From 220c3ace14a667bfdea3f9fcf304f00d5df8e399 Mon Sep 17 00:00:00 2001
From: zhouzhou218 <zhouzhou218@users.noreply.gitee.com>
Date: Fri, 14 Aug 2026 14:22:05 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20=E4=B8=BA=E7=AD=BE=E5=8F=91=E8=AF=81?=
 =?UTF-8?q?=E4=B9=A6=E5=A2=9E=E5=8A=A0=E6=97=B6=E9=92=9F=E5=81=8F=E5=B7=AE?=
 =?UTF-8?q?=E5=AE=B9=E5=BF=8D=20IK8K6B?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 tms/asset-manager/internal/ca/ca.go      |  4 +++-
 tms/asset-manager/internal/ca/ca_test.go | 22 ++++++++++++++++++++++
 2 files changed, 25 insertions(+), 1 deletion(-)

diff --git a/tms/asset-manager/internal/ca/ca.go b/tms/asset-manager/internal/ca/ca.go
index 850b87b..36bf526 100644
--- a/tms/asset-manager/internal/ca/ca.go
+++ b/tms/asset-manager/internal/ca/ca.go
@@ -30,6 +30,8 @@ import (
 	"time"
 )
 
+const certificateClockSkew = 5 * time.Minute
+
 // Manager 管理内置的证书颁发机构（CA）。
 type Manager struct {
 	caCert       *x509.Certificate
@@ -87,7 +89,7 @@ func (m *Manager) SignCert(agentID uint64) (
 	}
 
 	now := time.Now().UTC()
-	notBefore = now
+	notBefore = now.Add(-certificateClockSkew)
 	notAfter = now.Add(time.Duration(m.validityDays) * 24 * time.Hour)
 	template := &x509.Certificate{
 		SerialNumber: serialNumber,
diff --git a/tms/asset-manager/internal/ca/ca_test.go b/tms/asset-manager/internal/ca/ca_test.go
index ff33b09..6fe2728 100644
--- a/tms/asset-manager/internal/ca/ca_test.go
+++ b/tms/asset-manager/internal/ca/ca_test.go
@@ -304,3 +304,25 @@ func TestSignCert(t *testing.T) {
 		t.Errorf("cert verification failed: %v", err)
 	}
 }
+
+func TestSignCertBackdatesNotBeforeForClockSkew(t *testing.T) {
+	dir := t.TempDir()
+	m, err := New(filepath.Join(dir, "ca.crt"), filepath.Join(dir, "ca.key"), 365)
+	if err != nil {
+		t.Fatalf("New: %v", err)
+	}
+
+	started := time.Now().UTC()
+	_, _, _, _, notBefore, _, err := m.SignCert(12345)
+	finished := time.Now().UTC()
+	if err != nil {
+		t.Fatalf("SignCert: %v", err)
+	}
+
+	if notBefore.After(started.Add(-5 * time.Minute)) {
+		t.Fatalf("notBefore = %v, want no later than %v", notBefore, started.Add(-5*time.Minute))
+	}
+	if notBefore.Before(finished.Add(-5*time.Minute - time.Second)) {
+		t.Fatalf("notBefore = %v, want close to five minutes before signing", notBefore)
+	}
+}
-- 
Gitee