From 9a55137d08724927f1c42f28d662ded3ff0c3a9c Mon Sep 17 00:00:00 2001
From: "Evgeny @ SimpleX Chat"
 <259188159+evgeny-simplex@users.noreply.github.com>
Date: Tue, 10 Feb 2026 23:49:27 +0000
Subject: [PATCH] web test cert fixtures

---
 tests/XFTPServerTests.hs  |  22 +++++----
 tests/fixtures/web.crt    |  87 +++++++++++++++++++++------------
 tests/fixtures/web_ca.crt |  56 ++++++++++-----------
 tests/fixtures/web_ca.key | 100 +++++++++++++++++++-------------------
 tests/fixtures/web_ca.srl |   2 +-
 5 files changed, 149 insertions(+), 118 deletions(-)

diff --git a/tests/XFTPServerTests.hs b/tests/XFTPServerTests.hs
index 7a956c6a8..39dc79a89 100644
--- a/tests/XFTPServerTests.hs
+++ b/tests/XFTPServerTests.hs
@@ -432,7 +432,7 @@ getCerts tls =
 testSNICertSelection :: Expectation
 testSNICertSelection =
   withXFTPServerSNI $ \_ -> do
-    Fingerprint fpHTTP <- loadFileFingerprint "tests/fixtures/ca.crt"
+    Fingerprint fpHTTP <- loadFileFingerprint "tests/fixtures/web_ca.crt"
     let caHTTP = C.KeyHash fpHTTP
         cfg = defaultTransportClientConfig {clientALPN = Just ["h2"], useSNI = True}
     runTLSTransportClient defaultSupportedParamsHTTPS Nothing cfg Nothing "localhost" xftpTestPort (Just caHTTP) $ \(tls :: TLS 'TClient) -> do
@@ -458,7 +458,7 @@ testNoSNICertSelection =
 testCORSHeaders :: Expectation
 testCORSHeaders =
   withXFTPServerSNI $ \_ -> do
-    Fingerprint fpHTTP <- loadFileFingerprint "tests/fixtures/ca.crt"
+    Fingerprint fpHTTP <- loadFileFingerprint "tests/fixtures/web_ca.crt"
     let caHTTP = C.KeyHash fpHTTP
         cfg = defaultTransportClientConfig {clientALPN = Just ["h2"], useSNI = True}
     runTLSTransportClient defaultSupportedParamsHTTPS Nothing cfg Nothing "localhost" xftpTestPort (Just caHTTP) $ \(tls :: TLS 'TClient) -> do
@@ -472,7 +472,7 @@ testCORSHeaders =
 testCORSPreflight :: Expectation
 testCORSPreflight =
   withXFTPServerSNI $ \_ -> do
-    Fingerprint fpHTTP <- loadFileFingerprint "tests/fixtures/ca.crt"
+    Fingerprint fpHTTP <- loadFileFingerprint "tests/fixtures/web_ca.crt"
     let caHTTP = C.KeyHash fpHTTP
         cfg = defaultTransportClientConfig {clientALPN = Just ["h2"], useSNI = True}
     runTLSTransportClient defaultSupportedParamsHTTPS Nothing cfg Nothing "localhost" xftpTestPort (Just caHTTP) $ \(tls :: TLS 'TClient) -> do
@@ -505,10 +505,12 @@ testFileChunkDeliverySNI =
 testWebHandshake :: Expectation
 testWebHandshake =
   withXFTPServerSNI $ \_ -> do
-    Fingerprint fp <- loadFileFingerprint "tests/fixtures/ca.crt"
-    let keyHash = C.KeyHash fp
+    Fingerprint fpWeb <- loadFileFingerprint "tests/fixtures/web_ca.crt"
+    Fingerprint fpXFTP <- loadFileFingerprint "tests/fixtures/ca.crt"
+    let webCaHash = C.KeyHash fpWeb
+        keyHash = C.KeyHash fpXFTP
         cfg = defaultTransportClientConfig {clientALPN = Just ["h2"], useSNI = True}
-    runTLSTransportClient defaultSupportedParamsHTTPS Nothing cfg Nothing "localhost" xftpTestPort (Just keyHash) $ \(tls :: TLS 'TClient) -> do
+    runTLSTransportClient defaultSupportedParamsHTTPS Nothing cfg Nothing "localhost" xftpTestPort (Just webCaHash) $ \(tls :: TLS 'TClient) -> do
       let h2cfg = HC.defaultHTTP2ClientConfig {HC.bodyHeadSize = 65536}
       h2 <- either (error . show) pure =<< HC.attachHTTP2Client h2cfg (THDomainName "localhost") xftpTestPort mempty 65536 tls
       -- Send web challenge as XFTPClientHello
@@ -545,10 +547,12 @@ testWebHandshake =
 testWebReHandshake :: Expectation
 testWebReHandshake =
   withXFTPServerSNI $ \_ -> do
-    Fingerprint fp <- loadFileFingerprint "tests/fixtures/ca.crt"
-    let keyHash = C.KeyHash fp
+    Fingerprint fpWeb <- loadFileFingerprint "tests/fixtures/web_ca.crt"
+    Fingerprint fpXFTP <- loadFileFingerprint "tests/fixtures/ca.crt"
+    let webCaHash = C.KeyHash fpWeb
+        keyHash = C.KeyHash fpXFTP
         cfg = defaultTransportClientConfig {clientALPN = Just ["h2"], useSNI = True}
-    runTLSTransportClient defaultSupportedParamsHTTPS Nothing cfg Nothing "localhost" xftpTestPort (Just keyHash) $ \(tls :: TLS 'TClient) -> do
+    runTLSTransportClient defaultSupportedParamsHTTPS Nothing cfg Nothing "localhost" xftpTestPort (Just webCaHash) $ \(tls :: TLS 'TClient) -> do
       let h2cfg = HC.defaultHTTP2ClientConfig {HC.bodyHeadSize = 65536}
       h2 <- either (error . show) pure =<< HC.attachHTTP2Client h2cfg (THDomainName "localhost") xftpTestPort mempty 65536 tls
       g <- C.newRandom
diff --git a/tests/fixtures/web.crt b/tests/fixtures/web.crt
index 161bd23e0..570cfc58d 100644
--- a/tests/fixtures/web.crt
+++ b/tests/fixtures/web.crt
@@ -1,34 +1,61 @@
 -----BEGIN CERTIFICATE-----
-MIIDtTCCAzWgAwIBAgIUY5XXXyp6N8onS4vnZhh+qezGRmUwBQYDK2VxMCoxFjAU
-BgNVBAMMDVNNUCBzZXJ2ZXIgQ0ExEDAOBgNVBAoMB1NpbXBsZVgwIBcNMjYwMjEw
-MjMxMTEzWhgPNDc2NDAxMDcyMzExMTNaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCC
-AiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBALB59b8oyxP5YtXI1kemBzJU
-Pt0xLN/Tmzdul283DhbNCJV+eUn4fNz+PjiRS/F2vZLb3WXInPi3bc57hw2Yu94o
-7MXH5DTWkaubNq0bV0Koi17zZBSCOOq+MbPN7bUT1sOwOHadLh3IWTfkz9EufowD
-ivpymNKWbeAHMXlXsBJnHfHuM05MWlP87PTHd3D7YQmmgbISgEGG4GchWBqnnCxx
-gOOa09f/n+gWJFbN3hkbVZKMEpT5gu9WWsgv9BDhJzcBSw13MMz0sByxYKzhwQBJ
-ikFz+16AttZ0ccoDaWwajZzK8+yfFv9T3b8kWmioHi2dw2vBgSove78liUqYCsOU
-Bt5MNk3P037KgSJPdp6azsF3bMKmPssEhT9vHMPgSkiBfmBlJ7dTTRd9dh/cLKIO
-AMzu4O+pEodIOJDXTARBE6VX1qoEZQuft5+ljVy4i9ySpmHnkxLocF40rKV1G0c5
-LnVNTtr5GokC9sfIXZPZw0EEpk3eAseNWccwuyRfHQfL6yjcDig2IdLvLVcm9JyA
-2P5QpP15EoA3Ow9uX8HmBbSFe1F35rqcNwY0lhDXEboSA/X4xDLnu4aVhNPiUnRq
-NXqVlgz5ybRAUHd8fDBwK8fT5VhvuEnCja7+8hVc33gK56vu+28ZMkN2Y4z0GNQd
-iamPUZJlUcCJzNI2cz27AgMBAAGjgYYwgYMwFAYDVR0RBA0wC4IJbG9jYWxob3N0
-MAkGA1UdEwQCMAAwCwYDVR0PBAQDAgPIMBMGA1UdJQQMMAoGCCsGAQUFBwMBMB0G
-A1UdDgQWBBSWiPT6Nl13/CTjaHCkHp17GWoyvzAfBgNVHSMEGDAWgBQcUJvR7mm2
-6yxMQfCsWgbnwMmJVDAFBgMrZXEDcwCAU0Ly+IBQkjuefPKUvdE121uJou8EwE/r
-ccVywOsL61CjkMlzDbxBKKgq2ey8g9Gt76uQcG5AdIAPiWkdsgaKKrevwhV7/TBD
-D7UHgVyUBZWd362QJs4x/am59Wi6AbFQ98wvAudZzUfhx9h1te6BMAA=
+MIIFQTCCAymgAwIBAgIUZ7vJLAGbbk9wG8fLSTClM6NneS4wDQYJKoZIhvcNAQEL
+BQAwFjEUMBIGA1UEAwwLWEZUUCBXZWIgQ0EwIBcNMjYwMjEwMjMzMTQxWhgPNDc2
+NDAxMDcyMzMxNDFaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCAiIwDQYJKoZIhvcN
+AQEBBQADggIPADCCAgoCggIBALB59b8oyxP5YtXI1kemBzJUPt0xLN/Tmzdul283
+DhbNCJV+eUn4fNz+PjiRS/F2vZLb3WXInPi3bc57hw2Yu94o7MXH5DTWkaubNq0b
+V0Koi17zZBSCOOq+MbPN7bUT1sOwOHadLh3IWTfkz9EufowDivpymNKWbeAHMXlX
+sBJnHfHuM05MWlP87PTHd3D7YQmmgbISgEGG4GchWBqnnCxxgOOa09f/n+gWJFbN
+3hkbVZKMEpT5gu9WWsgv9BDhJzcBSw13MMz0sByxYKzhwQBJikFz+16AttZ0ccoD
+aWwajZzK8+yfFv9T3b8kWmioHi2dw2vBgSove78liUqYCsOUBt5MNk3P037KgSJP
+dp6azsF3bMKmPssEhT9vHMPgSkiBfmBlJ7dTTRd9dh/cLKIOAMzu4O+pEodIOJDX
+TARBE6VX1qoEZQuft5+ljVy4i9ySpmHnkxLocF40rKV1G0c5LnVNTtr5GokC9sfI
+XZPZw0EEpk3eAseNWccwuyRfHQfL6yjcDig2IdLvLVcm9JyA2P5QpP15EoA3Ow9u
+X8HmBbSFe1F35rqcNwY0lhDXEboSA/X4xDLnu4aVhNPiUnRqNXqVlgz5ybRAUHd8
+fDBwK8fT5VhvuEnCja7+8hVc33gK56vu+28ZMkN2Y4z0GNQdiamPUZJlUcCJzNI2
+cz27AgMBAAGjgYYwgYMwFAYDVR0RBA0wC4IJbG9jYWxob3N0MAkGA1UdEwQCMAAw
+CwYDVR0PBAQDAgPIMBMGA1UdJQQMMAoGCCsGAQUFBwMBMB0GA1UdDgQWBBSWiPT6
+Nl13/CTjaHCkHp17GWoyvzAfBgNVHSMEGDAWgBTrt7AAg953MNz2yI3mMIOGdhp4
+xTANBgkqhkiG9w0BAQsFAAOCAgEAdBNI0bmuthjyzKxR99GLm/hYPCi5GobQcv35
+sWzU/ivzkrKrjh7lZewc6Y5TyINgYYtLTnX82pJJdHDJQ8tQ2whW3eyiVF988HSO
+4Upw0TyyCAPN2PoCPQ338tfSwcNC63cK7z6/8aRFm9zMY+Lu14s2pDU1ry8bY8CZ
+pYDWT1qNgzBCt0geX93rU48RWO0/hdTWZksVfErDjhogtyV1DiEq6+fteRSjCNHV
+qQmgKoRNdphnduR/JMDWcHpmPdCqq4ffIGOsa3qRdjMqNTCc5Jgp1M92bXgbg+kh
+6K9PEcC+YKhTlJRkLxw98fxkZ16iFgKmPFfj9X4yye38lJJimK6c8/lXQcUQxKO7
+cqoIPVQ65xSxIxIprGDtF6CHZKGMkcNOycQjqEGq46qSXoNHNO47bheDlyCpmDIq
+B966RIpcOIZxsSn3mFLYK8vxdNMu4MuUmyoSQlgKGVchiSjErpQxyL+Ra1SSiZdZ
+uKxYQOXnCqg8VZKGmwRSCOSnwXT1bS8bc0wVe7MQpBnwWDjH7/GpfWXjvGmKfRIN
+loJ7I4akQ25xMa5CGzzsy5COJrXbq8vEDgJMZq02dgfVibK7minLSeOT7+xB1+pW
++sULqQgT+zOfVtdzQ7MrowNlEkUA2Sl9loQ9yhPHy5y4e6Z0Wv9yBps07dMdf8Oq
+mkhfGdY=
 -----END CERTIFICATE-----
 -----BEGIN CERTIFICATE-----
-MIIBtjCCATagAwIBAgIUe2PryrWo0xXX9vcA3WfbCzcdmgAwBQYDK2VxMCoxFjAU
-BgNVBAMMDVNNUCBzZXJ2ZXIgQ0ExEDAOBgNVBAoMB1NpbXBsZVgwIBcNMjIwMTEx
-MTExNjM5WhgPNDc1OTEyMDgxMTE2MzlaMCoxFjAUBgNVBAMMDVNNUCBzZXJ2ZXIg
-Q0ExEDAOBgNVBAoMB1NpbXBsZVgwQzAFBgMrZXEDOgCAcvFwVicR+RLZpiEWPFNR
-XYTbf+mFcX1NHIyPQDugFwOCgqJAW1fsjYgFhtQJSMH/lc1N7clfm4CjUzBRMB0G
-A1UdDgQWBBQcUJvR7mm26yxMQfCsWgbnwMmJVDAfBgNVHSMEGDAWgBQcUJvR7mm2
-6yxMQfCsWgbnwMmJVDAPBgNVHRMBAf8EBTADAQH/MAUGAytlcQNzAAAP/hMPNxyW
-fyJi+iJViodU+C/aklnvHtjh5P3AbiVCSUfY6+PEdvkC8Ov0pBAYpYi5ukSNNVXl
-ABVRlipB+vOcLQStNyaZ7kXzQ2IO/0btmIidh+G6SP8I4aytYIYYcV5pEUZpG1L1
-57g8P29SDv81AA==
+MIIFDzCCAvegAwIBAgIUI0uZLHpqLKV7FHEJonLx8bsild8wDQYJKoZIhvcNAQEL
+BQAwFjEUMBIGA1UEAwwLWEZUUCBXZWIgQ0EwIBcNMjYwMjEwMjMzMTM2WhgPNDc2
+NDAxMDcyMzMxMzZaMBYxFDASBgNVBAMMC1hGVFAgV2ViIENBMIICIjANBgkqhkiG
+9w0BAQEFAAOCAg8AMIICCgKCAgEAycPQtKmG0tzXtJz46Jh7IWwRpg1YmvR+n8KM
+sfCKKFmMYECHIQcHbKd/2aerElHmm3t13NCBn3biB1Rh1+tB8g9pNOadxSnl7Www
+QTI4uIsTeRVLOcwXkGg3BbQd7DKGQPEHPsS1gE47CGB+W48kndhzm5jrXeq/z/gJ
+mdiimrGWP+RP6touApyyjzDoEV6dmI5fcnf1Y0YCGQT7hEnA/OZH8YHZf+CbUnxZ
+B4BUuaUko+oji5OG2+UjI4X0CYmdvlAuUZ1uDe8kwQaJIgpnJidVBcCZP93VUr0I
+Upm8wJXoQdIAvfbT32LTMPcno0uyv9FmCEJY8fdteS1ByLZYNgM09IisEEIzVf8A
+Mx35vxm1Q7eCr8aoiOlgaA3EmTExhLuAYa1XbGSPwahOOtdLfdkr2Vxp2OdxY1AE
+Ze9b2iVvSdlwxpKRkaEI0rleEnBJkvmNP4dG2JBIv7PPu4OVfHHVCFmhFUxAjrcf
+FDyskq+58Wx8vvcTNeAGsv/fFGmt5C/muhOOZnm2ig6TRaE72QHZqfBA2PDKWC3p
+C+Oltm+9jkl1Ofo1IMFKf8fR3plltGez4vL4gc9o5aGoAB1f99Ig3D2Q40lOYucf
+GjsXQue+3pqzj8Dz90s3T1Rr340JtFpsw5+THUeIz/qM+mZiOvWOOM77k8iiKjOD
+VHRkBK0CAwEAAaNTMFEwHQYDVR0OBBYEFOu3sACD3ncw3PbIjeYwg4Z2GnjFMB8G
+A1UdIwQYMBaAFOu3sACD3ncw3PbIjeYwg4Z2GnjFMA8GA1UdEwEB/wQFMAMBAf8w
+DQYJKoZIhvcNAQELBQADggIBAGa2kZszMmzN55No/DFcnYchaszJ2Pn5duU/cjNf
+ZTme6e4CbB60Ot4gANnQa5geOiVGWw3WMNpqwInlMAKepuElhniZV3jDuKfsdGyy
+yicXzZe6QTDQc8uMqMU7eAZo/nbx+hObyh094a5KOXODiTnbAT7+udqlIcPGJkWa
+Sll5hZtlo3mIK59WsTjA1RxRAmjF/BxubBl1iSnxuO2fXLiO+EWTBMFMsVWZYFRC
+KK1HY4E0zVC+9qrjIPcc9nLYw1UV8EVFXcOSxvvMEsQ9mzGqhg6A65nD6TVOUSbf
+t+IWQXEvP6cDxTrsmdV4kTSeGPte2ANascE9BMOXgmWS/6mpa2NWKhbGvGZK/yTP
+3mHIEMxxve8KLeiFv2bQaHojIco6i85Y3a9EPGNfuzCsxXuK0lmT5A3mih3FgnUF
+KpVM4ci4O2qWjdrby6ydPjdU/KAywfNPg/htxoHen8wXm4fAVwy1JD7dM9OxgyyP
+8c+zThvQ8ueHrrzv68LPpMMwH5wskdSWt9+1bZyAZJN5MD05eqEJ6KoXj+oTnLTC
+4ERV1yxtECM8zqhT2fM7+UOKVjBRQWmZj4zlowRhogENHQKEXxghrHy0aKbz2daW
+usrIscN+SG9zHw3iq6Gf+hVKuLfTDPuBQDL+kIPep8mM0NI/Tayefzt7fyRn4R4W
+QBe2
 -----END CERTIFICATE-----
diff --git a/tests/fixtures/web_ca.crt b/tests/fixtures/web_ca.crt
index 6e4f36063..a9edf4966 100644
--- a/tests/fixtures/web_ca.crt
+++ b/tests/fixtures/web_ca.crt
@@ -1,30 +1,30 @@
 -----BEGIN CERTIFICATE-----
-MIIFDzCCAvegAwIBAgIUH4iIx8J7mtrJP1BTx9rg0u7NSxgwDQYJKoZIhvcNAQEL
-BQAwFjEUMBIGA1UEAwwLWEZUUCBXZWIgQ0EwIBcNMjYwMjEwMjE0MzQyWhgPMjEy
-NjAxMTcyMTQzNDJaMBYxFDASBgNVBAMMC1hGVFAgV2ViIENBMIICIjANBgkqhkiG
-9w0BAQEFAAOCAg8AMIICCgKCAgEA0R+kKVip2bAIBqnRS05GYJ3uBPidYrVEOyiC
-nB2asfcFIRlMBCWGchYeRrFxE70FCkbmHpIniiTrHwsYfG7uS6dW5myRbGX9g2X0
-L/zs9X4o7pYj+gWk/8X6FXr+urKT72kcNRgn/3fE+rYOaOPrYkQrHsUVsr0jWxt9
-9Qfjrh+PC8BT25BEDzoCqByHt6sVYMulpP8koUWIzcHTHdk5RNqzqIFZUnELsq0C
-dCohWw/87khT/ZNtWEG6gmipSj5/6IfabcF3C6dHIV69kff6f/Gv4W3z9yiusxw9
-hD5vwH1RaDQ7wPw+8w1wRu4ChOo9MWqjnprrahrEqURAQrKDEgzj9+ctULl7bd28
-f85ffJJlBF9P738u+0z5asJ7LNmy5hjNq4n0htKiuRiW8Yp2MSWqNZaF7rXRIFE9
-I9JhWQhaRwQ9Imq1WcOctj1+Ppk5o63cKsNssSkqNF0xK+VYFYLyebMJt0y3UqtW
-nLAXE2+xQTpzt2ixN0gHVX+lFGxNN0BKTrouuYLImPx5nBEdgjkeA9nFgRSAiG23
-5IvgvxYA777dcU4fdUI5WFbjhBIn0oo0qTmYM+b06a2B4B0b9RD0Vo3Zm4K0gGF5
-uRFx5SSS3SO16EWkEaXukq6vuSO3EiP4xQWPtn7OwuKN8AJxQOUxkrkaeLQPoHgp
-pgFmSfMCAwEAAaNTMFEwHQYDVR0OBBYEFBdmE/cMcZHm50hTCykKG0/IYAjgMB8G
-A1UdIwQYMBaAFBdmE/cMcZHm50hTCykKG0/IYAjgMA8GA1UdEwEB/wQFMAMBAf8w
-DQYJKoZIhvcNAQELBQADggIBABLntwY5YIdcFr+TI1a9c7v+4/OYg1xxn252Dqab
-u7UIE3esKuXSMa8j9KDiskklmzKV70Z4cEE7NWTwe6x5T/W1I38CWOhWSX9JmFBK
-V0WdT8nu+YfSz+Len8Q5PpJeiBhSItYRtQAkAkpvhpCcBzu50KBvZnGLnT+Lzwuc
-vC5eh7hT8srfLF342kS0sMZb0cGrtdihm2PnCpUJewaClLhUTU+MAgqf49yzY8Zr
-c4HWrpAb2VHsy9uzw5qKJCJQUUmIguetXbr+ZOp22Y5APCNfOBNwe+ndZAN4wk8f
-lZdIlOFIHZnHUF8rRufgM2bcn0QcqbuwHcaeiFb4TfTeEhF0Ck4LZlSjEDODNZ16
-yg3VkiCWlqwOZZ7gESwB672tzTHevZLQfyB0dC/6RVPFzoff+ZXpchOEsI9mAzhI
-3S1S/wOs2Tt7KOboMROg0vfYFO32a/nFHbr7EsVbdYdm/cCFH6vqX4AlSqMsBQ9Q
-g8HYShYmuW0w28mBSslIwA7/Wmh8uQ8oW/tr1mEVh1ZRCMjkLw+M2hKKZPJiveK5
-EtBxtD1xygGC/CvaWiiUMJjqxuKkOyZyEDl30+6QcgyTDjq8enFVoH/PfsancvFF
-nGYJhFbtwwKLjhf1XKjj8hT043s4pPzIIFLKrTCwaFALqRDadBT3st6VltWxgOcr
-sxdf
+MIIFDzCCAvegAwIBAgIUI0uZLHpqLKV7FHEJonLx8bsild8wDQYJKoZIhvcNAQEL
+BQAwFjEUMBIGA1UEAwwLWEZUUCBXZWIgQ0EwIBcNMjYwMjEwMjMzMTM2WhgPNDc2
+NDAxMDcyMzMxMzZaMBYxFDASBgNVBAMMC1hGVFAgV2ViIENBMIICIjANBgkqhkiG
+9w0BAQEFAAOCAg8AMIICCgKCAgEAycPQtKmG0tzXtJz46Jh7IWwRpg1YmvR+n8KM
+sfCKKFmMYECHIQcHbKd/2aerElHmm3t13NCBn3biB1Rh1+tB8g9pNOadxSnl7Www
+QTI4uIsTeRVLOcwXkGg3BbQd7DKGQPEHPsS1gE47CGB+W48kndhzm5jrXeq/z/gJ
+mdiimrGWP+RP6touApyyjzDoEV6dmI5fcnf1Y0YCGQT7hEnA/OZH8YHZf+CbUnxZ
+B4BUuaUko+oji5OG2+UjI4X0CYmdvlAuUZ1uDe8kwQaJIgpnJidVBcCZP93VUr0I
+Upm8wJXoQdIAvfbT32LTMPcno0uyv9FmCEJY8fdteS1ByLZYNgM09IisEEIzVf8A
+Mx35vxm1Q7eCr8aoiOlgaA3EmTExhLuAYa1XbGSPwahOOtdLfdkr2Vxp2OdxY1AE
+Ze9b2iVvSdlwxpKRkaEI0rleEnBJkvmNP4dG2JBIv7PPu4OVfHHVCFmhFUxAjrcf
+FDyskq+58Wx8vvcTNeAGsv/fFGmt5C/muhOOZnm2ig6TRaE72QHZqfBA2PDKWC3p
+C+Oltm+9jkl1Ofo1IMFKf8fR3plltGez4vL4gc9o5aGoAB1f99Ig3D2Q40lOYucf
+GjsXQue+3pqzj8Dz90s3T1Rr340JtFpsw5+THUeIz/qM+mZiOvWOOM77k8iiKjOD
+VHRkBK0CAwEAAaNTMFEwHQYDVR0OBBYEFOu3sACD3ncw3PbIjeYwg4Z2GnjFMB8G
+A1UdIwQYMBaAFOu3sACD3ncw3PbIjeYwg4Z2GnjFMA8GA1UdEwEB/wQFMAMBAf8w
+DQYJKoZIhvcNAQELBQADggIBAGa2kZszMmzN55No/DFcnYchaszJ2Pn5duU/cjNf
+ZTme6e4CbB60Ot4gANnQa5geOiVGWw3WMNpqwInlMAKepuElhniZV3jDuKfsdGyy
+yicXzZe6QTDQc8uMqMU7eAZo/nbx+hObyh094a5KOXODiTnbAT7+udqlIcPGJkWa
+Sll5hZtlo3mIK59WsTjA1RxRAmjF/BxubBl1iSnxuO2fXLiO+EWTBMFMsVWZYFRC
+KK1HY4E0zVC+9qrjIPcc9nLYw1UV8EVFXcOSxvvMEsQ9mzGqhg6A65nD6TVOUSbf
+t+IWQXEvP6cDxTrsmdV4kTSeGPte2ANascE9BMOXgmWS/6mpa2NWKhbGvGZK/yTP
+3mHIEMxxve8KLeiFv2bQaHojIco6i85Y3a9EPGNfuzCsxXuK0lmT5A3mih3FgnUF
+KpVM4ci4O2qWjdrby6ydPjdU/KAywfNPg/htxoHen8wXm4fAVwy1JD7dM9OxgyyP
+8c+zThvQ8ueHrrzv68LPpMMwH5wskdSWt9+1bZyAZJN5MD05eqEJ6KoXj+oTnLTC
+4ERV1yxtECM8zqhT2fM7+UOKVjBRQWmZj4zlowRhogENHQKEXxghrHy0aKbz2daW
+usrIscN+SG9zHw3iq6Gf+hVKuLfTDPuBQDL+kIPep8mM0NI/Tayefzt7fyRn4R4W
+QBe2
 -----END CERTIFICATE-----
diff --git a/tests/fixtures/web_ca.key b/tests/fixtures/web_ca.key
index f616c86fd..429554202 100644
--- a/tests/fixtures/web_ca.key
+++ b/tests/fixtures/web_ca.key
@@ -1,52 +1,52 @@
 -----BEGIN PRIVATE KEY-----
-MIIJQwIBADANBgkqhkiG9w0BAQEFAASCCS0wggkpAgEAAoICAQDRH6QpWKnZsAgG
-qdFLTkZgne4E+J1itUQ7KIKcHZqx9wUhGUwEJYZyFh5GsXETvQUKRuYekieKJOsf
-Cxh8bu5Lp1bmbJFsZf2DZfQv/Oz1fijuliP6BaT/xfoVev66spPvaRw1GCf/d8T6
-tg5o4+tiRCsexRWyvSNbG331B+OuH48LwFPbkEQPOgKoHIe3qxVgy6Wk/yShRYjN
-wdMd2TlE2rOogVlScQuyrQJ0KiFbD/zuSFP9k21YQbqCaKlKPn/oh9ptwXcLp0ch
-Xr2R9/p/8a/hbfP3KK6zHD2EPm/AfVFoNDvA/D7zDXBG7gKE6j0xaqOemutqGsSp
-REBCsoMSDOP35y1QuXtt3bx/zl98kmUEX0/vfy77TPlqwnss2bLmGM2rifSG0qK5
-GJbxinYxJao1loXutdEgUT0j0mFZCFpHBD0iarVZw5y2PX4+mTmjrdwqw2yxKSo0
-XTEr5VgVgvJ5swm3TLdSq1acsBcTb7FBOnO3aLE3SAdVf6UUbE03QEpOui65gsiY
-/HmcER2COR4D2cWBFICIbbfki+C/FgDvvt1xTh91QjlYVuOEEifSijSpOZgz5vTp
-rYHgHRv1EPRWjdmbgrSAYXm5EXHlJJLdI7XoRaQRpe6Srq+5I7cSI/jFBY+2fs7C
-4o3wAnFA5TGSuRp4tA+geCmmAWZJ8wIDAQABAoICAAPJOV0gRE7zH2oTd/0PiTml
-klIXuC25z2bsyFSQOqU/LiIXxacLkOAO43RvMPdlBCrX9sGV7s5S9cjFmCdkkL7g
-5DNewtE+FXVkCqQ1xYp6Qr5zDGqx4Hda+7iY1fTGV+RNOFwDuHGpFvFdC2y9t5y7
-VDaF5esq/nFfUYv2nRohayMQ09PVTE4kRDkL7y8Vk1kBxtlyXxTmX+Atwqc3MBC9
-juQdl2LlNguBk1pMCveNlgwwVgjwutmOsxQ6VdpIwGMS1pMHHiMhX6nMf80dOrVH
-SGJh7blLTMJkX/69bKOFAUzMKUrIplEbLK20EGqcnQgAgL7V2i49FtNjr3AlsDbC
-jC2ZcITODnIRJ4V1KqC13Y06y4vTVUrGLX+K0Wad50cjFzVOleRNaGQP3tyfDRxC
-o4de5IP1czYYzCwwnHSOkVhx/ciQBFYkWCNDXDGK6DqvVSVI2+6PLfBNZkGb3dlA
-DSMJN6LYe3DYHsRT3p3iE5qX6QTolg6IY47RHJnvWAlWmdXk116GhUu40OYmK99Y
-jZPmyTOA6wSiBn5bF4H9ulToUBfOiiVKKfGKoV8DyM5Fzg8ZrKvXbFYW2v3ReY7a
-ksGsCUUNPuiCFEAzabTt4zDwHnHAVCqLFbjgOocJ59iwXlidSJDuNfcjPJIo7EvV
-EEkeYBdOJYYQTf8KqKUNAoIBAQD3zIDHLYfRBfk7dqErBJ8upK1J+ReJklzn/MFG
-E4Gi0rdG5sYIIMhw9zSIncX9ZvMKFaz4yAcffwI9Loz6v8uin4F+e3B/vrUqKLDq
-lQiu0BDI0i2ZIXmuhW1SrTLhwcExWXunun/P+t/A9vowKpuUJpoywGXgju7Mh9Ek
-VIO3icgrhQ0HUGv1YnCwDG1Y0pOnt5ulnX5C2p0RQkEGw4Aqu6NsTdhWUl9ntVkw
-uCwWyp1xUcH/CSRkfXv+D8bnfpe/aPyNhkJq17rLfjqxUheuIix8DqvZmEYlsPxz
-Oj7vMJjJUyy5hbJTbhLphbVMb1hV+msfmNUXOySC3kvZvECHAoIBAQDYC3V7PYwn
-uwMDq3gA3mXAeMuE75N7QAjFX4p0wfqMcpFX0JZeE2rRSNBYig4eUwg4wN7UWpQ0
-AU4VSxzgVooMUV6jzk4r7d7Q1+URb93Bd5QRahXCyjWe//C3wjfGGsf875n2c48P
-f9uL2LAQK/SGiOPDfu2BBXQT6de2KuerYk1kkIEYHHiDMGFzc/yKVL7LBkulFbd+
-JOIulUX4JOMrf2qbDnBgWO9ho6tPZf/PYzyEXxgMU9SxyaFtMJPgantjiVtXLoq2
-/pdqc2VreLrjDLkArg98I1cm2790Ak+2+jWPEbHWMeLGUPg1ggxufgYKf0mMFYEK
-JlHsAPKqDSI1AoIBAE6x7o/SwNg76mvc/9AWlqsMd1APwE7bYY/3MDYeCcR44OWu
-cmOwbZeaml9so60XHcYtHhKgC8sP3dkqSHF1qakKuOg/MXoQSZ6K76yAChLiVwI/
-5WVFQUyQaSihgpA5pS4T+fZJfz/Ar4CrrsbPMTt6iuvlODV5jxL7awr7oB0Qr7ZK
-ednBy5dRXPI78BoOPgA8ijytaKS4orsRbG9GdRSdJIhHrJW1cUERUbLsOmw+ioOr
-cE2bTKhxRYho4EUyaeTK5bHYWo1t14+6lc8sgAK4LaJ0UlU3S8e6jmHVtJjnuQ3u
-0TxV3k0qnuz0nqAYmFgtwAl30uyexric+j+6zk8CggEBAMcRT+/91z3oqK9h+NI8
-Gl/OLiFQq4E+kJZlIWvSLS3qhxf2QAdxNtSeljNvCfFRKts4hFoBGFwO88bVDkd8
-FfmhpGWlPAxoQw4GULDPdfLFXy7opCJ3Ng9K36BCmie1F59tm10mP6TVeBOU1y4f
-glHQoqXJN8jRoJKUvsnBIPSfQJawO/NekIC5PKIoNoOz8JWcOGll6EyYabzomK88
-NgInhrBXDp8Ic5JxP/GKF7sdQm7qPHtnZy1mj5LP1wJKu2UM9JgRb4mMbzKMH+B2
-PyXk3DbPK7+DxNMuWmvnkVIVnPI2KLon/0Ai7YJIUXIiNyjG/prQWbVjd8rRWMfu
-EB0CggEBAPDc6Q8TsqpIWmk+1D1jd/xAhvMiEQ5VoKa6DTwo5TMlUdH2mmWbAsIa
-3XzJbE0IbxkiPsioYPuMtuXk6O60+UAvAlvDTODElqs+17bv7xPbGvBvqxlQ+rzJ
-A77T3EsVc2L1H9FL/DzeuGxcbXge70PYWBggq4qPT9mwESFZXaiTAcq375A92VoS
-4m6hDWw18YmCymx9Xjh8latfA3uxpY2wzgoOYxYn5sXmAtqMrnuc3MWgCBhgMMKE
-xHEKHNR5eGf6vL7IKqUfprQ25j6I1kVlJtcXoCEn97lYQ/Oxd/5ijvS72X0yI4zc
-jKWCUpUTNdIlYN3HcBgNnci7b2wXDHQ=
+MIIJRAIBADANBgkqhkiG9w0BAQEFAASCCS4wggkqAgEAAoICAQDJw9C0qYbS3Ne0
+nPjomHshbBGmDVia9H6fwoyx8IooWYxgQIchBwdsp3/Zp6sSUeabe3Xc0IGfduIH
+VGHX60HyD2k05p3FKeXtbDBBMji4ixN5FUs5zBeQaDcFtB3sMoZA8Qc+xLWATjsI
+YH5bjySd2HObmOtd6r/P+AmZ2KKasZY/5E/q2i4CnLKPMOgRXp2Yjl9yd/VjRgIZ
+BPuEScD85kfxgdl/4JtSfFkHgFS5pSSj6iOLk4bb5SMjhfQJiZ2+UC5RnW4N7yTB
+BokiCmcmJ1UFwJk/3dVSvQhSmbzAlehB0gC99tPfYtMw9yejS7K/0WYIQljx9215
+LUHItlg2AzT0iKwQQjNV/wAzHfm/GbVDt4KvxqiI6WBoDcSZMTGEu4BhrVdsZI/B
+qE4610t92SvZXGnY53FjUARl71vaJW9J2XDGkpGRoQjSuV4ScEmS+Y0/h0bYkEi/
+s8+7g5V8cdUIWaEVTECOtx8UPKySr7nxbHy+9xM14Aay/98Uaa3kL+a6E45mebaK
+DpNFoTvZAdmp8EDY8MpYLekL46W2b72OSXU5+jUgwUp/x9HemWW0Z7Pi8viBz2jl
+oagAHV/30iDcPZDjSU5i5x8aOxdC577emrOPwPP3SzdPVGvfjQm0WmzDn5MdR4jP
++oz6ZmI69Y44zvuTyKIqM4NUdGQErQIDAQABAoICABULRvPo8KaCoT711mJQMRuJ
+zYdvweubj69zF8ChcY+G04TghheUR5p2F/goLEgjYbWa2W64EqUCvc186B2grIam
+Q9dgLFl5psEuNRQ/vDnHS7cn2OpE1rpZnE+Me0h89pLEcPiDhNjGkBKuGc/L7MpH
+3rr+ZqIrj2kOGlZBCaiv2Bd+5TT+H6lnFZqow7O4FiDozJzAVUhO734TjnY8SRQ3
+oo5WeEyFrT2buZ92K6AXUOyFycJPl1PNIO6eFJeAEoNckpAxpt5uMHuvhlMWGa8Z
+kB0i+vj11r+j9r/CyDSgDhL7Z9dobK3SfWuQg8Jc7V5jZUx8OxG1uGXYqhFYr3d3
+N2CMz5f6T6VoM/f9WNtcaKNfeRHfysxLU1P7g57l5jo1ktts5lNOsrg2Pt8isAGF
+Yb13x1RRAKYlBzkuqUOx99g/wZvAHRzug2GBdmKpVTcFbqUQjhglxNm8mkYsb2ed
+RGs0jkq9IlJI7UxRaZbWCgBCwz/C2JBRpCbcom6WHqWSwjALGVI9inqZa9/Q01O4
+ZxXwBKpjVgkItqccjFOMppbx1HcUM5qUsRsdC3kGihWhAjO58j25yD4mO5JAlU6/
+u/EOOJ+F6/Dw6lDIfrkvkrt/GXruL7TY2BoIYhjOyXO/KEba7qyEShCtXMi44aj0
+m0Ldt1HKm3vbGQpffXsjAoIBAQDy8sGdw4YQQXXpBlASAsij8J+LoUlWOV+bxORo
+zES4VbF8OP3wLMgLj69nfnwdq1v3zggPHCdMmu4GqnD12HzalXDjT9T6ujxFawJK
+ApyPe3c7iBDUSX3tCfkEekKy6GPeDmFOrxeIuBA/lADYMGIY7qQisen2O5Qt0Vb0
+/kRyqrIDsWcVH4Cjx4zFFeOQ14vAzP69K/BeZVVJkeimY9EMVu2NJIrJmtBCw0yI
+7CaJa8Vu36y/u83ZC2jXxN1MhEJJCeBc2ydvyEjhuzvq2/dQbFHow6z/4AkAn9yS
+B1IIMz3X911FYxRnrTlDknWfB2r3ZVwHtXvIKjAtXT+OM1oPAoIBAQDUmqsOG4Ak
+lrXKPCs90YWqLnzOQPamyec3HP3Ma98Kw+O7ulQTFvjf+YB+OplFdtpaI04gk0Gm
+Vi5diu+HoABil//jduUOqUj5tNifv60XnrzVpVzek8oPphYCTq7P+vmBN66qQ6Sw
+JlYo6SBJZHR3FCvfIUTxQBPqZ9NL061lKt5g38YIxl8z2pK0JxrEfaxo7IXIFCm3
+/7DmtiikvQOrMLZ6r0pTnPaBf5+f8ySKU4x4kFJu3Hb9idBc1r13WMjqRPaqeS8p
+TAT6icyktA0N/aAoTbNj99wRvfjHvlXx9jh3jy9Ka2Dn2cE+YtY1/bIAvFQxiRzt
+8EW6sBKrbyGDAoIBAQCYsHN5WNpYOxwFAV+vgiphxqgvVIXH+DUbrEo1hzQlek4b
+GaKXoT107rA55mfRKdKaUtYD0Rjt721rqRFnodEOe9/ALXtYvVWF93Qv2aZWEy3j
+r2eMVEgdgygLZV+oG6Awfm8vyaGL3srvenBxby8oJkvoNlMp21YM2cXCIlAYlSle
+Ys+7mdn6lT7m2xP0A1QlL3FmqUffu+Y3X8mNUaygCb4w9+d2P6NmYmImp+ysb5xd
+S5zBwCHmqGITQfonzfPu/ZMSKPaHLaSIomlM+URdOkbceKaxBjgCOXaiHJG076eN
+pTzskBHR+y/DRThBY6MZq42Els4eBk3TJQj9sU6HAoIBAQCShsa9wlZe4UAJUc67
+nFvzHncF7+AOs7iXU3PYH8BpOvkJuTGYtoxwURUt6lUYewGifhKqgNMOQPdToR3U
+64FYckn6C0dzA1k4QFvMPd6eGNkspfuLq2/nuSASFwiEbwTm+el3j4dBoCphp8qI
+yqM6LrzN27AYVYFkXIpUCF/JCfKZ8aAbDB0xL8NMRmc8ZSEeb2UEsGDQX3kciQ8Z
++us8YSZjB8zCM7vxJHRvWLQmYc6+iTlHDsszknf4hEewqZBPZZhbhYnrfGkyAyb3
+nOAidFqdbG/mxjz2PWfowlWZnYjtXdHKCJeRM5Lr3FKmg2La/vFH8qftlVt5f0Be
+xwjhAoIBAQDSznM/ZO+yVMOME/L3Rphaep+vxzO2WHnlIeTFCep/fYS4PeeXvGQu
+Sg3JzMk6hh93OeZ0TYj0QCoi4/1RhQ2pbtIX0+FU/FtdfXJKWz9NXTT81DZtJK+n
+krVlutTEGSeDROkymcFmn56vGC6D9N/kv0tUoQ2tr4/5WLqE868Kl2Q3/AoLbIiF
+lH83oNTnXicaJAfrDlAlMieRmhIYbjYBdqjdiSkxG7N3t8TyTR6VRzCM7jy2/ZN1
+pFbX1ol+Dbf9zm6f3erTn1TnPju6gBZheQoCn2w7O00NapCgd2w6pVJT0I/srMS0
+7C4nNFR/SOa1Zpf0FsRY3pYK6usQu/9T
 -----END PRIVATE KEY-----
diff --git a/tests/fixtures/web_ca.srl b/tests/fixtures/web_ca.srl
index dfdcaaf21..f629f9cd0 100644
--- a/tests/fixtures/web_ca.srl
+++ b/tests/fixtures/web_ca.srl
@@ -1 +1 @@
-67BBC92C019B6E4F701BC7CB4930A533A367792D
+67BBC92C019B6E4F701BC7CB4930A533A367792E