# Anchor NC Fixtures

Generated by `gen.py` using pyca/cryptography. All certs use P-256 ECDSA (SHA-256).
Validity: 2000-01-01 to 2050-01-01.

## Files

| File | Description |
|---|---|
| `anchor_permitted_dns.der` | Self-signed CA; permittedSubtrees: .example.com |
| `anchor_excluded_dns.der` | Self-signed CA; excludedSubtrees: evil.example.com |
| `leaf_good_dns.der` | Leaf cert (signed by permitted anchor); SAN: www.example.com |
| `leaf_bad_dns.der` | Leaf cert (signed by permitted anchor); SAN: www.evil.com |
| `leaf_excluded_dns.der` | Leaf cert (signed by excluded anchor); SAN: evil.example.com |

## Test scenarios

- `anchor_permitted_dns.der` + `leaf_good_dns.der` → PASS (www.example.com in .example.com)
- `anchor_permitted_dns.der` + `leaf_bad_dns.der` → FAIL NameConstraintViolation (www.evil.com not in .example.com)
- `anchor_excluded_dns.der` + `leaf_excluded_dns.der` → FAIL NameConstraintViolation (evil.example.com in excluded)
