Preserve generated keys across keybox rotation

Only invalidate patched cert chains when keybox changes. Generated key material is independent and survives rotation.
2026-02-06 00:07:46 +01:00
parent fa28e9fc71
commit ce0ca18d98
1 changed files with 2 additions and 2 deletions
@@ -318,10 +318,10 @@ object ConfigurationManager {
                        )
                        KeyBoxManager.invalidateCache(path)
                        if (Build.VERSION.SDK_INT > Build.VERSION_CODES.R) {
-                            // Clear cached keys possibly containing old certificates
+                            // Patched chains are stale; generated keys survive rotation
                            org.matrix.TEESimulator.interception.keystore.shim
                                .KeyMintSecurityLevelInterceptor
-                                .clearAllGeneratedKeys("updating $file")
+                                .invalidatePatchedChains("keybox change: $path")
                        }
                    }
            }