src/crypto/tls/certificates_generator_test.go - go.git - Git at Google

 // Copyright 2026 The Go Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.

 package tls

 //go:generate go test -run ^TestGenerateCertificates$ crypto/tls -generate

 import (
 	"bytes"
 	"crypto/ecdsa"
 	"crypto/ed25519"
 	"crypto/elliptic"
 	"crypto/fips140"
 	"crypto/rand"
 	"crypto/rsa"
 	"crypto/x509"
 	"crypto/x509/pkix"
 	"encoding/pem"
 	"flag"
 	"fmt"
 	"internal/testenv"
 	"math/big"
 	"os"
 	"strings"
 	"testing"
 	"testing/cryptotest"
 	"time"
 )

 var generate = flag.Bool("generate", false, "regenerate certificates_test.go")

 func TestGenerateCertificates(t *testing.T) {
 	testenv.MustHaveSource(t)
 	if testing.Short() && !*generate {
 		t.Skip("set -generate to regenerate certificates_test.go, or run without -short to check")
 	}
 	if fips140.Version() == "v1.0.0" {
 		t.Skip("FIPS 140-3 module v1.0.0 doesn't support SetGlobalRandom")
 	}

 	// Allow RSA keys below 1024 bits for testRSA512.
 	t.Setenv("GODEBUG", os.Getenv("GODEBUG")+",rsa1024min=0")
 	// Unset cryptocustomrand to avoid MaybeReadByte non-determinism.
 	t.Setenv("GODEBUG", os.Getenv("GODEBUG")+",cryptocustomrand=0")
 	cryptotest.SetGlobalRandom(t, 0)

 	notBefore := time.Unix(1476984729, 0).Add(-100 * 24 * time.Hour)
 	notAfter := time.Unix(1476984729, 0).Add(100 * 24 * time.Hour)
 	serial := int64(0)
 	nextSerial := func() *big.Int {
 		serial++
 		return big.NewInt(serial)
 	}

 	// Root CA key and cert.
 	rootKey, err := rsa.GenerateKey(rand.Reader, 2048)
 	if err != nil {
 		t.Fatal(err)
 	}
 	rootTemplate := &x509.Certificate{
 		SerialNumber:          nextSerial(),
 		Subject:               pkix.Name{CommonName: "Root"},
 		NotBefore:             notBefore,
 		NotAfter:              notAfter,
 		KeyUsage:              x509.KeyUsageCertSign,
 		BasicConstraintsValid: true,
 		IsCA:                  true,
 	}
 	rootDER, err := x509.CreateCertificate(rand.Reader, rootTemplate, rootTemplate, &rootKey.PublicKey, rootKey)
 	if err != nil {
 		t.Fatal(err)
 	}
 	rootCert, err := x509.ParseCertificate(rootDER)
 	if err != nil {
 		t.Fatal(err)
 	}

 	// Client Root CA key and cert.
 	clientRootKey, err := rsa.GenerateKey(rand.Reader, 2048)
 	if err != nil {
 		t.Fatal(err)
 	}
 	clientRootTemplate := &x509.Certificate{
 		SerialNumber:          nextSerial(),
 		Subject:               pkix.Name{CommonName: "Client Root"},
 		NotBefore:             notBefore,
 		NotAfter:              notAfter,
 		KeyUsage:              x509.KeyUsageCertSign,
 		BasicConstraintsValid: true,
 		IsCA:                  true,
 	}
 	clientRootDER, err := x509.CreateCertificate(rand.Reader, clientRootTemplate, clientRootTemplate, &clientRootKey.PublicKey, clientRootKey)
 	if err != nil {
 		t.Fatal(err)
 	}
 	clientRootCert, err := x509.ParseCertificate(clientRootDER)
 	if err != nil {
 		t.Fatal(err)
 	}

 	// Helper to create a leaf template.
 	serverLeaf := func(cn string, san string) *x509.Certificate {
 		return &x509.Certificate{
 			SerialNumber:          nextSerial(),
 			Subject:               pkix.Name{CommonName: cn},
 			NotBefore:             notBefore,
 			NotAfter:              notAfter,
 			KeyUsage:              x509.KeyUsageDigitalSignature,
 			ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
 			BasicConstraintsValid: true,
 			DNSNames:              []string{san},
 		}
 	}
 	clientLeaf := func(cn string, san string) *x509.Certificate {
 		return &x509.Certificate{
 			SerialNumber:          nextSerial(),
 			Subject:               pkix.Name{CommonName: cn},
 			NotBefore:             notBefore,
 			NotAfter:              notAfter,
 			KeyUsage:              x509.KeyUsageDigitalSignature,
 			ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth},
 			BasicConstraintsValid: true,
 			DNSNames:              []string{san},
 		}
 	}

 	type certKeyPair struct {
 		name    string
 		comment string
 		certPEM string
 		keyPEM  string
 	}
 	var pairs []certKeyPair

 	emit := func(name, comment string, certDER []byte, key any) {
 		keyDER, err := x509.MarshalPKCS8PrivateKey(key)
 		if err != nil {
 			t.Fatal(err)
 		}
 		certPEM := string(pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: certDER}))
 		keyPEM := string(pem.EncodeToMemory(&pem.Block{Type: "TESTING KEY", Bytes: keyDER}))
 		pairs = append(pairs, certKeyPair{name, comment, strings.TrimSpace(certPEM), strings.TrimSpace(keyPEM)})
 	}

 	// Roots.
 	emit("testRoot", "Self-signed RSA 2048 root CA, CN=Root.", rootDER, rootKey)
 	emit("testClientRoot", "Self-signed RSA 2048 root CA, CN=Client Root.", clientRootDER, clientRootKey)

 	// Server certs issued by root.

 	// ECDSA P-256 (default).
 	ecdsaP256Key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
 	if err != nil {
 		t.Fatal(err)
 	}
 	tmpl := serverLeaf("ECDSA P-256", "test.golang.example")
 	der, err := x509.CreateCertificate(rand.Reader, tmpl, rootCert, &ecdsaP256Key.PublicKey, rootKey)
 	if err != nil {
 		t.Fatal(err)
 	}
 	emit("testECDSAP256", "ECDSA P-256 server leaf, SAN=test.golang.example, issued by Root.", der, ecdsaP256Key)

 	// RSA 2048.
 	rsa2048Key, err := rsa.GenerateKey(rand.Reader, 2048)
 	if err != nil {
 		t.Fatal(err)
 	}
 	tmpl = serverLeaf("RSA 2048", "test.golang.example")
 	der, err = x509.CreateCertificate(rand.Reader, tmpl, rootCert, &rsa2048Key.PublicKey, rootKey)
 	if err != nil {
 		t.Fatal(err)
 	}
 	emit("testRSA2048", "RSA 2048 server leaf, SAN=test.golang.example, issued by Root.", der, rsa2048Key)

 	// ECDSA P-384.
 	ecdsaP384Key, err := ecdsa.GenerateKey(elliptic.P384(), rand.Reader)
 	if err != nil {
 		t.Fatal(err)
 	}
 	tmpl = serverLeaf("ECDSA P-384", "test.golang.example")
 	der, err = x509.CreateCertificate(rand.Reader, tmpl, rootCert, &ecdsaP384Key.PublicKey, rootKey)
 	if err != nil {
 		t.Fatal(err)
 	}
 	emit("testECDSAP384", "ECDSA P-384 server leaf, SAN=test.golang.example, issued by Root.", der, ecdsaP384Key)

 	// ECDSA P-521.
 	ecdsaP521Key, err := ecdsa.GenerateKey(elliptic.P521(), rand.Reader)
 	if err != nil {
 		t.Fatal(err)
 	}
 	tmpl = serverLeaf("ECDSA P-521", "test.golang.example")
 	der, err = x509.CreateCertificate(rand.Reader, tmpl, rootCert, &ecdsaP521Key.PublicKey, rootKey)
 	if err != nil {
 		t.Fatal(err)
 	}
 	emit("testECDSAP521", "ECDSA P-521 server leaf, SAN=test.golang.example, issued by Root.", der, ecdsaP521Key)

 	// Ed25519.
 	ed25519Pub, ed25519Key, err := ed25519.GenerateKey(rand.Reader)
 	if err != nil {
 		t.Fatal(err)
 	}
 	tmpl = serverLeaf("Ed25519", "test.golang.example")
 	der, err = x509.CreateCertificate(rand.Reader, tmpl, rootCert, ed25519Pub, rootKey)
 	if err != nil {
 		t.Fatal(err)
 	}
 	emit("testEd25519", "Ed25519 server leaf, SAN=test.golang.example, issued by Root.", der, ed25519Key)

 	// RSA-PSS: signed by root with SHA512WithRSAPSS. The leaf SPKI is
 	// rsaEncryption while the signatureAlgorithm is rsassaPss, for use
 	// with the rsa_pss_rsae_* SignatureSchemes.
 	rsaPSSKey, err := rsa.GenerateKey(rand.Reader, 2048)
 	if err != nil {
 		t.Fatal(err)
 	}
 	tmpl = serverLeaf("RSA-PSS", "test.golang.example")
 	tmpl.SignatureAlgorithm = x509.SHA512WithRSAPSS
 	der, err = x509.CreateCertificate(rand.Reader, tmpl, rootCert, &rsaPSSKey.PublicKey, rootKey)
 	if err != nil {
 		t.Fatal(err)
 	}
 	emit("testRSAPSS", "RSA 2048 server leaf, SAN=test.golang.example, issued by Root.\n\t// Signature algorithm is SHA512WithRSAPSS (rsaEncryption SPKI, rsassaPss signature).", der, rsaPSSKey)

 	// RSA 1024: key is intentionally too small for rsa_pss_rsae_sha512
 	// (which requires at least 1040 bits), but large enough for
 	// rsa_pss_rsae_sha256. Used by TestHandshakeServerRSAPSS.
 	rsa1024Key, err := rsa.GenerateKey(rand.Reader, 1024)
 	if err != nil {
 		t.Fatal(err)
 	}
 	tmpl = serverLeaf("RSA 1024", "test.golang.example")
 	der, err = x509.CreateCertificate(rand.Reader, tmpl, rootCert, &rsa1024Key.PublicKey, rootKey)
 	if err != nil {
 		t.Fatal(err)
 	}
 	emit("testRSA1024", "RSA 1024 server leaf, SAN=test.golang.example, issued by Root.\n\t// Key is too small for rsa_pss_rsae_sha512; used by TestHandshakeServerRSAPSS.", der, rsa1024Key)

 	// RSA 512: key is too small for any rsa_pss_rsae_* SignatureScheme
 	// (the smallest, SHA-256, requires at least 528 bits). Used by
 	// TestKeyTooSmallForRSAPSS.
 	rsa512Key, err := rsa.GenerateKey(rand.Reader, 512)
 	if err != nil {
 		t.Fatal(err)
 	}
 	tmpl = serverLeaf("RSA 512", "test.golang.example")
 	der, err = x509.CreateCertificate(rand.Reader, tmpl, rootCert, &rsa512Key.PublicKey, rootKey)
 	if err != nil {
 		t.Fatal(err)
 	}
 	emit("testRSA512", "RSA 512 server leaf, SAN=test.golang.example, issued by Root.\n\t// Key is too small for any rsa_pss_rsae_*; used by TestKeyTooSmallForRSAPSS.", der, rsa512Key)

 	// SNI cert (different SAN for SNI mismatch testing).
 	sniKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
 	if err != nil {
 		t.Fatal(err)
 	}
 	tmpl = serverLeaf("different.example.com", "different.example.com")
 	der, err = x509.CreateCertificate(rand.Reader, tmpl, rootCert, &sniKey.PublicKey, rootKey)
 	if err != nil {
 		t.Fatal(err)
 	}
 	emit("testSNI", "ECDSA P-256 server leaf, SAN=different.example.com, issued by Root.", der, sniKey)

 	// Client certs issued by client root.

 	clientRSAKey, err := rsa.GenerateKey(rand.Reader, 2048)
 	if err != nil {
 		t.Fatal(err)
 	}
 	tmpl = clientLeaf("clientAuth RSA 2048", "test.golang.example")
 	der, err = x509.CreateCertificate(rand.Reader, tmpl, clientRootCert, &clientRSAKey.PublicKey, clientRootKey)
 	if err != nil {
 		t.Fatal(err)
 	}
 	emit("testClientRSA2048", "RSA 2048 client leaf, SAN=test.golang.example, issued by Client Root.", der, clientRSAKey)

 	clientECDSAKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
 	if err != nil {
 		t.Fatal(err)
 	}
 	tmpl = clientLeaf("clientAuth ECDSA P-256", "test.golang.example")
 	der, err = x509.CreateCertificate(rand.Reader, tmpl, clientRootCert, &clientECDSAKey.PublicKey, clientRootKey)
 	if err != nil {
 		t.Fatal(err)
 	}
 	emit("testClientECDSAP256", "ECDSA P-256 client leaf, SAN=test.golang.example, issued by Client Root.", der, clientECDSAKey)

 	clientEd25519Pub, clientEd25519Key, err := ed25519.GenerateKey(rand.Reader)
 	if err != nil {
 		t.Fatal(err)
 	}
 	tmpl = clientLeaf("clientAuth Ed25519", "test.golang.example")
 	der, err = x509.CreateCertificate(rand.Reader, tmpl, clientRootCert, clientEd25519Pub, clientRootKey)
 	if err != nil {
 		t.Fatal(err)
 	}
 	emit("testClientEd25519", "Ed25519 client leaf, SAN=test.golang.example, issued by Client Root.", der, clientEd25519Key)

 	// Client RSA-PSS: signed by client root with SHA512WithRSAPSS. The leaf
 	// SPKI is rsaEncryption while the signatureAlgorithm is rsassaPss.
 	clientRSAPSSKey, err := rsa.GenerateKey(rand.Reader, 2048)
 	if err != nil {
 		t.Fatal(err)
 	}
 	tmpl = clientLeaf("clientAuth RSA-PSS", "test.golang.example")
 	tmpl.SignatureAlgorithm = x509.SHA512WithRSAPSS
 	der, err = x509.CreateCertificate(rand.Reader, tmpl, clientRootCert, &clientRSAPSSKey.PublicKey, clientRootKey)
 	if err != nil {
 		t.Fatal(err)
 	}
 	emit("testClientRSAPSS", "RSA 2048 client leaf, SAN=test.golang.example, issued by Client Root.\n\t// Signature algorithm is SHA512WithRSAPSS (rsaEncryption SPKI, rsassaPss signature).", der, clientRSAPSSKey)

 	// Generate certificates_test.go.
 	var buf bytes.Buffer
 	fmt.Fprint(&buf, `// Code generated by certificates_generator_test.go; DO NOT EDIT.
 // To regenerate, run: go generate

 package tls

 import "crypto/x509"

 `)

 	fmt.Fprint(&buf, `var (
 `)
 	for _, p := range pairs {
 		fmt.Fprintf(&buf, "\t// %s\n", p.comment)
 		fmt.Fprintf(&buf, "\t%sCert = parseTestCert(%sCertPEM, %sKeyPEM)\n\n",
 			p.name, p.name, p.name)
 	}
 	fmt.Fprint(&buf, `	// x509.CertPool containing testRootCert.
 	testRootCertPool = newTestCertPool(testRootCertPEM)
 	// x509.CertPool containing testClientRootCert.
 	testClientRootCertPool = newTestCertPool(testClientRootCertPEM)
 )

 `)

 	for _, p := range pairs {
 		fmt.Fprintf(&buf, "const %sCertPEM = `\n%s`\n\n", p.name, p.certPEM)
 		fmt.Fprintf(&buf, "const %sKeyPEM = `\n%s`\n\n", p.name, p.keyPEM)
 	}

 	fmt.Fprint(&buf, `func parseTestCert(certPEM, keyPEM string) Certificate {
 	tlsCert, err := X509KeyPair([]byte(certPEM), []byte(testingKey(keyPEM)))
 	if err != nil {
 		panic(err)
 	}
 	return tlsCert
 }

 func newTestCertPool(certPEM string) *x509.CertPool {
 	pool := x509.NewCertPool()
 	if !pool.AppendCertsFromPEM([]byte(certPEM)) {
 		panic("failed to parse certificate for pool")
 	}
 	return pool
 }
 `)

 	if *generate {
 		if err := os.WriteFile("certificates_test.go", buf.Bytes(), 0644); err != nil {
 			t.Fatal(err)
 		}
 		t.Log("wrote certificates_test.go")
 	} else {
 		// Check that the generated content matches the existing file.
 		existing, err := os.ReadFile("certificates_test.go")
 		if err != nil {
 			t.Fatal(err)
 		}
 		if !bytes.Equal(existing, buf.Bytes()) {
 			t.Fatal("certificates_test.go is out of date; run go generate to update it")
 		}
 	}
 }
	// Copyright 2026 The Go Authors. All rights reserved.
	// Use of this source code is governed by a BSD-style
	// license that can be found in the LICENSE file.

	package tls

	//go:generate go test -run ^TestGenerateCertificates$ crypto/tls -generate

	import (
	"bytes"
	"crypto/ecdsa"
	"crypto/ed25519"
	"crypto/elliptic"
	"crypto/fips140"
	"crypto/rand"
	"crypto/rsa"
	"crypto/x509"
	"crypto/x509/pkix"
	"encoding/pem"
	"flag"
	"fmt"
	"internal/testenv"
	"math/big"
	"os"
	"strings"
	"testing"
	"testing/cryptotest"
	"time"
	)

	var generate = flag.Bool("generate", false, "regenerate certificates_test.go")

	func TestGenerateCertificates(t *testing.T) {
	testenv.MustHaveSource(t)
	if testing.Short() && !*generate {
	t.Skip("set -generate to regenerate certificates_test.go, or run without -short to check")
	}
	if fips140.Version() == "v1.0.0" {
	t.Skip("FIPS 140-3 module v1.0.0 doesn't support SetGlobalRandom")
	}

	// Allow RSA keys below 1024 bits for testRSA512.
	t.Setenv("GODEBUG", os.Getenv("GODEBUG")+",rsa1024min=0")
	// Unset cryptocustomrand to avoid MaybeReadByte non-determinism.
	t.Setenv("GODEBUG", os.Getenv("GODEBUG")+",cryptocustomrand=0")
	cryptotest.SetGlobalRandom(t, 0)

	notBefore := time.Unix(1476984729, 0).Add(-100 * 24 * time.Hour)
	notAfter := time.Unix(1476984729, 0).Add(100 * 24 * time.Hour)
	serial := int64(0)
	nextSerial := func() *big.Int {
	serial++
	return big.NewInt(serial)
	}

	// Root CA key and cert.
	rootKey, err := rsa.GenerateKey(rand.Reader, 2048)
	if err != nil {
	t.Fatal(err)
	}
	rootTemplate := &x509.Certificate{
	SerialNumber: nextSerial(),
	Subject: pkix.Name{CommonName: "Root"},
	NotBefore: notBefore,
	NotAfter: notAfter,
	KeyUsage: x509.KeyUsageCertSign,
	BasicConstraintsValid: true,
	IsCA: true,
	}
	rootDER, err := x509.CreateCertificate(rand.Reader, rootTemplate, rootTemplate, &rootKey.PublicKey, rootKey)
	if err != nil {
	t.Fatal(err)
	}
	rootCert, err := x509.ParseCertificate(rootDER)
	if err != nil {
	t.Fatal(err)
	}

	// Client Root CA key and cert.
	clientRootKey, err := rsa.GenerateKey(rand.Reader, 2048)
	if err != nil {
	t.Fatal(err)
	}
	clientRootTemplate := &x509.Certificate{
	SerialNumber: nextSerial(),
	Subject: pkix.Name{CommonName: "Client Root"},
	NotBefore: notBefore,
	NotAfter: notAfter,
	KeyUsage: x509.KeyUsageCertSign,
	BasicConstraintsValid: true,
	IsCA: true,
	}
	clientRootDER, err := x509.CreateCertificate(rand.Reader, clientRootTemplate, clientRootTemplate, &clientRootKey.PublicKey, clientRootKey)
	if err != nil {
	t.Fatal(err)
	}
	clientRootCert, err := x509.ParseCertificate(clientRootDER)
	if err != nil {
	t.Fatal(err)
	}

	// Helper to create a leaf template.
	serverLeaf := func(cn string, san string) *x509.Certificate {
	return &x509.Certificate{
	SerialNumber: nextSerial(),
	Subject: pkix.Name{CommonName: cn},
	NotBefore: notBefore,
	NotAfter: notAfter,
	KeyUsage: x509.KeyUsageDigitalSignature,
	ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
	BasicConstraintsValid: true,
	DNSNames: []string{san},
	}
	}
	clientLeaf := func(cn string, san string) *x509.Certificate {
	return &x509.Certificate{
	SerialNumber: nextSerial(),
	Subject: pkix.Name{CommonName: cn},
	NotBefore: notBefore,
	NotAfter: notAfter,
	KeyUsage: x509.KeyUsageDigitalSignature,
	ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth},
	BasicConstraintsValid: true,
	DNSNames: []string{san},
	}
	}

	type certKeyPair struct {
	name string
	comment string
	certPEM string
	keyPEM string
	}
	var pairs []certKeyPair

	emit := func(name, comment string, certDER []byte, key any) {
	keyDER, err := x509.MarshalPKCS8PrivateKey(key)
	if err != nil {
	t.Fatal(err)
	}
	certPEM := string(pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: certDER}))
	keyPEM := string(pem.EncodeToMemory(&pem.Block{Type: "TESTING KEY", Bytes: keyDER}))
	pairs = append(pairs, certKeyPair{name, comment, strings.TrimSpace(certPEM), strings.TrimSpace(keyPEM)})
	}

	// Roots.
	emit("testRoot", "Self-signed RSA 2048 root CA, CN=Root.", rootDER, rootKey)
	emit("testClientRoot", "Self-signed RSA 2048 root CA, CN=Client Root.", clientRootDER, clientRootKey)

	// Server certs issued by root.

	// ECDSA P-256 (default).
	ecdsaP256Key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
	if err != nil {
	t.Fatal(err)
	}
	tmpl := serverLeaf("ECDSA P-256", "test.golang.example")
	der, err := x509.CreateCertificate(rand.Reader, tmpl, rootCert, &ecdsaP256Key.PublicKey, rootKey)
	if err != nil {
	t.Fatal(err)
	}
	emit("testECDSAP256", "ECDSA P-256 server leaf, SAN=test.golang.example, issued by Root.", der, ecdsaP256Key)

	// RSA 2048.
	rsa2048Key, err := rsa.GenerateKey(rand.Reader, 2048)
	if err != nil {
	t.Fatal(err)
	}
	tmpl = serverLeaf("RSA 2048", "test.golang.example")
	der, err = x509.CreateCertificate(rand.Reader, tmpl, rootCert, &rsa2048Key.PublicKey, rootKey)
	if err != nil {
	t.Fatal(err)
	}
	emit("testRSA2048", "RSA 2048 server leaf, SAN=test.golang.example, issued by Root.", der, rsa2048Key)

	// ECDSA P-384.
	ecdsaP384Key, err := ecdsa.GenerateKey(elliptic.P384(), rand.Reader)
	if err != nil {
	t.Fatal(err)
	}
	tmpl = serverLeaf("ECDSA P-384", "test.golang.example")
	der, err = x509.CreateCertificate(rand.Reader, tmpl, rootCert, &ecdsaP384Key.PublicKey, rootKey)
	if err != nil {
	t.Fatal(err)
	}
	emit("testECDSAP384", "ECDSA P-384 server leaf, SAN=test.golang.example, issued by Root.", der, ecdsaP384Key)

	// ECDSA P-521.
	ecdsaP521Key, err := ecdsa.GenerateKey(elliptic.P521(), rand.Reader)
	if err != nil {
	t.Fatal(err)
	}
	tmpl = serverLeaf("ECDSA P-521", "test.golang.example")
	der, err = x509.CreateCertificate(rand.Reader, tmpl, rootCert, &ecdsaP521Key.PublicKey, rootKey)
	if err != nil {
	t.Fatal(err)
	}
	emit("testECDSAP521", "ECDSA P-521 server leaf, SAN=test.golang.example, issued by Root.", der, ecdsaP521Key)

	// Ed25519.
	ed25519Pub, ed25519Key, err := ed25519.GenerateKey(rand.Reader)
	if err != nil {
	t.Fatal(err)
	}
	tmpl = serverLeaf("Ed25519", "test.golang.example")
	der, err = x509.CreateCertificate(rand.Reader, tmpl, rootCert, ed25519Pub, rootKey)
	if err != nil {
	t.Fatal(err)
	}
	emit("testEd25519", "Ed25519 server leaf, SAN=test.golang.example, issued by Root.", der, ed25519Key)

	// RSA-PSS: signed by root with SHA512WithRSAPSS. The leaf SPKI is
	// rsaEncryption while the signatureAlgorithm is rsassaPss, for use
	// with the rsa_pss_rsae_* SignatureSchemes.
	rsaPSSKey, err := rsa.GenerateKey(rand.Reader, 2048)
	if err != nil {
	t.Fatal(err)
	}
	tmpl = serverLeaf("RSA-PSS", "test.golang.example")
	tmpl.SignatureAlgorithm = x509.SHA512WithRSAPSS
	der, err = x509.CreateCertificate(rand.Reader, tmpl, rootCert, &rsaPSSKey.PublicKey, rootKey)
	if err != nil {
	t.Fatal(err)
	}
	emit("testRSAPSS", "RSA 2048 server leaf, SAN=test.golang.example, issued by Root.\n\t// Signature algorithm is SHA512WithRSAPSS (rsaEncryption SPKI, rsassaPss signature).", der, rsaPSSKey)

	// RSA 1024: key is intentionally too small for rsa_pss_rsae_sha512
	// (which requires at least 1040 bits), but large enough for
	// rsa_pss_rsae_sha256. Used by TestHandshakeServerRSAPSS.
	rsa1024Key, err := rsa.GenerateKey(rand.Reader, 1024)
	if err != nil {
	t.Fatal(err)
	}
	tmpl = serverLeaf("RSA 1024", "test.golang.example")
	der, err = x509.CreateCertificate(rand.Reader, tmpl, rootCert, &rsa1024Key.PublicKey, rootKey)
	if err != nil {
	t.Fatal(err)
	}
	emit("testRSA1024", "RSA 1024 server leaf, SAN=test.golang.example, issued by Root.\n\t// Key is too small for rsa_pss_rsae_sha512; used by TestHandshakeServerRSAPSS.", der, rsa1024Key)

	// RSA 512: key is too small for any rsa_pss_rsae_* SignatureScheme
	// (the smallest, SHA-256, requires at least 528 bits). Used by
	// TestKeyTooSmallForRSAPSS.
	rsa512Key, err := rsa.GenerateKey(rand.Reader, 512)
	if err != nil {
	t.Fatal(err)
	}
	tmpl = serverLeaf("RSA 512", "test.golang.example")
	der, err = x509.CreateCertificate(rand.Reader, tmpl, rootCert, &rsa512Key.PublicKey, rootKey)
	if err != nil {
	t.Fatal(err)
	}
	emit("testRSA512", "RSA 512 server leaf, SAN=test.golang.example, issued by Root.\n\t// Key is too small for any rsa_pss_rsae_*; used by TestKeyTooSmallForRSAPSS.", der, rsa512Key)

	// SNI cert (different SAN for SNI mismatch testing).
	sniKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
	if err != nil {
	t.Fatal(err)
	}
	tmpl = serverLeaf("different.example.com", "different.example.com")
	der, err = x509.CreateCertificate(rand.Reader, tmpl, rootCert, &sniKey.PublicKey, rootKey)
	if err != nil {
	t.Fatal(err)
	}
	emit("testSNI", "ECDSA P-256 server leaf, SAN=different.example.com, issued by Root.", der, sniKey)

	// Client certs issued by client root.

	clientRSAKey, err := rsa.GenerateKey(rand.Reader, 2048)
	if err != nil {
	t.Fatal(err)
	}
	tmpl = clientLeaf("clientAuth RSA 2048", "test.golang.example")
	der, err = x509.CreateCertificate(rand.Reader, tmpl, clientRootCert, &clientRSAKey.PublicKey, clientRootKey)
	if err != nil {
	t.Fatal(err)
	}
	emit("testClientRSA2048", "RSA 2048 client leaf, SAN=test.golang.example, issued by Client Root.", der, clientRSAKey)

	clientECDSAKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
	if err != nil {
	t.Fatal(err)
	}
	tmpl = clientLeaf("clientAuth ECDSA P-256", "test.golang.example")
	der, err = x509.CreateCertificate(rand.Reader, tmpl, clientRootCert, &clientECDSAKey.PublicKey, clientRootKey)
	if err != nil {
	t.Fatal(err)
	}
	emit("testClientECDSAP256", "ECDSA P-256 client leaf, SAN=test.golang.example, issued by Client Root.", der, clientECDSAKey)

	clientEd25519Pub, clientEd25519Key, err := ed25519.GenerateKey(rand.Reader)
	if err != nil {
	t.Fatal(err)
	}
	tmpl = clientLeaf("clientAuth Ed25519", "test.golang.example")
	der, err = x509.CreateCertificate(rand.Reader, tmpl, clientRootCert, clientEd25519Pub, clientRootKey)
	if err != nil {
	t.Fatal(err)
	}
	emit("testClientEd25519", "Ed25519 client leaf, SAN=test.golang.example, issued by Client Root.", der, clientEd25519Key)

	// Client RSA-PSS: signed by client root with SHA512WithRSAPSS. The leaf
	// SPKI is rsaEncryption while the signatureAlgorithm is rsassaPss.
	clientRSAPSSKey, err := rsa.GenerateKey(rand.Reader, 2048)
	if err != nil {
	t.Fatal(err)
	}
	tmpl = clientLeaf("clientAuth RSA-PSS", "test.golang.example")
	tmpl.SignatureAlgorithm = x509.SHA512WithRSAPSS
	der, err = x509.CreateCertificate(rand.Reader, tmpl, clientRootCert, &clientRSAPSSKey.PublicKey, clientRootKey)
	if err != nil {
	t.Fatal(err)
	}
	emit("testClientRSAPSS", "RSA 2048 client leaf, SAN=test.golang.example, issued by Client Root.\n\t// Signature algorithm is SHA512WithRSAPSS (rsaEncryption SPKI, rsassaPss signature).", der, clientRSAPSSKey)

	// Generate certificates_test.go.
	var buf bytes.Buffer
	fmt.Fprint(&buf, `// Code generated by certificates_generator_test.go; DO NOT EDIT.
	// To regenerate, run: go generate

	package tls

	import "crypto/x509"

	`)

	fmt.Fprint(&buf, `var (
	`)
	for _, p := range pairs {
	fmt.Fprintf(&buf, "\t// %s\n", p.comment)
	fmt.Fprintf(&buf, "\t%sCert = parseTestCert(%sCertPEM, %sKeyPEM)\n\n",
	p.name, p.name, p.name)
	}
	fmt.Fprint(&buf, ` // x509.CertPool containing testRootCert.
	testRootCertPool = newTestCertPool(testRootCertPEM)
	// x509.CertPool containing testClientRootCert.
	testClientRootCertPool = newTestCertPool(testClientRootCertPEM)
	)

	`)

	for _, p := range pairs {
	fmt.Fprintf(&buf, "const %sCertPEM = `\n%s`\n\n", p.name, p.certPEM)
	fmt.Fprintf(&buf, "const %sKeyPEM = `\n%s`\n\n", p.name, p.keyPEM)
	}

	fmt.Fprint(&buf, `func parseTestCert(certPEM, keyPEM string) Certificate {
	tlsCert, err := X509KeyPair([]byte(certPEM), []byte(testingKey(keyPEM)))
	if err != nil {
	panic(err)
	}
	return tlsCert
	}

	func newTestCertPool(certPEM string) *x509.CertPool {
	pool := x509.NewCertPool()
	if !pool.AppendCertsFromPEM([]byte(certPEM)) {
	panic("failed to parse certificate for pool")
	}
	return pool
	}
	`)

	if *generate {
	if err := os.WriteFile("certificates_test.go", buf.Bytes(), 0644); err != nil {
	t.Fatal(err)
	}
	t.Log("wrote certificates_test.go")
	} else {
	// Check that the generated content matches the existing file.
	existing, err := os.ReadFile("certificates_test.go")
	if err != nil {
	t.Fatal(err)
	}
	if !bytes.Equal(existing, buf.Bytes()) {
	t.Fatal("certificates_test.go is out of date; run go generate to update it")
	}
	}
	}