secubox/secubox-deb
1
0
Fork 0
mirror of https://github.com/CyberMind-FR/secubox-deb.git synced 2026-07-28 21:17:36 +00:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

Merge pull request #691 from CyberMind-FR/feature/689-sbxmitm-forged-leaf-certs-expire-after-2
Some checks are pending
License Headers / check (push) Waiting to run
Details

Browse Source 
sbxmitm: forged leaves valid 365d not 24h — stop daily cert expiry (closes #689)
This commit is contained in:
CyberMind 2026-06-22 09:46:57 +02:00 committed by GitHub
commit dde96f212e
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
packages/secubox-toolbox-ng/cmd/sbxmitm/main.go
View File

@ -129,8 +129,12 @@ func (c *CA) forge(host string) (*tls.Certificate, error) {
tmpl := &x509.Certificate{
SerialNumber: serial,
Subject: pkix.Name{CommonName: host},
NotBefore: time.Now().Add(-1 * time.Hour),
NotAfter: time.Now().Add(24 * time.Hour),
// #689 — forged leaves must outlive the (non-evicting) cert cache, else a
// long-running worker keeps serving an expired leaf and every client
// reports "certificat expiré". 365d forward + 48h back-skew = 367d span,
// safely under Apple's 398-day max-validity rule for server certs.
NotBefore: time.Now().Add(-48 * time.Hour),
NotAfter: time.Now().Add(365 * 24 * time.Hour),
KeyUsage: x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment,
ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
DNSNames: []string{host},