From bcaf0bca964dcac70132ece310eebca0f21ebc36 Mon Sep 17 00:00:00 2001
From: Frank Denis <github@pureftpd.org>
Date: Fri, 18 Oct 2019 20:30:41 +0200
Subject: [PATCH] proxy.certIgnoreTimestamp should only be downgradable

---
 dnscrypt-proxy/proxy.go | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/dnscrypt-proxy/proxy.go b/dnscrypt-proxy/proxy.go
index 3782eb55..292ef926 100644
--- a/dnscrypt-proxy/proxy.go
+++ b/dnscrypt-proxy/proxy.go
@@ -157,7 +157,9 @@ func (proxy *Proxy) StartProxy() {
 		dlog.Fatal(err)
 	}
 	liveServers, err := proxy.serversInfo.refresh(proxy)
-	proxy.certIgnoreTimestamp = !(liveServers > 0)
+	if liveServers > 0 {
+		proxy.certIgnoreTimestamp = false
+	}
 	if proxy.showCerts {
 		os.Exit(0)
 	}
@@ -180,7 +182,9 @@ func (proxy *Proxy) StartProxy() {
 				}
 				clocksmith.Sleep(delay)
 				liveServers, _ = proxy.serversInfo.refresh(proxy)
-				proxy.certIgnoreTimestamp = !(liveServers > 0)
+				if liveServers > 0 {
+					proxy.certIgnoreTimestamp = false
+				}
 			}
 		}()
 	}