bugfix

backend/routers/admin.py

@@ -533,3 +533,43 @@ async def get_cert_info(domain_id: int, db: AsyncSession = Depends(get_db), _: b
         "need_renew": need_renew,
         "days_left": days_left,
     }
+
+
+# ──────────────── 证书下载 ────────────────
+
+def _cert_store_dir(domain: str) -> str:
+    """泛域名用裸域名作为存储目录"""
+    return domain[2:] if domain.startswith("*.") else domain
+
+
+@router.get("/cert-download/{domain_id}/{file_type}")
+async def download_cert_file(domain_id: int, file_type: str, db: AsyncSession = Depends(get_db), _: bool = Depends(require_auth)):
+    """下载证书文件，file_type: fullchain 或 private"""
+    from fastapi.responses import FileResponse
+
+    if file_type not in ("fullchain", "private"):
+        raise HTTPException(400, "file_type must be fullchain or private")
+
+    result = await db.execute(select(Domain).where(Domain.id == domain_id))
+    domain = result.scalar_one_or_none()
+    if not domain:
+        raise HTTPException(404, "Domain not found")
+
+    settings = get_settings()
+    store_dir = _cert_store_dir(domain.domain)
+
+    if file_type == "fullchain":
+        file_path = Path(settings.cert_dir) / store_dir / "fullchain.pem"
+        filename = f"{store_dir}-fullchain.pem"
+    else:
+        file_path = Path(settings.cert_dir) / store_dir / "private.key"
+        filename = f"{store_dir}-private.key"
+
+    if not file_path.exists():
+        raise HTTPException(404, "文件不存在，请先申请证书")
+
+    return FileResponse(
+        str(file_path),
+        media_type="application/x-pem-file",
+        filename=filename,
+    )