feat(CertificateManager): Implement on-demand certificate retrieval for missing SNI certificates. When no certificate is found for a TLS ClientHello, the system now automatically registers the domain with the Port80Handler to trigger ACME issuance and immediately falls back to using the default certificate to complete the handshake. Additionally, HTTP requests on port 80 for unrecognized domains now return a 503 indicating that certificate issuance is in progress.

test/test.certprovisioner.unit.ts

@@ -2,7 +2,7 @@ import { tap, expect } from '@push.rocks/tapbundle';
 import * as plugins from '../ts/plugins.js';
 import { CertProvisioner } from '../ts/smartproxy/classes.pp.certprovisioner.js';
 import type { IDomainConfig, ISmartProxyCertProvisionObject } from '../ts/smartproxy/classes.pp.interfaces.js';
-import type { ICertificateData } from '../ts/port80handler/classes.port80handler.js';
+import type { ICertificateData } from '../ts/common/types.js';
 
 // Fake Port80Handler stub
 class FakePort80Handler extends plugins.EventEmitter {
@@ -36,7 +36,10 @@ tap.test('CertProvisioner handles static provisioning', async () => {
       domainName: domain,
       publicKey: 'CERT',
       privateKey: 'KEY',
-      validUntil: Date.now() + 3600 * 1000
+      validUntil: Date.now() + 3600 * 1000,
+      created: Date.now(),
+      csr: 'CSR',
+      id: 'ID',
     };
   };
   const prov = new CertProvisioner(
@@ -117,7 +120,10 @@ tap.test('CertProvisioner on-demand static provisioning', async () => {
     domainName: domain,
     publicKey: 'PKEY',
     privateKey: 'PRIV',
-    validUntil: Date.now() + 1000
+    validUntil: Date.now() + 1000,
+    created: Date.now(),
+    csr: 'CSR',
+    id: 'ID',
   });
   const prov = new CertProvisioner(
     domainConfigs,

test/test.router.ts

@@ -31,10 +31,10 @@ function createProxyConfig(
 ): tsclass.network.IReverseProxyConfig {
   return {
     hostName: hostname,
-    destinationIp,
-    destinationPort: destinationPort.toString(), // Convert to string for IReverseProxyConfig
     publicKey: 'mock-cert',
-    privateKey: 'mock-key'
+    privateKey: 'mock-key',
+    destinationIps: [destinationIp],
+    destinationPorts: [destinationPort],
   } as tsclass.network.IReverseProxyConfig;
 }