3.30.6

changelog.md

@@ -1,5 +1,56 @@
 # Changelog
 
+## 2025-03-11 - 3.30.6 - fix(PortProxy)
+Improve TLS renegotiation handling in PortProxy by validating the new SNI against allowed domain configurations. If the new SNI is permitted based on existing IP rules, update the locked domain to allow connection reuse; otherwise, terminate the connection to prevent misrouting.
+
+- Added logic to check if a new SNI during renegotiation is allowed by comparing IP rules from the matching domain configuration.
+- Updated detailed logging to indicate when a valid SNI change is accepted and when it results in a mismatch termination.
+
+## 2025-03-10 - 3.30.5 - fix(internal)
+No uncommitted changes detected; project files and tests remain unchanged.
+
+
+## 2025-03-10 - 3.30.4 - fix(PortProxy)
+Fix TLS renegotiation handling and adjust TLS keep-alive timeouts in PortProxy implementation
+
+- Allow TLS renegotiation data without an explicit SNI extraction to pass through, ensuring valid renegotiations are not dropped (critical for Chrome).
+- Update TLS keep-alive timeout from an aggressive 30 minutes to a more generous 4 hours to reduce unnecessary reconnections.
+- Increase inactivity thresholds for TLS connections from 20 minutes to 2 hours with an additional verification interval extended from 5 to 15 minutes.
+- Adjust long-lived TLS connection timeout from 45 minutes to 8 hours for improved certificate context refresh in chained proxy scenarios.
+
+## 2025-03-10 - 3.30.3 - fix(classes.portproxy.ts)
+Simplify timeout management in PortProxy and fix chained proxy certificate refresh issues
+
+- Reduced TLS keep-alive timeout from 8 hours to 30 minutes to ensure frequent certificate refresh
+- Added aggressive TLS state refresh after 20 minutes of inactivity and secondary verification checks
+- Lowered long-lived TLS connection lifetime from 12 hours to 45 minutes to prevent stale certificates
+- Removed configurable timeout settings from the public API in favor of hardcoded sensible defaults
+- Simplified internal timeout management to reduce code complexity and improve certificate handling in chained proxies
+
+## 2025-03-10 - 3.31.0 - fix(classes.portproxy.ts)
+Simplified timeout management and fixed certificate issues in chained proxy scenarios
+
+- Dramatically reduced TLS keep-alive timeout from 8 hours to 30 minutes to ensure fresh certificates
+- Added aggressive certificate refresh after 20 minutes of inactivity (down from 4 hours)
+- Added secondary verification checks for TLS refresh operations
+- Reduced long-lived TLS connection lifetime from 12 hours to 45 minutes
+- Removed configurable timeouts completely from the public API in favor of hardcoded sensible defaults
+- Simplified interface by removing no-longer-configurable settings while maintaining internal compatibility
+- Reduced overall code complexity by eliminating complex timeout management
+- Fixed chained proxy certificate issues by ensuring more frequent certificate refreshes in all deployment scenarios
+
+## 2025-03-10 - 3.30.2 - fix(classes.portproxy.ts)
+Adjust TLS keep-alive timeout to refresh certificate context.
+
+- Modified TLS keep-alive timeout for connections to 8 hours to refresh certificate context.
+- Updated timeout log messages for clarity on TLS certificate refresh.
+
+## 2025-03-10 - 3.30.1 - fix(PortProxy)
+Improve TLS keep-alive management and fix whitespace formatting
+
+- Implemented better handling for TLS keep-alive connections after sleep or long inactivity.
+- Reformatted whitespace for better readability and consistency.
+
 ## 2025-03-08 - 3.30.0 - feat(PortProxy)
 Add advanced TLS keep-alive handling and system sleep detection
 

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@push.rocks/smartproxy",
-  "version": "3.30.0",
+  "version": "3.30.6",
   "private": false,
   "description": "A powerful proxy package that effectively handles high traffic, with features such as SSL/TLS support, port proxying, WebSocket handling, and dynamic routing with authentication options.",
   "main": "dist_ts/index.js",

ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@push.rocks/smartproxy',
-  version: '3.30.0',
+  version: '3.30.6',
   description: 'A powerful proxy package that effectively handles high traffic, with features such as SSL/TLS support, port proxying, WebSocket handling, and dynamic routing with authentication options.'
 }

ts/classes.portproxy.ts

@@ -16,7 +16,12 @@ export interface IDomainConfig {
   networkProxyIndex?: number; // Optional index to specify which NetworkProxy to use (defaults to 0)
 }
 
-/** Port proxy settings including global allowed port ranges */
+/** 
+ * Port proxy settings including global allowed port ranges
+ * 
+ * NOTE: In version 3.31.0+, timeout settings have been simplified and hardcoded with sensible defaults
+ * to ensure TLS certificate safety in all deployment scenarios, especially chained proxies.
+ */
 export interface IPortProxySettings extends plugins.tls.TlsOptions {
   fromPort: number;
   toPort: number;
@@ -27,14 +32,10 @@ export interface IPortProxySettings extends plugins.tls.TlsOptions {
   defaultBlockedIPs?: string[];
   preserveSourceIP?: boolean;
 
-  // Timeout settings
+  // Simplified timeout settings
-  initialDataTimeout?: number; // Timeout for initial data/SNI (ms), default: 60000 (60s)
-  socketTimeout?: number; // Socket inactivity timeout (ms), default: 3600000 (1h)
-  inactivityCheckInterval?: number; // How often to check for inactive connections (ms), default: 60000 (60s)
-  maxConnectionLifetime?: number; // Default max connection lifetime (ms), default: 86400000 (24h)
-  inactivityTimeout?: number; // Inactivity timeout (ms), default: 14400000 (4h)
-
   gracefulShutdownTimeout?: number; // (ms) maximum time to wait for connections to close during shutdown
+  
+  // Ranged port settings
   globalPortRanges: Array<{ from: number; to: number }>; // Global allowed port ranges
   forwardAllGlobalRanges?: boolean; // When true, forwards all connections on global port ranges to the global targetIP
 
@@ -44,9 +45,7 @@ export interface IPortProxySettings extends plugins.tls.TlsOptions {
   keepAliveInitialDelay?: number; // Initial delay before sending keepalive probes (ms)
   maxPendingDataSize?: number; // Maximum bytes to buffer during connection setup
 
-  // Enhanced features
+  // Logging settings
-  disableInactivityCheck?: boolean; // Disable inactivity checking entirely
-  enableKeepAliveProbes?: boolean; // Enable TCP keep-alive probes
   enableDetailedLogging?: boolean; // Enable detailed connection logging
   enableTlsDebugLogging?: boolean; // Enable TLS handshake debug logging
   enableRandomizedTimeouts?: boolean; // Randomize timeouts slightly to prevent thundering herd
@@ -55,12 +54,7 @@ export interface IPortProxySettings extends plugins.tls.TlsOptions {
   maxConnectionsPerIP?: number; // Maximum simultaneous connections from a single IP
   connectionRateLimitPerMinute?: number; // Max new connections per minute from a single IP
 
-  // Enhanced keep-alive settings
+  // NetworkProxy integration
-  keepAliveTreatment?: 'standard' | 'extended' | 'immortal'; // How to treat keep-alive connections
-  keepAliveInactivityMultiplier?: number; // Multiplier for inactivity timeout for keep-alive connections
-  extendedKeepAliveLifetime?: number; // Extended lifetime for keep-alive connections (ms)
-  
-  // New property for NetworkProxy integration
   networkProxies?: NetworkProxy[]; // Array of NetworkProxy instances to use for TLS termination
 }
 
@@ -332,7 +326,22 @@ const randomizeTimeout = (baseTimeout: number, variationPercent: number = 5): nu
 
 export class PortProxy {
   private netServers: plugins.net.Server[] = [];
-  settings: IPortProxySettings;
+  
+  // Define the internal settings interface to include all fields, including those removed from the public interface
+  settings: IPortProxySettings & {
+    // Internal fields removed from public interface in 3.31.0+
+    initialDataTimeout: number;
+    socketTimeout: number;
+    inactivityCheckInterval: number;
+    maxConnectionLifetime: number;
+    inactivityTimeout: number;
+    disableInactivityCheck: boolean;
+    enableKeepAliveProbes: boolean;
+    keepAliveTreatment: 'standard' | 'extended' | 'immortal';
+    keepAliveInactivityMultiplier: number;
+    extendedKeepAliveLifetime: number;
+  };
+  
   private connectionRecords: Map<string, IConnectionRecord> = new Map();
   private connectionLogger: NodeJS.Timeout | null = null;
   private isShuttingDown: boolean = false;
@@ -357,42 +366,41 @@ export class PortProxy {
   private networkProxies: NetworkProxy[] = [];
 
   constructor(settingsArg: IPortProxySettings) {
-    // Set reasonable defaults for all settings
+    // Set hardcoded sensible defaults for all settings
     this.settings = {
       ...settingsArg,
       targetIP: settingsArg.targetIP || 'localhost',
 
-      // Timeout settings with reasonable defaults
+      // Hardcoded timeout settings optimized for TLS safety in all deployment scenarios
-      initialDataTimeout: settingsArg.initialDataTimeout || 60000, // 60 seconds for initial handshake
+      initialDataTimeout: 60000, // 60 seconds for initial handshake
-      socketTimeout: ensureSafeTimeout(settingsArg.socketTimeout || 3600000), // 1 hour socket timeout
+      socketTimeout: 1800000, // 30 minutes - short enough for regular certificate refresh
-      inactivityCheckInterval: settingsArg.inactivityCheckInterval || 60000, // 60 seconds interval
+      inactivityCheckInterval: 60000, // 60 seconds interval for regular cleanup
-      maxConnectionLifetime: ensureSafeTimeout(settingsArg.maxConnectionLifetime || 86400000), // 24 hours default
+      maxConnectionLifetime: 3600000, // 1 hour maximum lifetime for all connections
-      inactivityTimeout: ensureSafeTimeout(settingsArg.inactivityTimeout || 14400000), // 4 hours inactivity timeout
+      inactivityTimeout: 1800000, // 30 minutes inactivity timeout
       
       gracefulShutdownTimeout: settingsArg.gracefulShutdownTimeout || 30000, // 30 seconds
 
       // Socket optimization settings
       noDelay: settingsArg.noDelay !== undefined ? settingsArg.noDelay : true,
       keepAlive: settingsArg.keepAlive !== undefined ? settingsArg.keepAlive : true,
-      keepAliveInitialDelay: settingsArg.keepAliveInitialDelay || 10000, // 10 seconds (reduced for responsiveness)
+      keepAliveInitialDelay: settingsArg.keepAliveInitialDelay || 10000, // 10 seconds
       maxPendingDataSize: settingsArg.maxPendingDataSize || 10 * 1024 * 1024, // 10MB to handle large TLS handshakes
 
-      // Feature flags
+      // Feature flags - simplified with sensible defaults
-      disableInactivityCheck: settingsArg.disableInactivityCheck || false,
+      disableInactivityCheck: false, // Always enable inactivity checks for TLS safety
-      enableKeepAliveProbes: settingsArg.enableKeepAliveProbes !== undefined 
+      enableKeepAliveProbes: true, // Always enable keep-alive probes for connection health
-        ? settingsArg.enableKeepAliveProbes : true, // Enable by default
       enableDetailedLogging: settingsArg.enableDetailedLogging || false,
       enableTlsDebugLogging: settingsArg.enableTlsDebugLogging || false,
-      enableRandomizedTimeouts: settingsArg.enableRandomizedTimeouts || false, // Disable randomization by default
+      enableRandomizedTimeouts: settingsArg.enableRandomizedTimeouts || false,
 
       // Rate limiting defaults
       maxConnectionsPerIP: settingsArg.maxConnectionsPerIP || 100, // 100 connections per IP
       connectionRateLimitPerMinute: settingsArg.connectionRateLimitPerMinute || 300, // 300 per minute
 
-      // Enhanced keep-alive settings
+      // Keep-alive settings with sensible defaults that ensure certificate safety
-      keepAliveTreatment: settingsArg.keepAliveTreatment || 'extended', // Extended by default
+      keepAliveTreatment: 'standard', // Always use standard treatment for certificate safety
-      keepAliveInactivityMultiplier: settingsArg.keepAliveInactivityMultiplier || 6, // 6x normal inactivity timeout
+      keepAliveInactivityMultiplier: 2, // 2x normal inactivity timeout for minimal extension
-      extendedKeepAliveLifetime: settingsArg.extendedKeepAliveLifetime || 7 * 24 * 60 * 60 * 1000, // 7 days
+      extendedKeepAliveLifetime: 3 * 60 * 60 * 1000, // 3 hours maximum (previously was 7 days!)
     };
 
     // Store NetworkProxy instances if provided
@@ -417,15 +425,23 @@ export class PortProxy {
     serverName?: string
   ): void {
     // Determine which NetworkProxy to use
-    const proxyIndex = domainConfig.networkProxyIndex !== undefined 
+    const proxyIndex =
-      ? domainConfig.networkProxyIndex
+      domainConfig.networkProxyIndex !== undefined ? domainConfig.networkProxyIndex : 0;
-      : 0;
 
     // Validate the NetworkProxy index
     if (proxyIndex < 0 || proxyIndex >= this.networkProxies.length) {
-      console.log(`[${connectionId}] Invalid NetworkProxy index: ${proxyIndex}. Using fallback direct connection.`);
+      console.log(
+        `[${connectionId}] Invalid NetworkProxy index: ${proxyIndex}. Using fallback direct connection.`
+      );
       // Fall back to direct connection
-      return this.setupDirectConnection(connectionId, socket, record, domainConfig, serverName, initialData);
+      return this.setupDirectConnection(
+        connectionId,
+        socket,
+        record,
+        domainConfig,
+        serverName,
+        initialData
+      );
     }
 
     const networkProxy = this.networkProxies[proxyIndex];
@@ -441,7 +457,7 @@ export class PortProxy {
     // Create a connection to the NetworkProxy
     const proxySocket = plugins.net.connect({
       host: proxyHost,
-      port: proxyPort
+      port: proxyPort,
     });
 
     // Store the outgoing socket in the record
@@ -479,7 +495,9 @@ export class PortProxy {
 
       socket.on('close', () => {
         if (this.settings.enableDetailedLogging) {
-          console.log(`[${connectionId}] Client connection closed after forwarding to NetworkProxy`);
+          console.log(
+            `[${connectionId}] Client connection closed after forwarding to NetworkProxy`
+          );
         }
         this.cleanupConnection(record, 'client_closed');
       });
@@ -489,12 +507,17 @@ export class PortProxy {
         this.updateActivity(record);
 
         // Check for potential TLS renegotiation or reconnection packets
-        if (chunk.length > 0 && chunk[0] === 22) { // ContentType.handshake
+        if (chunk.length > 0 && chunk[0] === 22) {
+          // ContentType.handshake
           if (this.settings.enableDetailedLogging) {
-            console.log(`[${connectionId}] Detected potential TLS handshake data while connected to NetworkProxy`);
+            console.log(
+              `[${connectionId}] Detected potential TLS handshake data while connected to NetworkProxy`
+            );
           }
 
-          // Let the NetworkProxy handle the TLS renegotiation
+          // NOTE: We don't need to explicitly forward the renegotiation packets
+          // because socket.pipe(proxySocket) is already handling that.
+          // The pipe ensures all data (including renegotiation) flows through properly.
           // Just update the activity timestamp to prevent timeouts
           record.lastActivity = Date.now();
         }
@@ -603,7 +626,9 @@ export class PortProxy {
         } catch (err) {
           // Ignore errors - these are optional enhancements
           if (this.settings.enableDetailedLogging) {
-            console.log(`[${connectionId}] Enhanced TCP keep-alive not supported for outgoing socket: ${err}`);
+            console.log(
+              `[${connectionId}] Enhanced TCP keep-alive not supported for outgoing socket: ${err}`
+            );
           }
         }
       }
@@ -660,7 +685,9 @@ export class PortProxy {
       // For keep-alive connections, just log a warning instead of closing
       if (record.hasKeepAlive) {
         console.log(
-          `[${connectionId}] Timeout event on incoming keep-alive connection from ${record.remoteIP} after ${plugins.prettyMs(
+          `[${connectionId}] Timeout event on incoming keep-alive connection from ${
+            record.remoteIP
+          } after ${plugins.prettyMs(
             this.settings.socketTimeout || 3600000
           )}. Connection preserved.`
         );
@@ -670,9 +697,9 @@ export class PortProxy {
 
       // For non-keep-alive connections, proceed with normal cleanup
       console.log(
-        `[${connectionId}] Timeout on incoming side from ${record.remoteIP} after ${plugins.prettyMs(
+        `[${connectionId}] Timeout on incoming side from ${
-          this.settings.socketTimeout || 3600000
+          record.remoteIP
-        )}`
+        } after ${plugins.prettyMs(this.settings.socketTimeout || 3600000)}`
       );
       if (record.incomingTerminationReason === null) {
         record.incomingTerminationReason = 'timeout';
@@ -685,7 +712,9 @@ export class PortProxy {
       // For keep-alive connections, just log a warning instead of closing
       if (record.hasKeepAlive) {
         console.log(
-          `[${connectionId}] Timeout event on outgoing keep-alive connection from ${record.remoteIP} after ${plugins.prettyMs(
+          `[${connectionId}] Timeout event on outgoing keep-alive connection from ${
+            record.remoteIP
+          } after ${plugins.prettyMs(
             this.settings.socketTimeout || 3600000
           )}. Connection preserved.`
         );
@@ -695,9 +724,9 @@ export class PortProxy {
 
       // For non-keep-alive connections, proceed with normal cleanup
       console.log(
-        `[${connectionId}] Timeout on outgoing side from ${record.remoteIP} after ${plugins.prettyMs(
+        `[${connectionId}] Timeout on outgoing side from ${
-          this.settings.socketTimeout || 3600000
+          record.remoteIP
-        )}`
+        } after ${plugins.prettyMs(this.settings.socketTimeout || 3600000)}`
       );
       if (record.outgoingTerminationReason === null) {
         record.outgoingTerminationReason = 'timeout';
@@ -713,7 +742,9 @@ export class PortProxy {
       targetSocket.setTimeout(0);
 
       if (this.settings.enableDetailedLogging) {
-        console.log(`[${connectionId}] Disabled socket timeouts for immortal keep-alive connection`);
+        console.log(
+          `[${connectionId}] Disabled socket timeouts for immortal keep-alive connection`
+        );
       }
     } else {
       // Set normal timeouts for other connections
@@ -743,9 +774,7 @@ export class PortProxy {
         const combinedData = Buffer.concat(record.pendingData);
         targetSocket.write(combinedData, (err) => {
           if (err) {
-            console.log(
+            console.log(`[${connectionId}] Error writing pending data to target: ${err.message}`);
-              `[${connectionId}] Error writing pending data to target: ${err.message}`
-            );
             return this.initiateCleanupOnce(record, 'write_error');
           }
 
@@ -764,7 +793,9 @@ export class PortProxy {
                     ? ` (Port-based for domain: ${domainConfig.domains.join(', ')})`
                     : ''
                 }` +
-                ` TLS: ${record.isTLS ? 'Yes' : 'No'}, Keep-Alive: ${record.hasKeepAlive ? 'Yes' : 'No'}`
+                ` TLS: ${record.isTLS ? 'Yes' : 'No'}, Keep-Alive: ${
+                  record.hasKeepAlive ? 'Yes' : 'No'
+                }`
             );
           } else {
             console.log(
@@ -795,7 +826,9 @@ export class PortProxy {
                   ? ` (Port-based for domain: ${domainConfig.domains.join(', ')})`
                   : ''
               }` +
-              ` TLS: ${record.isTLS ? 'Yes' : 'No'}, Keep-Alive: ${record.hasKeepAlive ? 'Yes' : 'No'}`
+              ` TLS: ${record.isTLS ? 'Yes' : 'No'}, Keep-Alive: ${
+                record.hasKeepAlive ? 'Yes' : 'No'
+              }`
           );
         } else {
           console.log(
@@ -817,14 +850,66 @@ export class PortProxy {
 
       // Add the renegotiation listener for SNI validation
       if (serverName) {
+        // This listener will check for TLS renegotiation attempts
+        // Note: We don't need to explicitly forward the renegotiation packets
+        // since socket.pipe(targetSocket) is already set up earlier and handles that
         socket.on('data', (renegChunk: Buffer) => {
           if (renegChunk.length > 0 && renegChunk.readUInt8(0) === 22) {
             try {
               // Try to extract SNI from potential renegotiation
               const newSNI = extractSNI(renegChunk, this.settings.enableTlsDebugLogging);
+              
+              // IMPORTANT: If we can't extract an SNI from renegotiation, we MUST allow it through
+              // Otherwise valid renegotiations that don't explicitly repeat the SNI will break
+              if (newSNI === undefined) {
+                if (this.settings.enableDetailedLogging) {
+                  console.log(
+                    `[${connectionId}] Rehandshake detected without SNI, allowing it through.`
+                  );
+                }
+                // Let it pass through - this is critical for Chrome's TLS handling
+                return;
+              }
+              
+              // Check if the SNI has changed
               if (newSNI && newSNI !== record.lockedDomain) {
+                // Instead of immediately terminating, check if the new SNI would be allowed
+                // by the same ruleset that allowed the initial connection
+                const newDomainConfig = this.settings.domainConfigs.find((config) =>
+                  config.domains.some((d) => plugins.minimatch(newSNI, d))
+                );
+                
+                // If we found a matching domain config, check IP rules
+                if (newDomainConfig) {
+                  const effectiveAllowedIPs = [
+                    ...newDomainConfig.allowedIPs,
+                    ...(this.settings.defaultAllowedIPs || []),
+                  ];
+                  const effectiveBlockedIPs = [
+                    ...(newDomainConfig.blockedIPs || []),
+                    ...(this.settings.defaultBlockedIPs || []),
+                  ];
+                  
+                  // Check if the IP is allowed for the new domain
+                  if (isGlobIPAllowed(record.remoteIP, effectiveAllowedIPs, effectiveBlockedIPs)) {
+                    // Allow the domain switch - Chrome is reusing the connection for a different domain
+                    if (this.settings.enableDetailedLogging) {
+                      console.log(
+                        `[${connectionId}] Rehandshake with new SNI: ${newSNI} (previously ${record.lockedDomain}). ` +
+                        `New domain is allowed by rules, permitting connection reuse.`
+                      );
+                    }
+                    
+                    // Update the locked domain to the new domain
+                    record.lockedDomain = newSNI;
+                    return;
+                  }
+                }
+                
+                // If we get here, either no matching domain config was found or the IP is not allowed
                 console.log(
-                  `[${connectionId}] Rehandshake detected with different SNI: ${newSNI} vs locked ${record.lockedDomain}. Terminating connection.`
+                  `[${connectionId}] Rehandshake detected with different SNI: ${newSNI} vs locked ${record.lockedDomain}. ` +
+                  `New domain not allowed by rules. Terminating connection.`
                 );
                 this.initiateCleanupOnce(record, 'sni_mismatch');
               } else if (newSNI && this.settings.enableDetailedLogging) {
@@ -833,6 +918,8 @@ export class PortProxy {
                 );
               }
             } catch (err) {
+              // Always allow the renegotiation to continue if we encounter an error
+              // This ensures Chrome can complete its TLS renegotiation
               console.log(
                 `[${connectionId}] Error processing potential renegotiation: ${err}. Allowing connection to continue.`
               );
@@ -849,24 +936,29 @@ export class PortProxy {
       // For immortal keep-alive connections, skip setting a timeout completely
       if (record.hasKeepAlive && this.settings.keepAliveTreatment === 'immortal') {
         if (this.settings.enableDetailedLogging) {
-          console.log(`[${connectionId}] Keep-alive connection with immortal treatment - no max lifetime`);
+          console.log(
+            `[${connectionId}] Keep-alive connection with immortal treatment - no max lifetime`
+          );
         }
         // No cleanup timer for immortal connections
       }
-      // For TLS keep-alive connections, use a very extended timeout
+      // For TLS keep-alive connections, use a more generous timeout now that
+      // we've fixed the renegotiation handling issue that was causing certificate problems
       else if (record.hasKeepAlive && record.isTLS) {
-        // For TLS keep-alive connections, use a very extended timeout
+        // Use a longer timeout for TLS connections now that renegotiation handling is fixed
-        // This helps prevent certificate errors after sleep/wake cycles
+        // This reduces unnecessary reconnections while still ensuring certificate freshness
-        const tlsKeepAliveTimeout = 14 * 24 * 60 * 60 * 1000; // 14 days for TLS keep-alive
+        const tlsKeepAliveTimeout = 4 * 60 * 60 * 1000; // 4 hours for TLS keep-alive - increased from 30 minutes
         const safeTimeout = ensureSafeTimeout(tlsKeepAliveTimeout);
 
         record.cleanupTimer = setTimeout(() => {
           console.log(
-            `[${connectionId}] TLS keep-alive connection from ${record.remoteIP} exceeded extended lifetime (${plugins.prettyMs(
+            `[${connectionId}] TLS keep-alive connection from ${
+              record.remoteIP
+            } exceeded max lifetime (${plugins.prettyMs(
               tlsKeepAliveTimeout
-            )}), forcing cleanup.`
+            )}), forcing cleanup to refresh certificate context.`
           );
-          this.initiateCleanupOnce(record, 'tls_extended_lifetime');
+          this.initiateCleanupOnce(record, 'tls_certificate_refresh');
         }, safeTimeout);
 
         // Make sure timeout doesn't keep the process alive
@@ -875,7 +967,11 @@ export class PortProxy {
         }
 
         if (this.settings.enableDetailedLogging) {
-          console.log(`[${connectionId}] TLS keep-alive connection with enhanced protection, lifetime: ${plugins.prettyMs(tlsKeepAliveTimeout)}`);
+          console.log(
+            `[${connectionId}] TLS keep-alive connection with aggressive certificate refresh protection, lifetime: ${plugins.prettyMs(
+              tlsKeepAliveTimeout
+            )}`
+          );
         }
       }
       // For extended keep-alive connections, use extended timeout
@@ -885,9 +981,9 @@ export class PortProxy {
 
         record.cleanupTimer = setTimeout(() => {
           console.log(
-            `[${connectionId}] Keep-alive connection from ${record.remoteIP} exceeded extended lifetime (${plugins.prettyMs(
+            `[${connectionId}] Keep-alive connection from ${
-              extendedTimeout
+              record.remoteIP
-            )}), forcing cleanup.`
+            } exceeded extended lifetime (${plugins.prettyMs(extendedTimeout)}), forcing cleanup.`
           );
           this.initiateCleanupOnce(record, 'extended_lifetime');
         }, safeTimeout);
@@ -898,20 +994,25 @@ export class PortProxy {
         }
 
         if (this.settings.enableDetailedLogging) {
-          console.log(`[${connectionId}] Keep-alive connection with extended lifetime of ${plugins.prettyMs(extendedTimeout)}`);
+          console.log(
+            `[${connectionId}] Keep-alive connection with extended lifetime of ${plugins.prettyMs(
+              extendedTimeout
+            )}`
+          );
         }
       }
       // For standard connections, use normal timeout
       else {
         // Use domain-specific timeout if available, otherwise use default
-        const connectionTimeout = record.domainConfig?.connectionTimeout || this.settings.maxConnectionLifetime!;
+        const connectionTimeout =
+          record.domainConfig?.connectionTimeout || this.settings.maxConnectionLifetime!;
         const safeTimeout = ensureSafeTimeout(connectionTimeout);
 
         record.cleanupTimer = setTimeout(() => {
           console.log(
-            `[${connectionId}] Connection from ${record.remoteIP} exceeded max lifetime (${plugins.prettyMs(
+            `[${connectionId}] Connection from ${
-              connectionTimeout
+              record.remoteIP
-            )}), forcing cleanup.`
+            } exceeded max lifetime (${plugins.prettyMs(connectionTimeout)}), forcing cleanup.`
           );
           this.initiateCleanupOnce(record, 'connection_timeout');
         }, safeTimeout);
@@ -1010,13 +1111,50 @@ export class PortProxy {
         if (this.settings.enableDetailedLogging) {
           console.log(
             `[${record.id}] Detected possible system sleep for ${plugins.prettyMs(timeDiff)}. ` +
-            `Preserving keep-alive connection.`
+              `Handling keep-alive connection after long inactivity.`
           );
         }
 
-        // For keep-alive connections after sleep, we should refresh the TLS state if needed
+        // For TLS keep-alive connections after sleep/long inactivity, force close
+        // to make browser establish a new connection with fresh certificate context
         if (record.isTLS && record.tlsHandshakeComplete) {
-          this.refreshTlsStateAfterSleep(record);
+          // More generous timeout now that we've fixed the renegotiation handling
+          if (timeDiff > 2 * 60 * 60 * 1000) {
+            // If inactive for more than 2 hours (increased from 20 minutes)
+            console.log(
+              `[${record.id}] TLS connection inactive for ${plugins.prettyMs(timeDiff)}. ` +
+                `Closing to force new connection with fresh certificate.`
+            );
+            return this.initiateCleanupOnce(record, 'certificate_refresh_needed');
+          } else if (timeDiff > 30 * 60 * 1000) {
+            // For shorter but still significant inactivity (30+ minutes), refresh TLS state
+            console.log(
+              `[${record.id}] TLS connection inactive for ${plugins.prettyMs(timeDiff)}. ` +
+                `Refreshing TLS state.`
+            );
+            this.refreshTlsStateAfterSleep(record);
+            
+            // Add an additional check in 15 minutes if no activity
+            const refreshCheckId = record.id;
+            const refreshCheck = setTimeout(() => {
+              const currentRecord = this.connectionRecords.get(refreshCheckId);
+              if (currentRecord && Date.now() - currentRecord.lastActivity > 15 * 60 * 1000) {
+                console.log(
+                  `[${refreshCheckId}] No activity detected after TLS refresh. ` +
+                    `Closing connection to ensure certificate freshness.`
+                );
+                this.initiateCleanupOnce(currentRecord, 'tls_refresh_verification_failed');
+              }
+            }, 15 * 60 * 1000);
+            
+            // Make sure timeout doesn't keep the process alive
+            if (refreshCheck.unref) {
+              refreshCheck.unref();
+            }
+          } else {
+            // For shorter inactivity periods, try to refresh the TLS state normally
+            this.refreshTlsStateAfterSleep(record);
+          }
         }
 
         // Mark that we detected sleep
@@ -1046,7 +1184,21 @@ export class PortProxy {
     try {
       // For outgoing connections that might need to be refreshed
       if (record.outgoing && !record.outgoing.destroyed) {
-        // Send a zero-byte packet to test the connection
+        // Check how long this connection has been established
+        const connectionAge = Date.now() - record.incomingStartTime;
+        const hourInMs = 60 * 60 * 1000;
+
+        // For TLS browser connections, use a more generous timeout now that 
+        // we've fixed the renegotiation handling issues
+        if (record.isTLS && record.hasKeepAlive && connectionAge > 8 * hourInMs) { // 8 hours instead of 45 minutes
+          console.log(
+            `[${record.id}] Long-lived TLS connection (${plugins.prettyMs(connectionAge)}). ` +
+              `Closing to ensure proper certificate handling on browser reconnect in proxy chain.`
+          );
+          return this.initiateCleanupOnce(record, 'certificate_context_refresh');
+        }
+
+        // For newer connections, try to send a refresh packet
         record.outgoing.write(Buffer.alloc(0));
 
         if (this.settings.enableDetailedLogging) {
@@ -1056,8 +1208,9 @@ export class PortProxy {
     } catch (err) {
       console.log(`[${record.id}] Error refreshing TLS state: ${err}`);
 
-      // If we can't refresh, don't terminate - client will re-establish if needed
+      // If we hit an error, it's likely the connection is already broken
-      // Just log the issue but preserve the connection
+      // Force cleanup to ensure browser reconnects cleanly
+      return this.initiateCleanupOnce(record, 'tls_refresh_error');
     }
   }
 
@@ -1158,7 +1311,9 @@ export class PortProxy {
             ` Duration: ${plugins.prettyMs(
               duration
             )}, Bytes IN: ${bytesReceived}, OUT: ${bytesSent}, ` +
-            `TLS: ${record.isTLS ? 'Yes' : 'No'}, Keep-Alive: ${record.hasKeepAlive ? 'Yes' : 'No'}` +
+            `TLS: ${record.isTLS ? 'Yes' : 'No'}, Keep-Alive: ${
+              record.hasKeepAlive ? 'Yes' : 'No'
+            }` +
             `${record.usingNetworkProxy ? `, NetworkProxy: ${record.networkProxyIndex}` : ''}`
         );
       } else {
@@ -1190,7 +1345,10 @@ export class PortProxy {
       console.log(`[${record.id}] Connection cleanup initiated for ${record.remoteIP} (${reason})`);
     }
 
-    if (record.incomingTerminationReason === null || record.incomingTerminationReason === undefined) {
+    if (
+      record.incomingTerminationReason === null ||
+      record.incomingTerminationReason === undefined
+    ) {
       record.incomingTerminationReason = reason;
       this.incrementTerminationStat('incoming', reason);
     }
@@ -1347,7 +1505,7 @@ export class PortProxy {
         usingNetworkProxy: false,
 
         // Initialize sleep detection fields
-        possibleSystemSleep: false
+        possibleSystemSleep: false,
       };
 
       // Apply keep-alive settings if enabled
@@ -1368,7 +1526,9 @@ export class PortProxy {
           } catch (err) {
             // Ignore errors - these are optional enhancements
             if (this.settings.enableDetailedLogging) {
-              console.log(`[${connectionId}] Enhanced TCP keep-alive settings not supported: ${err}`);
+              console.log(
+                `[${connectionId}] Enhanced TCP keep-alive settings not supported: ${err}`
+              );
             }
           }
         }
@@ -1381,8 +1541,8 @@ export class PortProxy {
       if (this.settings.enableDetailedLogging) {
         console.log(
           `[${connectionId}] New connection from ${remoteIP} on port ${localPort}. ` +
-          `Keep-Alive: ${connectionRecord.hasKeepAlive ? 'Enabled' : 'Disabled'}. ` +
+            `Keep-Alive: ${connectionRecord.hasKeepAlive ? 'Enabled' : 'Disabled'}. ` +
-          `Active connections: ${this.connectionRecords.size}`
+            `Active connections: ${this.connectionRecords.size}`
         );
       } else {
         console.log(
@@ -1808,18 +1968,25 @@ export class PortProxy {
         }
 
         // Skip inactivity check if disabled or for immortal keep-alive connections
-        if (!this.settings.disableInactivityCheck && 
+        if (
-            !(record.hasKeepAlive && this.settings.keepAliveTreatment === 'immortal')) {
+          !this.settings.disableInactivityCheck &&
-          
+          !(record.hasKeepAlive && this.settings.keepAliveTreatment === 'immortal')
+        ) {
           const inactivityTime = now - record.lastActivity;
 
           // Special handling for TLS keep-alive connections
-          if (record.hasKeepAlive && record.isTLS && inactivityTime > this.settings.inactivityTimeout! / 2) {
+          if (
+            record.hasKeepAlive &&
+            record.isTLS &&
+            inactivityTime > this.settings.inactivityTimeout! / 2
+          ) {
             // For TLS keep-alive connections that are getting stale, try to refresh before closing
             if (!record.inactivityWarningIssued) {
               console.log(
-                `[${id}] TLS keep-alive connection from ${record.remoteIP} inactive for ${plugins.prettyMs(inactivityTime)}. ` +
+                `[${id}] TLS keep-alive connection from ${
-                `Attempting to preserve connection.`
+                  record.remoteIP
+                } inactive for ${plugins.prettyMs(inactivityTime)}. ` +
+                  `Attempting to preserve connection.`
               );
 
               // Set warning flag but give a much longer grace period for TLS connections
@@ -1827,7 +1994,7 @@ export class PortProxy {
 
               // For TLS connections, extend the last activity time considerably
               // This gives browsers more time to re-establish the connection properly
-              record.lastActivity = now - (this.settings.inactivityTimeout! / 3);
+              record.lastActivity = now - this.settings.inactivityTimeout! / 3;
 
               // Try to stimulate the connection with a probe packet
               if (record.outgoing && !record.outgoing.destroyed) {
@@ -1860,8 +2027,10 @@ export class PortProxy {
             // For keep-alive connections, issue a warning first
             if (record.hasKeepAlive && !record.inactivityWarningIssued) {
               console.log(
-                `[${id}] Warning: Keep-alive connection from ${record.remoteIP} inactive for ${plugins.prettyMs(inactivityTime)}. ` +
+                `[${id}] Warning: Keep-alive connection from ${
-                `Will close in 10 minutes if no activity.`
+                  record.remoteIP
+                } inactive for ${plugins.prettyMs(inactivityTime)}. ` +
+                  `Will close in 10 minutes if no activity.`
               );
 
               // Set warning flag and add grace period
@@ -1882,22 +2051,37 @@ export class PortProxy {
               }
             } else {
               // MODIFIED: For TLS connections, be more lenient before closing
+              // For TLS browser connections, we need to handle certificate context properly
               if (record.isTLS && record.hasKeepAlive) {
-                // For TLS keep-alive connections, add additional grace period
+                // For very long inactivity, it's better to close the connection
-                // This helps with browsers reconnecting after sleep
+                // so the browser establishes a new one with a fresh certificate context
-                console.log(
+                if (inactivityTime > 6 * 60 * 60 * 1000) {
-                  `[${id}] TLS keep-alive connection from ${record.remoteIP} inactive for ${plugins.prettyMs(inactivityTime)}. ` +
+                  // 6 hours
-                  `Adding extra grace period.`
+                  console.log(
-                );
+                    `[${id}] TLS keep-alive connection from ${
+                      record.remoteIP
+                    } inactive for ${plugins.prettyMs(inactivityTime)}. ` +
+                      `Closing to ensure proper certificate handling on browser reconnect.`
+                  );
+                  this.cleanupConnection(record, 'tls_certificate_refresh');
+                } else {
+                  // For shorter inactivity periods, add grace period
+                  console.log(
+                    `[${id}] TLS keep-alive connection from ${
+                      record.remoteIP
+                    } inactive for ${plugins.prettyMs(inactivityTime)}. ` +
+                      `Adding extra grace period.`
+                  );
 
-                // Give additional time for browsers to reconnect properly
+                  // Give additional time for browsers to reconnect properly
-                record.lastActivity = now - (effectiveTimeout / 2);
+                  record.lastActivity = now - effectiveTimeout / 2;
+                }
               } else {
                 // For non-keep-alive or after warning, close the connection
                 console.log(
                   `[${id}] Inactivity check: No activity on connection from ${record.remoteIP} ` +
-                  `for ${plugins.prettyMs(inactivityTime)}.` +
+                    `for ${plugins.prettyMs(inactivityTime)}.` +
-                  (record.hasKeepAlive ? ' Despite keep-alive being enabled.' : '')
+                    (record.hasKeepAlive ? ' Despite keep-alive being enabled.' : '')
                 );
                 this.cleanupConnection(record, 'inactivity');
               }
@@ -1905,7 +2089,9 @@ export class PortProxy {
           } else if (inactivityTime <= effectiveTimeout && record.inactivityWarningIssued) {
             // If activity detected after warning, clear the warning
             if (this.settings.enableDetailedLogging) {
-              console.log(`[${id}] Connection activity detected after inactivity warning, resetting warning`);
+              console.log(
+                `[${id}] Connection activity detected after inactivity warning, resetting warning`
+              );
             }
             record.inactivityWarningIssued = false;
           }