From 7d8d2951bdc1af183d2b362d649e370d107c87fc Mon Sep 17 00:00:00 2001
From: yyamashita <yyamashita@hetzner.yyamashita.com>
Date: Thu, 2 Jul 2026 10:15:30 +0900
Subject: Send full cert chain to fix iOS IKEv2 validation

iOS IKEv2 does not look up intermediates from the system trust store
(unlike TLS/HTTPS). Send all 3 certs: YE1 + Root YE + cross-signed
ISRG Root X2, so iOS can build the full chain through to ISRG Root X1.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 vpn/entrypoint.sh | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/vpn/entrypoint.sh b/vpn/entrypoint.sh
index eb09280..51d166b 100644
--- a/vpn/entrypoint.sh
+++ b/vpn/entrypoint.sh
@@ -2,15 +2,15 @@
 set -e
 
 # 中間証明書チェーンを個別ファイルに分割（strongSwan は複数証明書 PEM の最初しか読まないため）
-# iOS/Android のトラストストアには ISRG Root X2 が含まれているため、
-# クロス署名版の ISRG Root X2 は送らず YE1 + Root YE の 2 枚のみ送る
+# iOS の IKEv2 実装は trust store を参照しないため、完全なチェーンを送る必要がある
+# YE1 + Root YE + ISRG Root X2(cross-signed by Root X1) の 3 枚を送る
 n=0
 file=""
 while IFS= read -r line; do
     case "$line" in
         "-----BEGIN CERTIFICATE-----")
             n=$((n+1))
-            if [ "$n" -gt 2 ]; then break; fi
+            if [ "$n" -gt 3 ]; then break; fi
             file="/etc/swanctl/x509ca/chain-${n}.crt"
             printf '%s\n' "$line" > "$file"
             ;;
-- 
cgit v1.2.3