Regenerate testdata and adapt tests for golang 1.24+

api/testdata/build_certs.sh

@@ -0,0 +1,165 @@
+#!/bin/bash
+# build_certs.sh -- regenerate api/testdata/ certificates
+#
+# Run from the repository root:
+#   bash api/testdata/build_certs.sh
+#
+# Requires: openssl (3.x recommended, also works with LibreSSL)
+#
+# Files regenerated:
+#   ca-bundle.pem   root CA (CFSSL_TEST_CA, RSA-2048, SHA-256, 10yr)
+#   ca_key.pem      private key for ca-bundle.pem / ca.pem
+#   int-bundle.pem  intermediate CA signed by ca-bundle.pem (RSA-2048, SHA-256, 10yr)
+#   leaf.pem        leaf cert signed by int-bundle (RSA-2048, SHA-256, 10yr)
+#   leaf.key        private key for leaf.pem
+#   leaf.badkey     a valid RSA-2048 key that does NOT match leaf.pem (for error-path tests)
+#   ca.pem          secondary root (CFSSL TEST Root CA, RSA-2048, SHA-256, 10yr)
+#   cert.pem        self-signed cert (Acme Co / 127.0.0.1, RSA-2048, SHA-256, 10yr)
+#
+# Files left untouched:
+#   ca2.pem         (ECDSA-SHA256 root, used by separate ca2 tests)
+#   ca2-key.pem     (private key for ca2.pem)
+#   csr.pem         (CSR, not a certificate)
+#   broken_csr.pem  (intentionally malformed, must stay broken)
+#   broken.pem      (intentionally malformed, must stay broken)
+#
+# Chain produced:
+#   ca-bundle.pem  (root, self-signed)
+#     └─ int-bundle.pem  (intermediate, pathlen:1)
+#          └─ leaf.pem   (leaf, SAN=cfssl-leaf.com)
+
+set -e
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+TESTDATA="${SCRIPT_DIR}"
+cd "$TESTDATA"
+
+echo "=== Regenerating api/testdata certificates ==="
+echo "    Output directory: $TESTDATA"
+echo ""
+
+# Detect whether openssl genrsa supports -traditional (OpenSSL 3.x)
+if openssl genrsa -traditional -out /dev/null 2048 >/dev/null 2>&1; then
+    RSA_TRADITIONAL="-traditional"
+else
+    RSA_TRADITIONAL=""
+fi
+
+# ── 1. ca-bundle.pem + shared ca_key.pem ────────────────────────────────────
+# Root CA for the main chain. DN preserved from original file.
+# ca_key.pem is reused as the key for ca.pem (secondary root) below.
+echo "--- ca-bundle.pem (root CA: CFSSL_TEST_CA, RSA-2048, SHA-256) ---"
+openssl genrsa $RSA_TRADITIONAL -out ca_key.pem 2048 2>/dev/null
+
+openssl req -new -x509 -key ca_key.pem -out ca-bundle.pem \
+    -days 3650 -sha256 \
+    -subj "/C=US/ST=California/L=San Francisco/O=CloudFlare/OU=DEV_TESTING/CN=CFSSL_TEST_CA" \
+    -addext "basicConstraints=critical,CA:TRUE" \
+    -addext "keyUsage=critical,keyCertSign,cRLSign" \
+    -addext "subjectKeyIdentifier=hash" 2>/dev/null
+openssl x509 -noout -subject -enddate -in ca-bundle.pem | sed 's/^/  /'
+
+# ── 2. int-bundle.pem ───────────────────────────────────────────────────────
+# Intermediate CA signed by ca-bundle.pem. DN preserved from original file.
+echo ""
+echo "--- int-bundle.pem (intermediate: cloudflare-inter.com, RSA-2048, SHA-256) ---"
+openssl genrsa $RSA_TRADITIONAL -out inter.key 2048 2>/dev/null
+
+INTER_EXT=$(mktemp /tmp/api_inter_XXXXXX.ext)
+cat > "$INTER_EXT" << 'EXTEOF'
+basicConstraints=critical,CA:TRUE,pathlen:1
+keyUsage=critical,keyCertSign
+subjectKeyIdentifier=hash
+authorityKeyIdentifier=keyid:always
+EXTEOF
+
+openssl req -new -key inter.key -out inter.csr \
+    -subj "/C=US/ST=California/L=San Francisco/O=CloudFlare/OU=Systems Engineering/CN=cloudflare-inter.com" \
+    2>/dev/null
+
+openssl x509 -req -in inter.csr -CA ca-bundle.pem -CAkey ca_key.pem \
+    -CAcreateserial -out int-bundle.pem \
+    -days 3650 -sha256 -extfile "$INTER_EXT" 2>/dev/null
+
+rm -f "$INTER_EXT" inter.csr ca-bundle.srl
+openssl x509 -noout -subject -issuer -enddate -in int-bundle.pem | sed 's/^/  /'
+
+# ── 3. leaf.pem + leaf.key ──────────────────────────────────────────────────
+# Leaf cert signed by int-bundle.pem. DN and SAN preserved from original file.
+echo ""
+echo "--- leaf.pem (leaf: cloudflare-leaf.com, RSA-2048, SHA-256, SAN=cfssl-leaf.com) ---"
+openssl genrsa $RSA_TRADITIONAL -out leaf.key 2048 2>/dev/null
+
+LEAF_EXT=$(mktemp /tmp/api_leaf_XXXXXX.ext)
+cat > "$LEAF_EXT" << 'EXTEOF'
+basicConstraints=critical,CA:FALSE
+keyUsage=critical,digitalSignature
+subjectKeyIdentifier=hash
+authorityKeyIdentifier=keyid:always
+subjectAltName=DNS:cfssl-leaf.com
+EXTEOF
+
+openssl req -new -key leaf.key -out leaf.csr \
+    -subj "/C=US/ST=California/L=San Francisco/O=CloudFlare/OU=Systems Engineering/CN=cloudflare-leaf.com" \
+    2>/dev/null
+
+openssl x509 -req -in leaf.csr -CA int-bundle.pem -CAkey inter.key \
+    -CAcreateserial -out leaf.pem \
+    -days 3650 -sha256 -extfile "$LEAF_EXT" 2>/dev/null
+
+rm -f "$LEAF_EXT" leaf.csr inter.srl
+
+openssl x509 -noout -subject -issuer -enddate -in leaf.pem | sed 's/^/  /'
+
+# ── 4. leaf.badkey ──────────────────────────────────────────────────────────
+# A valid RSA private key that intentionally does NOT match leaf.pem.
+# Used by tests that expect a key-mismatch error.
+echo ""
+echo "--- leaf.badkey (RSA-2048 key, intentionally mismatched with leaf.pem) ---"
+openssl genrsa $RSA_TRADITIONAL -out leaf.badkey 2048 2>/dev/null
+echo "  generated (does not match leaf.pem)"
+
+# ── 5. ca.pem (secondary root) ──────────────────────────────────────────────
+# Used by api tests that reference a separate root independent of the main chain.
+# DN preserved from original: CFSSL TEST Root CA with emailAddress.
+# Original had pathlen:0; preserved here.
+echo ""
+echo "--- ca.pem (secondary root: CFSSL TEST Root CA, RSA-2048, SHA-256) ---"
+openssl req -new -x509 -key ca_key.pem -out ca.pem \
+    -days 3650 -sha256 \
+    -subj "/C=US/ST=California/L=San Francisco/O=CFSSL TEST/CN=CFSSL TEST Root CA/emailAddress=test@test.local" \
+    -addext "basicConstraints=CA:TRUE,pathlen:0" \
+    -addext "keyUsage=critical,keyCertSign,cRLSign" \
+    -addext "subjectKeyIdentifier=hash" 2>/dev/null
+openssl x509 -noout -subject -enddate -in ca.pem | sed 's/^/  /'
+
+# ── 6. cert.pem ─────────────────────────────────────────────────────────────
+# Self-signed cert used by api tests as a generic TLS/test certificate.
+# Original DN: O=Acme Co, CN=127.0.0.1. Regenerate as SHA-256, RSA-2048.
+echo ""
+echo "--- cert.pem (self-signed: Acme Co / 127.0.0.1, RSA-2048, SHA-256) ---"
+CERT_KEY=$(mktemp /tmp/api_certkey_XXXXXX.pem)
+openssl genrsa $RSA_TRADITIONAL -out "$CERT_KEY" 2048 2>/dev/null
+openssl req -new -x509 -key "$CERT_KEY" -out cert.pem \
+    -days 3650 -sha256 \
+    -subj "/O=Acme Co/CN=127.0.0.1" \
+    -addext "basicConstraints=CA:FALSE" \
+    -addext "keyUsage=critical,digitalSignature,keyEncipherment" 2>/dev/null
+rm -f "$CERT_KEY"
+openssl x509 -noout -subject -enddate -in cert.pem | sed 's/^/  /'
+
+# ── 7. Cleanup intermediate files ───────────────────────────────────────────
+rm -f inter.key
+
+# ── 8. Verify the chain ─────────────────────────────────────────────────────
+echo ""
+echo "--- Chain verification ---"
+if openssl verify -CAfile ca-bundle.pem -untrusted int-bundle.pem leaf.pem; then
+    echo "  chain OK: leaf.pem -> int-bundle.pem -> ca-bundle.pem"
+else
+    echo "  ERROR: chain verification failed!" >&2
+    exit 1
+fi
+
+echo ""
+echo "=== Done. api/testdata regenerated in: $TESTDATA ==="

api/testdata/ca-bundle.pem

@@ -1,18 +1,23 @@
 -----BEGIN CERTIFICATE-----
-MIIC1jCCAj+gAwIBAgIUJhxh1ENJRZoFuCN+XB0xlP1zgeYwDQYJKoZIhvcNAQEL
+MIID6zCCAtOgAwIBAgIUG8bwsh4ZNICaymuESZmbkwREq+IwDQYJKoZIhvcNAQEL
 BQAwfTELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcM
 DVNhbiBGcmFuY2lzY28xEzARBgNVBAoMCkNsb3VkRmxhcmUxFDASBgNVBAsMC0RF
-Vl9URVNUSU5HMRYwFAYDVQQDDA1DRlNTTF9URVNUX0NBMB4XDTI1MDIwODIwMTYy
-N1oXDTM1MDIwNjIwMTYyN1owfTELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlm
+Vl9URVNUSU5HMRYwFAYDVQQDDA1DRlNTTF9URVNUX0NBMB4XDTI2MDMxMDE3Mjgy
+NFoXDTM2MDMwNzE3MjgyNFowfTELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlm
 b3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xEzARBgNVBAoMCkNsb3VkRmxh
 cmUxFDASBgNVBAsMC0RFVl9URVNUSU5HMRYwFAYDVQQDDA1DRlNTTF9URVNUX0NB
-MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCbp/6OQ/a3mr+8zRgBRlmSGr8Q
-BgP4vUIxLn2Mk4uiZ8OcpRY4YqL+TtREGDUc0ve+bv8RINrNlYXL2X+eJtbE2RJQ
-+RAiu+saw2K+RFTNeTCA1fwg3ws5gBDcFbECqK1dOkuN/gV4JMHobn2/15iUBfeS
-JxdF1j5yqES8sVu7cwIDAQABo1MwUTAdBgNVHQ4EFgQUuF7vrmdQt9bzB+VqvlWz
-ZzoNkj4wHwYDVR0jBBgwFoAUuF7vrmdQt9bzB+VqvlWzZzoNkj4wDwYDVR0TAQH/
-BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOBgQALmrNPUPlCyhabvgC8RsMZPhJjtxr9
-TotLuoa49zsHH18djRZLrm8mNzBwUVVNJ1hgwSpRnyrc7T4HQTTvjpCnyXEVRil/
-9HQbpVPBSw5W6oK3koLG0rFnZXHocqK+Qri4FkbwsTK5qlea35OJWkODiUY/ykVM
-E4sm6QDE79e0Iw==
+MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAoxHkErdhHpyAYGs9Fvqx
+p/f7Wnu0IyckGrxz3m7HDMU1c6GToNrNyf4FcspfE3IjENvnt8IyMBXCe73kLuFJ
+QOSSL1GuL3cW4EpEACxeFBmd/rxBZAczkAUjHqj+yr6Q6lHjZdPj/6difKh/zDsU
+idoLYR7cU3zly+XQpaHue9awaMEkjVvKsP5J8kl0iVaiuqcHtAPGhcPHSIGUu6oW
+v65T5wP/9buRp42W6URLvFv0FBF415MQw0Vn+9vdlyb5E/qnyl6PGCflpIWbBW9P
+rV98iTI4nzr8nHo67TBvvJjV/jqqgmlhU9SXTo6jBCDlOZMV7AtR1ZnnfxrvSlDb
+rQIDAQABo2MwYTAfBgNVHSMEGDAWgBSuA7AAG56okPOznKhsSYY3qiB52jAPBgNV
+HRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQUrgOwABueqJDz
+s5yobEmGN6ogedowDQYJKoZIhvcNAQELBQADggEBAB/lbbWpeGVpNzsHg2MU05Rq
+NvFb/f4oPGZupeT180C3D3TWIY8uPpNbVnL26V7Nnxleu9dX8Pcqr7rp6KlBjEom
+mSBK+JqxtIQhn5+sxZ/w4paDIFejnMkeU47G5ppTAJiXa79MPwf9WSlMjBaSCTjR
+jyvap/j1KJXx3ro+gZ/ZbYgJp+pzj8+g0PJwJkxxNjCKEIvqXz1HmX5B2G99+kTi
+Tcq0fiJgMF3453L+s9o+PmAp+l14VgxIildk9QhUIddvBWumqlDlDKCaYRROVPJF
+YH/OkmL2kDBu0rBlEPkz3os34K07ryFHkroj1BleOMZ/YGZEhCKF2Up0pLUAzmk=
 -----END CERTIFICATE-----

api/testdata/ca.pem

@@ -1,27 +1,24 @@
 -----BEGIN CERTIFICATE-----
-MIIEmzCCA4OgAwIBAgIMAMSvNBgypwaaSQ5iMA0GCSqGSIb3DQEBBQUAMIGMMQsw
-CQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTEWMBQGA1UEBxMNU2FuIEZy
-YW5jaXNjbzETMBEGA1UEChMKQ0ZTU0wgVEVTVDEbMBkGA1UEAxMSQ0ZTU0wgVEVT
-VCBSb290IENBMR4wHAYJKoZIhvcNAQkBFg90ZXN0QHRlc3QubG9jYWwwHhcNMTIx
-MjEyMDIxMDMxWhcNMjIxMDIxMDIxMDMxWjCBjDELMAkGA1UEBhMCVVMxEzARBgNV
-BAgTCkNhbGlmb3JuaWExFjAUBgNVBAcTDVNhbiBGcmFuY2lzY28xEzARBgNVBAoT
-CkNGU1NMIFRFU1QxGzAZBgNVBAMTEkNGU1NMIFRFU1QgUm9vdCBDQTEeMBwGCSqG
-SIb3DQEJARYPdGVzdEB0ZXN0LmxvY2FsMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
-MIIBCgKCAQEAsRp1xSfIDoD/40Bo4Hls3sFn4dav5NgxbZGpVyGF7dJI9u0eEnL4
-BUGssPaUFLWC83CZxujUEiEfE0oKX+uOhhGv3+j5xSTNM764m2eSiN53cdZtK05d
-hwq9uS8LtjKOQeN1mQ5qmiqxBMdjkKgMsVw5lMCgoYKo57kaKFyXzdpNVDzqw+pt
-HWmuNtDQjK3qT5Ma06mYPmIGYhIZYLY7oJGg9ZEaNR0GIw4zIT5JRsNiaSb5wTLw
-aa0n/4vLJyVjLJcYmJBvZWj8g+taK+C4INu/jGux+bmsC9hq14tbOaTNAn/NE0qN
-8oHwcRBEqfOdEYdZkxI5NWPiKNW/Q+AeXQIDAQABo4H6MIH3MB0GA1UdDgQWBBS3
-0veEuqg51fusEM4p/YuWpBPsvTCBxAYDVR0jBIG8MIG5gBS30veEuqg51fusEM4p
-/YuWpBPsvaGBkqSBjzCBjDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCkNhbGlmb3Ju
-aWExFjAUBgNVBAcTDVNhbiBGcmFuY2lzY28xEzARBgNVBAoTCkNGU1NMIFRFU1Qx
-GzAZBgNVBAMTEkNGU1NMIFRFU1QgUm9vdCBDQTEeMBwGCSqGSIb3DQEJARYPdGVz
-dEB0ZXN0LmxvY2FsggwAxK80GDKnBppJDmIwDwYDVR0TBAgwBgEB/wIBADANBgkq
-hkiG9w0BAQUFAAOCAQEAJ7r1EZYDwed6rS0+YKHdkRGRQ5Rz6A9DIVBPXrSMAGj3
-F5EF2m/GJbhpVbnNJTVlgP9DDyabOZNxzdrCr4cHMkYYnocDdgAodnkw6GZ/GJTc
-depbVTR4TpihFNzeDEGJePrEwM1DouGswpu97jyuCYZ3z1a60+a+3C1GwWaJ7Aet
-Uqm+yLTUrMISsfnDPqJdM1NeqW3jiZ4IgcqJkieCCSpag9Xuzrp9q6rjmePvlQkv
-qz020JGg6VijJ+c6Tf5y0XqbAhkBTqYtVamu9gEth9utn12EhdNjTZMPKMjjgFUd
-H0N6yOEuQMl4ky7RxZBM0iPyeob6i4z2LEQilgv9MQ==
+MIIECzCCAvOgAwIBAgIUEmQYG/mGuTZMMV2QZGWZbVUof2YwDQYJKoZIhvcNAQEL
+BQAwgYwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRYwFAYDVQQH
+DA1TYW4gRnJhbmNpc2NvMRMwEQYDVQQKDApDRlNTTCBURVNUMRswGQYDVQQDDBJD
+RlNTTCBURVNUIFJvb3QgQ0ExHjAcBgkqhkiG9w0BCQEWD3Rlc3RAdGVzdC5sb2Nh
+bDAeFw0yNjAzMTAxNzI4MjRaFw0zNjAzMDcxNzI4MjRaMIGMMQswCQYDVQQGEwJV
+UzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzET
+MBEGA1UECgwKQ0ZTU0wgVEVTVDEbMBkGA1UEAwwSQ0ZTU0wgVEVTVCBSb290IENB
+MR4wHAYJKoZIhvcNAQkBFg90ZXN0QHRlc3QubG9jYWwwggEiMA0GCSqGSIb3DQEB
+AQUAA4IBDwAwggEKAoIBAQCjEeQSt2EenIBgaz0W+rGn9/tae7QjJyQavHPebscM
+xTVzoZOg2s3J/gVyyl8TciMQ2+e3wjIwFcJ7veQu4UlA5JIvUa4vdxbgSkQALF4U
+GZ3+vEFkBzOQBSMeqP7KvpDqUeNl0+P/p2J8qH/MOxSJ2gthHtxTfOXL5dCloe57
+1rBowSSNW8qw/knySXSJVqK6pwe0A8aFw8dIgZS7qha/rlPnA//1u5GnjZbpREu8
+W/QUEXjXkxDDRWf7292XJvkT+qfKXo8YJ+WkhZsFb0+tX3yJMjifOvycejrtMG+8
+mNX+OqqCaWFT1JdOjqMEIOU5kxXsC1HVmed/Gu9KUNutAgMBAAGjYzBhMB8GA1Ud
+IwQYMBaAFK4DsAAbnqiQ87OcqGxJhjeqIHnaMA8GA1UdEwQIMAYBAf8CAQAwDgYD
+VR0PAQH/BAQDAgEGMB0GA1UdDgQWBBSuA7AAG56okPOznKhsSYY3qiB52jANBgkq
+hkiG9w0BAQsFAAOCAQEAGdRc1xufL2PWUhar4Rj+Ba/UhhpTcJptoEmNV8ycrsxt
+zFx6ZS+NlNViwhiGbuP1FddV0sgnvHZDyVctzyqpmWfTKVLZOmIYd0fJ6Ka5jCAC
+M0cTdvoc6kHlmZxTnO9VdPTYXjdoLTSwCmtSuBw7qcXpt6NNqGgFO0QtVqiQ8CrQ
+byljbpxPBysLyi8EQZsQCvJ4J3lnoLyPvbZ+rWHRGSDWz9a9yUnaWIhQMgCR8Y4/
+AS62sKN6pkt7qL8zUulwJo6KYBETxw5mxnzCCScY+j75bG++vsmNBLpA/GcX59wh
+XgioI2qWypi8bVE/8HM3v7YNXcl5PZujoDw+BQ4sbA==
 -----END CERTIFICATE-----

api/testdata/ca_key.pem

@@ -1,28 +1,27 @@
------BEGIN PRIVATE KEY-----
-MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCxGnXFJ8gOgP/j
-QGjgeWzewWfh1q/k2DFtkalXIYXt0kj27R4ScvgFQayw9pQUtYLzcJnG6NQSIR8T
-Sgpf646GEa/f6PnFJM0zvribZ5KI3ndx1m0rTl2HCr25Lwu2Mo5B43WZDmqaKrEE
-x2OQqAyxXDmUwKChgqjnuRooXJfN2k1UPOrD6m0daa420NCMrepPkxrTqZg+YgZi
-EhlgtjugkaD1kRo1HQYjDjMhPklGw2JpJvnBMvBprSf/i8snJWMslxiYkG9laPyD
-61or4Lgg27+Ma7H5uawL2GrXi1s5pM0Cf80TSo3ygfBxEESp850Rh1mTEjk1Y+Io
-1b9D4B5dAgMBAAECggEAKHhjcSomDSptTwDo9mLI/h40HudwSlsc8GzYxZBjinUD
-N2n39T9QbeMUE1xFenX/9qFEgq+xxnLLJx1EQacSapCgIAqdCO/f9HMgvGJumdg8
-c0cMq1i9Bp7tu+OESZ5D48qWlOM2eQRIb08g8W11eRIaFmPuUPoKnuktkQuXpPJc
-YbS/+JuA8SDwe6sV0cMCQuS+iHFfeGwWCKrDUkhLwcL3waW3od2XFyOeFFWFhl0h
-HmM/mWKRuRdqR7hrmArTwFZVkB+o/1ywVYXIv+JQm0eNZ5PKLNJGL2f5oxbMR/JI
-AoK0bAlJmYaFp96h1KpbPwLEL/0hHSWA7sAyJIgQAQKBgQDaEAZor/w4ZUTekT1+
-cbId0yA+ikDXQOfXaNCSh9Pex+Psjd5zVVOqyVFJ29daRju3d7rmpN4Cm5V4h0l1
-/2ad207rjCAnpCHtaddJWNyJzF2IL2IaoCZQRp0k7zOjBGQpoWDTwBaEin5CCv3P
-kkdQkKz6FDP1xskHSLZr21/QCQKBgQDP6jXutEgGjf3yKpMFk/69EamJdon8clbt
-hl7cOyWtobnZhdOWVZPe00Oo3Jag2aWgFFsm3EtwnUCnR4d4+fXRKS2LkhfIUZcz
-cKy17Ileggdd8UGhL4RDrF/En9tJL86WcVkcoOrqLcGB2FLWrVhVpHFK74eLMCH/
-uc/+ioPItQKBgHYoDsD08s7AGMQcoNx90MyWVLduhFnegoFW+wUa8jOZzieka6/E
-wVQeR5yksZjpy3vLNYu6M83n7eLkM2rrm/fXGHlLcTTpm7SgEBZfPwivotKjEh5p
-PrlqucWEk082lutz1RqHz+u7e1Rfzk2F7nx6GDBdeBYpw03eGXJx6QW5AoGBAIJq
-4puyAEAET1fZNtHX7IGCk7sDXTi6LCbgE57HhzHr8V0t4fQ6CABMuvMwM1gATjEk
-s6yjoLqqGUUUzDipanViBAy5fiuManC868lN7zkWDTLzQ3ytBqVAee4na/DziP27
-ae9YTSLJwskE/alloLRP6zTbHUXE0n7LelmrX1DFAoGBAMFLl+Lu+WFgCHxBjn43
-rHpJbQZQmsFhAMhkN4hsj6dJfAGn2gRLRiVRAika+8QF65xMZiVQWUVSUZADWERi
-0SXGjzN1wYxO3Qzy3LYwws6fxFAq5lo79eb38yFT2lHdqK3x/QgiDSRVl+R6cExV
-xQB518/lp2eIeMpglWByDwJX
------END PRIVATE KEY-----
+-----BEGIN RSA PRIVATE KEY-----
+MIIEogIBAAKCAQEAoxHkErdhHpyAYGs9Fvqxp/f7Wnu0IyckGrxz3m7HDMU1c6GT
+oNrNyf4FcspfE3IjENvnt8IyMBXCe73kLuFJQOSSL1GuL3cW4EpEACxeFBmd/rxB
+ZAczkAUjHqj+yr6Q6lHjZdPj/6difKh/zDsUidoLYR7cU3zly+XQpaHue9awaMEk
+jVvKsP5J8kl0iVaiuqcHtAPGhcPHSIGUu6oWv65T5wP/9buRp42W6URLvFv0FBF4
+15MQw0Vn+9vdlyb5E/qnyl6PGCflpIWbBW9PrV98iTI4nzr8nHo67TBvvJjV/jqq
+gmlhU9SXTo6jBCDlOZMV7AtR1ZnnfxrvSlDbrQIDAQABAoIBAB7E63IUpACwqxCG
+a5qAZzE4e3cRTGYtpoRc9sgLwwdH1tQgsshxQM9SXRjR0qrKqI8vz0M/I1UrZe0P
+YZTu8XGLL4I6OVG/eNONb9NQi9fjFYrRXs1PBo2wSnYokRsUZiewl+XI24aLwOug
+p6yToUZ5nBgRSKWANaQJkxsNuQAorzl4ADUqXmImPWQVPGvRrFr7fDsLlHQNVmUx
+K9YEKeCKvSXQbK/8/PMCX5WjuIpqjTNH8nlGgDz2qXsx3V3Wdz4MgVhzvoyw59Xf
+7WuRZbt4ZIhZ/FzI3rRekBEJ/hLCfozX9T4cqxhQITfzHmGv8ERVEYDMJrrs8MYP
+H61hRMECgYEAzTkihRo3PPw5F/6W0McIzZvOZn3BJmnlLlrkNtCwA8zM8vfKHgs7
+wFSNsgOr4YZjW2zgNK99e/zDjES+6xw7rJN/dCPKPI2zpDswmGVBhDMn9T5JkzD6
+Flnvijb4V1vgbts6H0mxUY9TvcKOHOMoP3npZJKQq2uVPPaH5+zqD2kCgYEAy2rC
+pqFBNt8dEEiv2u2xfOquP5yygk5DKHbgoHh+xotGc63RHtAB7jliduL1vEU5+x1r
+B5lNvB7C+jEFAQ96yD9RG0kRImEPwemwXJtRVXVevOUrNXVuqUmtquHQ72nxDsDS
+tT65ccAMOY+OSKs2THnz2biXRRfBbrnDpHDM5aUCgYBs+4F0c7aP4VWkg2Ot3XS0
+U6BpVzDiaGv3kPcOkQZYDkNsZ+Bi0g5aFczlkwONEWPkIk5yTBt0Y4epDrzgeC7M
+d8vAbl0wiQO0HGazF1qSjOQUXY6O5vx4MCyAFq8NHVJzLGKSSP0sVdPfutjjSFKQ
+WvpxmU/QaKJpLHaB2JN3uQKBgHyCzcDXBacDrLOR+mpkgfa3Y482aCHQq9Tx5w7y
+ko8PI0GdjFpy8iuSXo3s4IOsUBBAcooFMYrLvYcNSEXc5sf50biE4gMMLGwCkdwt
+ifxoSmQPVoJzbhgbLD1j2dMiItZn+tHMIhDZf+If1/TtL+Bh6XxEO/ujzdfrxzA5
+h4GtAoGATrET1gQLpZaGo3gKuc/njN4rbeIa8udqpGVWLG8EyQGddoP0Hz+5HKHV
++59XtPrbp1oaI4z1rLCikXKaNL+B4Vicuew0PutPX/3qgPJg31pFANUc9ZZKLYai
+RL2G6/2ycvbTgF8JKDjh63AJLMdmObxlINL/JoJPePCezR+pUpU=
+-----END RSA PRIVATE KEY-----

api/testdata/cert.pem

@@ -1,13 +1,20 @@
 -----BEGIN CERTIFICATE-----
-MIIB7jCCAVmgAwIBAgIBADALBgkqhkiG9w0BAQUwJjEQMA4GA1UEChMHQWNtZSBD
-bzESMBAGA1UEAxMJMTI3LjAuMC4xMB4XDTEyMDkwNzIyMDAwNFoXDTEzMDkwNzIy
-MDUwNFowJjEQMA4GA1UEChMHQWNtZSBDbzESMBAGA1UEAxMJMTI3LjAuMC4xMIGd
-MAsGCSqGSIb3DQEBAQOBjQAwgYkCgYEAm6f+jkP2t5q/vM0YAUZZkhq/EAYD+L1C
-MS59jJOLomfDnKUWOGKi/k7URBg1HNL3vm7/ESDazZWFy9l/nibWxNkSUPkQIrvr
-GsNivkRUzXkwgNX8IN8LOYAQ3BWxAqitXTpLjf4FeCTB6G59v9eYlAX3kicXRdY+
-cqhEvLFbu3MCAwEAAaMyMDAwDgYDVR0PAQH/BAQDAgCgMA0GA1UdDgQGBAQBAgME
-MA8GA1UdIwQIMAaABAECAwQwCwYJKoZIhvcNAQEFA4GBABndWRIcfi+QB9Sakr+m
-dYnXTgYCnFio53L2Z+6EHTGG+rEhWtUEGhL4p4pzXX4siAnjWvwcgXTo92cafcfi
-uB7wRfK+NL9CTJdpN6cdL+fiNHzH8hsl3bj1nL0CSmdn2hkUWVLbLhSgWlib/I8O
-aq+K7aVrgHkPnWeRiG6tl+ZA
+MIIDNzCCAh+gAwIBAgIUezo9H5UTJBFi4Ats6V+quDjZj9cwDQYJKoZIhvcNAQEL
+BQAwJjEQMA4GA1UECgwHQWNtZSBDbzESMBAGA1UEAwwJMTI3LjAuMC4xMB4XDTI2
+MDMxMDE3MjgyNFoXDTM2MDMwNzE3MjgyNFowJjEQMA4GA1UECgwHQWNtZSBDbzES
+MBAGA1UEAwwJMTI3LjAuMC4xMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
+AQEAlbxntRx6kxDiy6TYK/1w1is8IdPGp0vUtD6GvhflPTYPsitDsGTJOXkz4bK8
+TRGPqIqKlee5+SbOLEGDm19CLY01YFHFPRqZW5LnufLZ5EkrK9AE46RQuHsdeP7t
+BvaxCu4XtnoBO1HvbtWkErIcoTU/k2pXlprjd4k0X4B22g8hwYFLVBTwUWQFZkb4
+V2wx+QvbIiglqjV+DfYhDL9A5st0POMiFoJrEdN6FIKCbCY5C5l9SyFF7d0qdI/u
+uszOrGbOidkT84huq58ICxTR+UVOFH9QRP5bQ0bmE216TNTm/oZI/yhbnZAd8ojL
+badU9PES0H9CnOj9jyhLqvmfDQIDAQABo10wWzAdBgNVHQ4EFgQU2LsaM8TwNeU5
+uzHenQdcSRoig/swHwYDVR0jBBgwFoAU2LsaM8TwNeU5uzHenQdcSRoig/swCQYD
+VR0TBAIwADAOBgNVHQ8BAf8EBAMCBaAwDQYJKoZIhvcNAQELBQADggEBAI3UL33i
+vgG0zmTwTgnM+iH+eC9WbIVEXxNKDkN/Gtbc4BkukmKnnkPR1bUWhWEFYiW9WBzA
+xAwotvoY8q1AjW+pqHSpXfUFBaudQwT9m8LFJLZqGPwR3yIG2QN3sE6uSOMAK/97
+LOVxAS0G1ntXtLdU7z7Y8RzFSeHO3LXM/3ZzkW9gP4czu7AZeOUwNEKjFGdsqueg
+FTTJu4zrhmg7jXNVbSpv/5iKXnICvaKV76v51XUzipjB2WOWTyXkJ2ht05tnRiVy
+Q/kywZFt/CvrPZrvYzuLiszagbxXL00kSuKEttBwtla9BpCyLhyTq6/KxMDYrP+/
+Fcy8QFr4CZLWVec=
 -----END CERTIFICATE-----