From 1656b18df49a3a9b94af936c6897a2b1dc732b6e Mon Sep 17 00:00:00 2001
From: MDA2AV <fabreis202@gmail.com>
Date: Sat, 22 Aug 2026 19:00:10 +0100
Subject: [PATCH] certs: give the benchmark certificate a subjectAltName

The committed certificate carried CN=localhost and no subjectAltName. RFC
9525 removed CN fallback entirely, so it is not a valid server certificate
to anything current -- and some server libraries parse the extension while
loading the pair and fail outright rather than at verification time.

sanic is one: handing it the cert/key pair raises

    for t, name in cert["subjectAltName"]
    KeyError: 'subjectAltName'

and the process dies before it serves anything. Every entry that loads the
pair without inspecting it was unaffected, so the gap stayed invisible.

Regenerated over the existing private key, so only the certificate changes:
SANs for localhost, *.localhost and the loopback addresses (the harness
connects to localhost on every TLS profile), plus the keyUsage and
extendedKeyUsage a server certificate should carry. Added generate.sh, since
there was no record of how the pair had been produced.

No regression: actix 71/0 and aspnet-minimal 84/0, which between them cover
json-tls, static-tls, baseline-h2, static-h2 and the h3 profiles.

This does not by itself unblock sanic -- see the note in that entry.
---
 certs/generate.sh | 20 ++++++++++++++++++++
 certs/server.crt  | 26 ++++++++++++++------------
 2 files changed, 34 insertions(+), 12 deletions(-)
 create mode 100755 certs/generate.sh

diff --git a/certs/generate.sh b/certs/generate.sh
new file mode 100755
index 000000000..c519f6989
--- /dev/null
+++ b/certs/generate.sh
@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+# Regenerates the self-signed certificate the TLS profiles use.
+#
+# The subjectAltName matters: a certificate with only a CN is not valid to
+# anything that follows RFC 9525, which dropped CN fallback entirely, and some
+# server libraries parse the extension while loading and fail outright when it
+# is missing rather than at verification time. Every TLS profile connects to
+# localhost, so that plus the loopback addresses is what has to be covered.
+set -euo pipefail
+cd "$(dirname "$0")"
+
+openssl req -x509 -newkey rsa:2048 -nodes \
+    -keyout server.key -out server.crt \
+    -days 3650 -subj "/CN=localhost" \
+    -addext "subjectAltName=DNS:localhost,DNS:*.localhost,IP:127.0.0.1,IP:0.0.0.0,IP:::1" \
+    -addext "keyUsage=critical,digitalSignature,keyEncipherment" \
+    -addext "extendedKeyUsage=serverAuth"
+
+chmod 644 server.crt server.key
+openssl x509 -in server.crt -noout -subject -ext subjectAltName -dates
diff --git a/certs/server.crt b/certs/server.crt
index d01b26bfb..16be20e0d 100644
--- a/certs/server.crt
+++ b/certs/server.crt
@@ -1,19 +1,21 @@
 -----BEGIN CERTIFICATE-----
-MIIDCTCCAfGgAwIBAgIUbEz52reYuYYb26TfVwBpyW3YACUwDQYJKoZIhvcNAQEL
-BQAwFDESMBAGA1UEAwwJbG9jYWxob3N0MB4XDTI2MDMwNzEzNTYwNFoXDTM2MDMw
-NDEzNTYwNFowFDESMBAGA1UEAwwJbG9jYWxob3N0MIIBIjANBgkqhkiG9w0BAQEF
+MIIDcTCCAlmgAwIBAgIUNbyFd8r04QXc3yRecFjSqlJd2JkwDQYJKoZIhvcNAQEL
+BQAwFDESMBAGA1UEAwwJbG9jYWxob3N0MB4XDTI2MDgyMjE3NTYxMVoXDTM2MDgx
+OTE3NTYxMVowFDESMBAGA1UEAwwJbG9jYWxob3N0MIIBIjANBgkqhkiG9w0BAQEF
 AAOCAQ8AMIIBCgKCAQEAtJGyejZirwk/Yh5v0VwTY7YLBn+zLmHTcmkZeSiSwIUb
 P6y8vRigFoQHKSrqaS9WB49EXpuxwFTzxY0zPDjg/boJEVaPp+ct1YxS7DY93zQo
 0CSZCG/PYsw2SeXpBE93/UCajDJp3vHZXPi2tuT/zL/+dy8Si/r+ln9W8YiNINJm
 0Y2AnHgSoFDAt6sZY4B6R/FsHY3oeYlKIxIJIHZvwFpY4o1/Mr1Q8ZbfsGONEFGk
 Fsp/xB9FVFFNlM5mf3rNoRHfXZb6QykHMW2P9nXEx2cnG57xLaHhZAEzrilQ6/6G
-sI3ypxTaQCQinyz/l6yeG+uBbe4slXPHty6ue1RYeQIDAQABo1MwUTAdBgNVHQ4E
-FgQU+unU067fqVnaWvCOXgh2TIF55TUwHwYDVR0jBBgwFoAU+unU067fqVnaWvCO
-Xgh2TIF55TUwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAalzP
-zEpDH1858MTdbLf21D08DsW2BxXiZ2KsFVhE+UW4+utfGdi4s3qXbu2C4H4A4us7
-rmUYAXLZW9uZumV5yy/CfXbw3E9vy/kKztH6qNVaMfmEZNa4aNcCKziwef+/3x7e
-zI6o5pyw3ffhw9c8QIqD7ULBKLHdBKvE+NaTAzQNKWJoDDPd1HdeLkIzz4nm0xPR
-Zc8xAhIfOlniYzZ+y3NpCd7kOhfpYwMQY8mjP7cLYIQsoS2gD9reYxs2dvp/T8Y+
-skU1doO8r4ryU/wR60XXQs4ihykA8z/QUxqCgm8q4YPl8sKHUKjN9+fc0QRQCbKR
-g6nb97XFdZV9IZqtqQ==
+sI3ypxTaQCQinyz/l6yeG+uBbe4slXPHty6ue1RYeQIDAQABo4G6MIG3MB0GA1Ud
+DgQWBBT66dTTrt+pWdpa8I5eCHZMgXnlNTAfBgNVHSMEGDAWgBT66dTTrt+pWdpa
+8I5eCHZMgXnlNTAPBgNVHRMBAf8EBTADAQH/MD8GA1UdEQQ4MDaCCWxvY2FsaG9z
+dIILKi5sb2NhbGhvc3SHBH8AAAGHBAAAAACHEAAAAAAAAAAAAAAAAAAAAAEwDgYD
+VR0PAQH/BAQDAgWgMBMGA1UdJQQMMAoGCCsGAQUFBwMBMA0GCSqGSIb3DQEBCwUA
+A4IBAQBS/+X7IblIBZD9GlG84qs24rUCptqcgER0mMEtYNuyqGsnjg0nIRGz0+wG
+Aw89cWe8uNOt7Xj6mUMufyzlAUJm+yNsHyDd1PY2iX9yQ92FBBQMRwMa819IGjJH
+2kLOXzOe16gzQtYFmqOq1j01wwreop9OwR7kf96/PgWujHFr1KuXMXnjFpf8t6Rg
+4HDCcCNhZ05aBB0UfaZnig5mQr+ZWFoCiNDK8MB6Iig6ugNUxO73AezIiNSKt4x0
+vMhn1uGkC7CqIly2Djyx4IB5lD2EfGYt+zUmiuhZJwoMf9CWlS4DuE44qyBzae/U
+qrKHULMoZOMrpG2YSiiCW4lYslEu
 -----END CERTIFICATE-----