Fix stale OCSP snapshots indefinitely

- Parse and validate  from snapshot JSON, reject future/missing timestamps
- Enforce snapshot age vs  in cache and stale fallback (no lifetime extension on repeat S3 reads)
- OCSP: , ,
- Remove unused  from signer
- Publisher heartbeats: , republish clean snapshots past interval, preserve dirty-only behavior and concurrency
- Config/env/docker/docs updates for heartbeat

Rolling upgrade: enable publisher heartbeats before deploying the age-enforcing responder so existing snapshots remain within the age window.

ocsp-responder/src/snapshot.rs

@@ -25,6 +25,7 @@ pub struct StatusEntry {
 
 #[derive(Debug, Clone)]
 pub struct Snapshot {
+    pub generated_at: DateTime<Utc>,
     pub entries: HashMap<Vec<u8>, StatusEntry>,
 }
 
@@ -32,6 +33,7 @@ pub struct Snapshot {
 struct RawSnapshot {
     schema: String,
     issuer: RawIssuer,
+    generated_at: DateTime<Utc>,
     #[serde(default)]
     entries: Vec<RawEntry>,
 }
@@ -65,6 +67,9 @@ impl Snapshot {
         if raw.schema != SCHEMA {
             return Err(SnapshotError::Schema(raw.schema));
         }
+        if raw.generated_at > Utc::now() {
+            return Err(SnapshotError::FutureGeneration(raw.generated_at));
+        }
         if !raw.issuer.id.eq_ignore_ascii_case(expected_ca_id) {
             return Err(SnapshotError::IssuerIdMismatch {
                 expected: expected_ca_id.to_string(),
@@ -110,7 +115,10 @@ impl Snapshot {
             }
         }
         let _ = raw.issuer.sha256;
-        Ok(Self { entries })
+        Ok(Self {
+            generated_at: raw.generated_at,
+            entries,
+        })
     }
 
     pub fn status_for_serial(&self, serial: &[u8]) -> Option<&StatusEntry> {
@@ -170,6 +178,8 @@ pub enum SnapshotError {
     Json(#[from] serde_json::Error),
     #[error("unsupported snapshot schema {0:?}")]
     Schema(String),
+    #[error("snapshot generation time {0} is in the future")]
+    FutureGeneration(DateTime<Utc>),
     #[error("snapshot issuer ID {actual} does not match configured CA ID {expected}")]
     IssuerIdMismatch { expected: String, actual: String },
     #[error("snapshot issuer {actual} does not match configured CA {expected}")]
@@ -228,6 +238,24 @@ mod tests {
         assert!(Snapshot::parse(duplicate.as_bytes(), &sha, "ca").is_err());
     }
 
+    #[test]
+    fn rejects_missing_or_future_generation_time() {
+        let sha = sha256_hex(b"ca");
+        let missing = body(&sha)
+            .lines()
+            .filter(|line| !line.contains("\"generated_at\""))
+            .collect::<Vec<_>>()
+            .join("\n");
+        assert!(Snapshot::parse(missing.as_bytes(), &sha, "ca").is_err());
+
+        let future = (Utc::now() + chrono::Duration::hours(1)).to_rfc3339();
+        let future = body(&sha).replace("2026-01-01T00:00:00Z", &future);
+        assert!(matches!(
+            Snapshot::parse(future.as_bytes(), &sha, "ca"),
+            Err(SnapshotError::FutureGeneration(_))
+        ));
+    }
+
     #[test]
     fn normalizes_serials() {
         assert_eq!(normalize_serial(&[0, 0, 1, 2]), vec![1, 2]);