From acff0eebed7cd89a5b50db2366cd055d6aed67de Mon Sep 17 00:00:00 2001 From: yyamashita Date: Wed, 1 Jul 2026 10:29:36 +0900 Subject: Remove intermediate CA cert mount to fix Android IKEv2 fragmentation Android (XREAL Beam Pro) advertises FRAG_SUP but fails to reassemble IKE fragments. The IKE_AUTH response was 1776 bytes (leaf + YE1 intermediate) requiring fragmentation into 2 packets. Without x509ca mount, only the leaf cert is sent (~886 bytes total), fitting in a single packet without fragmentation. Android fetches the intermediate CA (YE1) via AIA extension before tunnel setup. Co-Authored-By: Claude Sonnet 4.6 --- vpn/docker-compose.yml | 1 - 1 file changed, 1 deletion(-) (limited to 'vpn') diff --git a/vpn/docker-compose.yml b/vpn/docker-compose.yml index 1961a99..83ff270 100644 --- a/vpn/docker-compose.yml +++ b/vpn/docker-compose.yml @@ -8,7 +8,6 @@ services: - SYS_MODULE volumes: - ./certs/server.crt:/etc/swanctl/x509/server.crt:ro - - ./certs/server-chain.crt:/etc/swanctl/x509ca/server-chain.crt:ro - ./certs/server.key:/etc/swanctl/private/server.key:ro - ./users.conf:/etc/strongswan/users.conf:ro environment: -- cgit v1.2.3