jason/socktop
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

agent: dynamic self-signed cert validity (~397d from now) to avoid immediate expiry

Browse Source
This commit is contained in:
jasonwitty 2025-08-22 12:43:48 -07:00
parent 9b177f3206
commit 30d263c71e
2 changed files with 6 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
socktop_agent/Cargo.toml
View File

@ -29,6 +29,7 @@ anyhow = "1"
hostname = "0.3" hostname = "0.3"
bytes = { workspace = true } bytes = { workspace = true }
prost = { workspace = true } prost = { workspace = true }
time = { version = "0.3", default-features = false, features = ["formatting", "macros", "parsing" ] }
[build-dependencies] [build-dependencies]
prost-build = "0.13" prost-build = "0.13"

9
socktop_agent/src/tls.rs
View File

@ -1,4 +1,5 @@
use rcgen::{CertificateParams, DistinguishedName, DnType, IsCa, SanType}; use rcgen::{CertificateParams, DistinguishedName, DnType, IsCa, SanType};
use time::{Duration, OffsetDateTime};
use std::{ use std::{
fs, fs,
io::Write, io::Write,
@ -47,10 +48,10 @@ pub fn ensure_self_signed_cert() -> anyhow::Result<(PathBuf, PathBuf)> {
dn.push(DnType::CommonName, hostname.clone()); dn.push(DnType::CommonName, hostname.clone());
params.distinguished_name = dn; params.distinguished_name = dn;
params.is_ca = IsCa::NoCa; params.is_ca = IsCa::NoCa;
// Keep default validity (30 days) but extend to ~1 year (397 days) // Dynamic validity: start slightly in the past to avoid clock skew issues, end ~397 days later
// rcgen 0.13 doesn't have validity_days; use not_before/not_after let now = OffsetDateTime::now_utc();
params.not_before = rcgen::date_time_ymd(2024, 1, 1); params.not_before = now - Duration::minutes(5);
params.not_after = rcgen::date_time_ymd(2025, 2, 2); // ~397 days later params.not_after = now + Duration::days(397);
// Generate key pair (default is ECDSA P256 SHA256) // Generate key pair (default is ECDSA P256 SHA256)
let key_pair = rcgen::KeyPair::generate()?; // defaults to ECDSA P256 SHA256 let key_pair = rcgen::KeyPair::generate()?; // defaults to ECDSA P256 SHA256