為什麼執行完用戶端腳本後，連線 HTTP 網址依然顯示「不安全」？
Why does plain HTTP still show "Not Secure" after running the client script?
▾
現代瀏覽器（如 Chrome、Edge、Safari）對於明文 `http://`
協定一律會顯示「不安全」字樣。請執行完用戶端腳本後完全關閉並重開瀏覽器，並將網址切換為加密的
https://<SERVER_IP>/ 或代理埠，即可看到亮起綠色/灰色安全鎖頭 🔒！
Modern browsers always label plain `http://` connections as "Not Secure". After running the
client script, please completely restart your browser and switch to
https://<SERVER_IP>/ to view the secure 🔒 lock icon.
AnyCert 需要連接外網或註冊網域名稱 (Domain) 嗎？
Does AnyCert require external internet access or a registered domain?
▾
完全不需要！ AnyCert 100% 在內網環境完全離線運作，不需要向外部 CA 註冊、不需要公網 Domain，也不需要 Cloudflare
API。
100% No! AnyCert operates completely offline in local LANs without external domain
registration or cloud dependencies.
支援 Tailscale、ZeroTier 或 VPN 虛擬網段 IP 存取嗎？
Does AnyCert support Tailscale, ZeroTier, or VPN IPs?
▾
完全支援！ 伺服器端設定時會在第二步提示輸入額外 IP（例如 Tailscale IP），自動寫入憑證的 SAN (Subject Alternative Name)
欄位中，經由虛擬網路連線依然安全有效。
Fully supported! The server script prompts for additional IPs (e.g. Tailscale IPs)
during setup and automatically bakes them into the certificate SANs.
如果日後想反安裝 AnyCert，該如何完全乾淨移除？
How do I cleanly uninstall AnyCert if needed?
▾
伺服器端執行 `anycert.bat -u` 或 `sudo bash anycert.sh -u` 即可復原 Nginx 設定並清理憑證。用戶端執行
`anycert-windows.bat -u` 即可選擇刪除匯入的 Root CA 信任與 hosts 紀錄。
Run `anycert.bat -u` or `sudo bash anycert.sh -u` on the server to restore Nginx configs.
Run `anycert-windows.bat -u` on clients to remove trusted Root CA and hosts entries.
可以在單一一台電腦上完成本地受信設定嗎？
Can I set up local certificate trust on a single computer?
▾
完全可以！ 請先執行伺服器端腳本（anycert.bat 或 anycert.sh），將 IP 設定為本機（127.0.0.1）。若在 Windows 平台上，腳本最後會詢問是否匯入本機信任區（確認後即無需再執行用戶端腳本）；若是 Linux / macOS / WSL 平台，請在同一台電腦執行一次對應平台的用戶端腳本即可。
Yes! First run the server script (anycert.bat or anycert.sh) and specify 127.0.0.1 as the IP. On Windows, the installer will ask if you want to import the CA into the local trust store (skipping the need for a client script). On Linux, macOS, or WSL, simply run the corresponding client script once on the same computer.
如果有雙網卡（或虛擬 IP / IP Alias），可以在單機做到 Profile 2 的「1:1 同 Port 轉發」嗎？有哪些避雷重點？
Can I achieve 1:1 port forwarding (like Profile 2) on a single host with dual NICs or IP Aliases? What are the key pitfalls?
▾
完全可以！這稱為「單機融合模式 (Fusion Mode)」。透過在同一台主機的網卡上綁定第二個 IP（Secondary IP / IP Alias），即可在單一機器上實現 1:1 同 Port 的 HTTPS 反向代理，無需額外部署 VM 或 LXC 網關！
🔹 架構與運作原理：
- 網路卡設定： 網卡綁定主 IP
IP-A（例如 192.168.1.100），並新增第二個虛擬 IP IP-B（例如 192.168.1.200）。
- 服務監聽與轉發： 後端 Web 服務僅綁定監聽
IP-A:port（或 127.0.0.1:port），而 Nginx 開啟 SSL 並僅監聽 IP-B:port。
- 流量路由： 存取
https://IP-B:3000/ 🔒 → Nginx 解密 → 轉發至 http://127.0.0.1:3000/ 🔓，成功達成 1:1 Port 不衝突。
🚨 關鍵避雷重點 (Pitfalls to Avoid)：
0.0.0.0 綁定衝突 (EADDRINUSE)： 許多後端服務與 Docker 容器預設會監聽 0.0.0.0:PORT（綁定所有 IP 介面）。如果後端佔用了 0.0.0.0:3000，Nginx 在 IP-B:3000 啟動時會因埠號衝突而直接崩潰。解決方式： 必須修改後端服務設定或 Docker 埠號映射，明確指定僅監聽 127.0.0.1 或 IP-A。- IP 資源與雲端環境限制： 內網環境需確保
IP-B 在路由器中已設為靜態或保留；若在雲端主機 (AWS/GCP/Azure)，需透過雲端面板申購配發 Secondary Private IP。
- 重啟持久化： 透過系統指令（如 Linux
ip addr add 或 Windows netsh）手動新增的 IP Alias，在重啟後會消失，需寫入系統網路設定檔（如 netplan / Windows Registry）維護持久化。
Yes! This is known as Single-Host Fusion Mode. By binding a secondary IP address (IP Alias / Secondary IP) to your host's network card, you can achieve 1:1 port HTTPS reverse proxying on a single machine without deploying extra VMs or LXC containers!
🔹 Architecture & Workflow:
- Network Setup: Assign primary
IP-A (e.g. 192.168.1.100) and add a secondary virtual IP-B (e.g. 192.168.1.200) to the network interface.
- Service Listening: Configure backend web services to bind strictly on
IP-A:port (or 127.0.0.1:port), while Nginx SSL listens on IP-B:port.
- Traffic Routing: Requests to
https://IP-B:3000/ 🔒 → decrypted by Nginx → forwarded to http://127.0.0.1:3000/ 🔓 with zero port conflicts.
🚨 Critical Pitfalls to Avoid:
0.0.0.0 Binding Collision (EADDRINUSE): Many backend applications and Docker containers default to listening on 0.0.0.0:PORT (all interfaces). If a backend service claims 0.0.0.0:3000, Nginx will fail to start on IP-B:3000 due to port collision. Solution: You must update the backend config or Docker port mapping to bind explicitly to 127.0.0.1 or IP-A.- IP Allocation & Cloud Restrictions: On LANs, ensure
IP-B is reserved/static on your router. On cloud providers (AWS/GCP/Azure), assign a Secondary Private IP via the cloud management console.
- Reboot Persistence: Secondary IPs added via temporary CLI tools (e.g. Linux
ip addr add or Windows netsh) will disappear upon reboot. Save them to system network configs (e.g. netplan, systemd-networkd, or Windows Registry) to survive reboots.
如果內網已經有軟路由（如 OpenWrt / pfSense / iStoreOS）可以簽發憑證，為什麼還需要 AnyCert？
If I already have a Soft Router (e.g. OpenWrt, pfSense, OPNSense) that issues certificates, why use AnyCert?
▾
兩者的適用情境與自動化維度完全不同！ 軟路由內建的 ACME 套件僅解決「公網 Domain 的憑證簽發」，而 AnyCert 提供了完整的「離線零 Domain 簽發 + Nginx 自動反代 + 全平台客戶端一鍵自動信任」端到端解決方案：
- 100% 離線 & 零 Domain 依賴： 軟路由 ACME 必須申請公網網域名稱 (Domain) 並設定 Cloudflare 等外網 DNS API 驗證；AnyCert 可在無網際網路的純內網、IP (如
192.168.x.x) 或 Tailscale 虛擬網段直接簽發。
- 跨平台客戶端一鍵自動信任： 軟路由完全無法幫客戶端電腦自動匯入憑證；AnyCert 提供
anycert-windows.bat / anycert-linux.sh / anycert-macos.sh 一鍵腳本，自動遠端下載 CA、自動導入系統與 Chrome 信任庫並配置 hosts。
- 零網路拓撲變更： 無需購買或更換軟路由硬體，在任何既有主機（Windows / Linux / macOS / PVE）上執行即可即刻生效！
Their target scenarios and automation scope are completely different! Router ACME tools usually only cover certificate generation for public domains, whereas AnyCert provides a complete end-to-end solution: 100% Offline & Domain-free Issuance + Automated Nginx Proxy + One-click Cross-Platform Client Trust Automation:
- 100% Offline & Zero Domain Dependencies: Router ACME requires a registered public domain name and external DNS API credentials (e.g. Cloudflare). AnyCert works offline in isolated LANs, raw IPs (e.g.
192.168.x.x), or Tailscale VPN networks.
- One-Click Automated Client Trust: Soft Routers cannot automate client-side trust installation. AnyCert provides one-click client scripts (
anycert-windows.bat, anycert-linux.sh, anycert-macos.sh) that automatically fetch the CA, install it into system & Chrome trust stores, and update local hosts.
- Zero Network Topology Changes: No need to buy or configure soft router hardware—simply run AnyCert on any existing host (Windows, Linux, macOS, or Proxmox VE).
行動裝置（iOS / Android 手機和平板）可以使用嗎？該如何匯入憑證？
Can I use AnyCert on mobile devices (iOS / Android)? How do I install the certificate?
▾
完全可以！行動裝置只需下載並導入 anycert-ca.crt 即可亮起安全鎖頭 🔒！
💡 手機連線關鍵說明（IP 網址 vs FQDN 域名）：
- 預設推薦使用 IP 網址存取 (
https://<SERVER_IP>:xxxx)： 由於手機無 Root 權限無法修訂本機 hosts 檔，AnyCert 簽發時已將伺服器實體 IP 與 Tailscale IP 寫入憑證 SAN 欄位中，因此無需修改 hosts，手機直接打 IP 網址即可安全連線！
- 若欲在手機使用 FQDN 域名 (
https://<FQDN>:xxxx)： 需在內網路由器或 DNS 伺服器（如 AdGuard Home、Pi-hole、OpenWrt）自訂 Local DNS A 紀錄指到伺服器 IP。
📱 iOS / iPadOS 安裝步驟：
- 用 Safari 開啟
http://<SERVER_IP>/（AnyCert 預設 Web 首頁），點擊下載 anycert-ca.crt。
- 前往 iOS 「設定」→「已下載描述檔」→ 點擊「安裝」。
- 關鍵步驟： 前往 iOS 「設定」→「一般」→「關於本機」→ 底部「憑證信任設定」→ 開啟 AnyCert Root CA 的「完全信任」開關。
🤖 Android 安裝步驟：
- 用 Chrome 開啟
http://<SERVER_IP>/ 下載 anycert-ca.crt。
- 前往 Android 「設定」→「安全性與隱私權」→「更多安全性設定」→「加密與憑證」→「安裝憑證」→ 選擇「CA 憑證」。
- 點擊「仍要安裝」並選取剛下載的
anycert-ca.crt 檔案完成匯入。
Yes, absolutely! Mobile devices can fully trust AnyCert by installing anycert-ca.crt 🔒!
💡 Important Note on Mobile Connectivity (IP vs. FQDN):
- Recommended: Connect via IP (
https://<SERVER_IP>:xxxx): Non-rooted mobile devices cannot edit local hosts files. AnyCert includes server IPs in the certificate's SAN fields, so direct IP connections work securely without editing hosts!
- To use FQDN domain names on mobile (
https://<FQDN>:xxxx): You must configure a Local DNS A Record pointing to the server IP on your router or local DNS server (e.g. AdGuard Home, Pi-hole, OpenWrt).
📱 iOS / iPadOS Setup:
- Open
http://<SERVER_IP>/ (AnyCert landing page) in Safari and tap Download Root CA.
- Go to iOS Settings → Profile Downloaded → Install.
- Crucial Step: Go to Settings → General → About → Certificate Trust Settings → Toggle Full Trust ON for AnyCert Root CA.
🤖 Android Setup:
- Open
http://<SERVER_IP>/ in Chrome and download anycert-ca.crt.
- Go to Android Settings → Security & Privacy → More Security Settings → Encryption & Credentials → Install a Certificate → CA Certificate.
- Tap "Install Anyway" and select the downloaded
anycert-ca.crt file.
一台用戶端可以同時信任多台 AnyCert 伺服器嗎？
Can a single client machine trust multiple AnyCert servers?
▾
完全可以！ 每台 AnyCert 伺服器各自擁有獨立的 Root CA，用戶端腳本完整支援多台伺服器並存。
只需針對每台伺服器分別執行一次用戶端腳本：
• anycert-windows.bat -s 192.168.1.10
• anycert-windows.bat -s 192.168.1.20
每台伺服器的 CA 憑證會被獨立匯入並記錄於本地清單（%ProgramData%\anycert\anycert-info.txt）。下次不帶 -s 直接執行時，腳本會列出所有已登記的伺服器，讓您選擇「新增 / 移除 / 離開」。
Absolutely! Each AnyCert server has its own independent Root CA, and the client scripts fully support multiple servers coexisting on the same machine.
Simply run the client script once per server:
• anycert-windows.bat -s 192.168.1.10
• anycert-windows.bat -s 192.168.1.20
Each server's CA cert is imported separately and tracked in a local registry file (%ProgramData%\anycert\anycert-info.txt). When you run the client script again without -s, it lists all registered servers and lets you choose to Add, Remove, or Exit.
