self_signed_cert.pem/self_signed_key.pem and self_signed_cert2.pem/self_signed_key2.pem are test fixtures. The private keys are intentionally committed to this public repository. They are not secrets and must never protect anything real.

Properties:

EC P-256 (prime256v1), SHA-256 signature
Subject CN=localhost
SAN DNS:localhost, IP:127.0.0.1
Validity 36500 days from generation

The loopback TLS test in src/platform/tls_server.zig uses the first pair. The second pair exists so certificate-reload tests can swap between two valid identities (milestone-10 ruling 13). Nothing in the shipped binary reads either.

Regenerate with (substitute 2 in both file names for the second pair):

openssl ecparam -name prime256v1 -genkey -noout -out self_signed_key.pem
openssl req -new -x509 -key self_signed_key.pem -out self_signed_cert.pem \
    -days 36500 -sha256 -subj "/CN=localhost" \
    -addext "subjectAltName=DNS:localhost,IP:127.0.0.1"

mismatched_key.pem is a second EC P-256 key with no certificate. It parses, but it does not belong to self_signed_cert.pem, so ServerContext.init must reject the pair with error.KeyMismatch. It is not a secret either.

Regenerate with:

openssl ecparam -name prime256v1 -genkey -noout -out mismatched_key.pem