From d5eeb4a1048a2c01adefa8154dde002bc38ead43 Mon Sep 17 00:00:00 2001
From: John Coffey <john@coffeylabs.org>
Date: Fri, 30 Oct 2026 15:21:53 -0700
Subject: [PATCH] Relays: each relay's certificate

The list says when a joined relay has no certificate, when this server
couldn't order one and why, and when it runs out, from the certificate
stored here before the one the relay reports (relay spec, RL-27). A
server from before RL-27 sends none of this, and no line shows.

A relay's settings get a Certificate section: how long it's good for or
why the last order failed, and the chain and key to paste where no
domain here manages the public name's DNS. The key is never shown;
left empty, the stored one stays. Clearing the chain removes both.
---
 src/features/relays/RelaysPage.tsx | 65 ++++++++++++++++++++++++++++++
 src/features/relays/model.test.ts  | 17 ++++++++
 src/features/relays/model.ts       | 28 +++++++++----
 src/help/texts.ts                  |  4 ++
 src/i18n/en.json                   | 20 +++++++--
 5 files changed, 123 insertions(+), 11 deletions(-)

diff --git a/src/features/relays/RelaysPage.tsx b/src/features/relays/RelaysPage.tsx
index 7aaec7d..7fcb293 100644
--- a/src/features/relays/RelaysPage.tsx
+++ b/src/features/relays/RelaysPage.tsx
@@ -154,6 +154,13 @@ function attentionText(t: TFunction, a: Attention): string {
       return t('relays.att.certSoon', 'Its certificate runs out {{when}}.', { when: when(a.notAfter) });
     case 'certificateExpired':
       return t('relays.att.certGone', 'Its certificate ran out {{when}}.', { when: when(a.notAfter) });
+    case 'noCertificate':
+      return t(
+        'relays.att.noCertificate',
+        'It has no certificate yet. This server orders one when a domain here manages the DNS of its public name; otherwise, upload one in its settings.',
+      );
+    case 'certificateFailed':
+      return t('relays.att.certFailed', 'Its certificate couldn’t be ordered: {{error}}', { error: a.error });
     case 'relayError':
       return t('relays.att.relayError', 'The relay reports: {{error}}', { error: a.error });
     case 'recipientsDiffer':
@@ -323,6 +330,8 @@ function SettingsDialog({
   const startForm = useMemo(() => toForm(relay.settings), [relay]);
   const [g, setG] = useState(startGeneral);
   const [form, setForm] = useState<SettingsForm>(startForm);
+  const [chain, setChain] = useState(relay.smtpCertificate ?? '');
+  const [key, setKey] = useState('');
   const [reason, setReason] = useState('');
   const [busy, setBusy] = useState(false);
   const [invalid, setInvalid] = useState<string | null>(null);
@@ -363,6 +372,19 @@ function SettingsDialog({
       }
       patch.mxPreference = Number(g.mxPreference);
     }
+    // A certificate uploaded by hand: the chain and its key go together
+    if (chain.trim() !== (relay.smtpCertificate ?? '').trim() || key.trim()) {
+      if (!chain.trim()) {
+        patch.smtpCertificate = null;
+        patch.smtpPrivateKey = null;
+      } else if (!key.trim() && !relay.smtpPrivateKey) {
+        setInvalid('smtpPrivateKey');
+        return;
+      } else {
+        patch.smtpCertificate = chain.trim();
+        if (key.trim()) patch.smtpPrivateKey = key.trim();
+      }
+    }
     for (const flag of ['enabled', 'sendThrough', 'inboundOnly'] as const) {
       if (g[flag] !== startGeneral[flag]) patch[flag] = g[flag];
     }
@@ -536,6 +558,49 @@ function SettingsDialog({
           </div>
         </section>
 
+        <section className="space-y-3">
+          <h3 className="text-sm font-medium">{t('relays.s.certificate', 'Certificate')}</h3>
+          <p className="text-sm text-muted-foreground">
+            {relay.certificateError
+              ? t('relays.cert.failed', 'The last order failed: {{error}}', { error: relay.certificateError })
+              : relay.certificateNotAfter
+                ? t('relays.cert.until', 'Good until {{when}}.', { when: when(relay.certificateNotAfter) })
+                : t('relays.cert.none', 'None yet.')}{' '}
+            {t(
+              'relays.cert.how',
+              'Where a domain here manages its public name’s DNS, this server orders and renews it. Otherwise, paste one here.',
+            )}
+          </p>
+          <Field field="smtpCertificate" label={t('relays.f.smtpCertificate', 'Certificate chain (PEM)')}>
+            <Textarea
+              value={chain}
+              rows={4}
+              disabled={!canChange}
+              spellCheck={false}
+              className="font-mono text-xs"
+              placeholder="-----BEGIN CERTIFICATE-----"
+              onChange={(e) => setChain(e.target.value)}
+            />
+          </Field>
+          <Field field="smtpPrivateKey" label={t('relays.f.smtpPrivateKey', 'Private key (PEM)')}>
+            <Textarea
+              value={key}
+              rows={3}
+              disabled={!canChange}
+              spellCheck={false}
+              autoComplete="off"
+              aria-invalid={invalid === 'smtpPrivateKey'}
+              className="font-mono text-xs"
+              placeholder={
+                relay.smtpPrivateKey
+                  ? t('relays.cert.keepKey', 'Leave empty to keep the stored key')
+                  : '-----BEGIN PRIVATE KEY-----'
+              }
+              onChange={(e) => setKey(e.target.value)}
+            />
+          </Field>
+        </section>
+
         {invalid && (
           <p className="text-sm text-destructive">
             {t('relays.invalid', 'One value doesn’t read: check the field marked in red.')}
diff --git a/src/features/relays/model.test.ts b/src/features/relays/model.test.ts
index 909f028..77772b9 100644
--- a/src/features/relays/model.test.ts
+++ b/src/features/relays/model.test.ts
@@ -134,6 +134,23 @@ describe('attention', () => {
     expect(expired).toEqual([{ kind: 'certificateExpired', notAfter: '2026-10-01T00:00:00Z' }]);
   });
 
+  it('reads the certificate stored here before the one the relay reports', () => {
+    const status = link('1').relay!;
+    const linked = [link('1', { relay: { ...status, certificateNotAfter: '2027-01-01T00:00:00Z' } })];
+    expect(attention(relay({ links: linked, certificateNotAfter: '2026-11-05T00:00:00Z' }), NOW)).toEqual([
+      { kind: 'certificateExpiring', notAfter: '2026-11-05T00:00:00Z' },
+    ]);
+    // None stored, on a server that reads certificates
+    expect(attention(relay({ links: [link('1')], certificateNotAfter: null }), NOW)).toEqual([
+      { kind: 'noCertificate' },
+    ]);
+    // An older server sends neither: no line
+    expect(attention(relay({ links: [link('1')] }), NOW)).toEqual([]);
+    expect(
+      attention(relay({ links: [link('1')], certificateNotAfter: null, certificateError: 'rate limited' }), NOW),
+    ).toEqual([{ kind: 'certificateFailed', error: 'rate limited' }]);
+  });
+
   it('reads the status the relay sent last', () => {
     const status = link('1').relay!;
     const found = attention(
diff --git a/src/features/relays/model.ts b/src/features/relays/model.ts
index 2782a2b..de00fb1 100644
--- a/src/features/relays/model.ts
+++ b/src/features/relays/model.ts
@@ -66,6 +66,13 @@ export interface Relay {
   /** Absent from servers before RL-25. */
   mxPreference?: number;
   settings: RelaySettings;
+  /** Its STARTTLS certificate chain, PEM; the key reads back as `****`. */
+  smtpCertificate?: string | null;
+  smtpPrivateKey?: string | null;
+  /** Absent from servers before RL-27: when the stored certificate runs out. */
+  certificateNotAfter?: string | null;
+  /** Why this server's last order for its certificate failed (RL-27). */
+  certificateError?: string | null;
   joinState: 'waiting' | 'expired' | 'joined';
   joinExpiresAt?: string | null;
   joinedAt?: string | null;
@@ -120,6 +127,8 @@ export type Attention =
   | { kind: 'spoolFilling'; percent: number }
   | { kind: 'certificateExpiring'; notAfter: string }
   | { kind: 'certificateExpired'; notAfter: string }
+  | { kind: 'noCertificate' }
+  | { kind: 'certificateFailed'; error: string }
   | { kind: 'relayError'; error: string }
   | { kind: 'recipientsDiffer' };
 
@@ -154,14 +163,19 @@ export function attention(relay: Relay, now: Date = new Date()): Attention[] {
     if (max > 0 && status.spool.bytes / max >= SPOOL_WARN) {
       out.push({ kind: 'spoolFilling', percent: Math.min(100, Math.round((status.spool.bytes / max) * 100)) });
     }
-    if (status.certificateNotAfter) {
-      const left = new Date(status.certificateNotAfter).getTime() - now.getTime();
-      if (left <= 0) out.push({ kind: 'certificateExpired', notAfter: status.certificateNotAfter });
-      else if (left < CERTIFICATE_WARN_DAYS * 86_400_000)
-        out.push({ kind: 'certificateExpiring', notAfter: status.certificateNotAfter });
-    }
-    if (status.lastError) out.push({ kind: 'relayError', error: status.lastError });
   }
+  // The certificate stored here, or else the one the relay reports
+  const notAfter = relay.certificateNotAfter ?? status?.certificateNotAfter;
+  if (notAfter) {
+    const left = new Date(notAfter).getTime() - now.getTime();
+    if (left <= 0) out.push({ kind: 'certificateExpired', notAfter });
+    else if (left < CERTIFICATE_WARN_DAYS * 86_400_000) out.push({ kind: 'certificateExpiring', notAfter });
+  } else if (relay.certificateNotAfter === null && !relay.certificateError) {
+    // A server that reads certificates says there's none
+    out.push({ kind: 'noCertificate' });
+  }
+  if (relay.certificateError) out.push({ kind: 'certificateFailed', error: relay.certificateError });
+  if (status?.lastError) out.push({ kind: 'relayError', error: status.lastError });
   // Every node sends the same recipients; nodes that disagree have a stale set
   const counts = new Set(
     relay.links.filter((l) => l.state === 'linked' && l.recipients != null).map((l) => l.recipients),
diff --git a/src/help/texts.ts b/src/help/texts.ts
index 336d255..95fb0f2 100644
--- a/src/help/texts.ts
+++ b/src/help/texts.ts
@@ -32,6 +32,10 @@ export const FIELD_HELP: Record<string, string> = {
     'The relay takes mail in but sends none, for instance while its address is new to other providers or not in your SPF record yet.',
   'inbuxa:Relay.hostname':
     'The relay’s public name: what it says when other servers connect, and the name on its certificate. Needs an A record and matching reverse DNS. Where this server publishes a domain’s DNS, it’s in the MX and SPF records.',
+  'inbuxa:Relay.smtpCertificate':
+    'The certificate the relay offers when other servers start TLS on port 25, with its chain. This server orders and renews it where a domain here manages the public name’s DNS; anything pasted is replaced only once it no longer does.',
+  'inbuxa:Relay.smtpPrivateKey':
+    'The key for the certificate. It’s never shown again: leave the box empty to keep the stored one.',
   'inbuxa:Relay.mxPreference':
     'Where this server publishes a domain’s DNS, the relay’s MX preference: senders try the lowest first. Give relays the same number to share the mail.',
   'inbuxa:Relay.smtpListen': 'The addresses the relay takes mail on, usually [::]:25 for every address on port 25.',
diff --git a/src/i18n/en.json b/src/i18n/en.json
index bbdbfb8..b04578e 100644
--- a/src/i18n/en.json
+++ b/src/i18n/en.json
@@ -2356,7 +2356,9 @@
       "certSoon": "Its certificate runs out {{when}}.",
       "certGone": "Its certificate ran out {{when}}.",
       "relayError": "The relay reports: {{error}}",
-      "recipients": "Nodes sent it different recipient lists; one of them is out of date."
+      "recipients": "Nodes sent it different recipient lists; one of them is out of date.",
+      "noCertificate": "It has no certificate yet. This server orders one when a domain here manages the DNS of its public name; otherwise, upload one in its settings.",
+      "certFailed": "Its certificate couldn’t be ordered: {{error}}"
     },
     "copied": "Copied",
     "tokenTitle": "Join {{name}}",
@@ -2389,7 +2391,9 @@
       "outboundRetry": "Waits between attempts",
       "outboundExpiry": "Give up after",
       "outboundTls": "Encryption",
-      "mxPreference": "MX preference"
+      "mxPreference": "MX preference",
+      "smtpCertificate": "Certificate chain (PEM)",
+      "smtpPrivateKey": "Private key (PEM)"
     },
     "cancel": "Cancel",
     "addGo": "Add",
@@ -2400,7 +2404,8 @@
     "s": {
       "general": "The relay",
       "receiving": "Taking mail in",
-      "sending": "Sending mail on"
+      "sending": "Sending mail on",
+      "certificate": "Certificate"
     },
     "tls": {
       "opportunistic": "When offered",
@@ -2469,6 +2474,13 @@
     "deleteTitle": "Remove {{name}}?",
     "deleteBody": "This server stops linking to it. The relay keeps the mail it holds, and goes on taking mail in, until you run inbuxa-relay reset on its host. To stop it for a while, turn it off instead: it comes back without a new join.",
     "deleteGo": "Remove",
-    "deleteFailed": "The relay wasn’t removed"
+    "deleteFailed": "The relay wasn’t removed",
+    "cert": {
+      "failed": "The last order failed: {{error}}",
+      "until": "Good until {{when}}.",
+      "none": "None yet.",
+      "how": "Where a domain here manages its public name’s DNS, this server orders and renews it. Otherwise, paste one here.",
+      "keepKey": "Leave empty to keep the stored key"
+    }
   }
 }
-- 
2.54.0