完全按照教程逐步配置，遇到大量报错tls: failed to verify certificate: x509: certificate relies on legacy Common Name field

[marsjane]

我是按照教程，主路由配置，包含了ipv6设置
架构 | ARMv8 Processor rev 4
固件版本 | OpenWrt 21.02-SNAPSHOT r15812+1085-46b6ee7ffc / LuCI openwrt-21.02 branch git-22.335.71649-0ecaf74
当前客户端版本 |  v0.46.086

大量报错如下：

2025-06-03 22:05:00 level=warning msg="[TCP] dial 🐟 漏网之鱼 (match Match/) 10.10.10.20:2630 --> derp25c.tailscale.com:443 error: aexgzbgp01.00117163.xyz:14391 connect error: tls: failed to verify certificate: x509: certificate relies on legacy Common Name field, use SANs instead"
2025-06-03 22:05:00 level=warning msg="[TCP] dial 🐟 漏网之鱼 (match Match/) 10.10.10.20:2404 --> derp7c.tailscale.com:443 error: aexgzbgp01.00117163.xyz:14391 connect error: tls: failed to verify certificate: x509: certificate relies on legacy Common Name field, use SANs instead"
2025-06-03 22:05:00 level=warning msg="[TCP] dial 🐟 漏网之鱼 (match Match/) 10.10.10.20:2612 --> derp14c.tailscale.com:443 error: aexgzbgp01.00117163.xyz:14391 connect error: tls: failed to verify certificate: x509: certificate relies on legacy Common Name field, use SANs instead"
2025-06-03 22:05:00 level=warning msg="[TCP] dial 🐟 漏网之鱼 (match Match/) 10.10.10.20:2626 --> derp16c.tailscale.com:443 error: aexgzbgp01.00117163.xyz:14391 connect error: tls: failed to verify certificate: x509: certificate relies on legacy Common Name field, use SANs instead"
2025-06-03 22:04:59 level=warning msg="[TCP] dial 🐟 漏网之鱼 (match Match/) 10.10.10.20:2618 --> derp4f.tailscale.com:443 error: aexgzbgp01.00117163.xyz:14391 connect error: tls: failed to verify certificate: x509: certificate relies on legacy Common Name field, use SANs instead"



2025-06-03 22:07:21 level=warning msg="because 🇭🇰 香港节点 failed multiple times, active health check"
2025-06-03 22:07:21 level=warning msg="[TCP] dial 🐟 漏网之鱼 (match Match/) 10.10.10.20:7368 --> api.segment.io:443 error: aexgzbgp01.00117163.xyz:14391 connect error: tls: failed to verify certificate: x509: certificate relies on legacy Common Name field, use SANs instead"
2025-06-03 22:07:20 level=warning msg="[TCP] dial 🐟 漏网之鱼 (match Match/) 10.10.10.20:7368 --> api.segment.io:443 error: aexgzbgp01.00117163.xyz:14391 connect error: tls: failed to verify certificate: x509: certificate relies on legacy Common Name field, use SANs instead"
2025-06-03 22:07:20 level=warning msg="[TCP] dial 🐟 漏网之鱼 (match Match/) 10.10.10.20:7357 --> www.notion.so:443 error: aexgzbgp01.00117163.xyz:14391 connect error: tls: failed to verify certificate: x509: certificate relies on legacy Common Name field, use SANs instead"
2025-06-03 22:07:20 level=warning msg="[TCP] dial 🐟 漏网之鱼 (match Match/) 10.10.10.20:7368 --> api.segment.io:443 error: aexgzbgp01.00117163.xyz:14391 connect error: tls: failed to verify certificate: x509: certificate relies on legacy Common Name field, use SANs instead"
2025-06-03 22:07:20 level=warning msg="[TCP] dial 🐟 漏网之鱼 (match Match/) 10.10.10.20:7368 --> api.segment.io:443 error: aexgzbgp01.00117163.xyz:14391 connect error: tls: failed to verify certificate: x509: certificate relies on legacy Common Name field, use SANs instead"
2025-06-03 22:07:19 level=warning msg="because 🇭🇰 香港节点 failed multiple times, active health check"
2025-06-03 22:07:19 level=warning msg="[TCP] dial 🐟 漏网之鱼 (match Match/) 10.10.10.20:7357 --> www.notion.so:443 error: aexgzbgp01.00117163.xyz:14391 connect error: tls: failed to verify certificate: x509: certificate relies on legacy Common Name field, use SANs instead"

完全不懂是哪里的问题，网上也搜不到相关资料，求大佬看看

[marsjane]

2025-06-03 22:43:32 OpenClash 启动成功，请等待服务器上线！
2025-06-03 22:43:32 第七步: 添加计划任务,启动进程守护程序...
2025-06-03 22:43:32 提示：开始添加自定义防火墙规则...
2025-06-03 22:43:32 警告：因为端口范围【546:547】存在于防火墙规则设置【Allow-DHCP-IPV6】自动绕过后可能造成客户端的正常连接无法到达内核，如有需要，请在插件设置-来源流量访问控制中自行添加！
2025-06-03 22:43:32 警告：因为端口范围【67-68】存在于防火墙规则设置【Allow-DHCP】自动绕过后可能造成客户端的正常连接无法到达内核，如有需要，请在插件设置-来源流量访问控制中自行添加！
2025-06-03 22:43:31 提示：正在根据防火墙端口转发和防火墙通信规则添加端口绕过规则...
2025-06-03 22:43:31 提示：IPv6 代理模式为 TProxy...
2025-06-03 22:43:31 提示：DNS 劫持模式为 Dnsmasq 转发...
2025-06-03 22:43:31 第六步: 设置防火墙规则...
2025-06-03 22:43:31 正在设置第二 DNS 服务器列表...
2025-06-03 22:43:30 第五步: 设置 Dnsmasq 程序...
2025-06-03 22:43:30 第四步: 启动主程序...
2025-06-03 22:43:30 提示：开始运行自定义覆写脚本...
2025-06-03 22:43:30 提示：为保证绕过 IP 正常工作，已在 Fake-IP-Filter 中添加规则【geosite:cn】...
2025-06-03 22:43:29 提示：您为 SOCKS5/HTTP(S) 代理设置的账户密码为【Clash:hicxK02N】...
2025-06-03 22:43:29 第三步: 修改配置文件...
2025-06-03 22:43:29 第二步: 组件运行前检查...
2025-06-03 22:43:29 第一步: 获取配置...
2025-06-03 22:43:29 OpenClash 开始启动...

这里的警告不知道是否相关

[Aethersailor]

目测是节点问题，随便找一些其他的免费节点试一下

[marsjane]

多谢，我把节点域名放进DNS黑名单就可以了！

[PaienNate]

刚刚尝试了一下不使用订阅节点转换，发现也工作正常。推测可能这里面有什么限制？