wire-mesh 3.3.0 → 3.5.0

package/README.md

@@ -34,14 +34,15 @@ Every flag the CLI accepts, exactly as `wire-mesh --help` prints it. An unknown
 Usage: wire-mesh [options]
 
 Options:
-      --bind <host:port>          Address to listen on. Port 0 asks the OS for a free port. Use 127.0.0.1:8787 to accept local connections only. (default: 0.0.0.0:8787)
-      --tls-cert <path>           PEM certificate file, to serve wss:// and https://. Requires --tls-key.
-      --tls-key <path>            PEM private key file for --tls-cert. Requires --tls-cert.
-      --mailbox-dir <path>        Directory to hold other devices' logs in while they are offline, which makes this node an announcer as well as a relay. Bounded by fixed limits. Off unless given.
-      --webtransport <host:port>  Also serve WebTransport on this UDP address, with a self-signed certificate renewed on a schedule that a browser accepts by pinning its hash, and print the address to give a console. Needs the optional @fails-components/webtransport dependency. Off unless given.
-      --state-dir <path>          Directory to keep the WebTransport certificates in, private keys included, so a restart serves the same certificates and the addresses already handed out stay valid. Created readable by this user only. Without it the certificates live in memory and a restart starts a new set. Needs --webtransport.
-  -h, --help                      Print this help and exit.
-  -v, --version                   Print the version and exit.
+      --bind <host:port>                Address to listen on. Port 0 asks the OS for a free port. Use 127.0.0.1:8787 to accept local connections only. (default: 0.0.0.0:8787)
+      --tls-cert <path>                 PEM certificate file, to serve wss:// and https://. Requires --tls-key.
+      --tls-key <path>                  PEM private key file for --tls-cert. Requires --tls-cert.
+      --mailbox-dir <path>              Directory to hold other devices' logs in while they are offline, which makes this node an announcer as well as a relay. Bounded by fixed limits. Off unless given.
+      --webtransport <host:port>        Also serve WebTransport on this UDP address, with a self-signed certificate renewed on a schedule that a browser accepts by pinning its hash, and print the address to give a console. Needs the optional @fails-components/webtransport dependency. Off unless given.
+      --state-dir <path>                Directory to keep the WebTransport certificates in, private keys included, so a restart serves the same certificates and the addresses already handed out stay valid. Created readable by this user only. Without it the certificates live in memory and a restart starts a new set. Needs --webtransport.
+      --certificate-lifetime <seconds>  How long each WebTransport certificate is valid, in seconds. The node rotates to the next certificate every half lifetime, ending the sessions open on the server it replaces, so a shorter lifetime rotates more often. At most the WebTransport limit for a pinned certificate, which is also the default. Needs --webtransport.
+  -h, --help                            Print this help and exit.
+  -v, --version                         Print the version and exit.
 ```
 
 **Default bind address is `0.0.0.0:8787`, not loopback.** Unlike a typical dev-server tool, whose loopback-only default assumes only the machine itself needs to reach it, this package's whole purpose is LAN reachability — a phone on the same network, a laptop in the next room. `--bind` overrides the address if you want to restrict it (loopback-only, a specific interface, a different port).
@@ -55,7 +56,7 @@ curl http://<host>:8787/health
 
 With `--webtransport <host:port>` the node also serves WebTransport on a UDP port, for a browser that has no way to trust a certificate for this node's LAN address. The node mints self-signed ECDSA certificates, each valid for under two weeks, and prints an address of the form `https://<host>:<port>#sha256=<hash>[,<hash>...]` for each address of this machine a client can reach (when bound to a wildcard, one per non-internal IPv4 address). Give one of them to a console (the Node field takes it as typed): a browser accepts the certificate whose hash matches any in the list, with no certificate authority and no internet.
 
-The list holds the certificate served now and the ones that will replace it. The node rotates to the next certificate every half lifetime, by replacing its WebTransport server, so open sessions on that server end and a console reconnects, and an address stays usable for about three of those periods after it was copied. Without `--state-dir` the certificates live in memory, so a restart starts a new set and every address already handed out stops working; with it the certificates, private keys included, are kept in that directory (created readable by this user only) and a restart resumes them. The server is the optional `@fails-components/webtransport` dependency with its native binary; where it is not installed the flag fails at startup rather than serving without it. The prebuilt binary needs glibc 2.38 or newer on Linux.
+The list holds the certificate served now and the ones that will replace it. The node rotates to the next certificate every half lifetime, by replacing its WebTransport server, so open sessions on that server end and a console reconnects, and an address stays usable for about three of those periods after it was copied, and a console that reconnects is told the current list by the node, so one that keeps reconnecting never needs a new address. Without `--state-dir` the certificates live in memory, so a restart starts a new set and every address already handed out stops working; with it the certificates, private keys included, are kept in that directory (created readable by this user only) and a restart resumes them. The server is the optional `@fails-components/webtransport` dependency with its native binary; where it is not installed the flag fails at startup rather than serving without it. The prebuilt binary needs glibc 2.38 or newer on Linux.
 
 With `--mailbox-dir` the node also serves the announcer role and `/health` says so (`"roles":["relay","announcer"]`). It then holds other devices' `core/data` logs in that directory while those devices are offline, so a peer that reconnects catches up from the node. Only the device that owns a log can write to it: the node takes a log's entries from the connection whose verified advert names that device and from no one else. Any client that has gossiped an advert can read a log. Entries are opaque bytes to the node, and the applications that write them sign and encrypt their own. The number of logs, the bytes in each and the size of an entry are bounded (`src/mailbox-limits.ts`), and a frame that would exceed a bound is refused whole; nothing is evicted, so a full log stays full until the directory is cleared.
 

package/dist/server.cjs

@@ -16,6 +16,12 @@ let wire_mesh_core_domain_pinned_address = require("wire-mesh-core/domain/pinned
 let wire_mesh_core_adapters_memory_storage = require("wire-mesh-core/adapters/memory-storage");
 require("reflect-metadata");
 let _peculiar_x509 = require("@peculiar/x509");
+//#region src/adapters/certificate-limits.ts
+const MILLISECONDS_PER_SECOND = 1e3;
+const MILLISECONDS_PER_DAY = 86400 * MILLISECONDS_PER_SECOND;
+/** Slack under the maximum, so clock skew between the node and a browser cannot push the certificate over the limit. */
+const PINNED_CERTIFICATE_LIFETIME_MS = 14 * MILLISECONDS_PER_DAY - 1 * MILLISECONDS_PER_DAY;
+//#endregion
 //#region src/cli-options.ts
 /** The address the server binds when --bind is not given. */
 const DEFAULT_BIND_ADDRESS = "0.0.0.0:8787";
@@ -53,6 +59,11 @@ const FLAGS = {
 		valueName: "path",
 		description: "Directory to keep the WebTransport certificates in, private keys included, so a restart serves the same certificates and the addresses already handed out stay valid. Created readable by this user only. Without it the certificates live in memory and a restart starts a new set. Needs --webtransport."
 	},
+	"certificate-lifetime": {
+		type: "string",
+		valueName: "seconds",
+		description: "How long each WebTransport certificate is valid, in seconds. The node rotates to the next certificate every half lifetime, ending the sessions open on the server it replaces, so a shorter lifetime rotates more often. At most the WebTransport limit for a pinned certificate, which is also the default. Needs --webtransport."
+	},
 	help: {
 		type: "boolean",
 		short: "h",
@@ -86,6 +97,12 @@ function helpText() {
 		...rows.map((row) => `  ${row.label.padEnd(labelWidth)}  ${row.description}`)
 	].join("\n");
 }
+function validatedCertificateLifetimeMs(seconds) {
+	if (seconds === void 0) return;
+	const lifetimeMs = Number(seconds) * MILLISECONDS_PER_SECOND;
+	if (!/^\d+$/.test(seconds) || lifetimeMs === 0 || lifetimeMs > 11232e5) throw new CliUsageError(`--certificate-lifetime expects a whole number of seconds from 1 to ${String(PINNED_CERTIFICATE_LIFETIME_MS / MILLISECONDS_PER_SECOND)}, got "${seconds}"`);
+	return lifetimeMs;
+}
 function validatedBindAddress(flag, address) {
 	const separator = address.lastIndexOf(":");
 	const host = address.slice(0, separator);
@@ -113,6 +130,7 @@ function parseCliArguments(argv) {
 	const keyPath = values["tls-key"];
 	if (certPath === void 0 !== (keyPath === void 0)) throw new CliUsageError("--tls-cert and --tls-key must be given together");
 	if (values["state-dir"] !== void 0 && values.webtransport === void 0) throw new CliUsageError("--state-dir needs --webtransport");
+	if (values["certificate-lifetime"] !== void 0 && values.webtransport === void 0) throw new CliUsageError("--certificate-lifetime needs --webtransport");
 	return {
 		kind: "serve",
 		bindAddress: validatedBindAddress("bind", values.bind),
@@ -122,7 +140,8 @@ function parseCliArguments(argv) {
 		},
 		mailboxDir: values["mailbox-dir"],
 		webTransportAddress: values.webtransport === void 0 ? void 0 : validatedBindAddress("webtransport", values.webtransport),
-		stateDir: values["state-dir"]
+		stateDir: values["state-dir"],
+		certificateLifetimeMs: validatedCertificateLifetimeMs(values["certificate-lifetime"])
 	};
 }
 //#endregion
@@ -136,13 +155,8 @@ const nodeMailboxLimits = {
 };
 //#endregion
 //#region src/adapters/pinned-certificate.ts
-const MILLISECONDS_PER_DAY = 864e5;
-const MAX_PINNED_CERTIFICATE_LIFETIME_DAYS = 14;
-const CLOCK_SKEW_ALLOWANCE_DAYS = 1;
 const SERIAL_NUMBER_BYTES = 16;
 const PEM_LINE_LENGTH = 64;
-/** Slack under the maximum, so clock skew between the node and a browser cannot push the certificate over the limit. */
-const PINNED_CERTIFICATE_LIFETIME_MS = MAX_PINNED_CERTIFICATE_LIFETIME_DAYS * MILLISECONDS_PER_DAY - CLOCK_SKEW_ALLOWANCE_DAYS * MILLISECONDS_PER_DAY;
 const SIGNING_ALGORITHM = {
 	name: "ECDSA",
 	namedCurve: "P-256",
@@ -247,6 +261,11 @@ async function advanceCertificateSchedule(storage, now, options = {}) {
 /** The path a client opens its WebTransport session on. */
 const WEBTRANSPORT_PATH = "/wire-mesh";
 const SECRET_BYTES = 32;
+/** How long to wait before trying a failed rotation again: the port may still be held by the server just stopped. */
+const ROTATION_RETRY_MS = 1e3;
+/** The application close code and reason sent when a certificate rotation ends a session; the code is arbitrary, and 0 is what a normal close carries. */
+const SESSION_CLOSE_CODE = 0;
+const ROTATION_CLOSE_REASON = "certificate rotated";
 const WILDCARD_HOSTS = ["0.0.0.0", "::"];
 /** The hosts a client can dial for a listener bound to `host`: the host itself, or for a wildcard every non-internal IPv4 address of this machine. */
 function reachableHosts(host) {
@@ -271,7 +290,7 @@ async function loadHttp3Server() {
 	}
 }
 function isIncomingSession(value) {
-	return typeof value === "object" && value !== null && "ready" in value && value.ready instanceof Promise && "incomingBidirectionalStreams" in value && value.incomingBidirectionalStreams instanceof ReadableStream;
+	return typeof value === "object" && value !== null && "ready" in value && value.ready instanceof Promise && "closed" in value && value.closed instanceof Promise && "close" in value && typeof value.close === "function" && "createUnidirectionalStream" in value && typeof value.createUnidirectionalStream === "function" && "incomingBidirectionalStreams" in value && value.incomingBidirectionalStreams instanceof ReadableStream;
 }
 /**
 * A WebTransport Transport: each session carries one connection, on the first bidirectional stream the client opens, framed as length-prefixed CBOR (core's byte-stream-connection). A server binds a UDP port and serves a self-signed ECDSA certificate it renews on a schedule, which a browser accepts by pinning its hash (`serverCertificateHashes`) with no certificate authority involved.
@@ -309,37 +328,77 @@ function createWebTransportTransport(options = {}) {
 				const bound = started.address();
 				if (bound === null) throw new Error("the WebTransport server bound no address");
 				port = bound.port;
+				const liveSessions = /* @__PURE__ */ new Set();
+				const drainState = { draining: false };
+				const endSession = (session) => {
+					session.close({
+						closeCode: SESSION_CLOSE_CODE,
+						reason: ROTATION_CLOSE_REASON
+					});
+				};
 				(async () => {
 					for await (const session of started.sessionStream(WEBTRANSPORT_PATH)) (async () => {
 						if (!isIncomingSession(session)) throw new Error("the WebTransport server yielded a malformed session");
 						await session.ready;
+						if (drainState.draining) {
+							endSession(session);
+							return;
+						}
+						liveSessions.add(session);
+						session.closed.catch(() => void 0).finally(() => {
+							liveSessions.delete(session);
+						});
+						const announcer = (await session.createUnidirectionalStream()).getWriter();
+						await announcer.write((0, wire_mesh_core_domain_pinned_address.encodeCertificateHashes)(schedule.advertised.map((certificate) => certificate.sha256Hex)));
+						await announcer.close();
 						const reader = session.incomingBidirectionalStreams.getReader();
 						const first = await reader.read();
 						reader.releaseLock();
 						if (!first.done) onConnection((0, wire_mesh_core_adapters_byte_stream_connection.connectionFromByteStream)(first.value));
 					})().catch(reportError);
 				})().catch(reportError);
-				return started;
+				return {
+					server: started,
+					drain: async () => {
+						drainState.draining = true;
+						const open = [...liveSessions];
+						for (const session of open) endSession(session);
+						await Promise.allSettled(open.map(async (session) => session.closed));
+					}
+				};
 			};
-			let server = await startServer();
+			let running = await startServer();
 			const advertise = () => reachableHosts(host).map((reachable) => (0, wire_mesh_core_domain_pinned_address.formatPinnedAddress)(`${reachable}:${String(port)}`, schedule.advertised.map((certificate) => certificate.sha256Hex)));
+			/** Drains and stops the running server, if there is one: cleared first, so a rotation that failed after this point is retried by starting a server rather than by retiring one that is already gone. */
+			const retire = async () => {
+				const current = running;
+				running = void 0;
+				if (current === void 0) return;
+				await current.drain();
+				current.server.stopServer();
+				await current.server.closed;
+			};
 			let rotation;
 			let closed = false;
-			const armRotation = () => {
+			const untilRotation = () => Math.max(schedule.rotatesAt.getTime() - now().getTime(), 0);
+			const armRotation = (delayMs) => {
 				rotation = setTimeout(() => {
 					(async () => {
 						schedule = await advanceCertificateSchedule(storage, now(), scheduleOptions);
-						server.stopServer();
-						await server.closed;
+						await retire();
 						if (closed) return;
-						server = await startServer();
+						running = await startServer();
 						options.onCertificateRenewed?.(advertise());
-						armRotation();
-					})().catch(reportError);
-				}, Math.max(schedule.rotatesAt.getTime() - now().getTime(), 0));
+					})().then(() => {
+						if (!closed) armRotation(untilRotation());
+					}, (error) => {
+						reportError(error);
+						if (!closed) armRotation(ROTATION_RETRY_MS);
+					});
+				}, delayMs);
 				rotation.unref();
 			};
-			armRotation();
+			armRotation(untilRotation());
 			return {
 				get address() {
 					return `${host}:${String(port)}`;
@@ -350,8 +409,7 @@ function createWebTransportTransport(options = {}) {
 				close: async () => {
 					closed = true;
 					clearTimeout(rotation);
-					server.stopServer();
-					await server.closed;
+					await retire();
 				},
 				unref: () => {
 					rotation?.unref();
@@ -495,6 +553,7 @@ async function main(argv) {
 			mode: STATE_DIR_MODE
 		});
 		const webTransport = await createWebTransportTransport({
+			...command.certificateLifetimeMs !== void 0 ? { certificateLifetimeMs: command.certificateLifetimeMs } : {},
 			...command.stateDir !== void 0 ? { storage: (0, wire_mesh_core_adapters_node_fs_storage.createNodeFsStorage)({ dir: command.stateDir }) } : {},
 			onError: (error) => {
 				logError(`wire-mesh: WebTransport: ${String(error)}`);

package/dist/server.mjs

@@ -11,10 +11,16 @@ import { createNodeFsStorage } from "wire-mesh-core/adapters/node-fs-storage";
 import { randomBytes } from "node:crypto";
 import { networkInterfaces } from "node:os";
 import { connectionFromByteStream } from "wire-mesh-core/adapters/byte-stream-connection";
-import { formatPinnedAddress } from "wire-mesh-core/domain/pinned-address";
+import { encodeCertificateHashes, formatPinnedAddress } from "wire-mesh-core/domain/pinned-address";
 import { createMemoryStorage } from "wire-mesh-core/adapters/memory-storage";
 import "reflect-metadata";
 import { BasicConstraintsExtension, ExtendedKeyUsage, ExtendedKeyUsageExtension, KeyUsageFlags, KeyUsagesExtension, X509CertificateGenerator } from "@peculiar/x509";
+//#region src/adapters/certificate-limits.ts
+const MILLISECONDS_PER_SECOND = 1e3;
+const MILLISECONDS_PER_DAY = 86400 * MILLISECONDS_PER_SECOND;
+/** Slack under the maximum, so clock skew between the node and a browser cannot push the certificate over the limit. */
+const PINNED_CERTIFICATE_LIFETIME_MS = 14 * MILLISECONDS_PER_DAY - 1 * MILLISECONDS_PER_DAY;
+//#endregion
 //#region src/cli-options.ts
 /** The address the server binds when --bind is not given. */
 const DEFAULT_BIND_ADDRESS = "0.0.0.0:8787";
@@ -52,6 +58,11 @@ const FLAGS = {
 		valueName: "path",
 		description: "Directory to keep the WebTransport certificates in, private keys included, so a restart serves the same certificates and the addresses already handed out stay valid. Created readable by this user only. Without it the certificates live in memory and a restart starts a new set. Needs --webtransport."
 	},
+	"certificate-lifetime": {
+		type: "string",
+		valueName: "seconds",
+		description: "How long each WebTransport certificate is valid, in seconds. The node rotates to the next certificate every half lifetime, ending the sessions open on the server it replaces, so a shorter lifetime rotates more often. At most the WebTransport limit for a pinned certificate, which is also the default. Needs --webtransport."
+	},
 	help: {
 		type: "boolean",
 		short: "h",
@@ -85,6 +96,12 @@ function helpText() {
 		...rows.map((row) => `  ${row.label.padEnd(labelWidth)}  ${row.description}`)
 	].join("\n");
 }
+function validatedCertificateLifetimeMs(seconds) {
+	if (seconds === void 0) return;
+	const lifetimeMs = Number(seconds) * MILLISECONDS_PER_SECOND;
+	if (!/^\d+$/.test(seconds) || lifetimeMs === 0 || lifetimeMs > 11232e5) throw new CliUsageError(`--certificate-lifetime expects a whole number of seconds from 1 to ${String(PINNED_CERTIFICATE_LIFETIME_MS / MILLISECONDS_PER_SECOND)}, got "${seconds}"`);
+	return lifetimeMs;
+}
 function validatedBindAddress(flag, address) {
 	const separator = address.lastIndexOf(":");
 	const host = address.slice(0, separator);
@@ -112,6 +129,7 @@ function parseCliArguments(argv) {
 	const keyPath = values["tls-key"];
 	if (certPath === void 0 !== (keyPath === void 0)) throw new CliUsageError("--tls-cert and --tls-key must be given together");
 	if (values["state-dir"] !== void 0 && values.webtransport === void 0) throw new CliUsageError("--state-dir needs --webtransport");
+	if (values["certificate-lifetime"] !== void 0 && values.webtransport === void 0) throw new CliUsageError("--certificate-lifetime needs --webtransport");
 	return {
 		kind: "serve",
 		bindAddress: validatedBindAddress("bind", values.bind),
@@ -121,7 +139,8 @@ function parseCliArguments(argv) {
 		},
 		mailboxDir: values["mailbox-dir"],
 		webTransportAddress: values.webtransport === void 0 ? void 0 : validatedBindAddress("webtransport", values.webtransport),
-		stateDir: values["state-dir"]
+		stateDir: values["state-dir"],
+		certificateLifetimeMs: validatedCertificateLifetimeMs(values["certificate-lifetime"])
 	};
 }
 //#endregion
@@ -135,13 +154,8 @@ const nodeMailboxLimits = {
 };
 //#endregion
 //#region src/adapters/pinned-certificate.ts
-const MILLISECONDS_PER_DAY = 864e5;
-const MAX_PINNED_CERTIFICATE_LIFETIME_DAYS = 14;
-const CLOCK_SKEW_ALLOWANCE_DAYS = 1;
 const SERIAL_NUMBER_BYTES = 16;
 const PEM_LINE_LENGTH = 64;
-/** Slack under the maximum, so clock skew between the node and a browser cannot push the certificate over the limit. */
-const PINNED_CERTIFICATE_LIFETIME_MS = MAX_PINNED_CERTIFICATE_LIFETIME_DAYS * MILLISECONDS_PER_DAY - CLOCK_SKEW_ALLOWANCE_DAYS * MILLISECONDS_PER_DAY;
 const SIGNING_ALGORITHM = {
 	name: "ECDSA",
 	namedCurve: "P-256",
@@ -246,6 +260,11 @@ async function advanceCertificateSchedule(storage, now, options = {}) {
 /** The path a client opens its WebTransport session on. */
 const WEBTRANSPORT_PATH = "/wire-mesh";
 const SECRET_BYTES = 32;
+/** How long to wait before trying a failed rotation again: the port may still be held by the server just stopped. */
+const ROTATION_RETRY_MS = 1e3;
+/** The application close code and reason sent when a certificate rotation ends a session; the code is arbitrary, and 0 is what a normal close carries. */
+const SESSION_CLOSE_CODE = 0;
+const ROTATION_CLOSE_REASON = "certificate rotated";
 const WILDCARD_HOSTS = ["0.0.0.0", "::"];
 /** The hosts a client can dial for a listener bound to `host`: the host itself, or for a wildcard every non-internal IPv4 address of this machine. */
 function reachableHosts(host) {
@@ -270,7 +289,7 @@ async function loadHttp3Server() {
 	}
 }
 function isIncomingSession(value) {
-	return typeof value === "object" && value !== null && "ready" in value && value.ready instanceof Promise && "incomingBidirectionalStreams" in value && value.incomingBidirectionalStreams instanceof ReadableStream;
+	return typeof value === "object" && value !== null && "ready" in value && value.ready instanceof Promise && "closed" in value && value.closed instanceof Promise && "close" in value && typeof value.close === "function" && "createUnidirectionalStream" in value && typeof value.createUnidirectionalStream === "function" && "incomingBidirectionalStreams" in value && value.incomingBidirectionalStreams instanceof ReadableStream;
 }
 /**
 * A WebTransport Transport: each session carries one connection, on the first bidirectional stream the client opens, framed as length-prefixed CBOR (core's byte-stream-connection). A server binds a UDP port and serves a self-signed ECDSA certificate it renews on a schedule, which a browser accepts by pinning its hash (`serverCertificateHashes`) with no certificate authority involved.
@@ -308,37 +327,77 @@ function createWebTransportTransport(options = {}) {
 				const bound = started.address();
 				if (bound === null) throw new Error("the WebTransport server bound no address");
 				port = bound.port;
+				const liveSessions = /* @__PURE__ */ new Set();
+				const drainState = { draining: false };
+				const endSession = (session) => {
+					session.close({
+						closeCode: SESSION_CLOSE_CODE,
+						reason: ROTATION_CLOSE_REASON
+					});
+				};
 				(async () => {
 					for await (const session of started.sessionStream(WEBTRANSPORT_PATH)) (async () => {
 						if (!isIncomingSession(session)) throw new Error("the WebTransport server yielded a malformed session");
 						await session.ready;
+						if (drainState.draining) {
+							endSession(session);
+							return;
+						}
+						liveSessions.add(session);
+						session.closed.catch(() => void 0).finally(() => {
+							liveSessions.delete(session);
+						});
+						const announcer = (await session.createUnidirectionalStream()).getWriter();
+						await announcer.write(encodeCertificateHashes(schedule.advertised.map((certificate) => certificate.sha256Hex)));
+						await announcer.close();
 						const reader = session.incomingBidirectionalStreams.getReader();
 						const first = await reader.read();
 						reader.releaseLock();
 						if (!first.done) onConnection(connectionFromByteStream(first.value));
 					})().catch(reportError);
 				})().catch(reportError);
-				return started;
+				return {
+					server: started,
+					drain: async () => {
+						drainState.draining = true;
+						const open = [...liveSessions];
+						for (const session of open) endSession(session);
+						await Promise.allSettled(open.map(async (session) => session.closed));
+					}
+				};
 			};
-			let server = await startServer();
+			let running = await startServer();
 			const advertise = () => reachableHosts(host).map((reachable) => formatPinnedAddress(`${reachable}:${String(port)}`, schedule.advertised.map((certificate) => certificate.sha256Hex)));
+			/** Drains and stops the running server, if there is one: cleared first, so a rotation that failed after this point is retried by starting a server rather than by retiring one that is already gone. */
+			const retire = async () => {
+				const current = running;
+				running = void 0;
+				if (current === void 0) return;
+				await current.drain();
+				current.server.stopServer();
+				await current.server.closed;
+			};
 			let rotation;
 			let closed = false;
-			const armRotation = () => {
+			const untilRotation = () => Math.max(schedule.rotatesAt.getTime() - now().getTime(), 0);
+			const armRotation = (delayMs) => {
 				rotation = setTimeout(() => {
 					(async () => {
 						schedule = await advanceCertificateSchedule(storage, now(), scheduleOptions);
-						server.stopServer();
-						await server.closed;
+						await retire();
 						if (closed) return;
-						server = await startServer();
+						running = await startServer();
 						options.onCertificateRenewed?.(advertise());
-						armRotation();
-					})().catch(reportError);
-				}, Math.max(schedule.rotatesAt.getTime() - now().getTime(), 0));
+					})().then(() => {
+						if (!closed) armRotation(untilRotation());
+					}, (error) => {
+						reportError(error);
+						if (!closed) armRotation(ROTATION_RETRY_MS);
+					});
+				}, delayMs);
 				rotation.unref();
 			};
-			armRotation();
+			armRotation(untilRotation());
 			return {
 				get address() {
 					return `${host}:${String(port)}`;
@@ -349,8 +408,7 @@ function createWebTransportTransport(options = {}) {
 				close: async () => {
 					closed = true;
 					clearTimeout(rotation);
-					server.stopServer();
-					await server.closed;
+					await retire();
 				},
 				unref: () => {
 					rotation?.unref();
@@ -494,6 +552,7 @@ async function main(argv) {
 			mode: STATE_DIR_MODE
 		});
 		const webTransport = await createWebTransportTransport({
+			...command.certificateLifetimeMs !== void 0 ? { certificateLifetimeMs: command.certificateLifetimeMs } : {},
 			...command.stateDir !== void 0 ? { storage: createNodeFsStorage({ dir: command.stateDir }) } : {},
 			onError: (error) => {
 				logError(`wire-mesh: WebTransport: ${String(error)}`);