Implement persistent certificate storage with reuse for self-signed SSL

[Copilot]

Self-signed SSL certificates are now stored persistently and reused across server restarts, eliminating the need for cleanup and improving performance.

Changes

• Persistent certificate storage: Certificates are stored in {UserCacheDir}/resolvespec/certs/ with consistent naming based on hostname
• Certificate reuse logic: System checks for existing valid certificates before generating new ones
• Expiration handling: Certificates are validated and regenerated if expired or expiring within 30 days
• Security improvements: Added hostname sanitization to prevent path traversal vulnerabilities and mutex protection to prevent race conditions during concurrent certificate generation
• Test coverage: Added TestSelfSignedSSLCertificateReuse to verify certificate reuse functionality

Implementation

Certificates are stored with consistent naming and reused when valid:

// tls.go
func configureTLS(cfg Config) (*tls.Config, string, string, error) {
    // ...
    // Check for existing valid certificates
    certFile := filepath.Join(certDir, fmt.Sprintf("%s-cert.pem", safeHost))
    keyFile := filepath.Join(certDir, fmt.Sprintf("%s-key.pem", safeHost))
    
    // If valid certificates exist, reuse them
    if isCertificateValid(certFile) {
        if _, err := os.Stat(keyFile); err == nil {
            return tlsConfig, certFile, keyFile, nil
        }
    }
    
    // Generate new certificates only when needed
    certPEM, keyPEM, err := generateSelfSignedCert(host)
    // ... save to persistent files
}

Only self-signed SSL certificates use persistent storage; user-provided certs and AutoTLS are unaffected.

Benefits

• No resource leaks: Certificates persist across server restarts
• Better performance: Reuses existing valid certificates instead of regenerating
• Simpler lifecycle: No cleanup required on shutdown
• Consistent storage: All certificates stored in a well-defined location

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[warkanum]

@copilot We don't need to clean up. We also need to insure to always generate certificates with the same name as to override the old ones. However, if the certificates exists, use them if they are not expired.

[Copilot]

Changed the approach in commit 4f8edd6. Certificates are now stored persistently in {UserCacheDir}/resolvespec/certs/ with consistent naming based on hostname. The system checks for existing certificates and reuses them if valid (not expired, not expiring within 30 days). New certificates are only generated when needed, overwriting any old ones.

[warkanum]

@copilot Remove this test

[Copilot]

Removed TestSelfSignedSSLCleanup in commit ccf8522 and added TestSelfSignedSSLCertificateReuse to verify the new certificate reuse functionality works correctly.