diff options
| author | yyamashita <yyamashita@hetzner.yyamashita.com> | 2026-07-02 00:41:24 +0900 |
|---|---|---|
| committer | yyamashita <yyamashita@hetzner.yyamashita.com> | 2026-07-02 00:41:24 +0900 |
| commit | f6f06e6aa292110bf774fa1ff4591c288b275305 (patch) | |
| tree | 00582f2f1fdc7b70d32c17242d082f3af415489d | |
| parent | c463eddaab816b6ffe032f37f4228e4b22a1425d (diff) | |
Send only YE1+RootYE intermediates, skip cross-signed ISRG Root X2
iOS 14+ and Android 11+ have ISRG Root X2 in their trust store.
Sending the cross-signed ISRG Root X2 alongside the trusted
self-signed version can confuse the cert path-building algorithm.
Chain: leaf -> YE1 -> Root YE -> [ISRG Root X2 from trust store]
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
| -rw-r--r-- | vpn/entrypoint.sh | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/vpn/entrypoint.sh b/vpn/entrypoint.sh index b80528a..eb09280 100644 --- a/vpn/entrypoint.sh +++ b/vpn/entrypoint.sh @@ -2,12 +2,15 @@ set -e # 中間証明書チェーンを個別ファイルに分割（strongSwan は複数証明書 PEM の最初しか読まないため） +# iOS/Android のトラストストアには ISRG Root X2 が含まれているため、 +# クロス署名版の ISRG Root X2 は送らず YE1 + Root YE の 2 枚のみ送る n=0 file="" while IFS= read -r line; do case "$line" in "-----BEGIN CERTIFICATE-----") n=$((n+1)) + if [ "$n" -gt 2 ]; then break; fi file="/etc/swanctl/x509ca/chain-${n}.crt" printf '%s\n' "$line" > "$file" ;; |