# Test fixtures

`self_signed_cert.pem`/`self_signed_key.pem` and
`self_signed_cert2.pem`/`self_signed_key2.pem` are **test fixtures**. The
private keys are **intentionally committed** to this public repository. They
are not secrets and must never protect anything real.

Properties:

- EC P-256 (`prime256v1`), SHA-256 signature
- Subject `CN=localhost`
- SAN `DNS:localhost`, `IP:127.0.0.1`
- Validity 36500 days from generation

The loopback TLS test in `src/platform/tls_server.zig` uses the first pair.
The second pair exists so certificate-reload tests can swap between two valid
identities (milestone-10 ruling 13). Nothing in the shipped binary reads
either.

Regenerate with (substitute `2` in both file names for the second pair):

```sh
openssl ecparam -name prime256v1 -genkey -noout -out self_signed_key.pem
openssl req -new -x509 -key self_signed_key.pem -out self_signed_cert.pem \
    -days 36500 -sha256 -subj "/CN=localhost" \
    -addext "subjectAltName=DNS:localhost,IP:127.0.0.1"
```

`mismatched_key.pem` is a second EC P-256 key with no certificate. It parses,
but it does not belong to `self_signed_cert.pem`, so `ServerContext.init` must
reject the pair with `error.KeyMismatch`. It is not a secret either.

Regenerate with:

```sh
openssl ecparam -name prime256v1 -genkey -noout -out mismatched_key.pem
```