diff options
| author | yyamashita <yyamashita@hetzner.yyamashita.com> | 2026-07-02 10:15:30 +0900 |
|---|---|---|
| committer | yyamashita <yyamashita@hetzner.yyamashita.com> | 2026-07-02 10:15:30 +0900 |
| commit | 7d8d2951bdc1af183d2b362d649e370d107c87fc (patch) | |
| tree | 7f993b7912d409363d2923eeaf818c5893d4e7ce /vpn | |
| parent | 8f0380a933f420320716de61a5838400117dbb8a (diff) | |
Send full cert chain to fix iOS IKEv2 validation
iOS IKEv2 does not look up intermediates from the system trust store
(unlike TLS/HTTPS). Send all 3 certs: YE1 + Root YE + cross-signed
ISRG Root X2, so iOS can build the full chain through to ISRG Root X1.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Diffstat (limited to 'vpn')
| -rw-r--r-- | vpn/entrypoint.sh | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/vpn/entrypoint.sh b/vpn/entrypoint.sh index eb09280..51d166b 100644 --- a/vpn/entrypoint.sh +++ b/vpn/entrypoint.sh @@ -2,15 +2,15 @@ set -e # 中間証明書チェーンを個別ファイルに分割（strongSwan は複数証明書 PEM の最初しか読まないため） -# iOS/Android のトラストストアには ISRG Root X2 が含まれているため、 -# クロス署名版の ISRG Root X2 は送らず YE1 + Root YE の 2 枚のみ送る +# iOS の IKEv2 実装は trust store を参照しないため、完全なチェーンを送る必要がある +# YE1 + Root YE + ISRG Root X2(cross-signed by Root X1) の 3 枚を送る n=0 file="" while IFS= read -r line; do case "$line" in "-----BEGIN CERTIFICATE-----") n=$((n+1)) - if [ "$n" -gt 2 ]; then break; fi + if [ "$n" -gt 3 ]; then break; fi file="/etc/swanctl/x509ca/chain-${n}.crt" printf '%s\n' "$line" > "$file" ;; |