From 73da9a6f0afe31bb1c45a339cb1afa8dc2731b28 Mon Sep 17 00:00:00 2001
From: yyamashita <yyamashita@hetzner.yyamashita.com>
Date: Thu, 2 Jul 2026 10:23:08 +0900
Subject: Force RSA4096 cert for VPN domain to fix iOS IKEv2
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

ECDSA chain (YE1→Root YE→ISRG Root X2) is not trusted by iOS IKEv2.
RSA chain (Leaf→R10→ISRG Root X1) is universally trusted.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 caddy/Caddyfile | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/caddy/Caddyfile b/caddy/Caddyfile
index 46a6c92..952d039 100644
--- a/caddy/Caddyfile
+++ b/caddy/Caddyfile
@@ -42,6 +42,9 @@ blog.yyamashita.com {
 }
 
 vpn.yyamashita.com {
+    tls {
+        key_type rsa4096
+    }
     header Referrer-Policy "no-referrer"
     header X-Robots-Tag "noindex, nofollow"
     route /ca.pem {
-- 
cgit v1.2.3