证书续签标准流程

1. 检查当前证书有效期

openssl x509 -in /etc/hysteria/certs/fullchain.crt -noout -dates

2. 触发 Caddy 续签

正常情况下 Caddy 会在到期前 30 天自动续签。如需手动触发：

systemctl restart caddy
# Caddy 启动时会检查并续签即将过期的证书

3. 同步证书到 Hysteria2

/usr/local/sbin/sync-hysteria-cert
systemctl restart hysteria-server

4. 验证

# 检查新证书日期
openssl x509 -in /etc/hysteria/certs/fullchain.crt -noout -dates -subject -issuer

# 测试 TLS 握手
echo | openssl s_client -connect 127.0.0.1:443 -servername edge.977979.xyz 2>/dev/null | openssl x509 -noout -dates