Regenerate client test cert, current one expires in 2032

[afonsojanu]

Fixes #997

client.cert.pem is signed by client_ca and used for the SSL client cert auth tests in test_connect.py, but its own validity ends on 2032-01-04, well before client_ca.cert.pem's own expiry in 2041. Once it expires the SSL handshake in those tests starts failing with a plain certificate-expired error, unrelated to anything the test is actually meant to check.

ca.cert.pem and server.cert.pem already went through this once and got regenerated further out in #1188, this does the same thing for the one cert that got missed. It isn't produced by tests/certs/gen.py at all, that script only ever generates the server-side ca/server pair; the client_ca/client pair looks to have been created separately by hand back when they were first added, and there's no record of a script for it anywhere in the repo's history.

Subject, issuer, public key and every X.509 extension match the previous cert exactly (checked field by field against the original), the only differences are a fresh serial number and a validity window matching client_ca's own. Reused the existing client.key.pem rather than rotating it since there's no reason to.

Verified the fix two ways since there's no live Postgres available to me here to run test_connect.py's SSL suite directly:

• Confirmed with openssl verify that the new cert chains correctly against client_ca.cert.pem, and that its public key still matches client.key.pem
• Set up a standalone mutual-TLS handshake between the actual server.cert.pem/server.key.pem and the new client.cert.pem/client.key.pem, which succeeds with the server correctly extracting CN=ssl_user from the peer certificate, the same mechanism the SSL client-cert tests rely on
• To confirm the failure mode itself is real, generated a deliberately expired variant of the client cert and reran the same handshake: the server correctly rejects it with "certificate has expired", which is exactly what would start happening in production once the real cert's own 2032 date arrives

[Copilot]

Copilot review overview

🟡 Changes recommended

Align the generator’s certificate extensions with the checked-in client certificate.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 1

Open (1)

• Regenerated client certificate lacks the generator's CLIENT_AUTH extension · New

What changed in this PR

Regenerates the SSL client certificate with extended validity and adds client-certificate generation support.

Changes:

• Updates client.cert.pem validity through 2041.
• Extends gen.py for client certificate generation.

File	Summary
tests/​certs/​gen.py	Adds client certificate generation, but its extensions do not match the checked-in certificate.
tests/​certs/​client.cert.pem	Refreshes the certificate validity period and serial number.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🟡 Changes recommended

Preserve the existing client key and CA, or explicitly address the intended key and trust-anchor rotation.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 2

Open (2)

• Client private key replaced during certificate renewal · New
• Regenerated client certificate lacks the generator's CLIENT_AUTH extension

[Copilot]

Copilot review overview

🔵 Needs a closer look

Certificate extension changes differ from the stated compatibility claims and need clarification or validation.

Review effort: Lite
Findings: 1

Open (1)

• Regenerated client certificate lacks the generator's CLIENT_AUTH extension

Resolved since last review (1)

• Client private key replaced during certificate renewal

[elprans]

I updated the generation script so these are not missed next time we need to re-roll them.

Thanks!