diff options
| author | yyamashita <yyamashita@hetzner.yyamashita.com> | 2026-07-01 10:16:13 +0900 |
|---|---|---|
| committer | yyamashita <yyamashita@hetzner.yyamashita.com> | 2026-07-01 10:16:13 +0900 |
| commit | 11b6518b75e06dcd716bf04e133ef1a67c591cae (patch) | |
| tree | afb24a215bed7c7b9b0d74e0820eaaf78bfe3e98 /vpn/install.sh | |
| parent | dd15de090cc70454f5039f8a1a9bb1d98358435b (diff) | |
Fix VPN: send certificate always, split cert chain, fix entrypoint
- swanctl.conf.tpl: send_cert = always (fix Android cert verification failure)
- docker-compose.yml: mount intermediate CAs to /etc/swanctl/x509ca/
- install.sh: split server.crt into leaf + chain for proper chain distribution
- entrypoint.sh: run charon directly for Docker log visibility,
fix sysctl error handling, fix charon binary path
- strongswan.conf: increase IKE log level to 4 for debugging
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Diffstat (limited to 'vpn/install.sh')
| -rw-r--r-- | vpn/install.sh | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/vpn/install.sh b/vpn/install.sh index 9a2f33d..3dc29bc 100644 --- a/vpn/install.sh +++ b/vpn/install.sh @@ -39,6 +39,12 @@ docker compose -f "$CADDY_DIR/docker-compose.yml" exec -T caddy \ cat "${CADDY_CERT_BASE}.key" > "$CERT_DIR/server.key" chmod 600 "$CERT_DIR/server.key" + +# 証明書チェーンを分割: 1枚目=リーフ、残り=中間CA +awk '/BEGIN CERTIFICATE/{n++} n==1' "$CERT_DIR/server.crt" > "$CERT_DIR/server-leaf.crt" +awk '/BEGIN CERTIFICATE/{n++} n>1' "$CERT_DIR/server.crt" > "$CERT_DIR/server-chain.crt" +mv "$CERT_DIR/server-leaf.crt" "$CERT_DIR/server.crt" + echo "証明書を $CERT_DIR/ に保存しました。" # VPN コンテナ起動 |