From 84739d906e9eeff02a4e6890eb111bfabf45de0f Mon Sep 17 00:00:00 2001
From: Alireza Ahmadi <alireza7@gmail.com>
Date: Sat, 10 Oct 2026 22:57:53 +0200
Subject: [PATCH] Outbound TLS: useSystemCA switch

---
 web/assets/js/model/outbound.js        |  4 ++++
 web/html/xui/form/outbound.html        | 11 +++++++++++
 web/translation/translate.en_US.toml   |  2 ++
 web/translation/translate.fa_IR.toml   |  2 ++
 web/translation/translate.ru_RU.toml   |  2 ++
 web/translation/translate.vi_VN.toml   |  2 ++
 web/translation/translate.zh_Hans.toml |  2 ++
 7 files changed, 25 insertions(+)

diff --git a/web/assets/js/model/outbound.js b/web/assets/js/model/outbound.js
index 385eaf69..036d1ac1 100644
--- a/web/assets/js/model/outbound.js
+++ b/web/assets/js/model/outbound.js
@@ -582,6 +582,7 @@ class TlsStreamSettings extends CommonClass {
         curvePreferences = [],
         masterKeyLog = '',
         echSockopt = undefined,
+        useSystemCA = false,
     ) {
         super();
         this.serverName = serverName;
@@ -596,6 +597,7 @@ class TlsStreamSettings extends CommonClass {
             : (curvePreferences ? curvePreferences.split(",").map(c => c.trim()).filter(c => c.length > 0) : []);
         this.masterKeyLog = masterKeyLog;
         this.echSockopt = echSockopt;
+        this.useSystemCA = !!useSystemCA;
     }
 
     get echSockoptSwitch() {
@@ -618,6 +620,7 @@ class TlsStreamSettings extends CommonClass {
             json.curvePreferences,
             json.masterKeyLog,
             ObjectUtil.isEmpty(json.echSockopt) ? undefined : SockoptStreamSettings.fromJson(json.echSockopt),
+            json.useSystemCA,
         );
     }
 
@@ -646,6 +649,7 @@ class TlsStreamSettings extends CommonClass {
             curvePreferences: CommonClass.shrinkObject(this.curvePreferences),
             masterKeyLog: CommonClass.shrinkObject(this.masterKeyLog),
             echSockopt: this.echSockopt ? this.echSockopt.toJson() : undefined,
+            useSystemCA: this.useSystemCA || undefined,
         };
     }
 }
diff --git a/web/html/xui/form/outbound.html b/web/html/xui/form/outbound.html
index c9af399b..dea80ed4 100644
--- a/web/html/xui/form/outbound.html
+++ b/web/html/xui/form/outbound.html
@@ -1196,6 +1196,17 @@
             <a-form-item label='{{ i18n "pages.inbounds.stream.tls.allowInsecure" }}'>
                 <a-switch v-model="outbound.stream.tls.allowInsecure"></a-switch>
             </a-form-item>
+            <a-form-item>
+                <template slot="label">
+                    <a-tooltip>
+                        <template slot="title">
+                            <span>{{ i18n "pages.outbounds.useSystemCADesc" }}</span>
+                        </template>
+                        {{ i18n "pages.outbounds.useSystemCA" }} <a-icon type="question-circle"></a-icon>
+                    </a-tooltip>
+                </template>
+                <a-switch v-model="outbound.stream.tls.useSystemCA"></a-switch>
+            </a-form-item>
             <a-form-item label='{{ i18n "pages.outbounds.verifyPeerCertByName" }}'>
                 <a-input v-model.trim="outbound.stream.tls.verifyPeerCertByName"></a-input>
             </a-form-item>
diff --git a/web/translation/translate.en_US.toml b/web/translation/translate.en_US.toml
index 2b78cd9e..d15a5ca2 100644
--- a/web/translation/translate.en_US.toml
+++ b/web/translation/translate.en_US.toml
@@ -251,6 +251,8 @@
 "echConfigList" = "ECH Config List"
 "verifyPeerCertByName" = "Verify Peer Cert By Name"
 "pinnedPeerCert" = "Pinned Peer Cert"
+"useSystemCA" = "Use System CA"
+"useSystemCADesc" = "Trust the operating system's certificate store instead of the root CAs built into Xray. Needed when the server's certificate is signed by a private CA."
 "shortID" = "Short ID"
 "addressPortStrategy" = "Address Port Strategy"
 "keepAliveInterval" = "Keep Alive Interval"
diff --git a/web/translation/translate.fa_IR.toml b/web/translation/translate.fa_IR.toml
index 0fe1edff..44df5fb5 100644
--- a/web/translation/translate.fa_IR.toml
+++ b/web/translation/translate.fa_IR.toml
@@ -252,6 +252,8 @@
 "echConfigList" = "لیست ECH Config"
 "verifyPeerCertByName" = "تأیید گواهی Peer با نام"
 "pinnedPeerCert" = "گواهی Peer ثابت"
+"useSystemCA" = "استفاده از CA سیستم"
+"useSystemCADesc" = "به جای CAهای ریشه‌ی داخلی Xray به گواهی‌های سیستم‌عامل اعتماد می‌کند. برای سروری که گواهی‌اش با یک CA خصوصی امضا شده لازم است."
 "shortID" = "Short ID"
 "addressPortStrategy" = "استراتژی آدرس و پورت"
 "keepAliveInterval" = "بازه Keep Alive"
diff --git a/web/translation/translate.ru_RU.toml b/web/translation/translate.ru_RU.toml
index 63718eb8..3500fb12 100644
--- a/web/translation/translate.ru_RU.toml
+++ b/web/translation/translate.ru_RU.toml
@@ -252,6 +252,8 @@
 "echConfigList" = "Список ECH Config"
 "verifyPeerCertByName" = "Проверка Peer Cert по имени"
 "pinnedPeerCert" = "Закреплённый Peer Cert"
+"useSystemCA" = "Системные CA"
+"useSystemCADesc" = "Доверять хранилищу сертификатов ОС вместо корневых CA, встроенных в Xray. Нужно, если сертификат сервера подписан частным CA."
 "shortID" = "Short ID"
 "addressPortStrategy" = "Стратегия адрес/порт"
 "keepAliveInterval" = "Keep Alive интервал"
diff --git a/web/translation/translate.vi_VN.toml b/web/translation/translate.vi_VN.toml
index 09b45d9c..a30584b0 100644
--- a/web/translation/translate.vi_VN.toml
+++ b/web/translation/translate.vi_VN.toml
@@ -252,6 +252,8 @@
 "echConfigList" = "ECH Config List"
 "verifyPeerCertByName" = "Xác minh Peer Cert theo tên"
 "pinnedPeerCert" = "Peer Cert đã ghim"
+"useSystemCA" = "Dùng CA hệ thống"
+"useSystemCADesc" = "Tin cậy kho chứng chỉ của hệ điều hành thay vì các CA gốc tích hợp trong Xray. Cần khi chứng chỉ máy chủ được ký bởi CA riêng."
 "shortID" = "Short ID"
 "addressPortStrategy" = "Chiến lược địa chỉ-cổng"
 "keepAliveInterval" = "Keep Alive Interval"
diff --git a/web/translation/translate.zh_Hans.toml b/web/translation/translate.zh_Hans.toml
index c3ddab14..3e78f5f3 100644
--- a/web/translation/translate.zh_Hans.toml
+++ b/web/translation/translate.zh_Hans.toml
@@ -252,6 +252,8 @@
 "echConfigList" = "ECH 配置列表"
 "verifyPeerCertByName" = "按名称验证 Peer 证书"
 "pinnedPeerCert" = "固定 Peer 证书"
+"useSystemCA" = "使用系统 CA"
+"useSystemCADesc" = "信任操作系统的证书库，而不是 Xray 内置的根 CA。服务器证书由私有 CA 签发时需要开启。"
 "shortID" = "Short ID"
 "addressPortStrategy" = "地址端口策略"
 "keepAliveInterval" = "Keep Alive 间隔"