gatewayd: dependencies for TLS and secrets; test-only certificates

Implemented-By: OpenCode session (model recorded in docs/implementer-log.md)
2026-09-23 19:17:51 -07:00
parent 9fa8f0abed
commit 64b34f48d6
16 changed files with 405 additions and 5 deletions
@@ -0,0 +1,12 @@
+# TEST-ONLY TLS fixtures
+
+Generated once with `openssl` on 2026-09-23 for `gatewayd`'s TLS tests. Every key here is public
+and must never be trusted anywhere but these tests. The two CA private keys were deleted after
+signing; the server keys are kept because the test servers need them.
+
+- `test-ca.pem`: the CA the tests trust (through `ca_file`).
+- `server.pem`/`server.key`: `localhost` and `127.0.0.1`, signed by `test-ca`.
+- `wrong-name.pem`/`wrong-name.key`: `wrong.example` only, signed by `test-ca` (a name mismatch).
+- `other-ca.pem`, `other-server.pem`/`other-server.key`: a CA the tests do not trust.
+
+Valid for 100 years from 2026-09-23.