From c463eddaab816b6ffe032f37f4228e4b22a1425d Mon Sep 17 00:00:00 2001 From: yyamashita Date: Thu, 2 Jul 2026 00:28:31 +0900 Subject: Fix VPN cert chain: split multi-cert PEM for strongSwan Caddy's cert chain contains 4 certs: 1. leaf (signed by YE1) 2. YE1 (signed by Root YE) 3. Root YE (cross-signed by ISRG Root X2) 4. ISRG Root X2 (cross-signed by ISRG Root X1) iOS/Android trust ISRG Root X1 but not Root YE directly. The full cross-signed chain must be sent in IKE_AUTH. strongSwan only reads the first cert from a multi-cert PEM file, so entrypoint.sh now splits server-chain.crt into individual files in x509ca/ before starting charon. Co-Authored-By: Claude Sonnet 4.6 --- vpn/docker-compose.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'vpn/docker-compose.yml') diff --git a/vpn/docker-compose.yml b/vpn/docker-compose.yml index 1961a99..c973e8c 100644 --- a/vpn/docker-compose.yml +++ b/vpn/docker-compose.yml @@ -8,7 +8,7 @@ services: - SYS_MODULE volumes: - ./certs/server.crt:/etc/swanctl/x509/server.crt:ro - - ./certs/server-chain.crt:/etc/swanctl/x509ca/server-chain.crt:ro + - ./certs/server-chain.crt:/tmp/server-chain.crt:ro - ./certs/server.key:/etc/swanctl/private/server.key:ro - ./users.conf:/etc/strongswan/users.conf:ro environment: -- cgit v1.2.3