fix: restore duplicate SKI validation fallback

Author: danielewood

RALPH.md

@@ -238,3 +238,10 @@ Area: [cmd/certkit/tree.go](cmd/certkit/tree.go), [cmd/certkit/cli_semantics_tes
 Summary: the default `tree` output included every local and inherited flag, which made the command map harder to scan than a command-focused tree.
 Source: User feedback
 Fix: `tree` now defaults to commands-only text output, with `--flags` and `--inherited` opt-ins for text-mode flag detail; JSON output remains the detailed machine-readable surface
+
+34. `validate-duplicate-ski-fallback`
+Status: fixed
+Area: [internal/certstore/validate.go](internal/certstore/validate.go), [internal/certstore/validate_test.go](internal/certstore/validate_test.go)
+Summary: validation errored on duplicate-SKI renewal sets even though the rest of the store/UI already presents one latest-expiring certificate per SKI.
+Source: Follow-up PR review
+Fix: `RunValidation()` now uses the store's latest-cert selection for a given SKI, and the regression test proves the later renewal is the record that gets validated

internal/certstore/validate.go

@@ -16,7 +16,6 @@ import (
 )
 
 var errValidationCertNotFound = errors.New("certificate with SKI not found")
-var errValidationCertAmbiguous = errors.New("multiple certificates share SKI")
 
 // ValidationResult holds the outcome of validating a single certificate.
 type ValidationResult struct {
@@ -46,14 +45,10 @@ func RunValidation(ctx context.Context, input RunValidationInput) (*ValidationRe
 	skiHex := strings.ReplaceAll(input.SKIColon, ":", "")
 	skiHex = strings.ToLower(skiHex)
 
-	certs := input.Store.CertsForSKI(skiHex)
-	if len(certs) == 0 {
+	rec := input.Store.GetCert(skiHex)
+	if rec == nil {
 		return nil, fmt.Errorf("%w: %s", errValidationCertNotFound, input.SKIColon)
 	}
-	if len(certs) > 1 {
-		return nil, fmt.Errorf("%w: %s", errValidationCertAmbiguous, input.SKIColon)
-	}
-	rec := certs[0]
 
 	leaf := rec.Cert
 	now := time.Now()

internal/certstore/validate_test.go

@@ -488,7 +488,7 @@ func TestRunValidation(t *testing.T) {
 					Subject:      pkix.Name{CommonName: "renewal-two.example.com"},
 					DNSNames:     []string{"renewal-two.example.com"},
 					NotBefore:    time.Now().Add(-time.Hour),
-					NotAfter:     time.Now().Add(365 * 24 * time.Hour),
+					NotAfter:     time.Now().Add(366 * 24 * time.Hour),
 					KeyUsage:     x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment,
 					ExtKeyUsage:  []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
 				}
@@ -516,8 +516,15 @@ func TestRunValidation(t *testing.T) {
 				}
 				return store, skiToColonHex(t, hexSKI)
 			},
-			wantErr:     true,
-			errContains: "multiple certificates share SKI",
+			validate: func(t *testing.T, result *ValidationResult) {
+				t.Helper()
+				if result.Subject != "renewal-two.example.com" {
+					t.Fatalf("Subject = %q, want renewal-two.example.com", result.Subject)
+				}
+				if result.NotAfter == "" {
+					t.Fatal("NotAfter should not be empty")
+				}
+			},
 		},
 	}