- Parse and validate from snapshot JSON, reject future/missing timestamps
- Enforce snapshot age vs in cache and stale fallback (no lifetime extension on repeat S3 reads)
- OCSP: , ,
- Remove unused from signer
- Publisher heartbeats: , republish clean snapshots past interval, preserve dirty-only behavior and concurrency
- Config/env/docker/docs updates for heartbeat
Rolling upgrade: enable publisher heartbeats before deploying the age-enforcing responder so existing snapshots remain within the age window.
Add shared serial collision checking against existing certificates and
issuer revocations, reuse it for automatic serial allocation, and enforce
it for user-supplied serials so duplicate serials no longer break the
OCSP snapshot.
make keep_serial renewal require replace_old, refuse keep_serial +
revoke_old, and reject serials already revoked by the issuer so revoked
serials cannot be inherited by renewed certificates.
woggioni