test: fix expired attribute certificate test vector

[yosuke-wolfssl]

Problem

wolfHSM CI checks out wolfSSL master unpinned. wolfSSL merged attribute
certificate validity-period enforcement (9c5436b85, 2026-07-28 01:31 UTC),
which adds CheckDate() on notBefore/notAfter inside VerifyX509Acert():

if (ret == 0) {
    ret = CheckDate(&dataASN[ACERT_IDX_ACINFO_VALIDITY_NOTB_GT], ASN_BEFORE);
}
if (ret == 0) {
    ret = CheckDate(&dataASN[ACERT_IDX_ACINFO_VALIDITY_NOTA_GT], ASN_AFTER);
}

The committed test vector attrCert_der[] was generated with a 48-hour
lifetime and is valid only 20250404195725Z → 20250406195725Z — expired
since April 2025. It passed until now only because VerifyX509Acert() never
checked dates. Result: Build and Test, Build and Test Client-Only, and
Code Coverage fail on every config, on main and every open PR, at
test/wh_test_cert.c:1541.

Fix (test/wh_test_cert_data_acert.h)

Regenerated the vector set with tools/testcertgen/gen_acerts.sh
(strongSwan pki), with lifetimes raised so the vector does not re-expire:

Command	Was	Now	Unit
pki --self --ca	3650	10950	days
pki --issue	365	10950	days
pki --acert	48	262800	hours

New acert validity is 20260728023203Z → 20560720023203Z. Array names are
unchanged, so no test source needed editing — the test now exercises the real
date check instead of skipping it. The script's stale
generate_certs.sh provenance string was corrected at the same time.

The CA private key is not committed and the dates live inside the signed
ACINFO, so the whole set must be regenerated together; the script already
does that.

Verification

Built against wolfSSL 9c5436b85 — the exact merge that broke CI.

• Negative control: with the old vector, the run aborts at
  ERROR [whTest_CertClientAcert:1541], reproducing CI exactly.
• Base: make && make run → rc=0, no errors.
• DMA=1: rc=0 (covers the second assertion at wh_test_cert.c:1846).
• CLIENT_ONLY=1 SHE=1 against the POSIX server over TCP → rc=0.

[Copilot]

Pull request overview

Updates the attribute-certificate (AC) test vectors so the wolfHSM test suite remains valid after wolfSSL started enforcing AC validity period checks during verification.

Changes:

• Regenerates the AC/CA/dummy cert vectors with ~30-year lifetimes to prevent test vectors from expiring.
• Updates gen_acerts.sh documentation to explain why long lifetimes are required and fixes the script provenance string embedded in the generated header.
• Renames the generated header’s include guard to match the filename-derived convention used by the generator.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
tools/testcertgen/gen_acerts.sh	Extends generated cert lifetimes and updates generator comments/provenance for AC test vectors.
test/wh_test_cert_data_acert.h	Replaces expired AC vector set with newly generated long-lived vectors and updates include guard/provenance.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.