diff options
| author | yyamashita <yyamashita@hetzner.yyamashita.com> | 2026-07-02 00:21:40 +0900 |
|---|---|---|
| committer | yyamashita <yyamashita@hetzner.yyamashita.com> | 2026-07-02 00:21:40 +0900 |
| commit | 86bc044356ae37aa24ff352858d71641c00740fc (patch) | |
| tree | 0b71adee53ed2ad106021a95236bd369df441674 /vpn/strongswan.conf | |
| parent | a86a5b9d1f68f292e33dfc0ed04b87c5ca785382 (diff) | |
Restore intermediate cert + reduce IKE fragment size to 512 bytes
iOS/Android VPN stacks don't follow AIA to download intermediate certs,
so YE1 must be sent by the server for cert chain validation.
The original 1236-byte IKE fragment was being dropped mid-path.
Setting fragment_size=512 splits the 1776-byte IKE_AUTH into ~4
fragments of ≤560 bytes each, which should traverse any NAT/router.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Diffstat (limited to 'vpn/strongswan.conf')
| -rw-r--r-- | vpn/strongswan.conf | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/vpn/strongswan.conf b/vpn/strongswan.conf index eeed46c..4c04b41 100644 --- a/vpn/strongswan.conf +++ b/vpn/strongswan.conf @@ -1,5 +1,6 @@ charon { load_modular = yes + fragment_size = 512 plugins { include strongswan.d/charon/*.conf } |