Fixture certificates

Minted ONCE with the openssl recipe below (see san.cnf) and committed with a 100-year validity so the differential lanes never depend on a system trust store or re-minting. ca.pem signs localhost.pem (SAN: DNS:localhost, IP:127.0.0.1, IP:::1); ca2.pem is a deliberately WRONG trust anchor for negative cases; selfsigned.pem is a self-signed localhost leaf for the "self-signed certificate" error shapes. All keys are throwaway P-256 test material — nothing here is a secret.

openssl ecparam -genkey -name prime256v1 -noout -out ca-key.pem
openssl req -new -x509 -key ca-key.pem -out ca.pem -days 36500 -subj "/CN=scriptc test CA" -config san.cnf -extensions caext
openssl ecparam -genkey -name prime256v1 -noout -out localhost-key.pem
openssl req -new -key localhost-key.pem -out leaf.csr -subj "/CN=localhost" -config san.cnf
openssl x509 -req -in leaf.csr -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out localhost.pem -days 36500 -extfile san.cnf -extensions ext
openssl ecparam -genkey -name prime256v1 -noout -out selfsigned-key.pem
openssl req -new -x509 -key selfsigned-key.pem -out selfsigned.pem -days 36500 -subj "/CN=localhost" -config san.cnf -extensions ext

(ca2 repeats the ca recipe with its own key and CN.)

alt.pem/alt-key.pem (the SNI fixtures' second identity: CN=alt.localhost, SAN DNS:alt.localhost) repeats the leaf recipe against the same ca.pem, with an ext section whose subjectAltName is DNS:alt.localhost.