty(t("workflow_node.apply.form.aws_route53_region.placeholder")),
-    hostedZoneId: z.string().nonempty(t("workflow_node.apply.form.aws_route53_hosted_zone_id.placeholder")),
+    hostedZoneId: z.string().nullish(),
  });
 };

--- a/ui/src/domain/provider.ts
+++ b/ui/src/domain/provider.ts
@ -76,6 +76,7 @@ export const ACCESS_PROVIDERS = Object.freeze({
  LETSENCRYPT: "letsencrypt",
  LETSENCRYPTSTAGING: "letsencryptstaging",
  LINODE: "linode",
+  LITESSL: "litessl",
  LOCAL: "local",
  MATTERMOST: "mattermost",
  NAMECHEAP: "namecheap",
@ -229,6 +230,7 @@ export const accessProvidersMap: Map<AccessProvider["type"] | string, AccessProv
      [ACCESS_PROVIDERS.ACTALISSSL, "provider.actalisssl", "/imgs/providers/actalisssl.png", [ACCESS_USAGES.CA]],
      [ACCESS_PROVIDERS.GLOBALSIGNATLAS, "provider.globalsignatlas", "/imgs/providers/globalsignatlas.png", [ACCESS_USAGES.CA]],
      [ACCESS_PROVIDERS.GOOGLETRUSTSERVICES, "provider.googletrustservices", "/imgs/providers/google.svg", [ACCESS_USAGES.CA]],
+      [ACCESS_PROVIDERS.LITESSL, "provider.litessl", "/imgs/providers/litessl.svg", [ACCESS_USAGES.CA]],
      [ACCESS_PROVIDERS.SECTIGO, "provider.sectigo", "/imgs/providers/sectigo.svg", [ACCESS_USAGES.CA]],
      [ACCESS_PROVIDERS.SSLCOM, "provider.sslcom", "/imgs/providers/sslcom.svg", [ACCESS_USAGES.CA]],
      [ACCESS_PROVIDERS.ZEROSSL, "provider.zerossl", "/imgs/providers/zerossl.svg", [ACCESS_USAGES.CA]],
@ -268,6 +270,7 @@ export const CA_PROVIDERS = Object.freeze({
  GOOGLETRUSTSERVICES: `${ACCESS_PROVIDERS.GOOGLETRUSTSERVICES}`,
  LETSENCRYPT: `${ACCESS_PROVIDERS.LETSENCRYPT}`,
  LETSENCRYPTSTAGING: `${ACCESS_PROVIDERS.LETSENCRYPTSTAGING}`,
+  LITESSL: `${ACCESS_PROVIDERS.LITESSL}`,
  SECTIGO: `${ACCESS_PROVIDERS.SECTIGO}`,
  SSLCOM: `${ACCESS_PROVIDERS.SSLCOM}`,
  ZEROSSL: `${ACCESS_PROVIDERS.ZEROSSL}`,
@ -292,6 +295,7 @@ export const caProvidersMap: Map<CAProvider["type"] | string, CAProvider> = new
      [CA_PROVIDERS.SECTIGO],
      [CA_PROVIDERS.SSLCOM],
      [CA_PROVIDERS.ZEROSSL],
+      [CA_PROVIDERS.LITESSL],
      [CA_PROVIDERS.ACMECA],
    ] satisfies Array<[CAProviderType, "builtin"] | [CAProviderType]>
  ).map(([type, builtin]) => [
--- a/ui/src/i18n/locales/en/nls.access.json
+++ b/ui/src/i18n/locales/en/nls.access.json
@ -191,7 +191,8 @@
  "access.form.cloudflare_dns_api_token.tooltip": "For more information, see <a href=\"https://developers.cloudflare.com/fundamentals/api/get-started/create-token/\" target=\"_blank\">https://developers.cloudflare.com/fundamentals/api/get-started/create-token/</a>",
  "access.form.cloudflare_zone_api_token.label": "Cloudflare Zone API token (Optional)",
  "access.form.cloudflare_zone_api_token.placeholder": "Please enter Cloudflare Zone API token",
-  "access.form.cloudflare_zone_api_token.tooltip": "For more information, see <a href=\"https://developers.cloudflare.com/fundamentals/api/get-started/create-token/\" target=\"_blank\">https://developers.cloudflare.com/fundamentals/api/get-started/create-token/</a><br><br>Only required when you scope the DNS API token to <b>specific zones</b>. PLease scope the Zone API token to <b>all zones</b> with <i>Zone/Zone/Read</i> permission.",
+  "access.form.cloudflare_zone_api_token.help": "Notes: Only required when you scope the DNS API token to <b>specific zones</b>. PLease scope the Zone API token to <b>all zones</b> with <i>Zone/Zone/Read</i> permission.",
+  "access.form.cloudflare_zone_api_token.tooltip": "For more information, see <a href=\"https://developers.cloudflare.com/fundamentals/api/get-started/create-token/\" target=\"_blank\">https://developers.cloudflare.com/fundamentals/api/get-started/create-token/</a>",
  "access.form.cloudns_auth_id.label": "ClouDNS API user ID",
  "access.form.cloudns_auth_id.placeholder": "Please enter ClouDNS API user ID",
  "access.form.cloudns_auth_id.tooltip": "For more information, see <a href=\"https://www.cloudns.net/wiki/article/42/\" target=\"_blank\">https://www.cloudns.net/wiki/article/42/</a>",
@ -391,6 +392,7 @@
  "access.form.linode_access_token.label": "Linode access token",
  "access.form.linode_access_token.placeholder": "Please enter Linode access token",
  "access.form.linode_access_token.tooltip": "For more information, see <a href=\"https://techdocs.akamai.com/linode-api/reference/get-started\" target=\"_blank\">https://techdocs.akamai.com/linode-api/reference/get-started</a>",
+  "access.form.litessl_eab.guide": "Learn more about using EAB key in LiteSSL: <br><a href=\"https://freessl.cn/automation/eab-manager\" target=\"_blank\">https://freessl.cn/automation/eab-manager</a>",
  "access.form.mattermost_server_url.label": "Mattermost server URL",
  "access.form.mattermost_server_url.placeholder": "Please enter Mattermost server URL",
  "access.form.mattermost_username.label": "Mattermost username",
--- a/ui/src/i18n/locales/en/nls.provider.json
+++ b/ui/src/i18n/locales/en/nls.provider.json
@ -126,6 +126,7 @@
  "provider.letsencrypt": "Let's Encrypt",
  "provider.letsencryptstaging": "Let's Encrypt Staging Environment",
  "provider.linode": "Linode",
+  "provider.litessl": "LiteSSL",
  "provider.local": "Local host",
  "provider.mattermost": "Mattermost",
  "provider.namecheap": "Namecheap",
--- a/ui/src/i18n/locales/en/nls.workflow.nodes.json
+++ b/ui/src/i18n/locales/en/nls.workflow.nodes.json
@ -60,8 +60,9 @@
  "workflow_node.apply.form.aws_route53_region.label": "AWS Region",
  "workflow_node.apply.form.aws_route53_region.placeholder": "Please enter AWS Route53 region (e.g. us-east-1)",
  "workflow_node.apply.form.aws_route53_region.tooltip": "For more information, see <a href=\"https://docs.aws.amazon.com/en_us/general/latest/gr/rande.html#regional-endpoints\" target=\"_blank\">https://docs.aws.amazon.com/en_us/general/latest/gr/rande.html#regional-endpoints</a>",
-  "workflow_node.apply.form.aws_route53_hosted_zone_id.label": "AWS Route53 hosted zone ID",
+  "workflow_node.apply.form.aws_route53_hosted_zone_id.label": "AWS Route53 hosted zone ID (Optional)",
  "workflow_node.apply.form.aws_route53_hosted_zone_id.placeholder": "Please enter AWS Route53 hosted zone ID",
+  "workflow_node.apply.form.aws_route53_hosted_zone_id.help": "Notes: Only required when there are several hosted zones with the same FQDN.",
  "workflow_node.apply.form.aws_route53_hosted_zone_id.tooltip": "For more information, see <a href=\"https://docs.aws.amazon.com/en_us/Route53/latest/DeveloperGuide/hosted-zones-working-with.html\" target=\"_blank\">https://docs.aws.amazon.com/en_us/Route53/latest/DeveloperGuide/hosted-zones-working-with.html</a>",
  "workflow_node.apply.form.huaweicloud_dns_region.label": "Huawei Cloud region",
  "workflow_node.apply.form.huaweicloud_dns_region.placeholder": "Please enter Huawei Cloud DNS region (e.g. cn-north-1)",
@ -170,7 +171,7 @@
  "workflow_node.monitor.form.port.placeholder": "Please enter port",
  "workflow_node.monitor.form.domain.label": "Domain (Optional)",
  "workflow_node.monitor.form.domain.placeholder": "Please enter domain name",
-  "workflow_node.monitor.form.domain.help": "Notes: It is only required when the host is an IP address.",
+  "workflow_node.monitor.form.domain.help": "Notes: Only required when the host is an IP address.",
  "workflow_node.monitor.form.request_path.label": "Request path (Optional)",
  "workflow_node.monitor.form.request_path.placeholder": "Please enter request path",

@ -201,7 +202,7 @@
  "workflow_node.deploy.form.1panel_console_auto_restart.label": "Auto restart 1Panel after deployment",
  "workflow_node.deploy.form.1panel_site_node_name.label": "1Panel node name (Optional)",
  "workflow_node.deploy.form.1panel_site_node_name.placeholder": "Please enter 1Panel node name",
-  "workflow_node.deploy.form.1panel_site_node_name.help": "Notes: It is only used for 1Panel v2+.",
+  "workflow_node.deploy.form.1panel_site_node_name.help": "Notes: Only used for 1Panel v2+.",
  "workflow_node.deploy.form.1panel_site_node_name.tooltip": "You can find it on 1Panel dashboard.",
  "workflow_node.deploy.form.1panel_site_resource_type.option.website.label": "Website",
  "workflow_node.deploy.form.1panel_site_resource_type.option.certificate.label": "Certificate",
--- a/ui/src/i18n/locales/zh/nls.access.json
+++ b/ui/src/i18n/locales/zh/nls.access.json
@ -190,7 +190,8 @@
  "access.form.cloudflare_dns_api_token.tooltip": "这是什么？请参阅 <a href=\"https://developers.cloudflare.com/fundamentals/api/get-started/create-token/\" target=\"_blank\">https://developers.cloudflare.com/fundamentals/api/get-started/create-token/</a>",
  "access.form.cloudflare_zone_api_token.label": "Cloudflare Zone API 令牌（可选）",
  "access.form.cloudflare_zone_api_token.placeholder": "请输入 Cloudflare Zone API 令牌",
-  "access.form.cloudflare_zone_api_token.tooltip": "这是什么？请参阅 <a href=\"https://developers.cloudflare.com/fundamentals/api/get-started/create-token/\" target=\"_blank\">https://developers.cloudflare.com/fundamentals/api/get-started/create-token/</a><br><br>仅当你将 DNS API 令牌范围指定为<b>特定域</b>时需要填写，请将 Zone API 令牌范围指定为<b>全部域</b>，并分配 <i>Zone/Zone/Read</i> 权限。",
+  "access.form.cloudflare_zone_api_token.help": "提示：仅当你将 DNS API 令牌范围指定为<b>特定域</b>时需要填写，请将 Zone API 令牌范围指定为<b>全部域</b>，并分配 <i>Zone/Zone/Read</i> 权限。",
+  "access.form.cloudflare_zone_api_token.tooltip": "这是什么？请参阅 <a href=\"https://developers.cloudflare.com/fundamentals/api/get-started/create-token/\" target=\"_blank\">https://developers.cloudflare.com/fundamentals/api/get-started/create-token/</a>",
  "access.form.cloudns_auth_id.label": "ClouDNS API 用户 ID",
  "access.form.cloudns_auth_id.placeholder": "请输入 ClouDNS API 用户 ID",
  "access.form.cloudns_auth_id.tooltip": "这是什么？请参阅 <a href=\"https://www.cloudns.net/wiki/article/42/\" target=\"_blank\">https://www.cloudns.net/wiki/article/42/</a>",
@ -390,6 +391,7 @@
  "access.form.linode_access_token.label": "Linode AccessToken",
  "access.form.linode_access_token.placeholder": "请输入 Linode AccessToken",
  "access.form.linode_access_token.tooltip": "这是什么？请参阅 <a href=\"https://techdocs.akamai.com/linode-api/reference/get-started\" target=\"_blank\">https://techdocs.akamai.com/linode-api/reference/get-started</a>",
+  "access.form.litessl_eab.guide": "点击下方链接了解如何获取 LiteSSL EAB：<br><a href=\"https://freessl.cn/automation/eab-manager\" target=\"_blank\">https://freessl.cn/automation/eab-manager</a>",
  "access.form.mattermost_server_url.label": "Mattermost 服务地址",
  "access.form.mattermost_server_url.placeholder": "请输入 Mattermost 服务地址",
  "access.form.mattermost_username.label": "Mattermost 用户名",
--- a/ui/src/i18n/locales/zh/nls.provider.json
+++ b/ui/src/i18n/locales/zh/nls.provider.json
@ -126,6 +126,7 @@
  "provider.letsencrypt": "Let's Encrypt",
  "provider.letsencryptstaging": "Let's Encrypt 测试环境",
  "provider.linode": "Linode",
+  "provider.litessl": "LiteSSL",
  "provider.local": "本地主机",
  "provider.mattermost": "Mattermost",
  "provider.namecheap": "Namecheap",
--- a/ui/src/i18n/locales/zh/nls.workflow.nodes.json
+++ b/ui/src/i18n/locales/zh/nls.workflow.nodes.json
@ -60,8 +60,9 @@
  "workflow_node.apply.form.aws_route53_region.label": "AWS 服务区域",
  "workflow_node.apply.form.aws_route53_region.placeholder": "请输入 AWS Route53 服务区域（例如：us-east-1）",
  "workflow_node.apply.form.aws_route53_region.tooltip": "这是什么？请参阅 <a href=\"https://docs.aws.amazon.com/zh_cn/general/latest/gr/rande.html#regional-endpoints\" target=\"_blank\">https://docs.aws.amazon.com/zh_cn/general/latest/gr/rande.html#regional-endpoints</a>",
-  "workflow_node.apply.form.aws_route53_hosted_zone_id.label": "AWS Route53 托管区域 ID",
+  "workflow_node.apply.form.aws_route53_hosted_zone_id.label": "AWS Route53 托管区域 ID（可选）",
  "workflow_node.apply.form.aws_route53_hosted_zone_id.placeholder": "请输入 AWS Route53 托管区域 ID",
+  "workflow_node.apply.form.aws_route53_hosted_zone_id.help": "提示：仅当存在多个相同 FQDN 的托管区域时需要填写。",
  "workflow_node.apply.form.aws_route53_hosted_zone_id.tooltip": "这是什么？请参阅 <a href=\"https://docs.aws.amazon.com/zh_cn/Route53/latest/DeveloperGuide/hosted-zones-working-with.html\" target=\"_blank\">https://docs.aws.amazon.com/zh_cn/Route53/latest/DeveloperGuide/hosted-zones-working-with.html</a>",
  "workflow_node.apply.form.huaweicloud_dns_region.label": "华为云服务区域",
  "workflow_node.apply.form.huaweicloud_dns_region.placeholder": "请输入华为云 DNS 服务区域（例如：cn-north-1）",
@ -169,7 +170,7 @@
  "workflow_node.monitor.form.port.placeholder": "请输入主机端口",
  "workflow_node.monitor.form.domain.label": "域名（可选）",
  "workflow_node.monitor.form.domain.placeholder": "请输入域名",
-  "workflow_node.monitor.form.domain.help": "提示：仅当主机地址为 IP 时需要输入。",
+  "workflow_node.monitor.form.domain.help": "提示：仅当主机地址为 IP 时需要填写。",
  "workflow_node.monitor.form.request_path.label": "请求路径（可选）",
  "workflow_node.monitor.form.request_path.placeholder": "请输入请求路径",

@ -200,7 +201,7 @@
  "workflow_node.deploy.form.1panel_console_auto_restart.label": "部署后自动重启 1Panel 服务",
  "workflow_node.deploy.form.1panel_site_node_name.label": "1Panel 子节点名称（可选）",
  "workflow_node.deploy.form.1panel_site_node_name.placeholder": "请输入 1Panel 子节点名称",
-  "workflow_node.deploy.form.1panel_site_node_name.help": "提示：仅 1Panel v2+ 需要输入。不填写时，将替换主控节点证书；否则，将替换被控节点证书。",
+  "workflow_node.deploy.form.1panel_site_node_name.help": "提示：仅 1Panel v2+ 需要填写。不填写时，将替换主控节点证书；否则，将替换被控节点证书。",
  "workflow_node.deploy.form.1panel_site_node_name.tooltip": "请登录 1Panel 面板查看",
  "workflow_node.deploy.form.1panel_site_resource_type.option.website.label": "部署到指定网站",
  "workflow_node.deploy.form.1panel_site_resource_type.option.certificate.label": "替换指定证书",
--- a/ui/src/pages/settings/SettingsSSLProvider.tsx
+++ b/ui/src/pages/settings/SettingsSSLProvider.tsx
@ -48,6 +48,7 @@ const SettingsSSLProvider = () => {
    [CA_PROVIDERS.SECTIGO, "provider.sectigo", "sectigo.com", "/imgs/providers/sectigo.svg"],
    [CA_PROVIDERS.SSLCOM, "provider.sslcom", "ssl.com", "/imgs/providers/sslcom.svg"],
    [CA_PROVIDERS.ZEROSSL, "provider.zerossl", "zerossl.com", "/imgs/providers/zerossl.svg"],
+    [CA_PROVIDERS.LITESSL, "provider.litessl", "litessl.cn (freessl.cn)", "/imgs/providers/litessl.svg"],
    [CA_PROVIDERS.ACMECA, "provider.acmeca", "ACME v2 (RFC 8555)", "/imgs/providers/acmeca.svg"],
  ].map(([value, name, description, icon]) => {
    return {
@ -70,6 +71,8 @@ const SettingsSSLProvider = () => {
        return <InternalSettingsFormProviderGlobalSignAtlas />;
      case CA_PROVIDERS.GOOGLETRUSTSERVICES:
        return <InternalSettingsFormProviderGoogleTrustServices />;
+      case CA_PROVIDERS.LITESSL:
+        return <InternalSettingsFormProviderLiteSSL />;
      case CA_PROVIDERS.SECTIGO:
        return <InternalSettingsFormProviderSectigo />;
      case CA_PROVIDERS.SSLCOM:
@ -271,6 +274,14 @@ const InternalSettingsFormProviderGoogleTrustServices = () => {
  );
 };

+const InternalSettingsFormProviderLiteSSL = () => {
+  return (
+    <InternalSharedForm provider={CA_PROVIDERS.LITESSL}>
+      <InternalSharedFormEabFields i18nKey="litessl" />
+    </InternalSharedForm>
+  );
+};
+
 const InternalSettingsFormProviderSectigo = () => {
  const { t } = useTranslation();

--- a/ui/src/repository/certificate.ts
+++ b/ui/src/repository/certificate.ts
@ -65,7 +65,7 @@ export const listByWorkflowRunId = async (workflowRunId: string) => {

  const list = await pb.collection(COLLECTION_NAME_CERTIFICATE).getFullList<CertificateModel>({
    batch: 65535,
-    fields: [..._commonFields, ..._expandFields].join(","),
+    fields: [..._commonFields, ..._expandFields, "certificate", "privateKey"].join(","),
    filter: pb.filter("workflowRunRef={:workflowRunId}", { workflowRunId }),
    sort: "created",
    requestKey: null,