diff options
| author | yyamashita <yyamashita@hetzner.yyamashita.com> | 2026-07-01 10:48:36 +0900 |
|---|---|---|
| committer | yyamashita <yyamashita@hetzner.yyamashita.com> | 2026-07-01 10:48:36 +0900 |
| commit | 47e47957cc363511d1de5f78caff7ff77ed7d0c7 (patch) | |
| tree | bd18418d49742bf285b010c59b03a462383b8c3a | |
| parent | acff0eebed7cd89a5b50db2366cd055d6aed67de (diff) | |
Serve YE1 intermediate CA cert for Android VPN trust chain
Android (XREAL Beam Pro) can't validate the server cert because it lacks
the Let's Encrypt YE1 hierarchy in its system trust store. The fix:
- Serve YE1 cert at https://vpn.yyamashita.com/ca.pem via Caddy
- Android VPN profile: set CA certificate to this downloaded cert
- install.sh / renew-cert.sh now extract and copy YE1 to caddy dir
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
| -rw-r--r-- | caddy/Caddyfile | 7 | ||||
| -rw-r--r-- | vpn/install.sh | 4 | ||||
| -rw-r--r-- | vpn/renew-cert.sh | 8 |
3 files changed, 18 insertions, 1 deletions
diff --git a/caddy/Caddyfile b/caddy/Caddyfile index 66a9d05..46a6c92 100644 --- a/caddy/Caddyfile +++ b/caddy/Caddyfile @@ -44,5 +44,12 @@ blog.yyamashita.com { vpn.yyamashita.com { header Referrer-Policy "no-referrer" header X-Robots-Tag "noindex, nofollow" + route /ca.pem { + header Content-Type "application/x-pem-file" + header Content-Disposition "attachment; filename=\"vpn-ca.pem\"" + file_server { + root /etc/caddy + } + } respond "VPN Server" 200 } diff --git a/vpn/install.sh b/vpn/install.sh index 3dc29bc..42088c0 100644 --- a/vpn/install.sh +++ b/vpn/install.sh @@ -45,6 +45,10 @@ awk '/BEGIN CERTIFICATE/{n++} n==1' "$CERT_DIR/server.crt" > "$CERT_DIR/server-l awk '/BEGIN CERTIFICATE/{n++} n>1' "$CERT_DIR/server.crt" > "$CERT_DIR/server-chain.crt" mv "$CERT_DIR/server-leaf.crt" "$CERT_DIR/server.crt" +# Android 用 CA 証明書 (YE1 中間 CA) を Caddy で配信 +awk '/BEGIN CERTIFICATE/{n++} n==1' "$CERT_DIR/server-chain.crt" > "$CADDY_DIR/ca.pem" +echo "Android 用 CA 証明書を ${CADDY_DIR}/ca.pem に配置しました。" + echo "証明書を $CERT_DIR/ に保存しました。" # VPN コンテナ起動 diff --git a/vpn/renew-cert.sh b/vpn/renew-cert.sh index 50f8784..b199350 100644 --- a/vpn/renew-cert.sh +++ b/vpn/renew-cert.sh @@ -14,5 +14,11 @@ docker compose -f "$CADDY_DIR/docker-compose.yml" exec -T caddy \ cat "${CADDY_CERT_BASE}.key" > certs/server.key chmod 600 certs/server.key -docker compose exec vpn swanctl --load-creds --noprompt +# チェーン分割 + Android 用 CA 証明書更新 +awk '/BEGIN CERTIFICATE/{n++} n==1' certs/server.crt > certs/server-leaf.crt +awk '/BEGIN CERTIFICATE/{n++} n>1' certs/server.crt > certs/server-chain.crt +mv certs/server-leaf.crt certs/server.crt +awk '/BEGIN CERTIFICATE/{n++} n==1' certs/server-chain.crt > "$CADDY_DIR/ca.pem" + +docker compose restart echo "完了。証明書を更新してリロードしました。" |