# Test certificates

For the TLS cases in `tst_mqtt` (docs/DESIGN.md, D44). EC P-256, valid until 2126. Test use
only: the private keys are public.

| File | What |
|---|---|
| `ca.crt` | Test CA (its key was deleted after signing) |
| `server.crt`, `server.key` | Broker certificate from the test CA, for `localhost` and `127.0.0.1` |
| `client.crt`, `client.key` | Client certificate from the test CA |
| `other-ca.crt` | A second CA that signed nothing here: the wrong CA |

Made with:

```sh
openssl req -x509 -newkey ec -pkeyopt ec_paramgen_curve:prime256v1 -nodes \
    -keyout ca.key -out ca.crt -days 36500 -subj "/CN=FrameAssistant test CA"
openssl req -newkey ec -pkeyopt ec_paramgen_curve:prime256v1 -nodes \
    -keyout server.key -out server.csr -subj "/CN=localhost"
openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out server.crt \
    -days 36500 -extfile <(printf "subjectAltName=DNS:localhost,IP:127.0.0.1\nextendedKeyUsage=serverAuth")
openssl req -newkey ec -pkeyopt ec_paramgen_curve:prime256v1 -nodes \
    -keyout client.key -out client.csr -subj "/CN=frameassistant-test-client"
openssl x509 -req -in client.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out client.crt \
    -days 36500 -extfile <(printf "extendedKeyUsage=clientAuth")
openssl req -x509 -newkey ec -pkeyopt ec_paramgen_curve:prime256v1 -nodes \
    -keyout other-ca.key -out other-ca.crt -days 36500 -subj "/CN=Other test CA"
rm server.csr client.csr ca.srl ca.key other-ca.key
```