fix: NTP syncs as soon as DHCP has a lease, random origin cookie instead of the unsynced local clock, TLS validates certificates against UTC

programs/lib/tls/tls.cpp

@@ -196,17 +196,12 @@ void free_trust_anchors(TrustAnchors* tas) {
 }
 
 void get_bearssl_time(uint32_t* days, uint32_t* seconds) {
-    montauk::abi::DateTime dt;
-    montauk::gettime(&dt);
-    int y = dt.Year, m = dt.Month, d = dt.Day;
-    uint32_t total = 365u * (uint32_t)y
-        + (uint32_t)((y+3)/4) - (uint32_t)((y+99)/100) + (uint32_t)((y+399)/400);
-    const int md[] = {0,31,28,31,30,31,30,31,31,30,31,30,31};
-    for (int mo = 1; mo < m && mo <= 12; mo++) total += md[mo];
-    if (y%4==0 && (y%100!=0 || y%400==0) && m > 2) total++;
-    total += d - 1;
-    *days = total;
-    *seconds = (uint32_t)(dt.Hour*3600 + dt.Minute*60 + dt.Second);
+    // Certificate validity is UTC; BearSSL counts days from 0000-01-01,
+    // and 1970-01-01 is day 719528.
+    int64_t t = montauk::get_unix_time();
+    if (t < 0) t = 0;
+    *days = 719528u + (uint32_t)(t / 86400);
+    *seconds = (uint32_t)(t % 86400);
 }
 
 int tls_send_all(int fd, const unsigned char* data, size_t len) {