alireza0X-UI 与 S-UI 核心维护者

值得推荐作者发言

GitHub·2026.11.07 09:09:45（UTC+8）

alireza0：S-UI 修复 ECH 分享链接与密钥生成流程

alireza0 表示，下一版将把 ECH 配置写入分享链接的 ech=<base64 ECHConfigList>，Clash 订阅去掉 PEM 包装并支持导入回填；密钥对保持随机，域名仅作为 public name 和外层 ClientHello 的伪装 SNI，生成按钮改为单独输入该名称；已有配置时 ECH Query Server Name 不再参与查询，并在生成密钥时清空或禁用该字段。

作者原文@alireza0

Thanks for the report, both points are fixed for the next release.

1. ECH in share links
When ECH is enabled on the inbound, links now carry ech=<base64 ECHConfigList> (same format as Xray/v2rayN and the Hysteria2 URI). Clash subscriptions now send the config in the form mihomo expects, without the -----BEGIN/END----- lines. Importing a link with ech= fills the client ECH config back in.

2. Key generation and the domain
The keypair is meant to be random. sing-box generate ech-keypair <public name> works the same way: the domain only goes into the config as the public name, the decoy SNI an observer sees in the outer ClientHello. The panel used to take that name from the TLS server name without asking. Now the Generate button opens a dialog where you enter the public name, with a short explanation of what it does.

One note on your setup: "ECH Query Server Name" is only used when the client config is empty, to look the config up in that domain's DNS (HTTPS record). With a key generated here the config is filled in, so www.icloud.com there had no effect. You can leave it empty. The field is now disabled while a config is set, and generating a key clears it.