diff options
| author | yyamashita <yyamashita@hetzner.yyamashita.com> | 2026-07-02 10:23:08 +0900 |
|---|---|---|
| committer | yyamashita <yyamashita@hetzner.yyamashita.com> | 2026-07-02 10:23:08 +0900 |
| commit | 73da9a6f0afe31bb1c45a339cb1afa8dc2731b28 (patch) | |
| tree | 852bbb1e94c7876b04ae9aa3baf2dc64ed2154b2 | |
| parent | 7d8d2951bdc1af183d2b362d649e370d107c87fc (diff) | |
Force RSA4096 cert for VPN domain to fix iOS IKEv2
ECDSA chain (YE1→Root YE→ISRG Root X2) is not trusted by iOS IKEv2.
RSA chain (Leaf→R10→ISRG Root X1) is universally trusted.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
| -rw-r--r-- | caddy/Caddyfile | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/caddy/Caddyfile b/caddy/Caddyfile index 46a6c92..952d039 100644 --- a/caddy/Caddyfile +++ b/caddy/Caddyfile @@ -42,6 +42,9 @@ blog.yyamashita.com { } vpn.yyamashita.com { + tls { + key_type rsa4096 + } header Referrer-Policy "no-referrer" header X-Robots-Tag "noindex, nofollow" route /ca.pem { |