# Test Certificates for TLS E2E Testing

This directory contains self-signed certificates for testing ModelConfig TLS support.

## Certificate Files

- **ca-cert.pem**: Test Certificate Authority (CA) certificate
- **ca-key.pem**: CA private key (used to sign server certificates)
- **server-cert.pem**: Server certificate signed by test CA
- **server-key.pem**: Server private key
- **server-req.pem**: Certificate signing request (CSR) for server
- **ca-cert.srl**: CA serial number file (generated by openssl)

## Certificate Details

- **CA Common Name**: Test CA
- **Server Common Name**: localhost
- **Subject Alternative Names**: DNS:localhost, IP:127.0.0.1
- **Validity**: 365 days from generation date
- **Key Size**: RSA 4096 bits

## Generation Commands

These certificates were generated using the following openssl commands:

### 1. Generate CA Certificate

```bash
# Create a config file for CA extensions
cat > ca-extensions.conf <<EOF
[req]
distinguished_name = req_distinguished_name
x509_extensions = v3_ca

[req_distinguished_name]

[v3_ca]
basicConstraints = critical,CA:TRUE
keyUsage = critical,keyCertSign,cRLSign
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer:always
EOF

openssl req -x509 -newkey rsa:4096 -nodes \
  -keyout ca-key.pem \
  -out ca-cert.pem \
  -days 365 \
  -subj "/CN=Test CA/O=Kagent Test/OU=Test" \
  -extensions v3_ca \
  -config ca-extensions.conf
```

### 2. Generate Server Key and Certificate Request

```bash
openssl req -newkey rsa:4096 -nodes \
  -keyout server-key.pem \
  -out server-req.pem \
  -subj "/CN=localhost/O=Kagent Test/OU=Test Server"
```

### 3. Sign Server Certificate with CA

```bash
openssl x509 -req \
  -in server-req.pem \
  -CA ca-cert.pem \
  -CAkey ca-key.pem \
  -CAcreateserial \
  -out server-cert.pem \
  -days 365 \
  -extfile <(echo "subjectAltName=DNS:localhost,IP:127.0.0.1")
```

## Regenerating Certificates

If certificates expire or need to be regenerated, run the commands above in sequence from the `tests/fixtures/certs/` directory.

## Security Note

These certificates are for **testing purposes only**. They use self-signed CAs and are not trusted by system certificate stores. Do not use these certificates in production environments.

## Usage in Tests

These certificates are used in E2E tests to:
1. Start test HTTPS servers with server-cert.pem and server-key.pem
2. Configure SSL contexts with ca-cert.pem as trusted CA
3. Verify TLS handshake and certificate validation logic
4. Test ModelConfig TLS configuration with real certificates

Example usage in tests:

```python
import ssl
from pathlib import Path

cert_dir = Path(__file__).parent / "fixtures" / "certs"

# Create SSL context for test server
server_ssl = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
server_ssl.load_cert_chain(
    cert_dir / "server-cert.pem",
    cert_dir / "server-key.pem"
)

# Create SSL context for client with custom CA
client_ssl = ssl.create_default_context(cafile=str(cert_dir / "ca-cert.pem"))
```

## Verification Commands

Verify certificate details:

```bash
# View CA certificate
openssl x509 -in ca-cert.pem -text -noout

# View server certificate
openssl x509 -in server-cert.pem -text -noout

# Verify server cert is signed by CA
openssl verify -CAfile ca-cert.pem server-cert.pem

# Test server connection (requires running server)
openssl s_client -connect localhost:8443 -CAfile ca-cert.pem
```
