diff options
| author | yyamashita <yyamashita@hetzner.yyamashita.com> | 2026-07-02 00:28:31 +0900 |
|---|---|---|
| committer | yyamashita <yyamashita@hetzner.yyamashita.com> | 2026-07-02 00:28:31 +0900 |
| commit | c463eddaab816b6ffe032f37f4228e4b22a1425d (patch) | |
| tree | 10c0b1dbde6c80c758cebe01c586350a4e40bfe3 /caddy/entrypoint.sh | |
| parent | 86bc044356ae37aa24ff352858d71641c00740fc (diff) | |
Fix VPN cert chain: split multi-cert PEM for strongSwan
Caddy's cert chain contains 4 certs:
1. leaf (signed by YE1)
2. YE1 (signed by Root YE)
3. Root YE (cross-signed by ISRG Root X2)
4. ISRG Root X2 (cross-signed by ISRG Root X1)
iOS/Android trust ISRG Root X1 but not Root YE directly.
The full cross-signed chain must be sent in IKE_AUTH.
strongSwan only reads the first cert from a multi-cert PEM file,
so entrypoint.sh now splits server-chain.crt into individual files
in x509ca/ before starting charon.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Diffstat (limited to 'caddy/entrypoint.sh')
0 files changed, 0 insertions, 0 deletions