为何iOS拒绝Let's Encrypt证书？自托管Bitwarden iOS端连接失败

我正尝试让Bitwarden iOS应用连接我的自托管Bitwarden服务器，该服务器前端由nginx反向代理提供支撑。我使用了Let's Encrypt签发的证书实现HTTPS访问，通过网页端访问完全正常，包括iOS 15上的Safari浏览器也可正常打开，但在iOS端Bitwarden应用中连接失败：

但该应用可以正常识别官方Bitwarden站点的证书，至少它返回了认证错误，我由此判断TLS连接是正常建立的。有意思的是该站点的证书同样由Let's Encrypt签发，这让我十分困惑。
我找到的影响iOS 15的TLS证书要求来自苹果官方发布的《iOS 13和macOS 10.15的受信任证书要求》文档，其中对证书提出了5条限制，我的证书看起来全部满足要求，以下是证书的核心文本内容及对应说明：

Certificate:
Data:
    Version: 3 (0x2)
    Serial Number:
        04:3a:cc:90:eb:09:ca:f2:76:60:11:30:1a:30:27:dc:64:1b
//>>>>>>>
//>>>>>>> TLS server certificates and issuing CAs must use a hash algorithm from the SHA-2 family in the signature algorithm
Signature Algorithm: sha256WithRSAEncryption
    Issuer: C=US, O=Let's Encrypt, CN=R3
    Validity
        //>>>>>>> 
        //>>>>>>> TLS server certificates must have a validity period of 825 days or fewer
        Not Before: Nov 10 20:51:04 2021 GMT
        Not After : Feb  8 20:51:03 2022 GMT
    Subject: CN=bw.ivan-kondratyev.ru
    Subject Public Key Info:
        Public Key Algorithm: rsaEncryption
        //>>>>>>> 
        //>>>>>>> TLS server certificates and issuing CAs using RSA keys must use key sizes greater than or equal to 2048 bits.
            Public-Key: (2048 bit)
            Modulus:
                00:c0:0b...
            Exponent: 65537 (0x10001)
    X509v3 extensions:
        X509v3 Key Usage: critical
            Digital Signature, Key Encipherment
        //>>>>>>> 
        //>>>>>>> TLS server certificates must contain an ExtendedKeyUsage (EKU) extension containing the id-kp-serverAuth OID.
        X509v3 Extended Key Usage: 
            TLS Web Server Authentication, TLS Web Client Authentication
        X509v3 Basic Constraints: critical
            CA:FALSE
        X509v3 Subject Key Identifier: 
            FD:FF:3D:B7:C9:C3:B4:E2:6A:2E:1B:52:56:FC:B4:F8:78:84:9F:6E
        X509v3 Authority Key Identifier: 
            keyid:14:2E:B3:17:B7:58:56:CB:AE:50:09:40:E6:1F:AF:9D:8B:14:C2:C6

        Authority Information Access: 
            OCSP - URI:http://r3.o.lencr.org
            CA Issuers - URI:http://r3.i.lencr.org/
        //>>>>>>>   
        //>>>>>>> TLS server certificates must present the DNS name of the server in the Subject Alternative Name extension of the certificate
        X509v3 Subject Alternative Name: 
            DNS:bw.ivan-kondratyev.ru
        X509v3 Certificate Policies: 
            Policy: 2.23.140.1.2.1
            Policy: 1.3.6.1.4.1.44947.1.1.1
              CPS: http://cps.letsencrypt.org

以下是我的nginx配置中的SSL相关参数：

ssl on;
ssl_protocols       SSLv3 TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers         AES256-SHA:RC4-SHA:DES-CBC3-SHA;
ssl_certificate /etc/letsencrypt/live/bw.ivan-kondratyev.ru/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/bw.ivan-kondratyev.ru/privkey.pem; # managed by Certbot
ssl_session_cache   shared:SSL:10m;
ssl_session_timeout 10m;

若有精通相关技术的人员能帮我指出问题所在，以及是否有办法在iOS 15上正常使用自托管Bitwarden服务，我将不胜感激。

你的问题出在Nginx的SSL配置不符合Bitwarden iOS客户端的安全要求，和证书本身无关：

• 你开启了已经被废弃的SSLv3、TLSv1、TLSv1.1协议，这些协议存在已知安全漏洞，Bitwarden iOS端默认禁止使用这些旧协议建立连接
• 你配置的加密套件AES256-SHA、RC4-SHA、DES-CBC3-SHA全部属于弱加密套件，RC4和3DES早已被列为不安全算法，基于SHA1哈希的套件也不符合现代安全要求，iOS 15的应用传输安全（ATS）策略会直接拒绝使用这些套件的TLS连接

Safari能正常访问是因为浏览器对旧加密套件的容忍度更高，而Bitwarden作为密码管理应用启用了更严格的安全策略，所以出现了两端表现不一致的情况。

修复步骤 #

1. 替换你现有的Nginx SSL相关配置为以下内容：

ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
ssl_prefer_server_ciphers off;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;
ssl_certificate /etc/letsencrypt/live/bw.ivan-kondratyev.ru/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/bw.ivan-kondratyev.ru/privkey.pem; # managed by Certbot

2. 执行nginx -t检查配置语法是否正确，确认无报错后执行systemctl reload nginx重载Nginx配置
3. 重启iOS端的Bitwarden应用，重新输入自托管地址尝试连接即可正常使用。

内容的提问来源于stack exchange，提问作者bionic