These certificates and the public test-only private key were generated for Maka's loopback network tests with OpenSSL. They grant no access to any service. Never use this key or CA outside tests. The CA private key and signing request were discarded.
The leaf certificate is valid from September 2026 for 7,300 days, with SANs localhost, 127.0.0.1, and models.maka.invalid. The tests inject this CA into one reqwest client only; they never install it in the OS trust store. Separate cases retain platform roots or request wrong.maka.invalid and require rejection.
The fixtures avoid an OpenSSL executable or a certificate-generation dependency at test time, including on Windows. Regeneration requires a new local P-256 CA, a P-256 leaf with CA:FALSE and serverAuth, signed with those SANs.