修复根证书信任问题

app.py

@@ -389,8 +389,14 @@ default_bits = {key_size}
     prompt = no
     default_md = sha256
     distinguished_name = dn
-req_extensions = req_ext
+    """
 
+    # 只有在有SAN时才添加扩展部分
+    has_san = bool(san_dns or san_ip)
+    if has_san:
+        csr_config += "req_extensions = req_ext\n"
+
+    csr_config += f"""
     [dn]
     CN = {common_name}
     O = {organization}
@@ -398,7 +404,10 @@ OU = {organizational_unit}
     C = {country}
     ST = {state}
     L = {locality}
+    """
 
+    if has_san:
+        csr_config += """
     [req_ext]
     basicConstraints = CA:FALSE
     keyUsage = digitalSignature, keyEncipherment
@@ -407,12 +416,13 @@ extendedKeyUsage = serverAuth, clientAuth
 
     [alt_names]"""
 
-    # 添加SAN条目
+        # 添加DNS SAN条目
         if san_dns:
             dns_entries = [dns.strip() for dns in san_dns.split(',') if dns.strip()]
             for i, dns in enumerate(dns_entries, 1):
                 csr_config += f"\nDNS.{i} = {dns}"
 
+        # 添加IP SAN条目
         if san_ip:
             ip_entries = [ip.strip() for ip in san_ip.split(',') if ip.strip()]
             for i, ip in enumerate(ip_entries, 1):