diff options
| author | yyamashita <yyamashita@hetzner.yyamashita.com> | 2026-07-02 00:28:31 +0900 |
|---|---|---|
| committer | yyamashita <yyamashita@hetzner.yyamashita.com> | 2026-07-02 00:28:31 +0900 |
| commit | c463eddaab816b6ffe032f37f4228e4b22a1425d (patch) | |
| tree | 10c0b1dbde6c80c758cebe01c586350a4e40bfe3 /vpn | |
| parent | 86bc044356ae37aa24ff352858d71641c00740fc (diff) | |
Fix VPN cert chain: split multi-cert PEM for strongSwan
Caddy's cert chain contains 4 certs:
1. leaf (signed by YE1)
2. YE1 (signed by Root YE)
3. Root YE (cross-signed by ISRG Root X2)
4. ISRG Root X2 (cross-signed by ISRG Root X1)
iOS/Android trust ISRG Root X1 but not Root YE directly.
The full cross-signed chain must be sent in IKE_AUTH.
strongSwan only reads the first cert from a multi-cert PEM file,
so entrypoint.sh now splits server-chain.crt into individual files
in x509ca/ before starting charon.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Diffstat (limited to 'vpn')
| -rw-r--r-- | vpn/docker-compose.yml | 2 | ||||
| -rw-r--r-- | vpn/entrypoint.sh | 17 |
2 files changed, 18 insertions, 1 deletions
diff --git a/vpn/docker-compose.yml b/vpn/docker-compose.yml index 1961a99..c973e8c 100644 --- a/vpn/docker-compose.yml +++ b/vpn/docker-compose.yml @@ -8,7 +8,7 @@ services: - SYS_MODULE volumes: - ./certs/server.crt:/etc/swanctl/x509/server.crt:ro - - ./certs/server-chain.crt:/etc/swanctl/x509ca/server-chain.crt:ro + - ./certs/server-chain.crt:/tmp/server-chain.crt:ro - ./certs/server.key:/etc/swanctl/private/server.key:ro - ./users.conf:/etc/strongswan/users.conf:ro environment: diff --git a/vpn/entrypoint.sh b/vpn/entrypoint.sh index febdfef..b80528a 100644 --- a/vpn/entrypoint.sh +++ b/vpn/entrypoint.sh @@ -1,6 +1,23 @@ #!/bin/sh set -e +# 中間証明書チェーンを個別ファイルに分割（strongSwan は複数証明書 PEM の最初しか読まないため） +n=0 +file="" +while IFS= read -r line; do + case "$line" in + "-----BEGIN CERTIFICATE-----") + n=$((n+1)) + file="/etc/swanctl/x509ca/chain-${n}.crt" + printf '%s\n' "$line" > "$file" + ;; + *) + [ -n "$file" ] && printf '%s\n' "$line" >> "$file" + ;; + esac +done < /tmp/server-chain.crt +echo "Loaded ${n} intermediate CA certs from chain" + # IP フォワーディング有効化（network_mode: host では書き込み不可の場合があるのでエラー無視） sysctl -w net.ipv4.ip_forward=1 2>/dev/null || true sysctl -w net.ipv6.conf.all.forwarding=1 2>/dev/null || true |