From 71b90de0d4aed7ea720e395ee945a6bfd63c5d8b Mon Sep 17 00:00:00 2001
From: Mike O'Driscoll <mikeo@tailscale.com>
Date: Wed, 15 Jul 2026 22:13:27 -0400
Subject: [PATCH] derp/derpserver,cmd/derper: use slices.Clip for cert chain
 copies (#20484)

---
 cmd/derper/cert.go            | 8 ++++----
 derp/derpserver/derpserver.go | 3 +--
 2 files changed, 5 insertions(+), 6 deletions(-)

diff --git a/cmd/derper/cert.go b/cmd/derper/cert.go
index ceeb36c39..0cf814b3e 100644
--- a/cmd/derper/cert.go
+++ b/cmd/derper/cert.go
@@ -23,6 +23,7 @@
 	"os"
 	"path/filepath"
 	"regexp"
+	"slices"
 	"time"
 
 	"golang.org/x/crypto/acme"
@@ -158,10 +159,9 @@ func (m *manualCertManager) getCertificate(hi *tls.ClientHelloInfo) (*tls.Certif
 
 	// Return a shallow copy of the cert with a capacity-clamped chain
 	// so callers can never mutate the manager's long-lived certificate.
-	certCopy := new(tls.Certificate)
-	*certCopy = *m.cert
-	certCopy.Certificate = certCopy.Certificate[:len(certCopy.Certificate):len(certCopy.Certificate)]
-	return certCopy, nil
+	certCopy := *m.cert
+	certCopy.Certificate = slices.Clip(certCopy.Certificate)
+	return &certCopy, nil
 }
 
 func (m *manualCertManager) HTTPHandler(fallback http.Handler) http.Handler {
diff --git a/derp/derpserver/derpserver.go b/derp/derpserver/derpserver.go
index 3da6f2bfa..d46399693 100644
--- a/derp/derpserver/derpserver.go
+++ b/derp/derpserver/derpserver.go
@@ -744,8 +744,7 @@ func (s *Server) ModifyTLSConfigToAddMetaCert(c *tls.Config) {
 		// cached value. Return a shallow copy with the meta cert
 		// appended to a freshly allocated chain slice.
 		certCopy := *cert
-		chain := cert.Certificate
-		certCopy.Certificate = append(chain[:len(chain):len(chain)], s.MetaCert())
+		certCopy.Certificate = append(slices.Clip(cert.Certificate), s.MetaCert())
 		return &certCopy, nil
 	}
 }