fix(@stdlib/net/http2-secure-server): renew expired self-signed test certificates

[Planeshifter]

Description

What is the purpose of this pull request?

This pull request:

• Certificates in @stdlib/net/http2-secure-server expired, breaking the package's TLS-based tests and example on every platform. Regenerated both self-signed cert/key pairs with a 10-year validity window instead of 30 days. No source code changed — PEM files only.

Related Issues

Does this pull request have any related issues?

This pull request has the following related issues:

• None.

Questions

Any questions for reviewers of this pull request?

No.

Other

Any other information relevant to this pull request? This may include screenshots, references, and/or implementation notes.

Failing run: macos_test / Node.js v16, branch develop.

Symptom:

Error [ERR_HTTP2_STREAM_CANCEL]: The pending stream has been canceled (caused by: certificate has expired)
cause: Error: certificate has expired
    code: 'CERT_HAS_EXPIRED'

Root cause: test/fixtures/server.js and examples/index.js both start a local HTTP/2 TLS server using checked-in self-signed certs (test/fixtures/localhost-{cert,privkey}.pem, examples/localhost-{cert,privkey}.pem). Both were generated with a 30-day validity window (2025-08-16 to 2025-09-15) and expired. Every handshake in the suite fails, deterministically, on every platform and Node version, every run going forward. Not flaky — permanent until fixed.

Fix: Regenerated both pairs: self-signed, CN=localhost, RSA-2048, SHA-256, 10-year validity (openssl req -x509 -newkey rsa:2048 -sha256 -days 3650 -nodes -subj "/CN=localhost"). No subjectAltName, matching the originals — tests connect by hostname localhost, which matches CN, and Node's TLS verification doesn't require SAN when CN matches and no SAN extension is present.

Validation:

• openssl x509 -noout -dates confirms new certs are not expired.
• Modulus comparison (openssl x509 -noout -modulus vs openssl rsa -noout -modulus, md5) confirms each private key matches its cert, both directories.
• Standalone Node HTTP/2 client/server handshake, mirroring test/test.js's http2.connect('https://localhost:'+port, {ca: CERT}), run against both cert pairs: zero cert errors, successful round-trip.
• Could not run npm test in this sandbox — no node_modules, and npm install blocked by a registry min-release-age policy on a tape transitive dependency.
• Three independent reviews (correctness, regression-scope, style) returned approve, no blocking findings.

Reviewer notes: One reviewer flagged, non-blocking, that fix: vs test: as commit type is a judgment call since the diff touches both test/fixtures/ and examples/ — defensible as fix: since it repairs broken observable behavior (a working handshake).

Checklist

Please ensure the following tasks are completed before submitting this pull request.

• Read, understood, and followed the contributing guidelines.

AI Assistance

When authoring the changes proposed in this PR, did you use any kind of AI assistance?

• Yes
• No

If you answered "yes" above, how did you use AI assistance?

• Code generation (e.g., when writing an implementation or fixing a bug)
• Test/benchmark generation
• Documentation (including examples)
• Research and understanding

Disclosure

If you answered "yes" to using AI assistance, please provide a short disclosure indicating how you used AI assistance. This helps reviewers determine how much scrutiny to apply when reviewing your contribution. Example disclosures: "This PR was written primarily by Claude Code." or "I consulted ChatGPT to understand the codebase, but the proposed changes were fully authored manually by myself.".

This PR was written primarily by Claude Code, running an automated CI-failure investigation and fix routine: it identified the failing run, diagnosed the root cause, authored the fix, and drafted this description, all based on the linked CI failure log.

---

@stdlib-js/reviewers

---

Generated by Claude Code

[stdlib-bot]

Coverage Report

Package	Statements	Branches	Functions	Lines
net/http2-secure-server	$\\color{red}413/418$ $\\color{green}+98.80\\%$	$\\color{red}48/50$ $\\color{green}+96.00\\%$	$\\color{red}5/6$ $\\color{green}+83.33\\%$	$\\color{red}413/418$ $\\color{green}+98.80\\%$

The above coverage report was generated for the changes in this PR.

[kgryte]

Isn't this a duplicate PR?

[Planeshifter]

Yes — this duplicates #13330, opened 2026-07-06 for the same root cause, still open and passing CI. I missed the open-PR check before starting this one. Closing in favor of #13330.

---

Generated by Claude Code