From c463eddaab816b6ffe032f37f4228e4b22a1425d Mon Sep 17 00:00:00 2001
From: yyamashita <yyamashita@hetzner.yyamashita.com>
Date: Thu, 2 Jul 2026 00:28:31 +0900
Subject: Fix VPN cert chain: split multi-cert PEM for strongSwan

Caddy's cert chain contains 4 certs:
  1. leaf (signed by YE1)
  2. YE1 (signed by Root YE)
  3. Root YE (cross-signed by ISRG Root X2)
  4. ISRG Root X2 (cross-signed by ISRG Root X1)

iOS/Android trust ISRG Root X1 but not Root YE directly.
The full cross-signed chain must be sent in IKE_AUTH.

strongSwan only reads the first cert from a multi-cert PEM file,
so entrypoint.sh now splits server-chain.crt into individual files
in x509ca/ before starting charon.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 vpn/docker-compose.yml |  2 +-
 vpn/entrypoint.sh      | 17 +++++++++++++++++
 2 files changed, 18 insertions(+), 1 deletion(-)

(limited to 'vpn')

diff --git a/vpn/docker-compose.yml b/vpn/docker-compose.yml
index 1961a99..c973e8c 100644
--- a/vpn/docker-compose.yml
+++ b/vpn/docker-compose.yml
@@ -8,7 +8,7 @@ services:
       - SYS_MODULE
     volumes:
       - ./certs/server.crt:/etc/swanctl/x509/server.crt:ro
-      - ./certs/server-chain.crt:/etc/swanctl/x509ca/server-chain.crt:ro
+      - ./certs/server-chain.crt:/tmp/server-chain.crt:ro
       - ./certs/server.key:/etc/swanctl/private/server.key:ro
       - ./users.conf:/etc/strongswan/users.conf:ro
     environment:
diff --git a/vpn/entrypoint.sh b/vpn/entrypoint.sh
index febdfef..b80528a 100644
--- a/vpn/entrypoint.sh
+++ b/vpn/entrypoint.sh
@@ -1,6 +1,23 @@
 #!/bin/sh
 set -e
 
+# 中間証明書チェーンを個別ファイルに分割（strongSwan は複数証明書 PEM の最初しか読まないため）
+n=0
+file=""
+while IFS= read -r line; do
+    case "$line" in
+        "-----BEGIN CERTIFICATE-----")
+            n=$((n+1))
+            file="/etc/swanctl/x509ca/chain-${n}.crt"
+            printf '%s\n' "$line" > "$file"
+            ;;
+        *)
+            [ -n "$file" ] && printf '%s\n' "$line" >> "$file"
+            ;;
+    esac
+done < /tmp/server-chain.crt
+echo "Loaded ${n} intermediate CA certs from chain"
+
 # IP フォワーディング有効化（network_mode: host では書き込み不可の場合があるのでエラー無視）
 sysctl -w net.ipv4.ip_forward=1 2>/dev/null || true
 sysctl -w net.ipv6.conf.all.forwarding=1 2>/dev/null || true
-- 
cgit v1.2.3