diff options
| author | yyamashita <yyamashita@hetzner.yyamashita.com> | 2026-07-01 10:29:36 +0900 |
|---|---|---|
| committer | yyamashita <yyamashita@hetzner.yyamashita.com> | 2026-07-01 10:29:36 +0900 |
| commit | acff0eebed7cd89a5b50db2366cd055d6aed67de (patch) | |
| tree | eff62ffa17823653e2e97466a061620f2bbb01f7 | |
| parent | 11b6518b75e06dcd716bf04e133ef1a67c591cae (diff) | |
Remove intermediate CA cert mount to fix Android IKEv2 fragmentation
Android (XREAL Beam Pro) advertises FRAG_SUP but fails to reassemble
IKE fragments. The IKE_AUTH response was 1776 bytes (leaf + YE1 intermediate)
requiring fragmentation into 2 packets. Without x509ca mount, only the leaf
cert is sent (~886 bytes total), fitting in a single packet without fragmentation.
Android fetches the intermediate CA (YE1) via AIA extension before tunnel setup.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
| -rw-r--r-- | vpn/docker-compose.yml | 1 |
1 files changed, 0 insertions, 1 deletions
diff --git a/vpn/docker-compose.yml b/vpn/docker-compose.yml index 1961a99..83ff270 100644 --- a/vpn/docker-compose.yml +++ b/vpn/docker-compose.yml @@ -8,7 +8,6 @@ services: - SYS_MODULE volumes: - ./certs/server.crt:/etc/swanctl/x509/server.crt:ro - - ./certs/server-chain.crt:/etc/swanctl/x509ca/server-chain.crt:ro - ./certs/server.key:/etc/swanctl/private/server.key:ro - ./users.conf:/etc/strongswan/users.conf:ro environment: |