fix(ssl): retire SAN-overlapping certs, never publish expired lineages, report no-op renewals

brainjar.net served an expired certificate for two days (2026-10-07..09):
the old brain-jar.com bundle (CN brain-jar.com, SANs incl. all eight
brainjar names) stayed in /etc/haproxy/certs and won the SNI match over the
valid brainjar.net bundle, because superseded-cert cleanup matched on CN
only, and renew-certificates.sh re-published the expired lineage every 12h.

- Retirement now matches on ANY shared name (CN or SAN). The overlapping pem
  is moved to cert-retired/ and its lineage's live/ dir and renewal conf to
  live-retired/ and renewal-retired/ (after HAProxy loads the new bundle).
  Nothing is deleted any more: `certbot delete` is gone from this path.
- Shared-PEM safety: a candidate is kept when it is still the only valid
  certificate for a name in the domains table (retirement_blockers()). Expired
  certs never block; names the caller lists in the new optional
  `unreachable_names` body field do not block.
- /api/ssl/bundle passes --keep-until-expiring and reports `renewed`
  (fingerprint before vs after), `certbot_not_due` and the certificate's
  `not_after`, so WHP can stop recording certbot no-ops as renewals.
- Never publish an expired certificate: renew-certificates.sh and
  sync-certificates.sh skip expired lineages (ERROR-logged, counted
  separately), and cert_publish / publish_pem_bundle refuse expired leaves.
- VERSION 2026.10.3.

Tests: test-cert-write-safety.py 31 -> 47, test-cert-scripts.py 38 -> 44,
each new group verified to fail against a reverted fix.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

scripts/test-cert-scripts.py

@@ -73,6 +73,15 @@ LIB = os.path.join(SCRIPTS_DIR, 'cert-publish-lib.sh')
 BROKEN_TOKEN = '__BROKEN__'
 DOMAIN = 'test.example.com'
 
+# Real SAN certificates (see scripts/test-fixtures/san-certs/). expired_old is
+# the brain-jar.com shape: a multi-SAN certificate that expired in 2020.
+SAN_FIXTURES = os.path.join(SCRIPTS_DIR, 'test-fixtures', 'san-certs')
+
+
+def san_fixture(name):
+    with open(os.path.join(SAN_FIXTURES, name)) as fh:
+        return fh.read()
+
 # --- test key material -------------------------------------------------------
 # openssl req -x509 -newkey rsa:2048 -keyout key1 -out cert1 -days 3650 -nodes \
 #         -subj /CN=test.example.com
@@ -618,6 +627,42 @@ class CertScriptBehaviour:
         self.assertFalse(self.reload_attempted())
 
 
+    # -- never publish an expired certificate (brainjar.net, 2026-10-07) ----
+    def test_expired_lineage_is_skipped_and_reported(self):
+        """renew-certificates.sh used to re-publish EVERY live/ lineage every 12h,
+        expired or not; the expired brain-jar.com bundle then shadowed the valid
+        brainjar.net bundle for the names they shared."""
+        dead = os.path.join(self.le_live, 'brain-jar.com')
+        os.makedirs(dead)
+        write(os.path.join(dead, 'fullchain.pem'), san_fixture('expired_old.crt'))
+        write(os.path.join(dead, 'privkey.pem'), san_fixture('expired_old.key'))
+
+        result = self.run_it()
+
+        self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
+        self.assertFalse(
+            os.path.exists(os.path.join(self.certs_dir, 'brain-jar.com.pem')),
+            'an expired lineage was published into the crt directory')
+        # The healthy lineage next to it is still published.
+        self.assertEqual(read(self.live_pem), NEW_BUNDLE)
+        self.assertIn('Skipping EXPIRED certificate lineage brain-jar.com', self.logs())
+        self.assertIn('1 updated, 0 failed, 1 expired lineage(s) skipped', self.logs())
+        self.assertIn('brain-jar.com', read(self.error_log),
+                      'the skip must land in the monitored error log')
+
+    def test_expired_lineage_does_not_replace_an_existing_pem(self):
+        dead = os.path.join(self.le_live, 'brain-jar.com')
+        os.makedirs(dead)
+        write(os.path.join(dead, 'fullchain.pem'), san_fixture('expired_old.crt'))
+        write(os.path.join(dead, 'privkey.pem'), san_fixture('expired_old.key'))
+        existing = write(os.path.join(self.certs_dir, 'brain-jar.com.pem'), OTHER_BUNDLE)
+
+        self.run_it()
+
+        self.assertEqual(read(existing), OTHER_BUNDLE,
+                         'an expired lineage overwrote the file in the crt dir')
+
+
 class TestRenewCertificates(CertScriptBehaviour, CertScriptFixture):
     SCRIPT = 'renew-certificates.sh'
 
@@ -638,6 +683,33 @@ class TestCertPublishLibrary(CertScriptFixture):
         path = write(os.path.join(self.tmp, 'ok.pem'), NEW_BUNDLE)
         self.assertEqual(self.call('cert_bundle_valid "$1"', path).returncode, 0)
 
+    def test_cert_is_expired_reports_both_directions(self):
+        expired = write(os.path.join(self.tmp, 'expired.crt'), san_fixture('expired_old.crt'))
+        valid = write(os.path.join(self.tmp, 'valid.crt'), san_fixture('new_bundle.crt'))
+        self.assertEqual(0, self.call('cert_is_expired "$1"', expired).returncode,
+                         'an expired certificate was not recognised as expired')
+        self.assertEqual(1, self.call('cert_is_expired "$1"', valid).returncode,
+                         'a valid certificate was reported as expired')
+        self.assertEqual(1, self.call('cert_is_expired "$1"',
+                                      os.path.join(self.tmp, 'missing')).returncode)
+
+    def test_cert_publish_refuses_an_expired_certificate(self):
+        cert = write(os.path.join(self.tmp, 'expired.crt'), san_fixture('expired_old.crt'))
+        key = write(os.path.join(self.tmp, 'expired.key'), san_fixture('expired_old.key'))
+        dest = os.path.join(self.certs_dir, 'brain-jar.com.pem')
+
+        result = self.call('cert_publish "$1" "$2" "$3"', cert, key, dest)
+
+        self.assert_rejected(result, because='expired')
+        self.assertFalse(os.path.exists(dest), 'expired certificate was published')
+        # And the same material with a valid certificate IS publishable, so the
+        # refusal above is about expiry, not about the fixture.
+        good_cert = write(os.path.join(self.tmp, 'good.crt'), san_fixture('new_bundle.crt'))
+        good_key = write(os.path.join(self.tmp, 'good.key'), san_fixture('new_bundle.key'))
+        ok = self.call('cert_publish "$1" "$2" "$3"', good_cert, good_key, dest)
+        self.assertEqual(0, ok.returncode, ok.stdout + ok.stderr)
+        self.assertTrue(os.path.exists(dest))
+
     def test_empty_and_missing_bundles_rejected(self):
         empty = write(os.path.join(self.tmp, 'empty.pem'), '')
         self.assert_rejected(self.call('cert_bundle_valid "$1"', empty),