[{"data":1,"prerenderedAt":222},["ShallowReactive",2],{"docs:\u002Fdocs\u002Fplatform\u002Flimits":3},{"id":4,"title":5,"body":6,"description":214,"extension":215,"meta":216,"navigation":217,"path":218,"seo":219,"stem":220,"__hash__":221},"docs\u002Fdocs\u002Fplatform\u002Flimits.md","申请范围与限制",{"type":7,"value":8,"toc":205},"minimark",[9,13,17,129,148,152,155,158,167,170,173],[10,11,12],"p",{},"申请证书前先确认你的域名在支持范围内,避免白忙一场。",[14,15,16],"h2",{"id":16},"支持的域名形式",[18,19,20,36],"table",{},[21,22,23],"thead",{},[24,25,26,30,33],"tr",{},[27,28,29],"th",{},"写法",[27,31,32],{},"是否支持",[27,34,35],{},"说明",[37,38,39,55,68,85,103,117],"tbody",{},[24,40,41,49,52],{},[42,43,44,48],"td",{},[45,46,47],"code",{},"example.com","(裸域)",[42,50,51],{},"✅",[42,53,54],{},"主流场景",[24,56,57,63,65],{},[42,58,59,62],{},[45,60,61],{},"api.example.com","(子域)",[42,64,51],{},[42,66,67],{},"任意层级的子域",[24,69,70,76,78],{},[42,71,72,75],{},[45,73,74],{},"*.example.com","(泛域名)",[42,77,51],{},[42,79,80,81,84],{},"开头带一个 ",[45,82,83],{},"*."," 即可,与裸域共用同一验证点",[24,86,87,93,95],{},[42,88,89,92],{},[45,90,91],{},"a.b.example.com","(二级子域)",[42,94,51],{},[42,96,97,102],{},[98,99,101],"a",{"href":100},"\u002Fdocs\u002Fdeleg","托管","时需要单独添加",[24,104,105,111,114],{},[42,106,107,110],{},[45,108,109],{},"192.168.1.10","(IP 地址)",[42,112,113],{},"❌",[42,115,116],{},"见下文",[24,118,119,125,127],{},[42,120,121,124],{},[45,122,123],{},"google.com"," 等公网知名站点",[42,126,113],{},[42,128,116],{},[130,131,134],"callout",{"title":132,"type":133},"泛域名建议走托管","tip",[10,135,136,137,139,140,142,143,147],{},"泛域名的验证点与裸域相同,托管裸域后 ",[45,138,47],{}," 与 ",[45,141,74],{}," 都能全自动申请,详见 ",[98,144,146],{"href":145},"\u002Fdocs\u002Fdeleg\u002Fwildcard","泛域名与子域覆盖","。",[14,149,151],{"id":150},"不支持-ip-地址","不支持 IP 地址",[10,153,154],{},"证书颁发机构(CA)不为公网 IP 签发 DV 证书,填 IP 会直接被拦截,提示「IP 地址不支持签发证书,请使用解析到该 IP 的域名申请」。内网 IP 同理。有 IP 直连需求的标准做法是:给一个域名解析到该 IP,然后用域名签证书。",[14,156,157],{"id":157},"不接受公网知名站点",[10,159,160,162,163,166],{},[45,161,123],{},"、",[45,164,165],{},"github.com"," 这类公网知名站点会被拦截,提示「该域名属于公网知名站点,无法为其签发证书,请使用你自己拥有的域名申请」。",[10,168,169],{},"原因很直接:DNS-01 验证只证明「你能控制这个域名的解析」,证明不了「这个域名归你所有」。拦截知名站点是为了防止有人借验证机制冒充不属于自己的服务。",[14,171,172],{"id":172},"证书本身的边界",[174,175,176,189,202],"ul",{},[177,178,179,180,184,185,147],"li",{},"有效期固定 ",[181,182,183],"strong",{},"90 天","(Let's Encrypt 政策),到期前重新申请即可,见 ",[98,186,188],{"href":187},"\u002Fdocs\u002Fssl\u002Fdownload","证书下载与删除",[177,190,191,192,195,196,198,199,201],{},"泛域名 ",[45,193,194],{},"*"," 只匹配一级:",[45,197,74],{}," 不覆盖 ",[45,200,91],{}," 与裸域,这与 Let's Encrypt 的通配符规则一致。",[177,203,204],{},"签发数量与频率受 Let's Encrypt 公共限额约束(同一注册域名每周签发上限),正常使用不会触达;大量域名批量签发时请分批进行。",{"title":206,"searchDepth":207,"depth":207,"links":208},"",3,[209,211,212,213],{"id":16,"depth":210,"text":16},2,{"id":150,"depth":210,"text":151},{"id":157,"depth":210,"text":157},{"id":172,"depth":210,"text":172},"平台支持的域名形式(裸域\u002F子域\u002F一级泛域名),IP 地址与公网知名站点会被拦截的原因,以及 Let's Encrypt 通配符的层级边界。","md",{},true,"\u002Fdocs\u002Fplatform\u002Flimits",{"title":5,"description":214},"docs\u002Fplatform\u002Flimits","Zp8Fcup65hVRtHwIruzxgp8XBtToMUEEfQ9QuEK5FAQ",1793537574525]