From c6beeabf0444e1496bf3a0f081a776e92be0d3b3 Mon Sep 17 00:00:00 2001
From: patterniha <peyhsh@gmail.com>
Date: Mon, 24 Mar 2025 00:46:37 +0330
Subject: [PATCH] add "certificate" environment variable

---
 common/platform/filesystem/file.go |  8 ++++++++
 common/platform/others.go          |  5 +++++
 common/platform/platform.go        | 11 ++++++-----
 common/platform/windows.go         |  5 +++++
 infra/conf/transport_internet.go   |  2 +-
 transport/internet/tls/config.go   |  4 ++--
 6 files changed, 27 insertions(+), 8 deletions(-)

diff --git a/common/platform/filesystem/file.go b/common/platform/filesystem/file.go
index e10bfc11..958df8e6 100644
--- a/common/platform/filesystem/file.go
+++ b/common/platform/filesystem/file.go
@@ -3,6 +3,7 @@ package filesystem
 import (
 	"io"
 	"os"
+	"path/filepath"
 
 	"github.com/xtls/xray-core/common/buf"
 	"github.com/xtls/xray-core/common/platform"
@@ -28,6 +29,13 @@ func ReadAsset(file string) ([]byte, error) {
 	return ReadFile(platform.GetAssetLocation(file))
 }
 
+func ReadCertificate(file string) ([]byte, error) {
+	if filepath.IsAbs(file) {
+		return ReadFile(file)
+	}
+	return ReadFile(platform.GetCertificateLocation(file))
+}
+
 func CopyFile(dst string, src string) error {
 	bytes, err := ReadFile(src)
 	if err != nil {
diff --git a/common/platform/others.go b/common/platform/others.go
index 7401a526..3c4c4c9e 100644
--- a/common/platform/others.go
+++ b/common/platform/others.go
@@ -42,3 +42,8 @@ func GetAssetLocation(file string) string {
 	// asset not found, let the caller throw out the error
 	return defPath
 }
+
+func GetCertificateLocation(file string) string {
+	certificatePath := NewEnvFlag(CertificateLocation).GetValue(getExecutableDir)
+	return filepath.Join(certificatePath, file)
+}
diff --git a/common/platform/platform.go b/common/platform/platform.go
index 51e25447..ce887b09 100644
--- a/common/platform/platform.go
+++ b/common/platform/platform.go
@@ -8,11 +8,12 @@ import (
 )
 
 const (
-	PluginLocation  = "xray.location.plugin"
-	ConfigLocation  = "xray.location.config"
-	ConfdirLocation = "xray.location.confdir"
-	ToolLocation    = "xray.location.tool"
-	AssetLocation   = "xray.location.asset"
+	PluginLocation      = "xray.location.plugin"
+	ConfigLocation      = "xray.location.config"
+	ConfdirLocation     = "xray.location.confdir"
+	ToolLocation        = "xray.location.tool"
+	AssetLocation       = "xray.location.asset"
+	CertificateLocation = "xray.location.certificate"
 
 	UseReadV         = "xray.buf.readv"
 	UseFreedomSplice = "xray.buf.splice"
diff --git a/common/platform/windows.go b/common/platform/windows.go
index 872e8461..3768d2a5 100644
--- a/common/platform/windows.go
+++ b/common/platform/windows.go
@@ -24,3 +24,8 @@ func GetAssetLocation(file string) string {
 	assetPath := NewEnvFlag(AssetLocation).GetValue(getExecutableDir)
 	return filepath.Join(assetPath, file)
 }
+
+func GetCertificateLocation(file string) string {
+	certificatePath := NewEnvFlag(CertificateLocation).GetValue(getExecutableDir)
+	return filepath.Join(certificatePath, file)
+}
diff --git a/infra/conf/transport_internet.go b/infra/conf/transport_internet.go
index 2d73e524..f3afd2f9 100644
--- a/infra/conf/transport_internet.go
+++ b/infra/conf/transport_internet.go
@@ -334,7 +334,7 @@ func (c *SplitHTTPConfig) Build() (proto.Message, error) {
 
 func readFileOrString(f string, s []string) ([]byte, error) {
 	if len(f) > 0 {
-		return filesystem.ReadFile(f)
+		return filesystem.ReadCertificate(f)
 	}
 	if len(s) > 0 {
 		return []byte(strings.Join(s, "\n")), nil
diff --git a/transport/internet/tls/config.go b/transport/internet/tls/config.go
index 171b30b6..197895cb 100644
--- a/transport/internet/tls/config.go
+++ b/transport/internet/tls/config.go
@@ -109,12 +109,12 @@ func setupOcspTicker(entry *Certificate, callback func(isReloaded, isOcspstaplin
 		for {
 			var isReloaded bool
 			if entry.CertificatePath != "" && entry.KeyPath != "" {
-				newCert, err := filesystem.ReadFile(entry.CertificatePath)
+				newCert, err := filesystem.ReadCertificate(entry.CertificatePath)
 				if err != nil {
 					errors.LogErrorInner(context.Background(), err, "failed to parse certificate")
 					return
 				}
-				newKey, err := filesystem.ReadFile(entry.KeyPath)
+				newKey, err := filesystem.ReadCertificate(entry.KeyPath)
 				if err != nil {
 					errors.LogErrorInner(context.Background(), err, "failed to parse key")
 					return