Fix MITM window

src/mitm/cert/rootCA.js

@@ -7,14 +7,33 @@ const ROOT_CA_KEY_PATH = path.join(MITM_DIR, "rootCA.key");
 const ROOT_CA_CERT_PATH = path.join(MITM_DIR, "rootCA.crt");
 
 /**
- * Generate Root CA certificate (only once)
+ * Check if cert file is expired or expiring within 30 days
+ */
+function isCertExpired(certPath) {
+  try {
+    const cert = forge.pki.certificateFromPem(fs.readFileSync(certPath, "utf8"));
+    const expiryThreshold = new Date(Date.now() + 30 * 24 * 60 * 60 * 1000);
+    return cert.validity.notAfter < expiryThreshold;
+  } catch {
+    return true; // treat unreadable cert as expired
+  }
+}
+
+/**
+ * Generate Root CA certificate (only once, auto-regenerate if expired)
  * This Root CA will sign all dynamic leaf certificates
  */
 async function generateRootCA() {
-  if (fs.existsSync(ROOT_CA_KEY_PATH) && fs.existsSync(ROOT_CA_CERT_PATH)) {
+  const exists = fs.existsSync(ROOT_CA_KEY_PATH) && fs.existsSync(ROOT_CA_CERT_PATH);
+  if (exists && !isCertExpired(ROOT_CA_CERT_PATH)) {
     console.log("✅ Root CA already exists");
     return { key: ROOT_CA_KEY_PATH, cert: ROOT_CA_CERT_PATH };
   }
+  if (exists) {
+    console.log("🔐 Root CA expired or expiring soon — regenerating...");
+    try { fs.unlinkSync(ROOT_CA_KEY_PATH); } catch { /* ignore */ }
+    try { fs.unlinkSync(ROOT_CA_CERT_PATH); } catch { /* ignore */ }
+  }
 
   if (!fs.existsSync(MITM_DIR)) {
     fs.mkdirSync(MITM_DIR, { recursive: true });
@@ -148,6 +167,7 @@ module.exports = {
   generateRootCA,
   loadRootCA,
   generateLeafCert,
+  isCertExpired,
   ROOT_CA_CERT_PATH,
   ROOT_CA_KEY_PATH
 };