Fix: Gate TLS-bridge leaf cache on wall-clock validity, not monotonic TTL

The minter cached forged leaves on a TTL compared with time.Now(), which
carries Go's monotonic clock. Across a host suspend / VM pause the
monotonic clock freezes while wall time — and the leaf's x509 NotAfter —
keeps advancing, so the cache kept serving a leaf the client already
rejected as expired ("certificate has expired"). The bridge then read the
rejection as a forged-cert failure, auto-skipped the host, and fell back
to undecrypted passthrough — silently disabling interception (and any
inference/MCP parsing) for that host until the proxy was restarted.

- mint: populate tls.Certificate.Leaf so the cache can gate on the cert's
  real NotAfter (and the TLS stack avoids re-parsing each handshake). Leaf
  validity is now now+ttl+renewBefore.
- cache: store the renewal deadline monotonic-stripped (.Round(0)) so the
  freshness check uses the wall clock, plus a backstop that never serves a
  leaf whose real NotAfter has already passed.
- SkipSet: same .Round(0) treatment so auto-skip entries expire on real
  time across a suspend instead of lingering.

Add a regression test that ages a cached leaf past its NotAfter while the
monotonic deadline still reads fresh, and asserts a re-mint.

Primarily a dev-environment robustness fix (laptop sleep / VM pause) —
production nodes do not suspend — but wall-clock gating is the correct
invariant regardless.

Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com>
Signed-off-by: Hai Huang <huang195@gmail.com>

Author: huang195

authbridge/authlib/tlsbridge/decision.go

@@ -114,7 +114,11 @@ func (s *SkipSet) Add(host string) {
 			delete(s.m, oldestK)
 		}
 	}
-	s.m[host] = now.Add(s.ttl)
+	// .Round(0) strips the monotonic reading so the expiry is a pure wall-clock
+	// time. Contains compares it against time.Now() via the wall clock, so an
+	// entry expires after skipTTL of real time even across a suspend (where the
+	// monotonic clock freezes and would otherwise keep the host skipped longer).
+	s.m[host] = now.Add(s.ttl).Round(0)
 }
 
 func (s *SkipSet) Contains(host string) bool {

authbridge/authlib/tlsbridge/minter.go

@@ -38,6 +38,12 @@ type cacheEntry struct {
 	expires time.Time
 }
 
+// renewBefore is the gap between the cache deadline (now+ttl, when Get
+// re-mints) and the leaf's NotAfter (now+ttl+renewBefore). It gives a
+// connection that grabbed the leaf just before re-mint ample remaining
+// validity, and a window for Get's NotAfter backstop to act.
+const renewBefore = time.Hour
+
 func NewMinter(src CASource, o MinterOpts) *Minter {
 	if o.CacheMax <= 0 {
 		o.CacheMax = 1024
@@ -71,7 +77,15 @@ func (m *Minter) GetCertificateForHost(host string) (*tls.Certificate, error) {
 	defer m.mu.Unlock()
 	if el, ok := m.items[host]; ok {
 		e := el.Value.(*cacheEntry)
-		if time.Now().Before(e.expires) {
+		// Gate freshness on WALL-clock deadlines, not the process monotonic
+		// clock. Across a host suspend / VM pause the monotonic clock freezes
+		// while wall time — and the leaf's x509 validity — keeps advancing, so
+		// a monotonic deadline would keep serving a leaf the client already
+		// rejects as expired. e.expires is monotonic-stripped (.Round(0) below);
+		// the Leaf.NotAfter check is the backstop tied to the cert's real
+		// validity, the only value the client actually verifies.
+		now := time.Now()
+		if now.Before(e.expires) && e.cert.Leaf != nil && now.Before(e.cert.Leaf.NotAfter) {
 			m.ll.MoveToFront(el)
 			return e.cert, nil
 		}
@@ -82,7 +96,10 @@ func (m *Minter) GetCertificateForHost(host string) (*tls.Certificate, error) {
 	if err != nil {
 		return nil, err
 	}
-	el := m.ll.PushFront(&cacheEntry{host: host, cert: cert, expires: time.Now().Add(m.ttl)})
+	// .Round(0) strips the monotonic reading so the deadline is a pure wall-clock
+	// time; comparisons against time.Now() then fall back to the wall clock and
+	// survive suspend (see the cache-hit gate above).
+	el := m.ll.PushFront(&cacheEntry{host: host, cert: cert, expires: time.Now().Add(m.ttl).Round(0)})
 	m.items[host] = el
 	for m.ll.Len() > m.max {
 		back := m.ll.Back()
@@ -101,9 +118,10 @@ func (m *Minter) mint(host string) (*tls.Certificate, error) {
 	tmpl := &x509.Certificate{
 		SerialNumber: serial,
 		Subject:      pkix.Name{CommonName: host},
-		NotBefore:    time.Now().Add(-time.Minute),
-		// Leaf validity must exceed the cache TTL so a cached leaf never serves past expiry.
-		NotAfter:    time.Now().Add(m.ttl + time.Hour),
+		NotBefore: time.Now().Add(-time.Minute),
+		// Leaf validity outlasts the cache deadline (now+ttl) by renewBefore so
+		// a cached leaf is always re-minted before it can serve past expiry.
+		NotAfter: time.Now().Add(m.ttl + renewBefore),
 		KeyUsage:    x509.KeyUsageDigitalSignature,
 		ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
 	}
@@ -116,8 +134,15 @@ func (m *Minter) mint(host string) (*tls.Certificate, error) {
 	if err != nil {
 		return nil, fmt.Errorf("tlsbridge: mint leaf for %s: %w", host, err)
 	}
+	leaf, err := x509.ParseCertificate(der)
+	if err != nil {
+		return nil, fmt.Errorf("tlsbridge: parse minted leaf for %s: %w", host, err)
+	}
 	return &tls.Certificate{
 		Certificate: [][]byte{der, caCert.Raw},
 		PrivateKey:  m.leafKey,
+		// Populate Leaf so Get can gate on the cert's real wall-clock NotAfter
+		// (and the TLS stack avoids re-parsing on each handshake).
+		Leaf: leaf,
 	}, nil
 }

authbridge/authlib/tlsbridge/minter_test.go

@@ -123,3 +123,38 @@ func TestMinter_LRUEvictsOldest(t *testing.T) {
 		t.Errorf("expected most-recent host \"c\" to still be cached")
 	}
 }
+
+// TestMinter_ReMintsWallClockExpiredLeaf is the regression guard for the
+// suspend/VM-pause bug: the cached leaf is expired by the wall clock, but the
+// process monotonic clock froze during suspend so the cache deadline still
+// reads as fresh. The minter must gate on the leaf's real NotAfter and
+// re-mint, never serve a leaf the client will reject as expired.
+func TestMinter_ReMintsWallClockExpiredLeaf(t *testing.T) {
+	m, _ := newTestMinter(t) // LeafTTL=time.Hour, so the cache deadline stays "fresh"
+	c1, err := m.GetCertificateForHost("h.example.com")
+	if err != nil {
+		t.Fatalf("first mint: %v", err)
+	}
+	// mint() must populate Leaf so the cache can gate on real validity.
+	m.mu.Lock()
+	e := m.items["h.example.com"].Value.(*cacheEntry)
+	if e.cert.Leaf == nil {
+		m.mu.Unlock()
+		t.Fatal("minted cert has no Leaf populated")
+	}
+	// Simulate the leaf having aged past its NotAfter while the monotonic cache
+	// deadline did not advance (host was suspended).
+	e.cert.Leaf.NotAfter = time.Now().Add(-time.Minute)
+	m.mu.Unlock()
+
+	c2, err := m.GetCertificateForHost("h.example.com")
+	if err != nil {
+		t.Fatalf("second mint: %v", err)
+	}
+	if &c1.Certificate[0][0] == &c2.Certificate[0][0] {
+		t.Fatal("served a wall-clock-expired cached leaf; expected a re-mint")
+	}
+	if c2.Leaf == nil || !time.Now().Before(c2.Leaf.NotAfter) {
+		t.Fatal("re-minted leaf is not valid")
+	}
+}