assorted patches

test/certs/ca.crt

@@ -1,8 +1,11 @@
 -----BEGIN CERTIFICATE-----
-MIIBFTCBvAIJAMNTFtpfcq8NMAoGCCqGSM49BAMCMBMxETAPBgNVBAMMCE1vbmdv
-b3NlMB4XDTI0MDUwNzE0MzczNloXDTM0MDUwNTE0MzczNlowEzERMA8GA1UEAwwI
-TW9uZ29vc2UwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAASuP+86T/rOWnGpEVhl
-fxYZ+pjMbCmDZ+vdnP0rjoxudwRMRQCv5slRlDK7Lxue761sdvqxWr0Ma6TFGTNg
-epsRMAoGCCqGSM49BAMCA0gAMEUCIQCwb2CxuAKm51s81S6BIoy1IcandXSohnqs
-us64BAA7QgIgGGtUrpkgFSS0oPBlCUG6YPHFVw42vTfpTC0ySwAS0M4=
+MIIBizCCATGgAwIBAgIUCeZlJSIxVY+xQGNhIXY42jph+SYwCgYIKoZIzj0EAwIw
+EzERMA8GA1UEAwwITW9uZ29vc2UwHhcNMjYwNjE2MTcyMDI3WhcNMzYwNjEzMTcy
+MDI3WjATMREwDwYDVQQDDAhNb25nb29zZTBZMBMGByqGSM49AgEGCCqGSM49AwEH
+A0IABK4/7zpP+s5acakRWGV/Fhn6mMxsKYNn692c/SuOjG53BExFAK/myVGUMrsv
+G57vrWx2+rFavQxrpMUZM2B6mxGjYzBhMB0GA1UdDgQWBBRVNi9ypHsbLJh/hZwm
+/IO+lYcIujAfBgNVHSMEGDAWgBRVNi9ypHsbLJh/hZwm/IO+lYcIujAPBgNVHRMB
+Af8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAKBggqhkjOPQQDAgNIADBFAiB7A6qe
+3N9QNxYWDYMGgUSYlQr+V2ShL/eOIZcxLt/vQAIhALwYVw/W8n8H3grXtx1Gby+u
+97aiTxPGbssyw6YShpaG
 -----END CERTIFICATE-----

test/certs/generate.sh

@@ -12,9 +12,12 @@ subjectAltName=DNS:localhost
 EOF
 
 # Generate CA
-# Important: CN names must be different for CA and client/server certs
+# Important: CN names must be different for CA and client/server certs;
+# extensions are required for a proper CA certificate
 openssl ecparam -noout -name prime256v1 -genkey -out ca.key
-openssl req -x509 -new -key ca.key -days 3650 -subj /CN=Mongoose -out ca.crt
+openssl req -x509 -new -key ca.key -days 3650 -subj /CN=Mongoose \
+  -addext "basicConstraints=critical,CA:TRUE" \
+  -addext "keyUsage=critical,keyCertSign,cRLSign" -out ca.crt
 
 # Generate server cert
 openssl ecparam -noout -name prime256v1 -genkey -out server.key