# TEST-ONLY TLS fixtures

Generated once with `openssl` on 2026-09-23 for `gatewayd`'s TLS tests. Every key here is public
and must never be trusted anywhere but these tests. The two CA private keys were deleted after
signing; the server keys are kept because the test servers need them.

- `test-ca.pem`: the CA the tests trust (through `ca_file`).
- `server.pem`/`server.key`: `localhost` and `127.0.0.1`, signed by `test-ca`.
- `wrong-name.pem`/`wrong-name.key`: `wrong.example` only, signed by `test-ca` (a name mismatch).
- `other-ca.pem`, `other-server.pem`/`other-server.key`: a CA the tests do not trust.

Valid for 100 years from 2026-09-23.