diff --git a/internal/server/lifecycle.go b/internal/server/lifecycle.go
index 302a739..fd12a53 100644
--- a/internal/server/lifecycle.go
+++ b/internal/server/lifecycle.go
@@ -43,6 +43,14 @@ func (s *Server) cleanupResources() {
 		s.tlsManager.Close()
 	}
 
+	// 关闭多服务器模式下创建的子 TLS 管理器
+	s.tlsManagersMu.Lock()
+	for _, m := range s.tlsManagers {
+		m.Close()
+	}
+	s.tlsManagers = nil
+	s.tlsManagersMu.Unlock()
+
 	// 关闭 AccessControl (释放 GeoIP 资源)
 	s.accessControlsMu.Lock()
 	for _, ac := range s.accessControls {
diff --git a/internal/server/server.go b/internal/server/server.go
index baff270..f2a0059 100644
--- a/internal/server/server.go
+++ b/internal/server/server.go
@@ -63,6 +63,8 @@ type Server struct {
 	handler             fasthttp.RequestHandler
 	resolver            resolver.Resolver
 	tlsManager          *ssl.TLSManager
+	tlsManagers         []*ssl.TLSManager
+	tlsManagersMu       sync.Mutex
 	accessLogMiddleware *accesslog.AccessLog
 	luaEngine           *lua.LuaEngine
 	accessControl       *security.AccessControl
@@ -768,6 +770,10 @@ func (s *Server) startMultiServerMode() error {
 					return
 				}
 				fastSrv.TLSConfig = tlsManager.GetTLSConfig()
+
+				s.tlsManagersMu.Lock()
+				s.tlsManagers = append(s.tlsManagers, tlsManager)
+				s.tlsManagersMu.Unlock()
 			}
 
 			s.fastServers[idx] = fastSrv