## Regeneration of Test CRL Validation PEM files

Use `testutils` to regenerate the PEM files for CRL validation.
Upon generation, these files will have an expiration date of now + 5 years.

These files can be regenerated by running the following code
using Leiningen's REPL:

```clojure
(require '[puppetlabs.ssl-utils.testutils :as t])

(t/write-valid-cert-chain-and-crls 1 "crl_validation")
(t/write-valid-cert-chain-and-crls 3 "crl_validation")
(t/write-expired-crl "crl_validation")
(t/write-not-yet-valid-crl "crl_validation")
(t/write-crl-with-bad-sig "crl_validation")
(t/write-cert-chain-with-revoked-cert 3 "crl_validation")
```

### Regeneration details
| Helper called | Files regenerated | What it does | Validity / behavior logic |
|---|---|---|---|
| `write-valid-cert-chain-and-crls 1 "crl_validation"` | `1-cert-chain.pem`, `1-crl-chain.pem` | Generates a 1-cert CA chain and matching CRL chain | Certificates: `not-before = now - 1 day`, `not-after = now + 5 years`; CRLs: `thisUpdate = now`, `nextUpdate = now + 5 years` |
| `write-valid-cert-chain-and-crls 3 "crl_validation"` | `3-cert-chain.pem`, `3-crl-chain.pem` | Generates a 3-cert CA chain and matching CRL chain | Same “valid for 5 years” logic as above |
| `write-expired-crl "crl_validation"` | `cert-with-expired-crl.pem`, `expired-crl.pem` | Generates a cert plus a CRL that is intentionally expired | CRL: `thisUpdate = now`, `nextUpdate = now - 1 day` |
| `write-not-yet-valid-crl "crl_validation"` | `cert-with-not-valid-crl.pem`, `not-yet-valid-crl.pem` | Generates a cert plus a CRL that is not yet valid | CRL: `thisUpdate = now + 5 years`, `nextUpdate = now + 5 years` |
| `write-crl-with-bad-sig "crl_validation"` | `cert-with-crl-bad-sig.pem`, `crl-with-bad-signature.pem` | Generates a CRL signed with the wrong keypair | The CRL exists, but its signature does not verify against the issuer |
| `write-cert-chain-with-revoked-cert 3 "crl_validation"` | `cert-chain-with-revoked-cert.pem`, `crl-chain-with-cert-revoked.pem` | Generates a 3-cert chain and updates the CRL to revoke one cert | The last CRL includes the chosen certificate’s serial number as revoked |
