GeezerVison

Renews the SMTP test server certificate in coderd/notifications/dispatch/smtptest/fixtures. It expired on 2026-10-18 at 13:36:08Z, so the TLS cases of TestSMTP (TLS:_self-signed, TLS:_self-signed_+_SNI, PLAIN_auth_and_TLS) fail in test-go-pg-17 and test-go-race-pg on every PR.

What changed

• server.crt: the committed server.csr, re-signed with the committed CA (ca.crt, ca.key) and v3_ext.conf. It is valid until 2034-07-12, a day before the CA expires. The key pair, subject, and extensions (SANs myserver.local, www.myserver.local, 127.0.0.1) are unchanged. Only the serial, the validity, and the signature differ.
• ca.srl: the next serial, which the new certificate uses.
• generate.sh: it issued the server certificate for 825 days, and 2024-07-15 plus 825 days is 2026-10-18. It now uses 3649 days, a day less than the CA's 3650.

The command, run in the fixtures directory:

openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -set_serial 0x0330C6D190E3FE649DAFCDA2F4D765E2D29328DF -out server.crt -days 2824 -extfile v3_ext.conf

With OpenSSL 3.0.2, -CAserial ca.srl issued a random serial and left ca.srl unchanged, so the command sets the next serial explicitly.

Review focus

Re-signing keeps the CA and the server key, so no other fixture or test changes. The one choice is the validity: about 7.7 years, ending a day before the CA.

Validation

go test ./coderd/notifications/... -count=1 passes, including notifications_test.go, the other user of smtptest. A text diff of the old and new certificates (openssl x509 -noout -text) shows only the serial, the dates, and the signature.

Xum, an AI agent, opened this PR for @ibetitsmike and wrote this description.