test: Add TLS PEM fixtures for HTTPS support

Author: thced

docs/superpowers/plans/2026-05-21-https-support.md

@@ -50,15 +50,15 @@
 
 These are deterministic test fixtures, not secrets. They're committed once and reused.
 
-- [ ] **Step 1: Ensure the fixture directory exists**
+- [x] **Step 1: Ensure the fixture directory exists**
 
 Run:
 
 ```bash
 mkdir -p src/test/resources/tls
 ```
 
-- [ ] **Step 2: Generate the RSA self-signed cert + PKCS#8 key**
+- [x] **Step 2: Generate the RSA self-signed cert + PKCS#8 key**
 
 Run from the repo root:
 
@@ -72,7 +72,7 @@ openssl req -x509 -newkey rsa:2048 -nodes -days 3650 \
 
 `-nodes` makes the key unencrypted. `openssl req` writes PKCS#8 (`-----BEGIN PRIVATE KEY-----`) by default on modern OpenSSL (1.1.1+). `subjectAltName` is required for Java's `HttpClient` to accept the cert without warning.
 
-- [ ] **Step 3: Verify the RSA key is PKCS#8 unencrypted**
+- [x] **Step 3: Verify the RSA key is PKCS#8 unencrypted**
 
 Run:
 
@@ -88,7 +88,7 @@ openssl pkcs8 -topk8 -nocrypt -in src/test/resources/tls/rsa-key.pem \
   && mv src/test/resources/tls/rsa-key.pem.tmp src/test/resources/tls/rsa-key.pem
 ```
 
-- [ ] **Step 4: Generate the EC (P-256) self-signed cert + PKCS#8 key**
+- [x] **Step 4: Generate the EC (P-256) self-signed cert + PKCS#8 key**
 
 Run:
 
@@ -100,7 +100,7 @@ openssl req -x509 -newkey ec -pkeyopt ec_paramgen_curve:P-256 -nodes -days 3650
   -addext "subjectAltName=DNS:localhost,IP:127.0.0.1"
 ```
 
-- [ ] **Step 5: Verify the EC key is PKCS#8 unencrypted**
+- [x] **Step 5: Verify the EC key is PKCS#8 unencrypted**
 
 Run:
 
@@ -116,7 +116,7 @@ openssl pkcs8 -topk8 -nocrypt -in src/test/resources/tls/ec-key.pem \
   && mv src/test/resources/tls/ec-key.pem.tmp src/test/resources/tls/ec-key.pem
 ```
 
-- [ ] **Step 6: Generate a second RSA key (does NOT match `rsa-cert.pem`)**
+- [x] **Step 6: Generate a second RSA key (does NOT match `rsa-cert.pem`)**
 
 Run:
 
@@ -127,7 +127,7 @@ openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 \
 
 This produces an unencrypted PKCS#8 key by default.
 
-- [ ] **Step 7: Create a deliberately-broken PEM file**
+- [x] **Step 7: Create a deliberately-broken PEM file**
 
 Write `src/test/resources/tls/garbage.pem` with this exact content:
 
@@ -137,7 +137,7 @@ this is not actually base64 encoded certificate data at all
 -----END CERTIFICATE-----
 ```
 
-- [ ] **Step 8: Sanity-check both happy-path fixtures**
+- [x] **Step 8: Sanity-check both happy-path fixtures**
 
 Run:
 
@@ -150,7 +150,7 @@ openssl pkey -in src/test/resources/tls/ec-key.pem  -noout -text 2>&1 | head -3
 
 Expected: subject `CN = localhost`, validity ~10 years, key text confirms RSA 2048 and EC P-256 respectively.
 
-- [ ] **Step 9: Commit the fixtures**
+- [x] **Step 9: Commit the fixtures**
 
 ```bash
 git add src/test/resources/tls/

src/test/resources/tls/ec-cert.pem

@@ -0,0 +1,11 @@
+-----BEGIN CERTIFICATE-----
+MIIBmTCCAT+gAwIBAgIUUuAW3n1W16lvRDk4YhVufmUP3cswCgYIKoZIzj0EAwIw
+FDESMBAGA1UEAwwJbG9jYWxob3N0MB4XDTI2MDUyMTA3MzE1N1oXDTM2MDUxODA3
+MzE1N1owFDESMBAGA1UEAwwJbG9jYWxob3N0MFkwEwYHKoZIzj0CAQYIKoZIzj0D
+AQcDQgAEMO762s3HsHL7NcUnOsxgB3T16F+9GngVF6c0eV3+AMtgHSev13DimMG7
+G9IYM6nRi72ry0WTrj75/Fteq+UZzaNvMG0wHQYDVR0OBBYEFJ6O8HE5ocETBKhy
+5SMbUiqyNd2vMB8GA1UdIwQYMBaAFJ6O8HE5ocETBKhy5SMbUiqyNd2vMA8GA1Ud
+EwEB/wQFMAMBAf8wGgYDVR0RBBMwEYIJbG9jYWxob3N0hwR/AAABMAoGCCqGSM49
+BAMCA0gAMEUCIQDT1+RT/oWzHZmCX+uDhkyx7Dp+Th53REbNYmwy3eSLCgIgC9B9
+s2pJC0OJKBzDAuE6q8teluBpxjaw+uBiXased0w=
+-----END CERTIFICATE-----

src/test/resources/tls/ec-key.pem

@@ -0,0 +1,5 @@
+-----BEGIN PRIVATE KEY-----
+MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgpm3qKHPykk2K2wlr
+UEYX831QX1y1opx26Iv3m4EF3/ShRANCAAQw7vrazcewcvs1xSc6zGAHdPXoX70a
+eBUXpzR5Xf4Ay2AdJ6/XcOKYwbsb0hgzqdGLvavLRZOuPvn8W16r5RnN
+-----END PRIVATE KEY-----

src/test/resources/tls/garbage.pem

@@ -0,0 +1,3 @@
+-----BEGIN CERTIFICATE-----
+this is not actually base64 encoded certificate data at all
+-----END CERTIFICATE-----

src/test/resources/tls/mismatched-key.pem

@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDM01Ssl34rRJEH
+puMh3M+bQWcI2Bnb5sqZuZPI4/RgjeIdq0SVsdF04f5GwPBv+M1gcVjD6mMmlqP7
+d36tAHuhs3qGRx3ArGEPqaYBy6wK72oeHtR/vgkf7B2XiqmF40xgMfkWpV5ctrTE
+4IjUU5MwS1YOeE/l9R1BrxbtC5dtfd0YO61hMqfd/u4o9cGW7emludsgopgbmgpa
+b0fZVoYq6qJgr6Xq56QNHi49mboEvpFiv1UHTEzRXubSHdKCKgJe8DN2jzQ180NN
+BGJ4AW5SHO46QRuHrIOzhXdWJ0G1AcLrh+MKZEEQuaDg21DUs4buIyA++LfwZWl9
+vA3o9GGbAgMBAAECggEABPEf+7b/E5xgIwePWSqTrotiMXZmqQ4ro5BW21CdfZgY
+YA2dUOmRcwOZiydp1sLX+wniItNw4Qyi8cPa83ttqt96JQTqLVuscQsiqAFvP1IH
+iUKTPAhS7QlZNdT7irV5z06gBwSMvyEvH5IgPjoqY7152tXa5UCDtdPmNpt50r8Q
+LxABenr9e9PrJSW2UCJgCe2S1/CFsChZLz5FrN5L/sjgK2C0WD2gESaP9eI2h1BR
+nvloRU0BVfXDf6kmLtJsbaQueXbUmmO2HNcccdmynW6Ap7887blv+WnWoDE1vBji
+nA+Smqn+5fAQEBriNJ/gfB12SRORmWiH+DLM1q7U6QKBgQDtsT4784KglVVyHhKs
+dAPIvibdTndmP5mNP3QiYcYQgBryfanOrNLIbdMPPJiNnWIkuyujKTvQ0UNQ7h27
+ltLVtcwt/6RgjCpZkeNhZ0f63+EdW9MYAE5MkJ3+bAfBVdhcOICU3pozKvpXIpHI
+6phvTO6aNi7WP4MbWVgbF3Z38wKBgQDcmgcTKC2+TsPpLF/pvs8YhIh/6Pg62nrD
+nn+hcrY7LRc17NJpo/E+iR0qwBZf9XZ9bE0YHFcLeFhEOvFw/8gr+cJnjpz0DPIR
+P16ZLPVHOhQwx9MIKOfO4ED1VDRKUWLj79iWRP3XUN8MEKYC4t3LvPla1V256+bs
+RlyaZFFBuQKBgQCI97raBx9986+yO9wc3hmUIub4Xg/1rq6IM0lzyo280mU02O7x
+9qrb7lVSEWQDLu7wJZ8mvUsHsJ6u0xf1EhtaJRGMbCTHsd1xkdzKMx7KVRo+tbw1
+t29nNWqlwpDReutbcP+/SWroE1sAvR3u/ihq8pUH7jMdKKofJ2Pa8LFGuwKBgQCY
+Em4yHI58FFwlT3vG7MxiwGpAkt8b4ySh2Y9uQl+xJ4JKoDjkrilNzMOYhtZlzBak
+m5YBuveeZpWiY2exWAIrnn8PWFaGPq5YiXCy8zUapsToY7fsdhZmnFzrQeLSIIyl
+SN/rpx+94HgCHy/x6WawXlMe9NspoZ+M3WxU2jbRsQKBgB60mokLEJJNNBJ4rfqB
++lzT5Yt7a9z8yxhRhGv0lJ1xzt+KaKZC30yujwheE83omW5Q8RR7nsc/cPD8wAoy
+Q+GswtBMEy02jHFJUtl7JZwzpsO6Sg2V/9mEKw5+kPrUT9XoTdrQRn3IWvbr3x8R
+3Xg8iJqw39t4FSOW2ZwKl4Hn
+-----END PRIVATE KEY-----

src/test/resources/tls/rsa-cert.pem

@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE-----
+MIIDJTCCAg2gAwIBAgIUF62pYLdthTkgNw94eFEo0QTjXm0wDQYJKoZIhvcNAQEL
+BQAwFDESMBAGA1UEAwwJbG9jYWxob3N0MB4XDTI2MDUyMTA3MzE0OVoXDTM2MDUx
+ODA3MzE0OVowFDESMBAGA1UEAwwJbG9jYWxob3N0MIIBIjANBgkqhkiG9w0BAQEF
+AAOCAQ8AMIIBCgKCAQEAmdNd21DRCVICYf/5KOXy78dES8eKQ5GEEVo/T0mnUUee
+nvkQg4qB1RGKSsBZShyqX2MoY2wq9viStfiErk5DIpIdJGFZ04cx9ACRzXy3B8/P
+xFCO/1UAxQ34ipLMbXPqpsdcacoUnNnTXKGohavP1KC4ZKuOMsb1M/72EWOivJuJ
+aAOjP4NZpGfdMCM6tulPwBA+kGAMShHfL00sA4L4FFSn/lxmhzeFhU1ij4rGqway
+DIrb33ovb5p4I1EwdTJ33yQr9pmRnUQesN8ftK1wQnH37kRCjULzAcfPnmD20qSk
+YtXlXDVjncrohz6uoHuZ8BIGgjzx5Yse7C0xxaDISQIDAQABo28wbTAdBgNVHQ4E
+FgQU2ICOPduZ7az8vS6Q1EZ6vQOuGjkwHwYDVR0jBBgwFoAU2ICOPduZ7az8vS6Q
+1EZ6vQOuGjkwDwYDVR0TAQH/BAUwAwEB/zAaBgNVHREEEzARgglsb2NhbGhvc3SH
+BH8AAAEwDQYJKoZIhvcNAQELBQADggEBACu6TZBkm2O3YZ+Ac1J5nFm8vs0y2j1O
+HEpCNVlbUkYqxrXR8jlZiG6iWF+U/ACdcYnDJQJznHJAvS3HNPQwNNz6D+jzlwNw
+4ltv0kOWVa9RtpLVp99i1KBIorJoJi1y93DVorYWdMYJNrsaz6STyEylUTlUIbsM
+teIIMSqCrjjFUgoPZalyAVGNTZaT1wWLnc4KeBCQ0gDz2kcLho32frvWsqLtRBdL
+ikZWwQCPorMVnxTPl6yntIqfxYO7HghlluyIrukH9yR9aURwPQTtoAZchOPACkpA
+JfDdHtm+4Oqr5zgwvNQ+AIGi7QMDBAajrk563+jj8G+nP+pA8PUHj/U=
+-----END CERTIFICATE-----

src/test/resources/tls/rsa-key.pem

@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQCZ013bUNEJUgJh
+//ko5fLvx0RLx4pDkYQRWj9PSadRR56e+RCDioHVEYpKwFlKHKpfYyhjbCr2+JK1
++ISuTkMikh0kYVnThzH0AJHNfLcHz8/EUI7/VQDFDfiKksxtc+qmx1xpyhSc2dNc
+oaiFq8/UoLhkq44yxvUz/vYRY6K8m4loA6M/g1mkZ90wIzq26U/AED6QYAxKEd8v
+TSwDgvgUVKf+XGaHN4WFTWKPisarBrIMitvfei9vmngjUTB1MnffJCv2mZGdRB6w
+3x+0rXBCcffuREKNQvMBx8+eYPbSpKRi1eVcNWOdyuiHPq6ge5nwEgaCPPHlix7s
+LTHFoMhJAgMBAAECggEADHVuGKFHDPYzczSEPafCMWF2Spzyud5DUBR7JDTW9GJU
+mpOZns3NDjDJfpxtnu8LbYZecw8Du9UOLObf+C4midpDufqYh+VfSl/xby82s89F
+CKVtr4h2837aLn8NR6An1TI4bekMGlgaIlqFh64Ouy35QU4TylEK8xcnXuku+Q+P
+ouac4fcYSxbOr7+9oOFRgvTph5shW46i6Gb3h0z3QQ5nvBTtCfvh71uITrFl00Eh
+pGAxI9UmYMCf6v3eeThuxi1Y8CvcPsQwyJrKLheLpRTC7Au4tc5ZjuuJ2/c5mNA/
+iRUWWIiaWHiOj6Nvk/uUy5V/PhFJkdQ4yWzbew6X8QKBgQDX8gyjX2MAlmxxdEDT
+wpK0ymKynCMkvPgbUsYWJNylOURi1IQu0J9FE20ATr08Mr01OIStuIUDYao0G8V8
+/yvp7zQpRGL5Dy6d6IOtUYpC7wnyAztFonw0eMjyWLS4OsWhoLsLNaD8fHHjzRf8
++rqnFLsmoUwhOgFmz1Ea+RPTSwKBgQC2W56nfe7aNAeujXenKmfaORTtKK3oMXc1
+697dnygIfEL4EeQf2B4jvKhC5LMWHB+U3r0vTvlPRDI19w/HLrMFnMjkJGGYnwok
+h8A1MLP5NUqzHjkuOuHIgWs+6WgR1bVS8n8yPDyuElpqYniHO+IXvnv4l8zB264/
+RIVtCWmCOwKBgQCI6UbIAf8T7Usd93XujItVIofG9CV38nNfZ3B9s6tM+ez4uAKC
+Z/TC59kQ+9sQop7Bcm70cWurxC0UUpM4d9QQwn8QtvIFNHH63eM2bN87JrDohtH6
+iVU0M2w78q/JqkGJAw3zwnGqAwB2TJ8r3o+exQ8PI+7PliYzV7f1YPwH1wKBgQC2
+BiQKmgi2I+NbF/jMkuaRDBNYWxekQuP0ndmbLIfgWHDcf7dPFgGXuHPYOcKNGktn
+5SHAPDtdJPxdo5xLPNETlBluqOYGWxHbvulb7p5m7gv/WPbIr5u58X0kkgUAcGqL
+PmU6tqf3NXis4lfe3SZkfw3t6VBIXUjD/FiWqyN3CwKBgQCX3NoqW0MnXzppPKfy
+7wAsZ9ErhEODFq12DWYf582vmx2VlFEiGp8RUOog4Iw4BJpjbQW1Pxo4MNc5Egqk
+c9Vg+vK8sKpVzhWkJ0GvCWFxH4jUt401bwICyRktF8RGbl8bnnbrtE7eOjk3JZeS
+VRGtDYZsCadvmsAH7o4u7hzdVQ==
+-----END PRIVATE KEY-----