milestone 10: doh and dot listeners, cert store with hot reload and cert reload api

tests/fixtures/README.md

@@ -1,8 +1,9 @@
 # Test fixtures
 
-`self_signed_cert.pem` and `self_signed_key.pem` are a **test fixture**. The
-private key is **intentionally committed** to this public repository. It is not
-a secret and it must never protect anything real.
+`self_signed_cert.pem`/`self_signed_key.pem` and
+`self_signed_cert2.pem`/`self_signed_key2.pem` are **test fixtures**. The
+private keys are **intentionally committed** to this public repository. They
+are not secrets and must never protect anything real.
 
 Properties:
 
@@ -11,10 +12,12 @@ Properties:
 - SAN `DNS:localhost`, `IP:127.0.0.1`
 - Validity 36500 days from generation
 
-The loopback TLS test in `src/platform/tls_server.zig` uses this pair. Nothing
-in the shipped binary reads it.
+The loopback TLS test in `src/platform/tls_server.zig` uses the first pair.
+The second pair exists so certificate-reload tests can swap between two valid
+identities (milestone-10 ruling 13). Nothing in the shipped binary reads
+either.
 
-Regenerate with:
+Regenerate with (substitute `2` in both file names for the second pair):
 
 ```sh
 openssl ecparam -name prime256v1 -genkey -noout -out self_signed_key.pem

tests/fixtures/fixtures.zig

@@ -7,3 +7,8 @@ pub const key_pem: [:0]const u8 = @embedFile("self_signed_key.pem");
 
 /// A well-formed private key that does not belong to `cert_pem`.
 pub const mismatched_key_pem: [:0]const u8 = @embedFile("mismatched_key.pem");
+
+/// A second, distinct self-signed pair (same profile as the first) so
+/// certificate-reload tests can swap between two valid identities.
+pub const cert2_pem: [:0]const u8 = @embedFile("self_signed_cert2.pem");
+pub const key2_pem: [:0]const u8 = @embedFile("self_signed_key2.pem");

tests/fixtures/self_signed_cert2.pem

@@ -0,0 +1,11 @@
+-----BEGIN CERTIFICATE-----
+MIIBmzCCAUGgAwIBAgIUQVvG0NCXCIgdQCFyQuJSfoFakSowCgYIKoZIzj0EAwIw
+FDESMBAGA1UEAwwJbG9jYWxob3N0MCAXDTI2MDgwMjExNDUzNVoYDzIxMjYwNzA5
+MTE0NTM1WjAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwWTATBgcqhkjOPQIBBggqhkjO
+PQMBBwNCAATRtQJUpAMiTlq/p7iVf9i3OimwlQWDfQF+5JukzaXEcUmdgWbEFwMu
+VvOj7QN3FIbBpSmksjtUpciK5CAn/tjoo28wbTAdBgNVHQ4EFgQUlZqpXrKmHgPn
+k9j8CxQ82XlbKQUwHwYDVR0jBBgwFoAUlZqpXrKmHgPnk9j8CxQ82XlbKQUwDwYD
+VR0TAQH/BAUwAwEB/zAaBgNVHREEEzARgglsb2NhbGhvc3SHBH8AAAEwCgYIKoZI
+zj0EAwIDSAAwRQIgLzOraDY3rbREZyvuEeuJgycajvL+0xQPYcF9Ukki3t0CIQCI
+YGtP3cBvclkBk1ASnFIO36HHLNtdgTnBRq4X0HkVKA==
+-----END CERTIFICATE-----

tests/fixtures/self_signed_key2.pem

@@ -0,0 +1,5 @@
+-----BEGIN EC PRIVATE KEY-----
+MHcCAQEEIDDLqib/NiyAJF4nBScYQf1lyAb4aAJmIbQqufbiKib7oAoGCCqGSM49
+AwEHoUQDQgAE0bUCVKQDIk5av6e4lX/YtzopsJUFg30BfuSbpM2lxHFJnYFmxBcD
+Llbzo+0DdxSGwaUppLI7VKXIiuQgJ/7Y6A==
+-----END EC PRIVATE KEY-----