diff options
| author | yyamashita <yyamashita@hetzner.yyamashita.com> | 2026-07-02 21:35:37 +0900 |
|---|---|---|
| committer | yyamashita <yyamashita@hetzner.yyamashita.com> | 2026-07-02 21:35:37 +0900 |
| commit | d99eef8641fe819cb0cc90e7eea0514b769e6389 (patch) | |
| tree | b2ef8364016033fc5a81e1490bd64e0b3eefb052 /vpn/swanctl.conf.tpl | |
| parent | 2a1b87ebcb167cededb22782241900a82d0e8d4d (diff) | |
Append issuer root CA to cert chain for Android IKEv2 compat
Android 12 native IKEv2 requires the presented cert chain to include
a cert that is directly in the device trust store. Fetch the issuer
root CA (ISRG Root X1) via AIA from the last intermediate cert and
append it to server-chain.crt so strongSwan sends 4 CERT payloads:
Leaf + YR1 + Root YR + ISRG Root X1 (trusted on all Android versions).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Diffstat (limited to 'vpn/swanctl.conf.tpl')
0 files changed, 0 insertions, 0 deletions