From 4376b9a907a718a4d324104aec0ad523fd995429 Mon Sep 17 00:00:00 2001
From: 233boy <31657650+233boy@users.noreply.github.com>
Date: Tue, 2 Jun 2026 15:43:27 +0800
Subject: [PATCH] fix hy2 tls*

---
 README.md   |  2 +-
 sing-box.sh |  2 +-
 src/core.sh | 12 +++++++-----
 3 files changed, 9 insertions(+), 7 deletions(-)

diff --git a/README.md b/README.md
index 95c0444..1d017da 100644
--- a/README.md
+++ b/README.md
@@ -75,7 +75,7 @@ Usage: sing-box [options]... [args]...
    port [name] [port | auto]                       更改端口
    path [name] [path | auto]                       更改路径
    passwd [name] [password | auto]                 更改密码
-   key [name] [Private key | atuo] [Public key]    更改密钥
+   key [name] [Private key | auto] [Public key]    更改密钥
    method [name] [method | auto]                   更改加密方式
    sni [name] [ ip | domain]                       更改 serverName
    new [name] [...]                                更改协议
diff --git a/sing-box.sh b/sing-box.sh
index 056947f..8177cfc 100644
--- a/sing-box.sh
+++ b/sing-box.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 
 args=$@
-is_sh_ver=v1.16
+is_sh_ver=v1.17
 
 . /etc/sing-box/sh/src/init.sh
\ No newline at end of file
diff --git a/src/core.sh b/src/core.sh
index 06e9c2c..939773f 100644
--- a/src/core.sh
+++ b/src/core.sh
@@ -1413,20 +1413,22 @@ info() {
         is_insecure=1
         is_can_change=(0 1 4)
         is_info_show=(0 1 2 10 4 8 20)
-        is_url="$is_protocol://$password@$is_addr:$port?type=tcp&security=tls&allowInsecure=1#233boy-$net-$is_addr"
+        is_url="$is_protocol://$password@$is_addr:$port?type=tcp&security=tls&insecure=1&allowInsecure=1#233boy-$net-$is_addr"
         is_info_str=($is_protocol $is_addr $port $password tcp tls true)
         ;;
     hy*)
         is_can_change=(0 1 4)
         is_info_show=(0 1 2 10 8 9 20)
-        is_url="$is_protocol://$password@$is_addr:$port?alpn=h3&insecure=1#233boy-$net-$is_addr"
-        is_info_str=($is_protocol $is_addr $port $password tls h3 true)
+        # fix xray core for client use.
+        is_sha256=$(openssl x509 -noout -fingerprint -sha256 -in $is_core_dir/bin/tls.cer | sed 's/.*=//;s/://g')
+        is_url="$is_protocol://$password@$is_addr:$port?alpn=h3&insecure=1&allowInsecure=1&pinSHA256=$is_sha256#233boy-$net-$is_addr"
+        is_info_str=($is_protocol $is_addr $port $password tls h3 "true (设置, 固定证书>证书指纹(SHA-256): $is_sha256)")
         ;;
     tuic)
         is_insecure=1
         is_can_change=(0 1 4 5)
         is_info_show=(0 1 2 3 10 8 9 20 21)
-        is_url="$is_protocol://$uuid:$password@$is_addr:$port?alpn=h3&allow_insecure=1&congestion_control=bbr#233boy-$net-$is_addr"
+        is_url="$is_protocol://$uuid:$password@$is_addr:$port?alpn=h3&insecure=1&allowInsecure=1&congestion_control=bbr#233boy-$net-$is_addr"
         is_info_str=($is_protocol $is_addr $port $uuid $password tls h3 true bbr)
         ;;
     reality)
@@ -1453,7 +1455,7 @@ info() {
             is_insecure=1
             is_info_show=(0 1 2 10 8 20)
             is_info_str=($is_protocol $is_addr $port $password tls true)
-            is_url="anytls://$password@$is_addr:$port?allowInsecure=1#233boy-$net-$is_addr"
+            is_url="anytls://$password@$is_addr:$port?insecure=1&allowInsecure=1#233boy-$net-$is_addr"
         fi
         ;;
     direct)