test(gateway): retain cert on expired hot reload

Author: kvinwang

dstack/gateway/src/cert_store.rs

@@ -476,4 +476,29 @@ mod tests {
         );
         assert!(resolver.get().has_cert_for_sni("app.example.com"));
     }
+
+    #[test]
+    fn expired_update_retains_previous_certificate() {
+        let original = make_test_cert_data();
+        let mut expired = make_test_cert_data();
+        expired.not_after = 1;
+
+        let resolver = CertResolver::new();
+        resolver
+            .update_cert("example.com", &original)
+            .expect("failed to install original certificate");
+        resolver
+            .update_cert("example.com", &expired)
+            .expect_err("expired certificate must be rejected");
+
+        assert_eq!(
+            resolver
+                .get()
+                .get_cert_data("example.com")
+                .expect("original certificate was lost")
+                .not_after,
+            original.not_after
+        );
+        assert!(resolver.get().has_cert_for_sni("app.example.com"));
+    }
 }