Invalidate cached client when TLS cert changes

api/profile/profile.go

@@ -177,7 +177,7 @@ func (p *Profile) TLSConfig() (*tls.Config, error) {
 
 // Expiry returns the credential expiry.
 func (p *Profile) Expiry() (time.Time, bool) {
-	certPEMBlock, err := os.ReadFile(p.TLSCertPath())
+	certPEMBlock, err := p.TLSCert()
 	if err != nil {
 		return time.Time{}, false
 	}
@@ -188,6 +188,12 @@ func (p *Profile) Expiry() (time.Time, bool) {
 	return cert.NotAfter, true
 }
 
+// TLSCert returns the profile's TLS certificate.
+func (p *Profile) TLSCert() ([]byte, error) {
+	certPEMBlock, err := os.ReadFile(p.TLSCertPath())
+	return certPEMBlock, trace.Wrap(err)
+}
+
 // RequireKubeLocalProxy returns true if this profile indicates a local proxy
 // is required for kube access.
 func (p *Profile) RequireKubeLocalProxy() bool {

lib/client/api.go

@@ -523,6 +523,9 @@ type Config struct {
 
 	// SSOHost is the host of the SSO provider used to log in.
 	SSOHost string
+
+	// Dir is the directory of the profile.
+	Dir string
 }
 
 // CachePolicy defines cache policy for local clients
@@ -953,6 +956,7 @@ func (c *Config) LoadProfile(proxyAddr string) error {
 	c.SAMLSingleLogoutEnabled = profile.SAMLSingleLogoutEnabled
 	c.SSHDialTimeout = profile.SSHDialTimeout
 	c.SSOHost = profile.SSOHost
+	c.Dir = profile.Dir
 
 	c.AuthenticatorAttachment, err = parseMFAMode(profile.MFAMode)
 	if err != nil {
@@ -1021,6 +1025,7 @@ func (c *Config) Profile() *profile.Profile {
 		SAMLSingleLogoutEnabled:       c.SAMLSingleLogoutEnabled,
 		SSHDialTimeout:                c.SSHDialTimeout,
 		SSOHost:                       c.SSOHost,
+		Dir:                           c.Dir,
 	}
 }
 

lib/client/clientcache/clientcache.go

@@ -17,6 +17,7 @@
 package clientcache
 
 import (
+	"bytes"
 	"context"
 	"log/slog"
 	"slices"
@@ -36,11 +37,30 @@ type Cache struct {
 	cfg Config
 	mu  sync.RWMutex
 	// clients keeps a mapping from key (profile name and leaf cluster name) to cluster client.
-	clients map[key]*client.ClusterClient
+	clients map[key]*clientWithCert
 	// group prevents duplicate requests to create clients for a given cluster.
 	group singleflight.Group
 }
 
+type clientWithCert struct {
+	// client is cluster client.
+	client *client.ClusterClient
+	// coreTLSCert is the cert used in TeleportClient.ConnectToCluster to create the client.
+	coreTLSCert []byte
+	// readCoreTLSCert reads a fresh cert from disk.
+	readCoreTLSCert func() ([]byte, error)
+}
+
+func (c *clientWithCert) isCoreTLSCertUnchanged() (bool, error) {
+	tlsCert, err := c.readCoreTLSCert()
+	if err != nil {
+		return false, trace.Wrap(err)
+	}
+
+	equal := bytes.Equal(c.coreTLSCert, tlsCert)
+	return equal, nil
+}
+
 // NewClientFunc is a function that will return a new [*client.TeleportClient] for a given profile and leaf
 // cluster. [leafClusterName] may be empty, in which case implementations should return a client for the root cluster.
 type NewClientFunc func(ctx context.Context, profileName, leafClusterName string) (*client.TeleportClient, error)
@@ -89,7 +109,7 @@ func New(c Config) (*Cache, error) {
 
 	return &Cache{
 		cfg:     c,
-		clients: make(map[key]*client.ClusterClient),
+		clients: make(map[key]*clientWithCert),
 	}, nil
 }
 
@@ -99,8 +119,19 @@ func (c *Cache) Get(ctx context.Context, profileName, leafClusterName string) (*
 	k := key{profile: profileName, leafCluster: leafClusterName}
 	groupClt, err, _ := c.group.Do(k.String(), func() (any, error) {
 		if fromCache := c.getFromCache(k); fromCache != nil {
-			c.cfg.Logger.DebugContext(ctx, "Retrieved client from cache", "cluster", k)
-			return fromCache, nil
+			unchanged, err := fromCache.isCoreTLSCertUnchanged()
+			if err != nil {
+				c.cfg.Logger.WarnContext(ctx, "Failed to validate TLS certificate, removing from cache", "cluster", k, "error", err)
+			} else if unchanged {
+				c.cfg.Logger.DebugContext(ctx, "Retrieved client from cache", "cluster", k)
+				return fromCache.client, nil
+			} else {
+				c.cfg.Logger.DebugContext(ctx, "TLS certificate for cached client has changed, removing from cache", "cluster", k)
+			}
+
+			if err := c.clearForKey(k); err != nil {
+				return nil, trace.Wrap(err)
+			}
 		}
 
 		tc, err := c.cfg.NewClientFunc(ctx, profileName, leafClusterName)
@@ -120,8 +151,17 @@ func (c *Cache) Get(ctx context.Context, profileName, leafClusterName string) (*
 			return nil, trace.Wrap(err)
 		}
 
+		keyRing, err := tc.LocalAgent().GetCoreKeyRing()
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+
 		// Save the client in the cache, so we don't have to build a new connection next time.
-		c.addToCache(k, newClient)
+		c.addToCache(k, &clientWithCert{
+			client:          newClient,
+			coreTLSCert:     keyRing.TLSCert,
+			readCoreTLSCert: tc.Profile().TLSCert,
+		})
 
 		c.cfg.Logger.InfoContext(ctx, "Added client to cache", "cluster", k)
 
@@ -151,7 +191,7 @@ func (c *Cache) ClearForRoot(profileName string) error {
 
 	for k, clt := range c.clients {
 		if k.profile == profileName {
-			if err := clt.Close(); err != nil {
+			if err := clt.client.Close(); err != nil {
 				errors = append(errors, err)
 			}
 			deleted = append(deleted, k.String())
@@ -175,7 +215,7 @@ func (c *Cache) Clear() error {
 
 	var errors []error
 	for _, clt := range c.clients {
-		if err := clt.Close(); err != nil {
+		if err := clt.client.Close(); err != nil {
 			errors = append(errors, err)
 		}
 	}
@@ -184,14 +224,28 @@ func (c *Cache) Clear() error {
 	return trace.NewAggregate(errors...)
 }
 
-func (c *Cache) addToCache(k key, clusterClient *client.ClusterClient) {
+func (c *Cache) clearForKey(k key) error {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	clt, ok := c.clients[k]
+	delete(c.clients, k)
+	if ok {
+		err := clt.client.Close()
+		return trace.Wrap(err)
+	}
+
+	return nil
+}
+
+func (c *Cache) addToCache(k key, cc *clientWithCert) {
 	c.mu.Lock()
 	defer c.mu.Unlock()
 
-	c.clients[k] = clusterClient
+	c.clients[k] = cc
 }
 
-func (c *Cache) getFromCache(k key) *client.ClusterClient {
+func (c *Cache) getFromCache(k key) *clientWithCert {
 	c.mu.RLock()
 	defer c.mu.RUnlock()
 

lib/teleterm/apiserver/handler/handler_auth.go

@@ -40,10 +40,6 @@ func (s *Handler) Login(ctx context.Context, req *api.LoginRequest) (*api.EmptyR
 		return nil, trace.BadParameter("cluster URI must be a root URI")
 	}
 
-	if err = s.DaemonService.ClearCachedClientsForRoot(cluster.URI); err != nil {
-		return nil, trace.Wrap(err)
-	}
-
 	if req.Params == nil {
 		return nil, trace.BadParameter("missing login parameters")
 	}
@@ -91,10 +87,6 @@ func (s *Handler) LoginPasswordless(stream api.TerminalService_LoginPasswordless
 	// daemon.Service.ResolveClusterURI.
 	clusterClient.MFAPromptConstructor = nil
 
-	if err := s.DaemonService.ClearCachedClientsForRoot(cluster.URI); err != nil {
-		return trace.Wrap(err)
-	}
-
 	// Start the prompt flow.
 	if err := cluster.PasswordlessLogin(stream.Context(), stream); err != nil {
 		return trace.Wrap(err)

lib/teleterm/daemon/daemon.go

@@ -885,8 +885,7 @@ func (s *Service) AssumeRole(ctx context.Context, req *api.AssumeRoleRequest) er
 		kubeGw.ClearCerts()
 	}
 
-	// We have to reconnect using the updated cert.
-	return trace.Wrap(s.ClearCachedClientsForRoot(cluster.URI))
+	return nil
 }
 
 // ListKubernetesResourcesRequest defines a request to retrieve kube resources paginated.

tool/tsh/common/vnet_client_application.go

@@ -32,7 +32,6 @@ import (
 	"github.com/gravitational/teleport/lib/client"
 	"github.com/gravitational/teleport/lib/client/clientcache"
 	libhwk "github.com/gravitational/teleport/lib/hardwarekey"
-	"github.com/gravitational/teleport/lib/utils"
 	"github.com/gravitational/teleport/lib/vnet"
 )
 
@@ -173,11 +172,6 @@ func (p *vnetClientApplication) getRootClusterCACertPoolPEM(ctx context.Context,
 }
 
 func (p *vnetClientApplication) retryWithRelogin(ctx context.Context, tc *client.TeleportClient, fn func() error, opts ...client.RetryWithReloginOption) error {
-	profileName, err := utils.Host(tc.WebProxyAddr)
-	if err != nil {
-		return trace.Wrap(err)
-	}
-
 	// Make sure the release the login mutex if we end up acquiring it.
 	didLock := false
 	defer func() {
@@ -200,9 +194,6 @@ func (p *vnetClientApplication) retryWithRelogin(ctx context.Context, tc *client
 			fmt.Printf("Login for cluster %s expired, attempting to log in again.\n", tc.SiteName)
 			return nil
 		}),
-		client.WithAfterLoginHook(func() error {
-			return trace.Wrap(p.clientCache.ClearForRoot(profileName), "clearing client cache after relogin")
-		}),
 		client.WithMakeCurrentProfile(false),
 	)
 	return client.RetryWithRelogin(ctx, tc, fn, opts...)