PYTHON-5040 Regenerate test TLS certificates for Python 3.13/3.14 compatibility

.evergreen/scripts/run_server.py

@@ -67,6 +67,10 @@ def start_server():
             set_env("TLS_CERT_KEY_FILE", certs / "client.pem")
             set_env("TLS_PEM_KEY_FILE", certs / "server.pem")
             set_env("TLS_CA_FILE", certs / "ca.pem")
+            if sys.platform == "darwin":
+                # macOS SecTrust requires a positive OCSP response but our test
+                # CA has no OCSP responder.  See test/certificates/README.md.
+                extra_opts.append("--tls-allow-invalid-certificates")
 
     if opts.auth:
         extra_opts.append("--auth")

.evergreen/scripts/setup_tests.py

@@ -373,10 +373,8 @@ def handle_test_env() -> None:
         run_command(cmd, cwd=DRIVERS_TOOLS)
 
     if SSL != "nossl":
-        if not DRIVERS_TOOLS:
-            raise RuntimeError("Missing DRIVERS_TOOLS")
-        write_env("CLIENT_PEM", f"{DRIVERS_TOOLS}/.evergreen/x509gen/client.pem")
-        write_env("CA_PEM", f"{DRIVERS_TOOLS}/.evergreen/x509gen/ca.pem")
+        write_env("CLIENT_PEM", ROOT / "test/certificates/client.pem")
+        write_env("CA_PEM", ROOT / "test/certificates/ca.pem")
 
     compressors = os.environ.get("COMPRESSORS") or opts.compressor
     if compressors == "snappy":
@@ -429,6 +427,24 @@ def handle_test_env() -> None:
         if not DRIVERS_TOOLS:
             raise RuntimeError("Missing DRIVERS_TOOLS")
         csfle_dir = Path(f"{DRIVERS_TOOLS}/.evergreen/csfle")
+
+        # Set CSFLE TLS cert paths to our AKI-enabled test/certificates/ before
+        # setup-secrets.sh runs. setup-secrets.sh uses ${VAR:-default} so
+        # pre-setting these vars causes them to flow into secrets-export.sh
+        # through csfle/setup_secrets.py (which reads os.environ for these keys).
+        # load_config_from_file then persists all vars from that file for the
+        # test runner, so no separate write_env calls are needed.
+        certs = ROOT / "test/certificates"
+        os.environ["CSFLE_TLS_CA_FILE"] = str(certs / "ca.pem")
+        os.environ["CSFLE_TLS_CERT_FILE"] = str(certs / "kms-server.pem")
+        os.environ["CSFLE_TLS_CLIENT_CERT_FILE"] = str(certs / "client.pem")
+        os.environ["CSFLE_TLS_WRONG_HOST_FILE"] = str(certs / "kms-wrong-host.pem")
+        os.environ["CSFLE_TLS_EXPIRED_FILE"] = str(certs / "kms-expired.pem")
+        # The KMS failpoint server (port 9003) must also present a cert signed
+        # by our test CA so the driver's own TLS verification succeeds.
+        os.environ["CSFLE_TLS_FAILPOINT_CERT_FILE"] = str(certs / "kms-server.pem")
+        os.environ["CSFLE_TLS_FAILPOINT_CA_FILE"] = str(certs / "ca.pem")
+
         # Opt in to corporate Azure credentials (DRIVERS-3392)
         os.environ["FLE_AZURE_USE_CORPORATE"] = "YES"
         run_command(f"bash {csfle_dir.as_posix()}/setup-secrets.sh", cwd=csfle_dir)

.github/workflows/test-python.yml

@@ -193,12 +193,18 @@ jobs:
       - id: setup-mongodb
         uses: mongodb-labs/drivers-evergreen-tools@master
       - name: Run tests
-        run:  |
+        run: |
           just integration-tests
       - id: setup-mongodb-ssl
         uses: mongodb-labs/drivers-evergreen-tools@master
         with:
           ssl: true
+        env:
+          # drivers-evergreen-tools invokes run-mongodb.sh directly (not
+          # through run_server.py), so cert paths must be provided explicitly here.
+          TLS_PEM_KEY_FILE: ${{ github.workspace }}/test/certificates/server.pem
+          TLS_CA_FILE: ${{ github.workspace }}/test/certificates/ca.pem
+          TLS_CERT_KEY_FILE: ${{ github.workspace }}/test/certificates/client.pem
       - name: Run tests
         run: |
           just integration-tests

.pre-commit-config.yaml

@@ -115,7 +115,7 @@ repos:
     # - test/test_bson.py:267: isnt ==> isn't
     # - test/versioned-api/crud-api-version-1-strict.json:514: nin ==> inn, min, bin, nine
     # - test/test_client.py:188: te ==> the, be, we, to
-    args: ["-L", "fle,fo,infinit,isnt,nin,te,aks"]
+    args: ["-L", "fle,fo,infinit,isnt,nin,te,aks", "--skip", "test/certificates/*.pem"]
     exclude: ^pymongo/public_suffix_list\.dat$
 
 - repo: local

CONTRIBUTING.md

@@ -248,7 +248,17 @@ client = MongoClient(
 ```
 
 If you want to use the actual certificate file then set `tlsCertificateKeyFile` to the local path
-to `<repo_roo>/test/certificates/client.pem` and `tlsCAFile` to the local path to `<repo_roo>/test/certificates/ca.pem`.
+to `<repo_root>/test/certificates/client.pem` and `tlsCAFile` to the local path to `<repo_root>/test/certificates/ca.pem`.
+
+#### Regenerating test certificates
+
+If the test certificates in `test/certificates/` need to be regenerated (e.g. after expiry or to add missing extensions), run:
+
+```bash
+cd test/certificates && uv run gen-certs.py
+```
+
+See `test/certificates/README.md` for full details and constraints on certificate subjects/Subject Alternative Names that must be preserved.
 
 ### Encryption tests
 

test/asynchronous/test_encryption.py

@@ -3102,8 +3102,6 @@ async def http_post(self, path, data=None):
         # each request because the server is single threaded.
         ctx = ssl.create_default_context(cafile=CA_PEM)
         ctx.load_cert_chain(CLIENT_PEM)
-        ctx.check_hostname = False
-        ctx.verify_mode = ssl.CERT_NONE
         conn = http.client.HTTPSConnection("127.0.0.1:9003", context=ctx)
         try:
             if data is not None:

test/certificates/README.md

@@ -0,0 +1,83 @@
+# Test TLS Certificates
+
+These certificates are used by the PyMongo test suite for TLS/SSL integration tests.
+
+## Regenerating certificates
+
+Run the generation script from this directory:
+
+```bash
+uv run gen-certs.py
+```
+
+**Prerequisites:** Python 3, [uv](https://docs.astral.sh/uv/), and the OpenSSL CLI (`openssl`) available on PATH (used by the script’s verification step). The script declares its own dependency on `cryptography` using PEP 723 inline metadata, so `uv` installs it automatically.
+
+## Certificate details
+
+Two classes of leaf certificate are generated, with different extension profiles to satisfy
+conflicting requirements from Python's ssl module and macOS's SecTrust framework.
+AKI (Authority Key Identifier) and SKI (Subject Key Identifier) are X.509 extensions that
+identify the key used to sign a certificate and the certificate's own key, respectively.
+
+**MongoDB certs**: presented to MongoDB Enterprise, verified by Apple SecTrust on macOS.
+No AKI or SKI. Adding AKI triggers SecTrust OCSP checks; our CA has no OCSP responder, so those
+fail with `CSSMERR_TP_CERT_SUSPENDED`. See Background below.
+
+**KMS certs**: presented by KMS mock servers and verified by Python's ssl module (OpenSSL).
+Carry both AKI (keyid form) and SKI. These extensions are required by the strict mode that
+`ssl.create_default_context()` enables on Python 3.13+; see Background below for the full
+version history.
+
+| File | Subject | Signed by | Extensions | Purpose |
+|---|---|---|---|---|
+| `ca.pem` | `CN=Drivers Testing CA, ...` | Self (CA) | basicConstraints critical, keyUsage critical, SKI | Root CA for all test certs |
+| `server.pem` | `CN=localhost, ...` + SAN | Drivers Testing CA | SAN only | MongoDB server cert (key + cert) |
+| `client.pem` | `CN=client, O=MDB, ...` | Drivers Testing CA | keyUsage, extKeyUsage | Client auth cert (key + cert) |
+| `password_protected.pem` | Same as client | Drivers Testing CA | keyUsage, extKeyUsage | Client cert with AES-256 encrypted key |
+| `crl.pem` | N/A | Drivers Testing CA | N/A | CRL revoking serial 1 (server.pem) |
+| `kms-server.pem` | `CN=localhost, ...` + SAN | Drivers Testing CA | SAN, AKI, SKI | KMS mock server cert (key + cert) |
+| `kms-wrong-host.pem` | `CN=wronghost.example.com` | Drivers Testing CA | SAN, AKI, SKI | KMS wrong-host test cert |
+| `kms-expired.pem` | `CN=localhost, ...` + SAN | Drivers Testing CA | SAN, AKI, SKI | KMS expired cert (validity 2000–2001) |
+| `trusted-ca.pem` | `CN=Trusted Kernel Test CA, ...` | Self (CA) | basicConstraints critical, keyUsage critical | Separate CA for CA-bundle tests |
+
+**Password** for `password_protected.pem`: `qwerty`
+
+## Important constraints
+
+The following values are hardcoded in tests and **must not change**:
+
+- Client cert subject: `C=US,ST=New York,L=New York City,O=MDB,OU=Drivers,CN=client`
+  (used as the MongoDB X.509 username in `test/test_ssl.py`)
+- Server cert SAN: `DNS:localhost, IP:127.0.0.1, IP:::1`
+- The `server` hostname alias for `127.0.0.1` must be present in `/etc/hosts` for SSL tests to pass
+  (added automatically by `.evergreen/scripts/setup-system.sh`)
+
+## Background
+
+Certificates were regenerated for PYTHON-5040 to fix `ssl.SSLCertVerificationError` failures on
+macOS and Windows with Python 3.13+.  The root causes were:
+
+1. Python 3.13 enables `X509_V_FLAG_X509_STRICT` in `ssl.create_default_context()`, which
+   requires **AKI** on non-root certs.  The KMS mock-server connection (`http_post`) used
+   `create_default_context()`, so the original 2019 KMS certs (no AKI) started failing.
+2. Python 3.14 sets `ssl.VERIFY_X509_STRICT` (OpenSSL's `X509_V_FLAG_X509_STRICT`) in
+   `ssl.create_default_context()`, which additionally requires **SKI** on non-root certs and
+   **keyUsage** on CA certs.
+
+The generated MongoDB certs carry no AKI: AKI on any leaf cert triggers Apple SecTrust OCSP checks, which fail
+(`CSSMERR_TP_CERT_SUSPENDED`) because our CA has no OCSP responder.  MongoDB Enterprise on macOS
+uses `kSecRevocationRequirePositiveResponse`, so even without AKI the server startup fails; that is
+why `.evergreen/scripts/run_server.py` passes `--tls-allow-invalid-certificates` on macOS.  The CA
+carries SKI (but no AKI), which enables keyid-form AKI on KMS leaf certs without re-triggering
+macOS OCSP.  As long as `pymongo.ssl_support.get_ssl_context` uses `PROTOCOL_SSLv23` (not
+`create_default_context`), `X509_V_FLAG_X509_STRICT` is not set and no AKI is required on MongoDB
+leaf certs.
+
+KMS connections use `ssl.create_default_context()`, which sets `X509_V_FLAG_X509_STRICT`.
+OpenSSL 3.3+ strict mode requires the `keyIdentifier` field within AKI; issuer/serial form is not
+sufficient, so KMS leaf certs use keyid-form AKI derived from the CA's SKI.
+
+> **If the driver is changed to use `ssl.create_default_context()` for MongoDB connections**, the
+> MongoDB certs will need AKI and SKI.  Adding AKI will re-trigger macOS SecTrust OCSP failures;
+> to resolve that, either add `--tls-allow-invalid-certificates` to the server startup in
+> `run_server.py`, or install the test CA into the macOS system keychain in the CI setup.

test/certificates/ca.pem

@@ -1,21 +1,22 @@
 -----BEGIN CERTIFICATE-----
-MIIDfzCCAmegAwIBAgIDB1MGMA0GCSqGSIb3DQEBCwUAMHkxGzAZBgNVBAMTEkRy
-aXZlcnMgVGVzdGluZyBDQTEQMA4GA1UECxMHRHJpdmVyczEQMA4GA1UEChMHTW9u
-Z29EQjEWMBQGA1UEBxMNTmV3IFlvcmsgQ2l0eTERMA8GA1UECBMITmV3IFlvcmsx
-CzAJBgNVBAYTAlVTMB4XDTE5MDUyMjIwMjMxMVoXDTM5MDUyMjIwMjMxMVoweTEb
-MBkGA1UEAxMSRHJpdmVycyBUZXN0aW5nIENBMRAwDgYDVQQLEwdEcml2ZXJzMRAw
-DgYDVQQKEwdNb25nb0RCMRYwFAYDVQQHEw1OZXcgWW9yayBDaXR5MREwDwYDVQQI
-EwhOZXcgWW9yazELMAkGA1UEBhMCVVMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw
-ggEKAoIBAQCl7VN+WsQfHlwapcOpTLZVoeMAl1LTbWTFuXSAavIyy0W1Ytky1UP/
-bxCSW0mSWwCgqoJ5aXbAvrNRp6ArWu3LsTQIEcD3pEdrFIVQhYzWUs9fXqPyI9k+
-QNNQ+MRFKeGteTPYwF2eVEtPzUHU5ws3+OKp1m6MCLkwAG3RBFUAfddUnLvGoZiT
-pd8/eNabhgHvdrCw+tYFCWvSjz7SluEVievpQehrSEPKe8DxJq/IM3tSl3tdylzT
-zeiKNO7c7LuQrgjAfrZl7n2SriHIlNmqiDR/kdd8+TxBuxjFlcf2WyHCO3lIcIgH
-KXTlhUCg50KfHaxHu05Qw0x8869yIzqbAgMBAAGjEDAOMAwGA1UdEwQFMAMBAf8w
-DQYJKoZIhvcNAQELBQADggEBAEHuhTL8KQZcKCTSJbYA9MgZj7U32arMGBbc1hiq
-VBREwvdVz4+9tIyWMzN9R/YCKmUTnCq8z3wTlC8kBtxYn/l4Tj8nJYcgLJjQ0Fwe
-gT564CmvkUat8uXPz6olOCdwkMpJ9Sj62i0mpgXJdBfxKQ6TZ9yGz6m3jannjZpN
-LchB7xSAEWtqUgvNusq0dApJsf4n7jZ+oBZVaQw2+tzaMfaLqHgMwcu1FzA8UKCD
-sxCgIsZUs8DdxaD418Ot6nPfheOTqe24n+TTa+Z6O0W0QtnofJBx7tmAo1aEc57i
-77s89pfwIJetpIlhzNSMKurCAocFCJMJLAASJFuu6dyDvPo=
+MIIDsTCCApmgAwIBAgIDB1MGMA0GCSqGSIb3DQEBCwUAMHkxGzAZBgNVBAMMEkRy
+aXZlcnMgVGVzdGluZyBDQTEQMA4GA1UECwwHRHJpdmVyczEQMA4GA1UECgwHTW9u
+Z29EQjEWMBQGA1UEBwwNTmV3IFlvcmsgQ2l0eTERMA8GA1UECAwITmV3IFlvcmsx
+CzAJBgNVBAYTAlVTMB4XDTI2MDkwODEzNDMzOVoXDTQ2MDkwNDEzNDMzOVoweTEb
+MBkGA1UEAwwSRHJpdmVycyBUZXN0aW5nIENBMRAwDgYDVQQLDAdEcml2ZXJzMRAw
+DgYDVQQKDAdNb25nb0RCMRYwFAYDVQQHDA1OZXcgWW9yayBDaXR5MREwDwYDVQQI
+DAhOZXcgWW9yazELMAkGA1UEBhMCVVMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw
+ggEKAoIBAQCE2b7H4d+NRVoEKSZb2i1604DrzIBERLf0zfNiLkYDS9SzC9p2w4FL
+dKvncKIC9NlHMShE6S7AEqaJKUFNqmIy/9yhgozoibx5HWSBh0e1OqWVPrHN4rqw
+XpG1S5x4f+v1ZOZPjs8Jy1k8ZTEb+l8AKUmyOkGy0BVXiNqw5NGvOuZ/Q9oyCPMO
+/Q6r/STEKl4q9NQ9NDPv24Ohozmor/SQ43EVJqQs5i9oYC/c5g9z44di1/redEn1
+qc3S/s5LjUOffw+U0QLJ8LzRaiF0EtLCrF/cQw4ADODYDcaplUUiqqDxOOp+sgNX
+Y4ifndKbc6WrL+pimjVy7B1BVP9NoejRAgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMB
+Af8wDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBQW1/8RzJZiN2u/+BhCoy4lCOzW
+HjANBgkqhkiG9w0BAQsFAAOCAQEAX2CzWse6k+WN/MDW4kPtoEVzODcO61j5zB6A
+rPY0OyU7v2oZDVzLLkcbu5MYnKRwQypdAs7Zwu1KrGu5kRMODeu7ca5STTgiMhxR
+twEpHLK+xIwwxu1Np1HV6ARgPDbnhaMjFYKbCx672iQEcnpr7yipxZOcKTmBvHZV
+6mhlQAyX22qSvMVTUMkO0TI2dqtRMlQa9HbOQ10lupqpPXwrfSLxjc6Qextm47P/
+y7qhhT2bSXs4gnvbw/h1WgfVeF5qrzafw96QzalRli24Ll9QqPlmFo9oE3iEzg/+
+tLUtid0EnRAL0rK/XygFdgc36KU35rZxKHxNBWpKCcU72a3R5w==
 -----END CERTIFICATE-----

test/certificates/client.pem

@@ -1,48 +1,48 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIIEpAIBAAKCAQEAsNS8UEuin7/K29jXfIOLpIoh1jEyWVqxiie2Onx7uJJKcoKo
-khA3XeUnVN0k6X5MwYWcN52xcns7LYtyt06nRpTG2/emoV44w9uKTuHsvUbiOwSV
-m/ToKQQ4FUFZoqorXH+ZmJuIpJNfoW+3CkE1vEDCIecIq6BNg5ySsPtvSuSJHGjp
-mc7/5ZUDvFE2aJ8QbJU3Ws0HXiEb6ymi048LlzEL2VKX3w6mqqh+7dcZGAy7qYk2
-5FZ9ktKvCeQau7mTyU1hsPrKFiKtMN8Q2ZAItX13asw5/IeSTq2LgLFHlbj5Kpq4
-GmLdNCshzH5X7Ew3IYM8EHmsX8dmD6mhv7vpVwIDAQABAoIBABOdpb4qhcG+3twA
-c/cGCKmaASLnljQ/UU6IFTjrsjXJVKTbRaPeVKX/05sgZQXZ0t3s2mV5AsQ2U1w8
-Cd+3w+qaemzQThW8hAOGCROzEDX29QWi/o2sX0ydgTMqaq0Wv3SlWv6I0mGfT45y
-/BURIsrdTCvCmz2erLqa1dL4MWJXRFjT9UTs5twlecIOM2IHKoGGagFhymRK4kDe
-wTRC9fpfoAgyfus3pCO/wi/F8yKGPDEwY+zgkhrJQ+kSeki7oKdGD1H540vB8gRt
-EIqssE0Y6rEYf97WssQlxJgvoJBDSftOijS6mwvoasDUwfFqyyPiirawXWWhHXkc
-DjIi/XECgYEA5xfjilw9YyM2UGQNESbNNunPcj7gDZbN347xJwmYmi9AUdPLt9xN
-3XaMqqR22k1DUOxC/5hH0uiXir7mDfqmC+XS/ic/VOsa3CDWejkEnyGLiwSHY502
-wD/xWgHwUiGVAG9HY64vnDGm6L3KGXA2oqxanL4V0+0+Ht49pZ16i8sCgYEAw+Ox
-CHGtpkzjCP/z8xr+1VTSdpc/4CP2HONnYopcn48KfQnf7Nale69/1kZpypJlvQSG
-eeA3jMGigNJEkb8/kaVoRLCisXcwLc0XIfCTeiK6FS0Ka30D/84Qm8UsHxRdpGkM
-kYITAa2r64tgRL8as4/ukeXBKE+oOhX43LeEfyUCgYBkf7IX2Ndlhsm3GlvIarxy
-NipeP9PGdR/hKlPbq0OvQf9R1q7QrcE7H7Q6/b0mYNV2mtjkOQB7S2WkFDMOP0P5
-BqDEoKLdNkV/F9TOYH+PCNKbyYNrodJOt0Ap6Y/u1+Xpw3sjcXwJDFrO+sKqX2+T
-PStG4S+y84jBedsLbDoAEwKBgQCTz7/KC11o2yOFqv09N+WKvBKDgeWlD/2qFr3w
-UU9K5viXGVhqshz0k5z25vL09Drowf1nAZVpFMO2SPOMtq8VC6b+Dfr1xmYIaXVH
-Gu1tf77CM9Zk/VSDNc66e7GrUgbHBK2DLo+A+Ld9aRIfTcSsMbNnS+LQtCrQibvb
-cG7+MQKBgQCY11oMT2dUekoZEyW4no7W5D74lR8ztMjp/fWWTDo/AZGPBY6cZoZF
-IICrzYtDT/5BzB0Jh1f4O9ZQkm5+OvlFbmoZoSbMzHL3oJCBOY5K0/kdGXL46WWh
-IRJSYakNU6VIS7SjDpKgm9D8befQqZeoSggSjIIULIiAtYgS80vmGA==
+MIIEowIBAAKCAQEA4GCcDOaDX8C9ysldwrtQn+rxrFSyzlCzqh15OBFTN8gKcC2P
+fHaZsep1Nl47YfwL8vQwh9rvYyWf0zu0dkX3CzJdRW8i5jt1FOG20n6bQIjqOHa6
+WrMBU8wva2ncpRabGWZziySqDsqRZywgZzrKbTILuSifzjFLrGOmZIhT6Mjgfcwf
+lSLkLOHo8pJZXNAmOV2w63/165poP1EwpUkSqyWZnZLTXALBhAGD32lFVfzE34o+
+OtzyiXpTB0Mggqfg5JLgqjefODktMDKVZ303oeNBmOOpucyLJwrPA8M6LnrHSZIf
+ZNePy3SdTYhlvs0SajbXr94asT7yUPU5KVhVrQIDAQABAoIBACQohXVRv3mSjLNN
+fInZWE6RFMWd95umZzGiosp9hkDewInf2bfnv/BrNVzf1id97+oE3n5CMqIyab1n
+aXdG4p8gDGZYWNIr4jwNfMISq4+8kKwtO+5KWwwnQzwG2QsUp8Vx3GxfqfUMwV5U
+PtuL3pu2vStnR8t5Z7W98E5Spt0EFsB6mHYjo7WBvxXL4tVxRwQ4Wsc1XuMTU5PE
+deDbwq1dVB+d4mTCP07/tithhBJmch4dZQOwd5sIjWqps7MBmjWSUjhoEG1T1CK6
+0q+NbpeY3fON8FVlGPJv6mOF+ghNA0cXU8AKKOSBQd30M5PJZR+TzZoPXJIkpsjO
+m8/okBkCgYEA/ouD+9kianeilsz9ArHTIBLHEepOgSYJ/UNUqE8z7Od5ryZp94qU
+uqSqJGCxgZ7T0w15pscKX7Y+/jbDq+TgKwWq4OmIanroXZGq3X3rMCeN0MGclUfU
+i2tOCJxpPQ4c3DCXJmNSp3GOAaZQRKug8qVB4wFEVr16INcS2HTNF7UCgYEA4ajy
+31GQQxe9Y3ogJKjpx2BcQ7FWoyY9CUQu3MqP+wh1CzuMXJ4X0sN3H213hlfLh+9F
+7wWX956Ga6xV7KVDSNZFKanU67VXOSgoQ9zLF3gd6CNHAoYpdq6b5GhfcoexZDOy
+JImPTtsz/WZv+Ga1ZqPzTyjUWWnHnqQFcxKGERkCgYBZyz+pBWUVp9RsXC3Y2IBA
+7T7afAxrlM6rUCg6I46OwO11MxjooTNsUBBROucDcdMJvdQvWEG5l+HK7ejC57+I
+jbxFETz1SxxTfcKH1ha0aw+lF9ez9Z3t/NGPShX52tOlfWKkwR70QKO2w0PHpb/m
+ORPwD49bBgZiNVzJjRKYjQKBgQCWPTaeSh6DHN4hyeB2p+Mls9kZ1Ir7Cm1eqv+M
+Tmy31LSgauATlcoEr9Cyot4OGovOkBZ+gbngybFzJIT8jjcS2l2n1IOG/u/4hOzx
+6aFpmbZHpJ0VaB9Y/f2af4b0qLUJIoX7X36DINwnXLk1p6QklwlZ7bQbZ5rY2xkp
+uO57mQKBgAR/7pWJJAzyuc6d14GLE+bYBlEZL+551YVjaSjWwnIJLtNGIamteR8c
+e1FRykIEJRi823FIpvF9AvZSqu75fm4KkKrJNB7X+pH1PWJS2QfvrSwdrBX1CTWU
+fswdRmq5bhyiQyVY3jYs0Zqd6NBLbhQu29uJJEgNeK/I23nfLp9z
 -----END RSA PRIVATE KEY-----
 -----BEGIN CERTIFICATE-----
-MIIDgzCCAmugAwIBAgIDAxOUMA0GCSqGSIb3DQEBCwUAMHkxGzAZBgNVBAMTEkRy
-aXZlcnMgVGVzdGluZyBDQTEQMA4GA1UECxMHRHJpdmVyczEQMA4GA1UEChMHTW9u
-Z29EQjEWMBQGA1UEBxMNTmV3IFlvcmsgQ2l0eTERMA8GA1UECBMITmV3IFlvcmsx
-CzAJBgNVBAYTAlVTMB4XDTE5MDUyMjIzNTU1NFoXDTM5MDUyMjIzNTU1NFowaTEP
-MA0GA1UEAxMGY2xpZW50MRAwDgYDVQQLEwdEcml2ZXJzMQwwCgYDVQQKEwNNREIx
-FjAUBgNVBAcTDU5ldyBZb3JrIENpdHkxETAPBgNVBAgTCE5ldyBZb3JrMQswCQYD
-VQQGEwJVUzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALDUvFBLop+/
-ytvY13yDi6SKIdYxMllasYontjp8e7iSSnKCqJIQN13lJ1TdJOl+TMGFnDedsXJ7
-Oy2LcrdOp0aUxtv3pqFeOMPbik7h7L1G4jsElZv06CkEOBVBWaKqK1x/mZibiKST
-X6FvtwpBNbxAwiHnCKugTYOckrD7b0rkiRxo6ZnO/+WVA7xRNmifEGyVN1rNB14h
-G+spotOPC5cxC9lSl98Opqqofu3XGRgMu6mJNuRWfZLSrwnkGru5k8lNYbD6yhYi
-rTDfENmQCLV9d2rMOfyHkk6ti4CxR5W4+SqauBpi3TQrIcx+V+xMNyGDPBB5rF/H
-Zg+pob+76VcCAwEAAaMkMCIwCwYDVR0PBAQDAgeAMBMGA1UdJQQMMAoGCCsGAQUF
-BwMCMA0GCSqGSIb3DQEBCwUAA4IBAQAqRcLAGvYMaGYOV4HJTzNotT2qE0I9THNQ
-wOV1fBg69x6SrUQTQLjJEptpOA288Wue6Jt3H+p5qAGV5GbXjzN/yjCoItggSKxG
-Xg7279nz6/C5faoIKRjpS9R+MsJGlttP9nUzdSxrHvvqm62OuSVFjjETxD39DupE
-YPFQoHOxdFTtBQlc/zIKxVdd20rs1xJeeU2/L7jtRBSPuR/Sk8zot7G2/dQHX49y
-kHrq8qz12kj1T6XDXf8KZawFywXaz0/Ur+fUYKmkVk1T0JZaNtF4sKqDeNE4zcns
-p3xLVDSl1Q5Gwj7bgph9o4Hxs9izPwiqjmNaSjPimGYZ399zcurY
+MIIDgTCCAmmgAwIBAgIBAjANBgkqhkiG9w0BAQsFADB5MRswGQYDVQQDDBJEcml2
+ZXJzIFRlc3RpbmcgQ0ExEDAOBgNVBAsMB0RyaXZlcnMxEDAOBgNVBAoMB01vbmdv
+REIxFjAUBgNVBAcMDU5ldyBZb3JrIENpdHkxETAPBgNVBAgMCE5ldyBZb3JrMQsw
+CQYDVQQGEwJVUzAeFw0yNjA5MDgxMzQzMzlaFw00NjA5MDQxMzQzMzlaMGkxDzAN
+BgNVBAMMBmNsaWVudDEQMA4GA1UECwwHRHJpdmVyczEMMAoGA1UECgwDTURCMRYw
+FAYDVQQHDA1OZXcgWW9yayBDaXR5MREwDwYDVQQIDAhOZXcgWW9yazELMAkGA1UE
+BhMCVVMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDgYJwM5oNfwL3K
+yV3Cu1Cf6vGsVLLOULOqHXk4EVM3yApwLY98dpmx6nU2Xjth/Avy9DCH2u9jJZ/T
+O7R2RfcLMl1FbyLmO3UU4bbSfptAiOo4drpaswFTzC9radylFpsZZnOLJKoOypFn
+LCBnOsptMgu5KJ/OMUusY6ZkiFPoyOB9zB+VIuQs4ejykllc0CY5XbDrf/Xrmmg/
+UTClSRKrJZmdktNcAsGEAYPfaUVV/MTfij463PKJelMHQyCCp+DkkuCqN584OS0w
+MpVnfTeh40GY46m5zIsnCs8DwzouesdJkh9k14/LdJ1NiGW+zRJqNtev3hqxPvJQ
+9TkpWFWtAgMBAAGjJDAiMAsGA1UdDwQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcD
+AjANBgkqhkiG9w0BAQsFAAOCAQEAedO3g7tzgmhg/hnJMxH88OTd757o2zZSJnLH
+0tzfLqz961gKt2KnBKYXg1i5CMnew1hCxkwUIXYWhzwACgJwv8x79uRlrvq3j0DE
+OqXeMdFBIHQhkEV2vipaNGq3VTMurvL0EHghi9M1/YGcmdMuHNPIq/882n1B6yet
+wGviRON2OMkKa65J4t31HGq5FeGOAWuyOuRGqgg8uexN55AzYjvd7VYWblrjsxm1
+W3HDQWaZYyv1cwbpfWYrJpnUBHcYYApvJBJpJPnM8EDpNA0HtTd/cBQiFvp0P4ss
+SyyhFXDMJT9OpgTotIKPHdhZvOuy2pzRrQj2xSTUPWrRnKMJPQ==
 -----END CERTIFICATE-----

test/certificates/crl.pem

@@ -1,13 +1,12 @@
 -----BEGIN X509 CRL-----
-MIIB6jCB0wIBATANBgkqhkiG9w0BAQsFADB5MRswGQYDVQQDExJEcml2ZXJzIFRl
-c3RpbmcgQ0ExEDAOBgNVBAsTB0RyaXZlcnMxEDAOBgNVBAoTB01vbmdvREIxFjAU
-BgNVBAcTDU5ldyBZb3JrIENpdHkxETAPBgNVBAgTCE5ldyBZb3JrMQswCQYDVQQG
-EwJVUxcNMTkwNTIyMjI0NTUzWhcNMTkwNjIxMjI0NTUzWjAVMBMCAncVFw0xOTA1
-MjIyMjQ1MzJaoA8wDTALBgNVHRQEBAICEAAwDQYJKoZIhvcNAQELBQADggEBACwQ
-W9OF6ExJSzzYbpCRroznkfdLG7ghNSxIpBQUGtcnYbkP4em6TdtAj5K3yBjcKn4a
-hnUoa5EJGr2Xgg0QascV/1GuWEJC9rsYYB9boVi95l1CrkS0pseaunM086iItZ4a
-hRVza8qEMBc3rdsracA7hElYMKdFTRLpIGciJehXzv40yT5XFBHGy/HIT0CD50O7
-BDOHzA+rCFCvxX8UY9myDfb1r1zUW7Gzjn241VT7bcIJmhFE9oV0popzDyqr6GvP
-qB2t5VmFpbnSwkuc4ie8Jizip1P8Hg73lut3oVAHACFGPpfaNIAp4GcSH61zJmff
-9UBe3CJ1INwqyiuqGeA=
+MIIB2DCBwQIBATANBgkqhkiG9w0BAQsFADB5MRswGQYDVQQDDBJEcml2ZXJzIFRl
+c3RpbmcgQ0ExEDAOBgNVBAsMB0RyaXZlcnMxEDAOBgNVBAoMB01vbmdvREIxFjAU
+BgNVBAcMDU5ldyBZb3JrIENpdHkxETAPBgNVBAgMCE5ldyBZb3JrMQswCQYDVQQG
+EwJVUxcNMjYwOTA5MTM0MzM5WhcNNDYwOTA0MTM0MzM5WjAUMBICAQEXDTI2MDkw
+OTEzNDMzOVowDQYJKoZIhvcNAQELBQADggEBAB59jdr1fKfc8oUUrCe+JfcDyEEO
+Xf8gKSj4y+0O+QiybzWRJsyk6etTIxCPVQR1YlTJ38mBhFNFloaz1vdpBW2u2qpY
+Jm2G1qeeUsDPHHK6e5oJydzgulhQgEkkXxPzUv/cMv2b2XVZ3kpLjBZaXynKwdlu
+DtFq3f5LYcYluQCeUrsaIhdgTx+W12vDEQCyaRya5Z5WDwOjUhQYxpi4jb+a8+Y5
+s1eGP1SrdXqwHBGGJ/ONGksZwHSZXTv+JU7EX8lb6C1hZ5WY+vRYykKJ1sG7hOWw
+q4CJ7kNFGkSa5bfI5+41gIc8/dxtVq2q4EmoUbLm/VVNyl/eWIg/oX23qYQ=
 -----END X509 CRL-----