From f6f06e6aa292110bf774fa1ff4591c288b275305 Mon Sep 17 00:00:00 2001
From: yyamashita <yyamashita@hetzner.yyamashita.com>
Date: Thu, 2 Jul 2026 00:41:24 +0900
Subject: Send only YE1+RootYE intermediates, skip cross-signed ISRG Root X2

iOS 14+ and Android 11+ have ISRG Root X2 in their trust store.
Sending the cross-signed ISRG Root X2 alongside the trusted
self-signed version can confuse the cert path-building algorithm.

Chain: leaf -> YE1 -> Root YE -> [ISRG Root X2 from trust store]

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 vpn/entrypoint.sh | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/vpn/entrypoint.sh b/vpn/entrypoint.sh
index b80528a..eb09280 100644
--- a/vpn/entrypoint.sh
+++ b/vpn/entrypoint.sh
@@ -2,12 +2,15 @@
 set -e
 
 # 中間証明書チェーンを個別ファイルに分割（strongSwan は複数証明書 PEM の最初しか読まないため）
+# iOS/Android のトラストストアには ISRG Root X2 が含まれているため、
+# クロス署名版の ISRG Root X2 は送らず YE1 + Root YE の 2 枚のみ送る
 n=0
 file=""
 while IFS= read -r line; do
     case "$line" in
         "-----BEGIN CERTIFICATE-----")
             n=$((n+1))
+            if [ "$n" -gt 2 ]; then break; fi
             file="/etc/swanctl/x509ca/chain-${n}.crt"
             printf '%s\n' "$line" > "$file"
             ;;
-- 
cgit v1.2.3