From 11b6518b75e06dcd716bf04e133ef1a67c591cae Mon Sep 17 00:00:00 2001 From: yyamashita Date: Wed, 1 Jul 2026 10:16:13 +0900 Subject: Fix VPN: send certificate always, split cert chain, fix entrypoint - swanctl.conf.tpl: send_cert = always (fix Android cert verification failure) - docker-compose.yml: mount intermediate CAs to /etc/swanctl/x509ca/ - install.sh: split server.crt into leaf + chain for proper chain distribution - entrypoint.sh: run charon directly for Docker log visibility, fix sysctl error handling, fix charon binary path - strongswan.conf: increase IKE log level to 4 for debugging Co-Authored-By: Claude Sonnet 4.6 --- vpn/docker-compose.yml | 1 + 1 file changed, 1 insertion(+) (limited to 'vpn/docker-compose.yml') diff --git a/vpn/docker-compose.yml b/vpn/docker-compose.yml index 83ff270..1961a99 100644 --- a/vpn/docker-compose.yml +++ b/vpn/docker-compose.yml @@ -8,6 +8,7 @@ services: - SYS_MODULE volumes: - ./certs/server.crt:/etc/swanctl/x509/server.crt:ro + - ./certs/server-chain.crt:/etc/swanctl/x509ca/server-chain.crt:ro - ./certs/server.key:/etc/swanctl/private/server.key:ro - ./users.conf:/etc/strongswan/users.conf:ro environment: -- cgit v1.2.3