Move certificates into per-test directories

Each secure test now has its own certs/ subfolder with per-identity
subdirectories and a single shared trust store.  Configs reference
paths relative to the project root (e.g. tests/secure_anonymous/
certs/ServerLDS/cert.der).  Cert generation logic removed from test
scripts since certs are now pre-generated and committed.

50 files changed, 38 insertions, 75 deletions

diff --git a/tests/run_download_cert_test.sh b/tests/run_download_cert_test.sh
index 9bcc750..f20609c 100755
--- a/tests/run_download_cert_test.sh
+++ b/tests/run_download_cert_test.sh
@@ -20,24 +20,6 @@ TMPFILE=""
 DOWNLOADED_CERT=""
 FAILURES=0
 
-# ── ensure certificates exist ─────────────────────────────────
-CERT_DIR=certs
-GEN_CERT=tools/generate_certificate.sh
-
-for identity in ServerLDS Client; do
-  if [ ! -f "$CERT_DIR/${identity}_cert.der" ]; then
-    "$GEN_CERT" "$CERT_DIR" "$identity"
-  fi
-done
-
-for store in server_lds client; do
-  mkdir -p "$CERT_DIR/trust/$store"
-  for identity in ServerLDS Client; do
-    cert="$CERT_DIR/${identity}_cert.der"
-    [ -f "$cert" ] && cp -n "$cert" "$CERT_DIR/trust/$store/"
-  done
-done
-
 # ── cleanup ────────────────────────────────────────────────────
 cleanup() {
   [ -n "$LDS_PID" ] && kill "$LDS_PID" 2>/dev/null && wait "$LDS_PID" 2>/dev/null
@@ -100,8 +82,8 @@ echo "$DC_OUTPUT" | grep -q "Certificate saved to"
 check "download-cert output contains 'Certificate saved to'" $?
 
 # ── compare with original ─────────────────────────────────────
-cmp -s "$DOWNLOADED_CERT" "certs/ServerLDS_cert.der"
-check "downloaded certificate matches certs/ServerLDS_cert.der" $?
+cmp -s "$DOWNLOADED_CERT" "$CONFIG_DIR/certs/ServerLDS/cert.der"
+check "downloaded certificate matches $CONFIG_DIR/certs/ServerLDS/cert.der" $?
 
 # ── result ─────────────────────────────────────────────────────
 if [ "$FAILURES" -ne 0 ]; then
diff --git a/tests/run_test.sh b/tests/run_test.sh
index 2767919..fc44ad6 100755
--- a/tests/run_test.sh
+++ b/tests/run_test.sh
@@ -28,25 +28,6 @@ SR_PID=""
 TMPFILE=""
 FAILURES=0
 
-# ── ensure certificates exist ─────────────────────────────────
-CERT_DIR=certs
-GEN_CERT=tools/generate_certificate.sh
-
-for identity in ServerLDS ServerRegister ServerRegisterClient Client; do
-  if [ ! -f "$CERT_DIR/${identity}_cert.der" ]; then
-    "$GEN_CERT" "$CERT_DIR" "$identity"
-  fi
-done
-
-# Populate trust stores: each identity trusts every other identity.
-for store in server_lds server_register server_register_client client; do
-  mkdir -p "$CERT_DIR/trust/$store"
-  for identity in ServerLDS ServerRegister ServerRegisterClient Client; do
-    cert="$CERT_DIR/${identity}_cert.der"
-    [ -f "$cert" ] && cp -n "$cert" "$CERT_DIR/trust/$store/"
-  done
-done
-
 # ── cleanup ────────────────────────────────────────────────────
 cleanup() {
   [ -n "$LDS_PID" ] && kill "$LDS_PID" 2>/dev/null && wait "$LDS_PID" 2>/dev/null
diff --git a/tests/secure_anonymous/certs/Client/cert.der b/tests/secure_anonymous/certs/Client/cert.der
new file mode 100644
index 0000000..b4661db
--- /dev/null
+++ b/tests/secure_anonymous/certs/Client/cert.der
diff --git a/tests/secure_anonymous/certs/Client/key.der b/tests/secure_anonymous/certs/Client/key.der
new file mode 100644
index 0000000..4ac4469
--- /dev/null
+++ b/tests/secure_anonymous/certs/Client/key.der
diff --git a/tests/secure_anonymous/certs/ServerLDS/cert.der b/tests/secure_anonymous/certs/ServerLDS/cert.der
new file mode 100644
index 0000000..7460975
--- /dev/null
+++ b/tests/secure_anonymous/certs/ServerLDS/cert.der
diff --git a/tests/secure_anonymous/certs/ServerLDS/key.der b/tests/secure_anonymous/certs/ServerLDS/key.der
new file mode 100644
index 0000000..bb917eb
--- /dev/null
+++ b/tests/secure_anonymous/certs/ServerLDS/key.der
diff --git a/tests/secure_anonymous/certs/ServerRegister/cert.der b/tests/secure_anonymous/certs/ServerRegister/cert.der
new file mode 100644
index 0000000..5b8a6bd
--- /dev/null
+++ b/tests/secure_anonymous/certs/ServerRegister/cert.der
diff --git a/tests/secure_anonymous/certs/ServerRegister/key.der b/tests/secure_anonymous/certs/ServerRegister/key.der
new file mode 100644
index 0000000..83669b7
--- /dev/null
+++ b/tests/secure_anonymous/certs/ServerRegister/key.der
diff --git a/tests/secure_anonymous/certs/ServerRegisterClient/cert.der b/tests/secure_anonymous/certs/ServerRegisterClient/cert.der
new file mode 100644
index 0000000..cf62a2c
--- /dev/null
+++ b/tests/secure_anonymous/certs/ServerRegisterClient/cert.der
diff --git a/tests/secure_anonymous/certs/ServerRegisterClient/key.der b/tests/secure_anonymous/certs/ServerRegisterClient/key.der
new file mode 100644
index 0000000..8f44211
--- /dev/null
+++ b/tests/secure_anonymous/certs/ServerRegisterClient/key.der
diff --git a/tests/secure_anonymous/certs/trust/Client_cert.der b/tests/secure_anonymous/certs/trust/Client_cert.der
new file mode 100644
index 0000000..b4661db
--- /dev/null
+++ b/tests/secure_anonymous/certs/trust/Client_cert.der
diff --git a/tests/secure_anonymous/certs/trust/ServerLDS_cert.der b/tests/secure_anonymous/certs/trust/ServerLDS_cert.der
new file mode 100644
index 0000000..7460975
--- /dev/null
+++ b/tests/secure_anonymous/certs/trust/ServerLDS_cert.der
diff --git a/tests/secure_anonymous/certs/trust/ServerRegisterClient_cert.der b/tests/secure_anonymous/certs/trust/ServerRegisterClient_cert.der
new file mode 100644
index 0000000..cf62a2c
--- /dev/null
+++ b/tests/secure_anonymous/certs/trust/ServerRegisterClient_cert.der
diff --git a/tests/secure_anonymous/certs/trust/ServerRegister_cert.der b/tests/secure_anonymous/certs/trust/ServerRegister_cert.der
new file mode 100644
index 0000000..5b8a6bd
--- /dev/null
+++ b/tests/secure_anonymous/certs/trust/ServerRegister_cert.der
diff --git a/tests/secure_anonymous/client.conf b/tests/secure_anonymous/client.conf
index 2a059fa..4cfc7c2 100644
--- a/tests/secure_anonymous/client.conf
+++ b/tests/secure_anonymous/client.conf
@@ -2,9 +2,9 @@
 
 applicationUri = urn:localhost:bobink:Client
 
-certificate = certs/Client_cert.der
-privateKey = certs/Client_key.der
-trustStore = certs/trust/client
+certificate = tests/secure_anonymous/certs/Client/cert.der
+privateKey = tests/secure_anonymous/certs/Client/key.der
+trustStore = tests/secure_anonymous/certs/trust
 
 securityMode = SignAndEncrypt
 securityPolicy = Aes256_Sha256_RsaPss
diff --git a/tests/secure_anonymous/server_lds.conf b/tests/secure_anonymous/server_lds.conf
index f92b803..8d86c7f 100644
--- a/tests/secure_anonymous/server_lds.conf
+++ b/tests/secure_anonymous/server_lds.conf
@@ -4,9 +4,9 @@
 port = 14840
 applicationUri = urn:localhost:bobink:ServerLDS
 
-certificate = certs/ServerLDS_cert.der
-privateKey = certs/ServerLDS_key.der
-trustStore = certs/trust/server_lds
+certificate = tests/secure_anonymous/certs/ServerLDS/cert.der
+privateKey = tests/secure_anonymous/certs/ServerLDS/key.der
+trustStore = tests/secure_anonymous/certs/trust
 
 authMode = anonymous
 
diff --git a/tests/secure_anonymous/server_register.conf b/tests/secure_anonymous/server_register.conf
index 31df277..b559526 100644
--- a/tests/secure_anonymous/server_register.conf
+++ b/tests/secure_anonymous/server_register.conf
@@ -3,9 +3,9 @@
 port = 14841
 applicationUri = urn:localhost:bobink:ServerRegister
 
-certificate = certs/ServerRegister_cert.der
-privateKey = certs/ServerRegister_key.der
-trustStore = certs/trust/server_register
+certificate = tests/secure_anonymous/certs/ServerRegister/cert.der
+privateKey = tests/secure_anonymous/certs/ServerRegister/key.der
+trustStore = tests/secure_anonymous/certs/trust
 
 authMode = anonymous
 
diff --git a/tests/secure_anonymous/server_register_client.conf b/tests/secure_anonymous/server_register_client.conf
index e7c34c7..183be16 100644
--- a/tests/secure_anonymous/server_register_client.conf
+++ b/tests/secure_anonymous/server_register_client.conf
@@ -3,9 +3,9 @@
 
 applicationUri = urn:localhost:bobink:ServerRegister
 
-certificate = certs/ServerRegisterClient_cert.der
-privateKey = certs/ServerRegisterClient_key.der
-trustStore = certs/trust/server_register_client
+certificate = tests/secure_anonymous/certs/ServerRegisterClient/cert.der
+privateKey = tests/secure_anonymous/certs/ServerRegisterClient/key.der
+trustStore = tests/secure_anonymous/certs/trust
 
 securityMode = SignAndEncrypt
 securityPolicy = Aes256_Sha256_RsaPss
diff --git a/tests/secure_cert/certs/Client/cert.der b/tests/secure_cert/certs/Client/cert.der
new file mode 100644
index 0000000..b4661db
--- /dev/null
+++ b/tests/secure_cert/certs/Client/cert.der
diff --git a/tests/secure_cert/certs/Client/key.der b/tests/secure_cert/certs/Client/key.der
new file mode 100644
index 0000000..4ac4469
--- /dev/null
+++ b/tests/secure_cert/certs/Client/key.der
diff --git a/tests/secure_cert/certs/ServerLDS/cert.der b/tests/secure_cert/certs/ServerLDS/cert.der
new file mode 100644
index 0000000..7460975
--- /dev/null
+++ b/tests/secure_cert/certs/ServerLDS/cert.der
diff --git a/tests/secure_cert/certs/ServerLDS/key.der b/tests/secure_cert/certs/ServerLDS/key.der
new file mode 100644
index 0000000..bb917eb
--- /dev/null
+++ b/tests/secure_cert/certs/ServerLDS/key.der
diff --git a/tests/secure_cert/certs/ServerRegister/cert.der b/tests/secure_cert/certs/ServerRegister/cert.der
new file mode 100644
index 0000000..5b8a6bd
--- /dev/null
+++ b/tests/secure_cert/certs/ServerRegister/cert.der
diff --git a/tests/secure_cert/certs/ServerRegister/key.der b/tests/secure_cert/certs/ServerRegister/key.der
new file mode 100644
index 0000000..83669b7
--- /dev/null
+++ b/tests/secure_cert/certs/ServerRegister/key.der
diff --git a/tests/secure_cert/certs/ServerRegisterClient/cert.der b/tests/secure_cert/certs/ServerRegisterClient/cert.der
new file mode 100644
index 0000000..cf62a2c
--- /dev/null
+++ b/tests/secure_cert/certs/ServerRegisterClient/cert.der
diff --git a/tests/secure_cert/certs/ServerRegisterClient/key.der b/tests/secure_cert/certs/ServerRegisterClient/key.der
new file mode 100644
index 0000000..8f44211
--- /dev/null
+++ b/tests/secure_cert/certs/ServerRegisterClient/key.der
diff --git a/tests/secure_cert/certs/trust/Client_cert.der b/tests/secure_cert/certs/trust/Client_cert.der
new file mode 100644
index 0000000..b4661db
--- /dev/null
+++ b/tests/secure_cert/certs/trust/Client_cert.der
diff --git a/tests/secure_cert/certs/trust/ServerLDS_cert.der b/tests/secure_cert/certs/trust/ServerLDS_cert.der
new file mode 100644
index 0000000..7460975
--- /dev/null
+++ b/tests/secure_cert/certs/trust/ServerLDS_cert.der
diff --git a/tests/secure_cert/certs/trust/ServerRegisterClient_cert.der b/tests/secure_cert/certs/trust/ServerRegisterClient_cert.der
new file mode 100644
index 0000000..cf62a2c
--- /dev/null
+++ b/tests/secure_cert/certs/trust/ServerRegisterClient_cert.der
diff --git a/tests/secure_cert/certs/trust/ServerRegister_cert.der b/tests/secure_cert/certs/trust/ServerRegister_cert.der
new file mode 100644
index 0000000..5b8a6bd
--- /dev/null
+++ b/tests/secure_cert/certs/trust/ServerRegister_cert.der
diff --git a/tests/secure_cert/client.conf b/tests/secure_cert/client.conf
index 68a14aa..b8c7908 100644
--- a/tests/secure_cert/client.conf
+++ b/tests/secure_cert/client.conf
@@ -3,9 +3,9 @@
 
 applicationUri = urn:localhost:bobink:Client
 
-certificate = certs/Client_cert.der
-privateKey = certs/Client_key.der
-trustStore = certs/trust/client
+certificate = tests/secure_cert/certs/Client/cert.der
+privateKey = tests/secure_cert/certs/Client/key.der
+trustStore = tests/secure_cert/certs/trust
 
 securityMode = SignAndEncrypt
 securityPolicy = Aes256_Sha256_RsaPss
diff --git a/tests/secure_cert/server_lds.conf b/tests/secure_cert/server_lds.conf
index ca1f8a6..c863534 100644
--- a/tests/secure_cert/server_lds.conf
+++ b/tests/secure_cert/server_lds.conf
@@ -4,9 +4,9 @@
 port = 14840
 applicationUri = urn:localhost:bobink:ServerLDS
 
-certificate = certs/ServerLDS_cert.der
-privateKey = certs/ServerLDS_key.der
-trustStore = certs/trust/server_lds
+certificate = tests/secure_cert/certs/ServerLDS/cert.der
+privateKey = tests/secure_cert/certs/ServerLDS/key.der
+trustStore = tests/secure_cert/certs/trust
 
 authMode = anonymous
 
diff --git a/tests/secure_cert/server_register.conf b/tests/secure_cert/server_register.conf
index ba6de55..145857c 100644
--- a/tests/secure_cert/server_register.conf
+++ b/tests/secure_cert/server_register.conf
@@ -4,9 +4,9 @@
 port = 14841
 applicationUri = urn:localhost:bobink:ServerRegister
 
-certificate = certs/ServerRegister_cert.der
-privateKey = certs/ServerRegister_key.der
-trustStore = certs/trust/server_register
+certificate = tests/secure_cert/certs/ServerRegister/cert.der
+privateKey = tests/secure_cert/certs/ServerRegister/key.der
+trustStore = tests/secure_cert/certs/trust
 
 authMode = cert
 
diff --git a/tests/secure_cert/server_register_client.conf b/tests/secure_cert/server_register_client.conf
index ddba01d..1838958 100644
--- a/tests/secure_cert/server_register_client.conf
+++ b/tests/secure_cert/server_register_client.conf
@@ -3,9 +3,9 @@
 
 applicationUri = urn:localhost:bobink:ServerRegister
 
-certificate = certs/ServerRegisterClient_cert.der
-privateKey = certs/ServerRegisterClient_key.der
-trustStore = certs/trust/server_register_client
+certificate = tests/secure_cert/certs/ServerRegisterClient/cert.der
+privateKey = tests/secure_cert/certs/ServerRegisterClient/key.der
+trustStore = tests/secure_cert/certs/trust
 
 securityMode = SignAndEncrypt
 securityPolicy = Aes256_Sha256_RsaPss
diff --git a/tests/secure_user/certs/Client/cert.der b/tests/secure_user/certs/Client/cert.der
new file mode 100644
index 0000000..b4661db
--- /dev/null
+++ b/tests/secure_user/certs/Client/cert.der
diff --git a/tests/secure_user/certs/Client/key.der b/tests/secure_user/certs/Client/key.der
new file mode 100644
index 0000000..4ac4469
--- /dev/null
+++ b/tests/secure_user/certs/Client/key.der
diff --git a/tests/secure_user/certs/ServerLDS/cert.der b/tests/secure_user/certs/ServerLDS/cert.der
new file mode 100644
index 0000000..7460975
--- /dev/null
+++ b/tests/secure_user/certs/ServerLDS/cert.der
diff --git a/tests/secure_user/certs/ServerLDS/key.der b/tests/secure_user/certs/ServerLDS/key.der
new file mode 100644
index 0000000..bb917eb
--- /dev/null
+++ b/tests/secure_user/certs/ServerLDS/key.der
diff --git a/tests/secure_user/certs/ServerRegister/cert.der b/tests/secure_user/certs/ServerRegister/cert.der
new file mode 100644
index 0000000..5b8a6bd
--- /dev/null
+++ b/tests/secure_user/certs/ServerRegister/cert.der
diff --git a/tests/secure_user/certs/ServerRegister/key.der b/tests/secure_user/certs/ServerRegister/key.der
new file mode 100644
index 0000000..83669b7
--- /dev/null
+++ b/tests/secure_user/certs/ServerRegister/key.der
diff --git a/tests/secure_user/certs/ServerRegisterClient/cert.der b/tests/secure_user/certs/ServerRegisterClient/cert.der
new file mode 100644
index 0000000..cf62a2c
--- /dev/null
+++ b/tests/secure_user/certs/ServerRegisterClient/cert.der
diff --git a/tests/secure_user/certs/ServerRegisterClient/key.der b/tests/secure_user/certs/ServerRegisterClient/key.der
new file mode 100644
index 0000000..8f44211
--- /dev/null
+++ b/tests/secure_user/certs/ServerRegisterClient/key.der
diff --git a/tests/secure_user/certs/trust/Client_cert.der b/tests/secure_user/certs/trust/Client_cert.der
new file mode 100644
index 0000000..b4661db
--- /dev/null
+++ b/tests/secure_user/certs/trust/Client_cert.der
diff --git a/tests/secure_user/certs/trust/ServerLDS_cert.der b/tests/secure_user/certs/trust/ServerLDS_cert.der
new file mode 100644
index 0000000..7460975
--- /dev/null
+++ b/tests/secure_user/certs/trust/ServerLDS_cert.der
diff --git a/tests/secure_user/certs/trust/ServerRegisterClient_cert.der b/tests/secure_user/certs/trust/ServerRegisterClient_cert.der
new file mode 100644
index 0000000..cf62a2c
--- /dev/null
+++ b/tests/secure_user/certs/trust/ServerRegisterClient_cert.der
diff --git a/tests/secure_user/certs/trust/ServerRegister_cert.der b/tests/secure_user/certs/trust/ServerRegister_cert.der
new file mode 100644
index 0000000..5b8a6bd
--- /dev/null
+++ b/tests/secure_user/certs/trust/ServerRegister_cert.der
diff --git a/tests/secure_user/client.conf b/tests/secure_user/client.conf
index 5059ca9..1ce4452 100644
--- a/tests/secure_user/client.conf
+++ b/tests/secure_user/client.conf
@@ -2,9 +2,9 @@
 
 applicationUri = urn:localhost:bobink:Client
 
-certificate = certs/Client_cert.der
-privateKey = certs/Client_key.der
-trustStore = certs/trust/client
+certificate = tests/secure_user/certs/Client/cert.der
+privateKey = tests/secure_user/certs/Client/key.der
+trustStore = tests/secure_user/certs/trust
 
 securityMode = SignAndEncrypt
 securityPolicy = Aes256_Sha256_RsaPss
diff --git a/tests/secure_user/server_lds.conf b/tests/secure_user/server_lds.conf
index 3babf37..39ca4d1 100644
--- a/tests/secure_user/server_lds.conf
+++ b/tests/secure_user/server_lds.conf
@@ -4,9 +4,9 @@
 port = 14840
 applicationUri = urn:localhost:bobink:ServerLDS
 
-certificate = certs/ServerLDS_cert.der
-privateKey = certs/ServerLDS_key.der
-trustStore = certs/trust/server_lds
+certificate = tests/secure_user/certs/ServerLDS/cert.der
+privateKey = tests/secure_user/certs/ServerLDS/key.der
+trustStore = tests/secure_user/certs/trust
 
 authMode = anonymous
 
diff --git a/tests/secure_user/server_register.conf b/tests/secure_user/server_register.conf
index 65e69d8..d0efa16 100644
--- a/tests/secure_user/server_register.conf
+++ b/tests/secure_user/server_register.conf
@@ -3,9 +3,9 @@
 port = 14841
 applicationUri = urn:localhost:bobink:ServerRegister
 
-certificate = certs/ServerRegister_cert.der
-privateKey = certs/ServerRegister_key.der
-trustStore = certs/trust/server_register
+certificate = tests/secure_user/certs/ServerRegister/cert.der
+privateKey = tests/secure_user/certs/ServerRegister/key.der
+trustStore = tests/secure_user/certs/trust
 
 authMode = user
 username = user
diff --git a/tests/secure_user/server_register_client.conf b/tests/secure_user/server_register_client.conf
index b2edd24..148bab3 100644
--- a/tests/secure_user/server_register_client.conf
+++ b/tests/secure_user/server_register_client.conf
@@ -3,9 +3,9 @@
 
 applicationUri = urn:localhost:bobink:ServerRegister
 
-certificate = certs/ServerRegisterClient_cert.der
-privateKey = certs/ServerRegisterClient_key.der
-trustStore = certs/trust/server_register_client
+certificate = tests/secure_user/certs/ServerRegisterClient/cert.der
+privateKey = tests/secure_user/certs/ServerRegisterClient/key.der
+trustStore = tests/secure_user/certs/trust
 
 securityMode = SignAndEncrypt
 securityPolicy = Aes256_Sha256_RsaPss