From: Theo Buehler <tb@theobuehler.org>
Subject: rpki-client: change expire time for BRKs
To: tech@openbsd.org
Cc: rcovelli@openbsd.org
Date: Tue, 13 Oct 2026 19:05:07 +0200

Currently the expire time for BRKs in rpki-client's BRK tree is the
BGPsec Router Cert's notAfter unlike for VRPs and VAPs, where the
signature path's expire time is used. The JSON output in file mode
already displays the expire time of the signature path for them, which
is inconsistent with the json output file and what rtrd receives.

This diff pushes the expire time of all certs to the main process (which
we may want at some point) and uses this for the BRK tree. In particular,
the expire time communicated to rtrd is more in line with the ones used
for VRPs and VAPs.

For the two BRKs this means for a run at Tue 13 Oct 2026 16:50:00 UTC
(a few minutes ago):

OLD: Tue 15 Jun 2027 08:09:44 +0000 (the second one has 08:09:48)
NEW: Tue 13 Oct 2026 22:39:01 +0000

This makes all expire times lie between now and about a week from now
rather than having two outliers expiring many months in the future.

Index: cert.c
===================================================================
RCS file: /cvs/src/usr.sbin/rpki-client/cert.c,v
diff -u -p -r1.246 cert.c
--- cert.c	9 Oct 2026 08:36:50 -0000	1.246
+++ cert.c	13 Oct 2026 16:26:15 -0000
@@ -1821,6 +1821,7 @@ void
 cert_buffer(struct ibuf *b, const struct cert *cert)
 {
 	io_simple_buffer(b, &cert->notafter, sizeof(cert->notafter));
+	io_simple_buffer(b, &cert->expires, sizeof(cert->expires));
 	io_simple_buffer(b, &cert->purpose, sizeof(cert->purpose));
 	io_simple_buffer(b, &cert->talid, sizeof(cert->talid));
 	io_simple_buffer(b, &cert->issuerid, sizeof(cert->issuerid));
@@ -1877,6 +1878,7 @@ cert_read(struct ibuf *b)
 		err(1, NULL);
 
 	io_read_buf(b, &cert->notafter, sizeof(cert->notafter));
+	io_read_buf(b, &cert->expires, sizeof(cert->expires));
 	io_read_buf(b, &cert->purpose, sizeof(cert->purpose));
 	io_read_buf(b, &cert->talid, sizeof(cert->talid));
 	io_read_buf(b, &cert->issuerid, sizeof(cert->issuerid));
@@ -2043,7 +2045,7 @@ insert_brk(struct brk_tree *tree, struct
 		err(1, NULL);
 
 	b->asid = asid;
-	b->expires = cert->notafter;
+	b->expires = cert->expires;
 	b->talid = cert->talid;
 	if ((b->ski = strdup(cert->ski)) == NULL)
 		err(1, NULL);
Index: parser.c
===================================================================
RCS file: /cvs/src/usr.sbin/rpki-client/parser.c,v
diff -u -p -r1.192 parser.c
--- parser.c	9 Oct 2026 10:05:12 -0000	1.192
+++ parser.c	13 Oct 2026 16:26:15 -0000
@@ -646,6 +646,7 @@ proc_parser_cert(char *file, const unsig
 	if (cert->purpose == CERT_PURPOSE_BGPSEC_ROUTER) {
 		if (!constraints_validate(file, cert))
 			goto out;
+		cert->expires = x509_find_expires(cert->notafter, a, crl);
 	}
 
 	/*