我正在尝试制作一个 Bitwarden iOS 应用程序与我的自托管 Bitwarden 服务器一起工作。该服务器由反向 (nginx) 支持。我使用 letsencrypt-powered certificate,以便通过 HTTPS 访问。它通过 web 界面工作正常 (不排除 iOS 15 中的 Safari),但在 iOS 应用程序中失败:

虽然，这个应用程序似乎接受https://bitwarden.com的证书。至少它显示了身份验证错误，我认为 TLS 套接字是正常建立的。这个证书也是由 LetsEncrypt 提供支持的有趣的事情。一点也不好笑，实际上，这让我完全困惑。

我发现影响 iOS 15 的 TLS 证书的唯一要求在Requirements for trusted certificates in iOS 13 and macOS 10.15中有说明。它对证书施加了五个限制,似乎我的证书满足所有这些限制。这里是其文本表示的基本部分,带有相应的注释。

    Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:3a:cc:90:eb:09:ca:f2:76:60:11:30:1a:30:27:dc:64:1b
    //>>>>>>
    //>>>>>> TLS server certificates and issuing CAs must use a hash algorithm from the SHA-2 family in the signature algorithm
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=US, O=Let's Encrypt, CN=R3
        Validity
            //>>>>>> 
            //>>>>>> TLS server certificates must have a validity period of 825 days or fewer
            Not Before: Nov 10 20:51:04 2021 T
            Not After : Feb  8 20:51:03 2022 T
        Subject: CN=bw.ivan-kondratyev.ru
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
            //>>>>>> 
            //>>>>>> TLS server certificates and issuing CAs using RSA keys must use key sizes greater than or equal to 2048 bits.
                Public-Key: (2048 bit)
                Modulus:
                    00:c0:0b...
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Key Encipherment
            //>>>>>> 
            //>>>>>> TLS server certificates must contain an ExtendedKeyUsage (EKU) extension containing the id-kp-serverAuth OID.
            X509v3 Extended Key Usage: 
                TLS Web Server Authentication, TLS Web  Authentication
            X509v3 Basic Constraints: critical
                CA:FALSE
            X509v3 Subject Key Identifier: 
                FD:FF:3D:B7:C9:C3:B4:E2:6A:2E:1B:52:56:FC:B4:F8:78:84:9F:6E
            X509v3 Authority Key Identifier: 
                keyid:14:2E:B3:17:B7:58:56:CB:AE:50:09:40:E6:1F:AF:9D:8B:14:C2:C6
            Authority Information Access: 
                OCSP - URI:http://r3.o.lencr.org
                CA Issuers - URI:http://r3.i.lencr.org/
            //>>>>>>   
            //>>>>>> TLS server certificates must present the DNS name of the server in the Subject Alternative Name extension of the certificate
            X509v3 Subject Alternative Name: 
                DNS:bw.ivan-kondratyev.ru
            X509v3 Certificate Policies: 
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.44947.1.1.1
                  CPS: http://cps.letsencrypt.org

我的 nginx 配置有 ssl 相关参数：

    ssl on;
    ssl_protocols       SSLv3 TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers         AES256-SHA:RC4-SHA:DES-CBC3-SHA;
    ssl_certificate /etc/letsencrypt/live/bw.ivan-kondratyev.ru/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/bw.ivan-kondratyev.ru/privkey.pem; # managed by Certbot
    ssl_session_cache   shared:SSL:10m;
    ssl_session_timeout 10m;

我非常感谢任何精通这个主题的人解释我做错了什么，是否有机会通过 iOS 15 利用自托管的 Bitwarden。