> ## Documentation Index
> Fetch the complete documentation index at: https://frp.xdr.ooo/llms.txt
> Use this file to discover all available pages before exploring further.

# Security Overview

> Understand enrollment trust, management identity, secret handling, and security boundaries.

# Security Overview

FRP Auto Deploy separates **FRP tunnel authentication** from **management-plane trust**. Keeping those responsibilities separate is important when troubleshooting or reviewing risk.

## Security model at a glance

```mermaid theme={null}
flowchart TB
    subgraph TUNNEL[FRP tunnel plane]
      FT[FRP token]
      FC[FRP native TLS or WSS]
    end

    subgraph MGMT[Enrollment / management plane]
      EC[Enrollment Code / Bootstrap Ticket]
      CA[Project private CA]
      MI[Persistent client management identity]
    end

    EC --> CA --> MI
    FT --> FC
```

The FRP token is **not** an Enrollment Code, Bootstrap Ticket, or management API credential.

## Trust establishment

```mermaid theme={null}
sequenceDiagram
    participant C as New client
    participant S as Server

    C->>S: Short-lived enrollment credential
    S-->>C: CA bootstrap / expected trust material
    C->>C: Verify CA fingerprint and certificate
    C->>S: Verified HTTPS enrollment
    S-->>C: Persistent ECDSA management identity + config
    C->>S: Signed management requests thereafter
```

Enrollment and signed client management use verified HTTPS. There is no supported production plain-HTTP fallback.

## FRP tunnel plane

* Direct mode uses FRP native TLS for control.
* Enterprise single-443 carries FRP control over WSS.
* The FRP token authenticates the tunnel.
* Published service traffic is forwarded through FRP after the proxy is registered.

## Persistent management identity

After enrollment, the client keeps a persistent ECDSA P-256 management identity. The private key stays on the client.

Signed management requests bind request data to freshness/replay protections such as timestamp/nonce handling so stale or replayed requests can be rejected.

## Zero-Touch credential properties

A Bootstrap Ticket is designed to be:

* high entropy
* short-lived
* first-machine bound
* single-use after successful enrollment
* hashed at rest on the server
* sensitive until used, expired, or revoked

Do not paste generated bootstrap commands into public issue trackers, public chat, analytics, or long-lived logs.

## Secrets to protect

| Secret                                | Why it matters                            |
| ------------------------------------- | ----------------------------------------- |
| FRP server token                      | authenticates FRP tunnel clients          |
| Enrollment Code                       | first-time manual enrollment secret       |
| Bootstrap Ticket                      | first-time Zero-Touch secret              |
| Client management private key         | persistent management identity            |
| Management MAC material               | management request authentication         |
| CA private key                        | project management trust root             |
| TLS private key                       | server-side TLS identity where applicable |
| Generated FRP config containing token | can expose tunnel credential              |

## Security boundaries

```mermaid theme={null}
flowchart LR
    P[FRP Auto Deploy protects] --> A[Enrollment trust]
    P --> B[Credential separation]
    P --> C[Identity consistency]
    P --> D[Fail-closed management behavior]

    O[Outside product boundary] --> E[Compromised local root]
    O --> F[External firewall policy]
    O --> G[DNS provider]
    O --> H[SSH account/key policy]
    O --> I[Application authentication/TLS]
```

The product does not claim to protect secrets from a fully compromised root account on the server or client.

## Fail closed

Conditions such as unknown identity, invalid signatures, CA mismatch, corrupted registry state, or ambiguous client selectors should fail rather than silently guess.

<Warning>
  Do not "fix" trust failures by using `curl -k`, disabling TLS verification, using plain HTTP enrollment, or copying secrets between clients.
</Warning>

## Related pages

* [Architecture](/reference/architecture)
* [Zero-Touch Enrollment](/guides/zero-touch)
* [Lifecycle Semantics](/operations/lifecycle)
* [Backup & Restore](/operations/backup-restore)