snapshot of https://github.com/nats-io/nats-server.git (main, 2026-09-15; blobs > 131072B omitted)

test/configs/certs/tlsauth/certstore/delete-cert-from-store.ps1

@@ -0,0 +1,5 @@
+$issuer="NATS CA"
+Get-ChildItem Cert:\CurrentUser\My | Where-Object {$_.Issuer -match $issuer} | Remove-Item
+Get-ChildItem Cert:\CurrentUser\CA| Where-Object {$_.Issuer -match $issuer} | Remove-Item
+Get-ChildItem Cert:\CurrentUser\AuthRoot | Where-Object {$_.Issuer -match $issuer} | Remove-Item
+Get-ChildItem Cert:\CurrentUser\Root | Where-Object {$_.Issuer -match $issuer} | Remove-Item

test/configs/certs/tlsauth/certstore/ecdsa_server.key

@@ -0,0 +1,6 @@
+-----BEGIN PRIVATE KEY-----
+MIG2AgEAMBAGByqGSM49AgEGBSuBBAAiBIGeMIGbAgEBBDAfrq5ri+W7sYQp/6xc
+lH6YbTy43dnnrKUbbdlzsDn4DPzO1k15LVXx8EPK+7vuh5uhZANiAAR6V4nqBt3k
+ZfO9H664fPB8PkuDhphBfzxbSFFcr2DXj11g0ZV56Yjnh3RMC4Lud29ofpTQd8IP
+9bspEvjnBvOw60tH9WiquWqxLgSREUZVLEMD1dZ3JSVUfDCI2zzf00s=
+-----END PRIVATE KEY-----

test/configs/certs/tlsauth/certstore/ecdsa_server.pem

@@ -0,0 +1,12 @@
+-----BEGIN CERTIFICATE-----
+MIIB2jCCAWCgAwIBAgIUKRYMoky98mN3mpyL6PMIY8/d2OswCgYIKoZIzj0EAwMw
+FjEUMBIGA1UEAwwLbmF0cy1zZXJ2ZXIwHhcNMjUwMjA3MTgxNDM5WhcNMzUwMjA1
+MTgxNDM5WjAWMRQwEgYDVQQDDAtuYXRzLXNlcnZlcjB2MBAGByqGSM49AgEGBSuB
+BAAiA2IABHpXieoG3eRl870frrh88Hw+S4OGmEF/PFtIUVyvYNePXWDRlXnpiOeH
+dEwLgu53b2h+lNB3wg/1uykS+OcG87DrS0f1aKq5arEuBJERRlUsQwPV1nclJVR8
+MIjbPN/TS6NvMG0wHQYDVR0OBBYEFHbcfCfGs+l2bVg22WLTdV10AnpTMB8GA1Ud
+IwQYMBaAFHbcfCfGs+l2bVg22WLTdV10AnpTMA8GA1UdEwEB/wQFMAMBAf8wGgYD
+VR0RBBMwEYcEfwAAAYIJbG9jYWxob3N0MAoGCCqGSM49BAMDA2gAMGUCMQDhzRyw
+Q+m2fMFyqIgFc890jLIzh2bGqlmdkUpb+/Z/y9zKZQPSG5xhXp7A/FhvM24CMHVW
+ZIWBCJJRhw/L3s73QHX1d+M6mNqES16cnnht6j9DF1AddIipcsnBcpo4s7K/Xg==
+-----END CERTIFICATE-----

test/configs/certs/tlsauth/certstore/generate_ecdsa_test_cert.sh

@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+
+set -eou pipefail
+
+SCRIPT_ROOT="$(cd -P "$(dirname "${BASH_SOURCE[0]}")" >/dev/null 2>&1 && pwd)"
+
+cert_file_prefix="${SCRIPT_ROOT}/ecdsa_server"
+export_password="s3cr3t"
+
+openssl req -x509 \
+  -days 3650 \
+  -newkey ec \
+  -pkeyopt ec_paramgen_curve:secp384r1 \
+  -sha384 \
+  -subj "/CN=nats-server" \
+  --addext "subjectAltName=IP:127.0.0.1,DNS:localhost" \
+  -nodes \
+  -out "${cert_file_prefix}.pem" \
+  -keyout "${cert_file_prefix}.key" \
+  -outform PEM >/dev/null 2>&1
+
+openssl pkcs12 \
+  -inkey "${cert_file_prefix}.key" \
+  -in "${cert_file_prefix}.pem" \
+  -export \
+  -password "pass:${export_password}" \
+  -out "${cert_file_prefix}.pfx" >/dev/null 2>&1

test/configs/certs/tlsauth/certstore/import-p12-ca.ps1

@@ -0,0 +1,7 @@
+$fileLocale = $PSScriptRoot + "\ca.p12"
+$Pass = ConvertTo-SecureString -String 's3cr3t' -Force -AsPlainText
+$User = "whatever"
+$Cred = New-Object -TypeName "System.Management.Automation.PSCredential" -ArgumentList $User, $Pass
+Import-PfxCertificate -FilePath $filelocale -CertStoreLocation Cert:\CurrentUser\My -Password $Cred.Password
+#Import-PfxCertificate -FilePath $filelocale -CertStoreLocation Cert:\LocalMachine\Root -Password $Cred.Password
+# TODO?  Move to trusted enterprise?  Requires some fingerprint parsing.

test/configs/certs/tlsauth/certstore/import-p12-client.ps1

@@ -0,0 +1,5 @@
+$fileLocale = $PSScriptRoot + "\client.p12"
+$Pass = ConvertTo-SecureString -String 's3cr3t' -Force -AsPlainText
+$User = "whatever"
+$Cred = New-Object -TypeName "System.Management.Automation.PSCredential" -ArgumentList $User, $Pass
+Import-PfxCertificate -FilePath $filelocale -CertStoreLocation Cert:\CurrentUser\My -Password $Cred.Password

test/configs/certs/tlsauth/certstore/import-p12-server.ps1

@@ -0,0 +1,8 @@
+$file=$args[0]
+if (!$file) { $file="server.p12 "}
+$fileLocale = $PSScriptRoot + "\" + $file
+echo "Installing certificate $fileLocale"
+$Pass = ConvertTo-SecureString -String 's3cr3t' -Force -AsPlainText
+$User = "whatever"
+$Cred = New-Object -TypeName "System.Management.Automation.PSCredential" -ArgumentList $User, $Pass
+Import-PfxCertificate -FilePath $filelocale -CertStoreLocation Cert:\CurrentUser\My -Password $Cred.Password

test/configs/certs/tlsauth/certstore/pkcs12.md

@@ -0,0 +1,26 @@
+# PKCS12 Files
+
+Refresh PKCS12 files when test certificates and keys (PEM files) are refreshed (e.g. expiry workflow)
+
+- `client.p12` is a p12/pfx packaging of `client.pem` and `client-key.pem`
+
+`openssl pkcs12 -export -inkey ./client-key.pem -in ./client.pem -out client.p12`
+
+To add the CA, use the following:
+
+`openssl pkcs12 -export -nokeys -in ..\ca.pem -out ca.p12`
+
+> Note: set the PKCS12 bundle password to `s3cr3t` as required by provisioning scripts
+
+## Cert Store Provisioning Scripts
+
+Windows cert store supports p12/pfx bundle for certificate-with-key import.  Windows cert store tests will execute 
+a Powershell script to import relevant PKCS12 bundle into the Windows store before the test. Equivalent to:
+
+`powershell.exe -command "& '..\test\configs\certs\tlsauth\certstore\import-<client,server>-p12.ps1'"`
+
+The `delete-cert-from-store.ps1` script deletes imported certificates from the Windows store (if present) that can
+cause side-effects and impact the validity of different use tests.
+
+> Note: Tests are configured for "current user" store context. Execute tests with appropriate Windows permissions
+> (e.g. as Admin) if adding tests with "local machine" store context specified.