> ## Documentation Index
> Fetch the complete documentation index at: https://frp.xdr.ooo/llms.txt
> Use this file to discover all available pages before exploring further.

# HTTP & HTTPS

> Publish HTTP and HTTPS applications through FRP Auto Deploy using TCP forwarding.

# HTTP & HTTPS

FRP Auto Deploy publishes HTTP and HTTPS as **TCP services**. It is not an application-layer reverse proxy for the published service.

## HTTP path

```mermaid theme={null}
flowchart LR
    B[Browser] -->|http://server:6001| S[FRP Server]
    S --> C[FRP Client]
    C -->|127.0.0.1:80| W[HTTP App]
```

Example targets:

```text theme={null}
127.0.0.1:80
10.10.20.40:80
```

## HTTPS path: TLS stays encrypted through FRP

```mermaid theme={null}
sequenceDiagram
    participant B as Browser
    participant S as FRP Server
    participant C as FRP Client
    participant W as HTTPS App

    B->>S: TLS connection to public service port
    S->>C: encrypted TCP stream
    C->>W: encrypted TCP stream
    W-->>B: target application's certificate + TLS response
```

FRP Auto Deploy does **not** terminate, replace, or automatically issue the target application's TLS certificate.

## DNS hostname and certificate

Suppose:

```text theme={null}
Public service hostname : fw.example.com
Public service port     : 6005
Target                   : 127.0.0.1:443
```

Users connect to:

```text theme={null}
https://fw.example.com:6005
```

The certificate presented by the **target application** must be valid for `fw.example.com` where hostname verification applies.

## Multiple web services on one client

```mermaid theme={null}
flowchart LR
    U[Users]
    S[FRP Server]
    C[Client A]
    A[web-admin\n127.0.0.1:443]
    B[api\n127.0.0.1:8080]
    D[lan-ui\n10.10.20.50:8443]

    U -->|6001| S
    U -->|6002| S
    U -->|6003| S
    S --> C
    C --> A
    C --> B
    C --> D
```

Give each service a stable Service ID so later lifecycle and target changes remain unambiguous.

## Common failure patterns

| Symptom                                              | Likely layer to check            |
| ---------------------------------------------------- | -------------------------------- |
| Connection timeout                                   | public firewall/NAT/service port |
| FRP path works but target returns connection refused | target listener/bind address     |
| IP works, hostname does not                          | DNS/hairpin NAT                  |
| HTTPS certificate warning                            | target app certificate/SAN       |
| LAN web target fails only                            | client-to-LAN routing/ACL        |

<Tip>
  First prove the target is reachable from the FRP client. Then prove the public service port is reachable. Treat DNS and TLS hostname validation as later layers.
</Tip>