refactor: improve certificates validity comparison

2026-07-20 21:01:41 +08:00 · 2026-07-01 10:59:35 +08:00 · 2026-07-01 10:59:35 +08:00 · a03b60df85
commit a03b60df85
parent b9f7368901
23 changed files with 56 additions and 43 deletions
--- a/pkg/core/certmgr/providers/aws-acm/aws_acm.go
+++ b/pkg/core/certmgr/providers/aws-acm/aws_acm.go
@ -106,9 +106,9 @@ func (c *Certmgr) Upload(ctx context.Context, certPEM, privkeyPEM string) (*Uplo
 			}

 			// 对比证书有效期
-			if certItem.NotBefore == nil || !certItem.NotBefore.Equal(certX509.NotBefore) {
+			if certItem.NotBefore == nil || !certX509.NotBefore.Equal(*certItem.NotBefore) {
 				continue
-			} else if certItem.NotAfter == nil || !certItem.NotAfter.Equal(certX509.NotAfter) {
+			} else if certItem.NotAfter == nil || !certX509.NotAfter.Equal(*certItem.NotAfter) {
 				continue
 			}

--- a/pkg/core/certmgr/providers/aws-iam/aws_iam.go
+++ b/pkg/core/certmgr/providers/aws-iam/aws_iam.go
@ -112,7 +112,7 @@ func (c *Certmgr) Upload(ctx context.Context, certPEM, privkeyPEM string) (*Uplo
 			}

 			// 对比证书有效期
-			if certItem.Expiration == nil || !certItem.Expiration.Equal(certX509.NotAfter) {
+			if certItem.Expiration == nil || !certX509.NotAfter.Equal(*certItem.Expiration) {
 				continue
 			}

--- a/pkg/core/certmgr/providers/azure-keyvault/azure_keyvault.go
+++ b/pkg/core/certmgr/providers/azure-keyvault/azure_keyvault.go
@ -95,9 +95,9 @@ func (c *Certmgr) Upload(ctx context.Context, certPEM, privkeyPEM string) (*Uplo
 			// 对比证书有效期
 			if certItem.Attributes == nil {
 				continue
-			} else if !lo.FromPtr(certItem.Attributes.NotBefore).Equal(certX509.NotBefore) {
+			} else if !certX509.NotBefore.Equal(lo.FromPtr(certItem.Attributes.NotBefore)) {
 				continue
-			} else if !lo.FromPtr(certItem.Attributes.Expires).Equal(certX509.NotAfter) {
+			} else if !certX509.NotAfter.Equal(lo.FromPtr(certItem.Attributes.Expires)) {
 				continue
 			}

--- a/pkg/core/certmgr/providers/baiducloud-cert/baiducloud_cert.go
+++ b/pkg/core/certmgr/providers/baiducloud-cert/baiducloud_cert.go
@ -87,9 +87,11 @@ func (c *Certmgr) Upload(ctx context.Context, certPEM, privkeyPEM string) (*Uplo
 			}

 			// 对比证书有效期
+			newCertNotBefore := certX509.NotBefore
+			newCertNotAfter := certX509.NotAfter
 			oldCertNotBefore, _ := time.Parse("2006-01-02T15:04:05Z", certItem.CertStartTime)
 			oldCertNotAfter, _ := time.Parse("2006-01-02T15:04:05Z", certItem.CertStopTime)
-			if !certX509.NotBefore.Equal(oldCertNotBefore) || !certX509.NotAfter.Equal(oldCertNotAfter) {
+			if !newCertNotBefore.Equal(oldCertNotBefore) || !newCertNotAfter.Equal(oldCertNotAfter) {
 				continue
 			}

--- a/pkg/core/certmgr/providers/byteplus-medialive/byteplus_medialive.go
+++ b/pkg/core/certmgr/providers/byteplus-medialive/byteplus_medialive.go
@ -97,8 +97,7 @@ func (c *Certmgr) Upload(ctx context.Context, certPEM, privkeyPEM string) (*Uplo
 			}

 			// 如果已存在相同证书，直接返回
-			oldCertPEM := strings.Join(describeCertDetailSecretResp.Result.SSL.Chain, "\n\n")
-			if xcert.EqualCertificatesFromPEM(certPEM, oldCertPEM) {
+			if xcert.EqualCertificatesFromPEM(certPEM, strings.Join(describeCertDetailSecretResp.Result.SSL.Chain, "\n\n")) {
 				c.logger.Info("ssl certificate already exists")
 				return &UploadResult{
 					CertId:   certItem.ChainID,
--- a/pkg/core/certmgr/providers/cmcccloud-vlb/cmcccloud_vlb.go
+++ b/pkg/core/certmgr/providers/cmcccloud-vlb/cmcccloud_vlb.go
@ -84,8 +84,9 @@ func (c *Certmgr) Upload(ctx context.Context, certPEM, privkeyPEM string) (*Uplo
 		if listLoadbalanceCertificationResp.Body != nil && listLoadbalanceCertificationResp.Body.Content != nil {
 			for _, certItem := range *listLoadbalanceCertificationResp.Body.Content {
 				// 对比证书有效期
+				newCertNotAfter := certX509.NotAfter
 				oldCertNotAfter, _ := time.Parse(time.DateTime, lo.FromPtr(certItem.ExpirationTime))
-				if !certX509.NotAfter.Equal(oldCertNotAfter) {
+				if !newCertNotAfter.Equal(oldCertNotAfter) {
 					continue
 				}

--- a/pkg/core/certmgr/providers/ctcccloud-ao/ctcccloud_ao.go
+++ b/pkg/core/certmgr/providers/ctcccloud-ao/ctcccloud_ao.go
@ -107,9 +107,9 @@ func (c *Certmgr) Upload(ctx context.Context, certPEM, privkeyPEM string) (*Uplo
 			}

 			// 对比证书有效期
-			if !certX509.NotBefore.Equal(time.Unix(certItem.IssueTime, 0).UTC()) {
+			if certX509.NotBefore.Unix() != certItem.IssueTime {
 				continue
-			} else if !certX509.NotAfter.Equal(time.Unix(certItem.ExpiresTime, 0).UTC()) {
+			} else if certX509.NotAfter.Unix() != certItem.ExpiresTime {
 				continue
 			}

--- a/pkg/core/certmgr/providers/ctcccloud-cdn/ctcccloud_cdn.go
+++ b/pkg/core/certmgr/providers/ctcccloud-cdn/ctcccloud_cdn.go
@ -107,9 +107,9 @@ func (c *Certmgr) Upload(ctx context.Context, certPEM, privkeyPEM string) (*Uplo
 			}

 			// 对比证书有效期
-			if !certX509.NotBefore.Equal(time.Unix(certItem.IssueTime, 0).UTC()) {
+			if certX509.NotBefore.Unix() != certItem.IssueTime {
 				continue
-			} else if !certX509.NotAfter.Equal(time.Unix(certItem.ExpiresTime, 0).UTC()) {
+			} else if certX509.NotAfter.Unix() != certItem.ExpiresTime {
 				continue
 			}

--- a/pkg/core/certmgr/providers/ctcccloud-cms/ctcccloud_cms.go
+++ b/pkg/core/certmgr/providers/ctcccloud-cms/ctcccloud_cms.go
@ -163,11 +163,11 @@ func (c *Certmgr) tryGetResultIfCertExists(ctx context.Context, certPEM string)
 			}

 			// 对比证书有效期
+			newCertNotBefore := certX509.NotBefore
+			newCertNotAfter := certX509.NotAfter
 			oldCertNotBefore, _ := time.Parse("2006-01-02T15:04:05Z", certItem.IssueTime)
 			oldCertNotAfter, _ := time.Parse("2006-01-02T15:04:05Z", certItem.ExpireTime)
-			if !certX509.NotBefore.Equal(oldCertNotBefore) {
-				continue
-			} else if !certX509.NotAfter.Equal(oldCertNotAfter) {
+			if !newCertNotBefore.Equal(oldCertNotBefore) || !newCertNotAfter.Equal(oldCertNotAfter) {
 				continue
 			}

--- a/pkg/core/certmgr/providers/ctcccloud-icdn/ctcccloud_icdn.go
+++ b/pkg/core/certmgr/providers/ctcccloud-icdn/ctcccloud_icdn.go
@ -107,9 +107,9 @@ func (c *Certmgr) Upload(ctx context.Context, certPEM, privkeyPEM string) (*Uplo
 			}

 			// 对比证书有效期
-			if !certX509.NotBefore.Equal(time.Unix(certItem.IssueTime, 0).UTC()) {
+			if certX509.NotBefore.Unix() != certItem.IssueTime {
 				continue
-			} else if !certX509.NotAfter.Equal(time.Unix(certItem.ExpiresTime, 0).UTC()) {
+			} else if certX509.NotAfter.Unix() != certItem.ExpiresTime {
 				continue
 			}

--- a/pkg/core/certmgr/providers/digitalocean-certificate/digitalocean_certificate.go
+++ b/pkg/core/certmgr/providers/digitalocean-certificate/digitalocean_certificate.go
@ -104,8 +104,9 @@ func (c *Certmgr) Upload(ctx context.Context, certPEM, privkeyPEM string) (*Uplo
 			}

 			// 对比证书有效期
+			newCertNotAfter := certX509.NotAfter
 			oldCertNotAfter, _ := time.Parse("2006-01-02T15:04:05Z", certItem.NotAfter)
-			if !certX509.NotAfter.Equal(oldCertNotAfter) {
+			if !newCertNotAfter.Equal(oldCertNotAfter) {
 				continue
 			}

--- a/pkg/core/certmgr/providers/jdcloud-ssl/jdcloud_ssl.go
+++ b/pkg/core/certmgr/providers/jdcloud-ssl/jdcloud_ssl.go
@ -98,6 +98,8 @@ func (c *Certmgr) Upload(ctx context.Context, certPEM, privkeyPEM string) (*Uplo
 			return nil, fmt.Errorf("failed to execute sdk request 'ssl.DescribeCerts': %w", err)
 		}

+		keyDigest := sha256.Sum256([]byte(privkeyPEM))
+		keyDigestHex := hex.EncodeToString(keyDigest[:])
 		for _, certItem := range describeCertsResp.Result.CertListDetails {
 			// 对比证书通用名称
 			if !strings.EqualFold(certX509.Subject.CommonName, certItem.CommonName) {
@ -110,16 +112,16 @@ func (c *Certmgr) Upload(ctx context.Context, certPEM, privkeyPEM string) (*Uplo
 			}

 			// 对比证书有效期
+			newCertNotBefore := certX509.NotBefore
+			newCertNotAfter := certX509.NotAfter
 			oldCertNotBefore, _ := time.Parse(time.RFC3339, certItem.StartTime)
 			oldCertNotAfter, _ := time.Parse(time.RFC3339, certItem.EndTime)
-			if !certX509.NotBefore.Equal(oldCertNotBefore) || !certX509.NotAfter.Equal(oldCertNotAfter) {
+			if !newCertNotBefore.Equal(oldCertNotBefore) || !newCertNotAfter.Equal(oldCertNotAfter) {
 				continue
 			}

 			// 对比私钥 SHA-256 摘要
-			newKeyDigest := sha256.Sum256([]byte(privkeyPEM))
-			newKeyDigestHex := hex.EncodeToString(newKeyDigest[:])
-			if !strings.EqualFold(newKeyDigestHex, certItem.Digest) {
+			if !strings.EqualFold(keyDigestHex, certItem.Digest) {
 				continue
 			}

--- a/pkg/core/certmgr/providers/oraclecloud-certificatesmgmt/oraclecloud_certificatesmgmt.go
+++ b/pkg/core/certmgr/providers/oraclecloud-certificatesmgmt/oraclecloud_certificatesmgmt.go
@ -124,9 +124,9 @@ func (c *Certmgr) Upload(ctx context.Context, certPEM, privkeyPEM string) (*Uplo
 			}

 			// 对比证书有效期
-			if certItem.CurrentVersionSummary.Validity == nil || !certItem.CurrentVersionSummary.Validity.TimeOfValidityNotBefore.Equal(certX509.NotBefore) {
+			if certItem.CurrentVersionSummary.Validity == nil || !certX509.NotBefore.Equal(lo.FromPtr(certItem.CurrentVersionSummary.Validity.TimeOfValidityNotBefore).Time) {
 				continue
-			} else if certItem.CurrentVersionSummary.Validity == nil || !certItem.CurrentVersionSummary.Validity.TimeOfValidityNotAfter.Equal(certX509.NotAfter) {
+			} else if certItem.CurrentVersionSummary.Validity == nil || !certX509.NotAfter.Equal(lo.FromPtr(certItem.CurrentVersionSummary.Validity.TimeOfValidityNotAfter).Time) {
 				continue
 			}

--- a/pkg/core/certmgr/providers/qiniu-sslcert/qiniu_sslcert.go
+++ b/pkg/core/certmgr/providers/qiniu-sslcert/qiniu_sslcert.go
@ -99,7 +99,9 @@ func (c *Certmgr) Upload(ctx context.Context, certPEM, privkeyPEM string) (*Uplo
 			}

 			// 对比证书有效期
-			if certX509.NotBefore.Unix() != sslItem.NotBefore || certX509.NotAfter.Unix() != sslItem.NotAfter {
+			if certX509.NotBefore.Unix() != sslItem.NotBefore {
+				continue
+			} else if certX509.NotAfter.Unix() != sslItem.NotAfter {
 				continue
 			}

--- a/pkg/core/certmgr/providers/rainyun-sslcenter/rainyun_sslcenter.go
+++ b/pkg/core/certmgr/providers/rainyun-sslcenter/rainyun_sslcenter.go
@ -153,7 +153,9 @@ func (c *Certmgr) tryGetResultIfCertExists(ctx context.Context, certPEM string)
 			}

 			// 对比证书有效期
-			if sslItem.StartDate != certX509.NotBefore.Unix() || sslItem.ExpireDate != certX509.NotAfter.Unix() {
+			if certX509.NotBefore.Unix() != sslItem.StartDate {
+				continue
+			} else if certX509.NotAfter.Unix() != sslItem.ExpireDate {
 				continue
 			}

--- a/pkg/core/certmgr/providers/tencentcloud-gaap/tencentcloud_gaap.go
+++ b/pkg/core/certmgr/providers/tencentcloud-gaap/tencentcloud_gaap.go
@ -104,8 +104,9 @@ func (c *Certmgr) Upload(ctx context.Context, certPEM, privkeyPEM string) (*Uplo
 			}

 			// 对比证书有效期
-			if certX509.NotBefore.Unix() != int64(lo.FromPtr(certItem.BeginTime)) ||
-				certX509.NotAfter.Unix() != int64(lo.FromPtr(certItem.EndTime)) {
+			if certX509.NotBefore.Unix() != int64(lo.FromPtr(certItem.BeginTime)) {
+				continue
+			} else if certX509.NotAfter.Unix() != int64(lo.FromPtr(certItem.EndTime)) {
 				continue
 			}

--- a/pkg/core/certmgr/providers/ucloud-ulb/ucloud_ulb.go
+++ b/pkg/core/certmgr/providers/ucloud-ulb/ucloud_ulb.go
@ -133,7 +133,9 @@ func (c *Certmgr) tryGetResultIfCertExists(ctx context.Context, certPEM, privkey

 		for _, sslItem := range describeSSLResp.DataSet {
 			// 对比证书有效期
-			if int64(sslItem.NotBefore) != certX509.NotBefore.Unix() || int64(sslItem.NotAfter) != certX509.NotAfter.Unix() {
+			if certX509.NotBefore.Unix() != int64(sslItem.NotBefore) {
+				continue
+			} else if certX509.NotAfter.Unix() != int64(sslItem.NotAfter) {
 				continue
 			}

--- a/pkg/core/certmgr/providers/ucloud-upathx/ucloud_upathx.go
+++ b/pkg/core/certmgr/providers/ucloud-upathx/ucloud_upathx.go
@ -132,7 +132,7 @@ func (c *Certmgr) tryGetResultIfCertExists(ctx context.Context, certPEM, privkey

 		for _, sslItem := range describePathXSSLResp.DataSet {
 			// 对比证书有效期
-			if int64(sslItem.ExpireTime) != certX509.NotAfter.Unix() {
+			if certX509.NotAfter.Unix() != int64(sslItem.ExpireTime) {
 				continue
 			}

--- a/pkg/core/certmgr/providers/ucloud-ussl/ucloud_ussl.go
+++ b/pkg/core/certmgr/providers/ucloud-ussl/ucloud_ussl.go
@ -157,9 +157,9 @@ func (c *Certmgr) tryGetResultIfCertExists(ctx context.Context, certPEM string)
 			}

 			// 对比证书有效期
-			if int64(certItem.NotBefore) != certX509.NotBefore.UnixMilli() {
+			if certX509.NotBefore.UnixMilli() != int64(certItem.NotBefore) {
 				continue
-			} else if int64(certItem.NotAfter) != certX509.NotAfter.UnixMilli() {
+			} else if certX509.NotAfter.UnixMilli() != int64(certItem.NotAfter) {
 				continue
 			}

--- a/pkg/core/certmgr/providers/volcengine-live/volcengine_live.go
+++ b/pkg/core/certmgr/providers/volcengine-live/volcengine_live.go
@ -97,8 +97,7 @@ func (c *Certmgr) Upload(ctx context.Context, certPEM, privkeyPEM string) (*Uplo
 			}

 			// 如果已存在相同证书，直接返回
-			oldCertPEM := strings.Join(describeCertDetailSecretResp.Result.SSL.Chain, "\n\n")
-			if xcert.EqualCertificatesFromPEM(certPEM, oldCertPEM) {
+			if xcert.EqualCertificatesFromPEM(certPEM, strings.Join(describeCertDetailSecretResp.Result.SSL.Chain, "\n\n")) {
 				c.logger.Info("ssl certificate already exists")
 				return &UploadResult{
 					CertId:   certItem.ChainID,
--- a/pkg/core/certmgr/providers/wangsu-certificate/wangsu_certificate.go
+++ b/pkg/core/certmgr/providers/wangsu-certificate/wangsu_certificate.go
@ -85,9 +85,11 @@ func (c *Certmgr) Upload(ctx context.Context, certPEM, privkeyPEM string) (*Uplo

 			// 对比证书有效期
 			timezoneOfCST := time.FixedZone("CST", 8*60*60)
+			newCertNotBefore := certX509.NotBefore
+			newCertNotAfter := certX509.NotAfter
 			oldCertNotBefore, _ := time.ParseInLocation(time.DateTime, certItem.ValidityFrom, timezoneOfCST)
 			oldCertNotAfter, _ := time.ParseInLocation(time.DateTime, certItem.ValidityTo, timezoneOfCST)
-			if !certX509.NotBefore.Equal(oldCertNotBefore) || !certX509.NotAfter.Equal(oldCertNotAfter) {
+			if !newCertNotBefore.Equal(oldCertNotBefore) || !newCertNotAfter.Equal(oldCertNotAfter) {
 				continue
 			}

--- a/pkg/core/certmgr/providers/zenlayer-cdn/zenlayer_cdn.go
+++ b/pkg/core/certmgr/providers/zenlayer-cdn/zenlayer_cdn.go
@ -111,11 +111,11 @@ func (c *Certmgr) Upload(ctx context.Context, certPEM, privkeyPEM string) (*Uplo
 			}

 			// 对比证书有效期
+			newCertNotBefore := certX509.NotBefore
+			newCertNotAfter := certX509.NotAfter
 			oldCertNotBefore, _ := time.Parse("2006-01-02T15:04:05Z", certItem.StartTime)
 			oldCertNotAfter, _ := time.Parse("2006-01-02T15:04:05Z", certItem.EndTime)
-			if !certX509.NotBefore.Equal(oldCertNotBefore) {
-				continue
-			} else if !certX509.NotAfter.Equal(oldCertNotAfter) {
+			if !newCertNotBefore.Equal(oldCertNotBefore) || !newCertNotAfter.Equal(oldCertNotAfter) {
 				continue
 			}

--- a/pkg/core/certmgr/providers/zenlayer-ga/zenlayer_ga.go
+++ b/pkg/core/certmgr/providers/zenlayer-ga/zenlayer_ga.go
@ -110,12 +110,12 @@ func (c *Certmgr) Upload(ctx context.Context, certPEM, privkeyPEM string) (*Uplo
 				continue
 			}

-			// gi
+			// 对比证书有效期
+			newCertNotBefore := certX509.NotBefore
+			newCertNotAfter := certX509.NotAfter
 			oldCertNotBefore, _ := time.Parse("2006-01-02T15:04:05Z", certItem.StartTime)
 			oldCertNotAfter, _ := time.Parse("2006-01-02T15:04:05Z", certItem.EndTime)
-			if !certX509.NotBefore.Equal(oldCertNotBefore) {
-				continue
-			} else if !certX509.NotAfter.Equal(oldCertNotAfter) {
+			if !newCertNotBefore.Equal(oldCertNotBefore) || !newCertNotAfter.Equal(oldCertNotAfter) {
 				continue
 			}