go.step.sm/crypto v0.44.6: minica.Sign

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify go.step.sm/crypto/minica.Sign in pkg:golang/go.step.sm/crypto@v0.44.6
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:golang/go.step.sm/crypto@v0.44.6
Demonstrate these symbols/APIs:
  - go.step.sm/crypto/minica.Sign
Constraints:
  - executionContext: node
Required runtime conditions:
  - ecosystem: npm
  - language: javascript
  - moduleSystem: cjs
  - packageManager: npm@10.9.8
  - runtime: node@22.23.2

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:229d20bf704fb254edaa42b582e5703ba17fec69b2a254a6ee7f2bfdfc0fc0f2","contract":["minica.New initializes a new MiniCA with default Root and Intermediate CA certificates and signers","minica.New with minica.WithName configures Root and Intermediate CA Subject CommonNames with custom prefix","minica.CA.Sign signs an X.509 certificate template and automatically populates NotBefore, NotAfter, SerialNumber, and SubjectKeyId","minica.CA.Sign preserves explicit SerialNumber and validity period when provided in certificate template","minica.CA.Sign sets AuthorityKeyId matching the intermediate CA SubjectKeyId and Issuer matching intermediate CA Subject","x509 certificate signed by minica.CA.Sign verifies successfully against intermediate and root CA certificate pools","minica.CA.Sign signs certificate templates with RSA public keys","minica.CA.Sign returns an error when given an invalid certificate template with a nil public key"],"goal":"verify go.step.sm/crypto/minica.Sign in pkg:golang/go.step.sm/crypto@v0.44.6","kind":"HOW","packages":["pkg:golang/go.step.sm/crypto@v0.44.6"],"schemaVersion":1,"symbols":["go.step.sm/crypto/minica.Sign"]},"contractCommand":["go","run","./test"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"golang","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"go","schemaVersion":1},"license":"MIT-0","packages":["pkg:golang/go.step.sm/crypto@v0.44.6"],"schemaVersion":1,"subject":"pkg:golang/go.step.sm/crypto@v0.44.6","symbols":["go.step.sm/crypto/minica.Sign"],"verifierAdapter":"golang@1"}

module sample

go 1.22

require go.step.sm/crypto v0.44.6

require (
	filippo.io/edwards25519 v1.1.0 // indirect
	github.com/Masterminds/goutils v1.1.1 // indirect
	github.com/Masterminds/semver/v3 v3.2.0 // indirect
	github.com/Masterminds/sprig/v3 v3.2.3 // indirect
	github.com/google/uuid v1.6.0 // indirect
	github.com/huandu/xstrings v1.3.3 // indirect
	github.com/imdario/mergo v0.3.12 // indirect
	github.com/mitchellh/copystructure v1.2.0 // indirect
	github.com/mitchellh/reflectwalk v1.0.2 // indirect
	github.com/pkg/errors v0.9.1 // indirect
	github.com/shopspring/decimal v1.2.0 // indirect
	github.com/spf13/cast v1.4.1 // indirect
	golang.org/x/crypto v0.22.0 // indirect
	golang.org/x/net v0.24.0 // indirect
	golang.org/x/sys v0.19.0 // indirect
	golang.org/x/text v0.14.0 // indirect
)

filippo.io/edwards25519 v1.1.0 h1:FNf4tywRC1HmFuKW5xopWpigGjJKiJSV0Cqo0cJWDaA=
filippo.io/edwards25519 v1.1.0/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4=
github.com/Masterminds/goutils v1.1.1 h1:5nUrii3FMTL5diU80unEVvNevw1nH4+ZV4DSLVJLSYI=
github.com/Masterminds/goutils v1.1.1/go.mod h1:8cTjp+g8YejhMuvIA5y2vz3BpJxksy863GQaJW2MFNU=
github.com/Masterminds/semver/v3 v3.2.0 h1:3MEsd0SM6jqZojhjLWWeBY+Kcjy9i6MQAeY7YgDP83g=
github.com/Masterminds/semver/v3 v3.2.0/go.mod h1:qvl/7zhW3nngYb5+80sSMF+FG2BjYrf8m9wsX0PNOMQ=
github.com/Masterminds/sprig/v3 v3.2.3 h1:eL2fZNezLomi0uOLqjQoN6BfsDD+fyLtgbJMAj9n6YA=
github.com/Masterminds/sprig/v3 v3.2.3/go.mod h1:rXcFaZ2zZbLRJv/xSysmlgIM1u11eBaRMhvYXJNkGuM=
github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
github.com/huandu/xstrings v1.3.3 h1:/Gcsuc1x8JVbJ9/rlye4xZnVAbEkGauT8lbebqcQws4=
github.com/huandu/xstrings v1.3.3/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE=
github.com/imdario/mergo v0.3.11/go.mod h1:jmQim1M+e3UYxmgPu/WyfjB3N3VflVyUjjjwH0dnCYA=
github.com/imdario/mergo v0.3.12 h1:b6R2BslTbIEToALKP7LxUvijTsNI9TAe80pLWN2g/HU=
github.com/imdario/mergo v0.3.12/go.mod h1:jmQim1M+e3UYxmgPu/WyfjB3N3VflVyUjjjwH0dnCYA=
github.com/mitchellh/copystructure v1.0.0/go.mod h1:SNtv71yrdKgLRyLFxmLdkAbkKEFWgYaq1OVrnRcwhnw=
github.com/mitchellh/copystructure v1.2.0 h1:vpKXTN4ewci03Vljg/q9QvCGUDttBOGBIa15WveJJGw=
github.com/mitchellh/copystructure v1.2.0/go.mod h1:qLl+cE2AmVv+CoeAwDPye/v+N2HKCj9FbZEVFJRxO9s=
github.com/mitchellh/reflectwalk v1.0.0/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
github.com/mitchellh/reflectwalk v1.0.2 h1:G2LzWKi524PWgd3mLHV8Y5k7s6XUvT0Gef6zxSIeXaQ=
github.com/mitchellh/reflectwalk v1.0.2/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
github.com/shopspring/decimal v1.2.0 h1:abSATXmQEYyShuxI4/vyW3tV1MrKAJzCZ/0zLUXYbsQ=
github.com/shopspring/decimal v1.2.0/go.mod h1:DKyhrW/HYNuLGql+MJL6WCR6knT2jwCFRcu2hWCYk4o=
github.com/smallstep/assert v0.0.0-20200723003110-82e2b9b3b262 h1:unQFBIznI+VYD1/1fApl1A+9VcBk+9dcqGfnePY87LY=
github.com/smallstep/assert v0.0.0-20200723003110-82e2b9b3b262/go.mod h1:MyOHs9Po2fbM1LHej6sBUT8ozbxmMOFG+E+rx/GSGuc=
github.com/spf13/cast v1.3.1/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE=
github.com/spf13/cast v1.4.1 h1:s0hze+J0196ZfEMTs80N7UlFt0BDuQ7Q+JDnHiMWKdA=
github.com/spf13/cast v1.4.1/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE=
github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
go.step.sm/crypto v0.44.6 h1:vQg8ujce7fNXDO8EWdriSz+ZSJpYnNh22QrFtRjdyoY=
go.step.sm/crypto v0.44.6/go.mod h1:oKRO4jaf2MaCohJDN+/8ShImkvIgUKfJxxy87gqsnXs=
golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
golang.org/x/crypto v0.3.0/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
golang.org/x/crypto v0.22.0 h1:g1v0xeRhjcugydODzvb3mEM9SQ0HGp9s/nh3COQ/C30=
golang.org/x/crypto v0.22.0/go.mod h1:vr6Su+7cTlO45qkww3VDJlzDn0ctJvRgYbC2NvXHt+M=
golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY=
golang.org/x/net v0.24.0 h1:1PcaxkF854Fu3+lvBIx5SYn9wRlBzzcnHZSiaFFAb0w=
golang.org/x/net v0.24.0/go.mod h1:2Q7sJY5mzlzWjKtYUEXSlBWCdyaioyXzRB2RtU8KVE8=
golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.19.0 h1:q5f1RH2jigJ1MoAWp2KTp3gm5zAGFUTarQZ5U386+4o=
golang.org/x/sys v0.19.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
golang.org/x/term v0.19.0 h1:+ThwsDv+tYfnJFhF4L8jITxu1tdTWRTZpdsWgEgjL6Q=
golang.org/x/term v0.19.0/go.mod h1:2CuTdWZ7KHSQwUzKva0cbMg6q2DMI3Mmxp+gKJbskEk=
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ=
golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
gopkg.in/yaml.v2 v2.3.0 h1:clyUAQHOM3G0M3f5vQj7LuJrETvjVot3Z5el9nffUtU=
gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

package main

import (
	"crypto/ecdsa"
	"crypto/elliptic"
	"crypto/rand"
	"crypto/x509"
	"crypto/x509/pkix"
	"fmt"
	"net"

	"go.step.sm/crypto/minica"
)

func main() {
	ca, err := minica.New(minica.WithName("Example"))
	if err != nil {
		fmt.Printf("failed to initialize CA: %v\n", err)
		return
	}

	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
	if err != nil {
		fmt.Printf("failed to generate key: %v\n", err)
		return
	}

	tmpl := &x509.Certificate{
		Subject: pkix.Name{
			CommonName: "service.example.internal",
		},
		DNSNames:    []string{"service.example.internal"},
		IPAddresses: []net.IP{net.ParseIP("127.0.0.1")},
		PublicKey:   key.Public(),
	}

	cert, err := ca.Sign(tmpl)
	if err != nil {
		fmt.Printf("failed to sign certificate: %v\n", err)
		return
	}

	roots := x509.NewCertPool()
	roots.AddCert(ca.Root)
	intermediates := x509.NewCertPool()
	intermediates.AddCert(ca.Intermediate)

	opts := x509.VerifyOptions{
		Roots:         roots,
		Intermediates: intermediates,
		DNSName:       "service.example.internal",
	}

	if _, err := cert.Verify(opts); err != nil {
		fmt.Printf("certificate verification failed: %v\n", err)
		return
	}

	fmt.Printf("Successfully signed and verified certificate for %s\n", cert.Subject.CommonName)
}

{
  "schemaVersion": 1,
  "goal": "verify go.step.sm/crypto/minica.Sign in pkg:golang/go.step.sm/crypto@v0.44.6",
  "kind": "HOW",
  "packages": [
    "pkg:golang/go.step.sm/crypto@v0.44.6"
  ],
  "symbols": [
    "go.step.sm/crypto/minica.Sign"
  ],
  "constraints": {
    "executionContext": "node"
  },
  "runtimeConditions": {
    "ecosystem": "npm",
    "language": "javascript",
    "moduleSystem": "cjs",
    "packageManager": "npm@10.9.8",
    "runtime": "node@22.23.2"
  }
}

package main

import (
	"bytes"
	"crypto/ecdsa"
	"crypto/elliptic"
	"crypto/rand"
	"crypto/rsa"
	"crypto/x509"
	"crypto/x509/pkix"
	"fmt"
	"math/big"
	"net"
	"os"
	"time"

	"go.step.sm/crypto/minica"
)

func main() {
	// Assertion 1: minica.New initializes a new MiniCA with default Root and Intermediate CA certificates and signers
	{
		ca, err := minica.New()
		if err != nil {
			fmt.Fprintf(os.Stderr, "Contract 1 failed: minica.New error: %v\n", err)
			os.Exit(1)
		}
		if ca.Root == nil || ca.Intermediate == nil || ca.Signer == nil || ca.RootSigner == nil {
			fmt.Fprintf(os.Stderr, "Contract 1 failed: nil CA certificates or signers\n")
			os.Exit(1)
		}
		if ca.Root.Subject.CommonName != "MiniCA Root CA" {
			fmt.Fprintf(os.Stderr, "Contract 1 failed: unexpected default Root CN: %s\n", ca.Root.Subject.CommonName)
			os.Exit(1)
		}
		if ca.Intermediate.Subject.CommonName != "MiniCA Intermediate CA" {
			fmt.Fprintf(os.Stderr, "Contract 1 failed: unexpected default Intermediate CN: %s\n", ca.Intermediate.Subject.CommonName)
			os.Exit(1)
		}
	}

	// Assertion 2: minica.New with minica.WithName configures Root and Intermediate CA Subject CommonNames with custom prefix
	var ca *minica.CA
	{
		var err error
		ca, err = minica.New(minica.WithName("TestPKI"))
		if err != nil {
			fmt.Fprintf(os.Stderr, "Contract 2 failed: minica.New with name error: %v\n", err)
			os.Exit(1)
		}
		if ca.Root.Subject.CommonName != "TestPKI Root CA" {
			fmt.Fprintf(os.Stderr, "Contract 2 failed: unexpected named Root CN: %s\n", ca.Root.Subject.CommonName)
			os.Exit(1)
		}
		if ca.Intermediate.Subject.CommonName != "TestPKI Intermediate CA" {
			fmt.Fprintf(os.Stderr, "Contract 2 failed: unexpected named Intermediate CN: %s\n", ca.Intermediate.Subject.CommonName)
			os.Exit(1)
		}
	}

	ecKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
	if err != nil {
		fmt.Fprintf(os.Stderr, "Setup error: failed to generate ECDSA key: %v\n", err)
		os.Exit(1)
	}

	var signedCert *x509.Certificate

	// Assertion 3: minica.CA.Sign signs an X.509 certificate template and automatically populates NotBefore, NotAfter, SerialNumber, and SubjectKeyId
	{
		beforeTime := time.Now().Add(-1 * time.Second)
		tmpl := &x509.Certificate{
			Subject: pkix.Name{
				CommonName: "server.example.internal",
			},
			DNSNames:    []string{"server.example.internal"},
			IPAddresses: []net.IP{net.ParseIP("192.168.1.10")},
			PublicKey:   ecKey.Public(),
		}
		signedCert, err = ca.Sign(tmpl)
		if err != nil {
			fmt.Fprintf(os.Stderr, "Contract 3 failed: ca.Sign error: %v\n", err)
			os.Exit(1)
		}
		if signedCert.SerialNumber == nil || signedCert.SerialNumber.Sign() <= 0 {
			fmt.Fprintf(os.Stderr, "Contract 3 failed: SerialNumber not generated or non-positive\n")
			os.Exit(1)
		}
		if signedCert.NotBefore.Before(beforeTime) || signedCert.NotBefore.After(time.Now().Add(5*time.Second)) {
			fmt.Fprintf(os.Stderr, "Contract 3 failed: NotBefore not set to current time\n")
			os.Exit(1)
		}
		expectedNotAfter := signedCert.NotBefore.Add(24 * time.Hour)
		if !signedCert.NotAfter.Equal(expectedNotAfter) {
			fmt.Fprintf(os.Stderr, "Contract 3 failed: NotAfter (%v) expected to be 24h after NotBefore (%v)\n", signedCert.NotAfter, expectedNotAfter)
			os.Exit(1)
		}
		if len(signedCert.SubjectKeyId) == 0 {
			fmt.Fprintf(os.Stderr, "Contract 3 failed: SubjectKeyId empty\n")
			os.Exit(1)
		}
		if signedCert.Subject.CommonName != "server.example.internal" {
			fmt.Fprintf(os.Stderr, "Contract 3 failed: CommonName mismatch\n")
			os.Exit(1)
		}
	}

	// Assertion 4: minica.CA.Sign preserves explicit SerialNumber and validity period when provided in certificate template
	{
		customSerial := big.NewInt(778899)
		customNotBefore := time.Now().Add(-2 * time.Hour).Truncate(time.Second)
		customNotAfter := customNotBefore.Add(72 * time.Hour)
		tmpl := &x509.Certificate{
			SerialNumber: customSerial,
			NotBefore:    customNotBefore,
			NotAfter:     customNotAfter,
			Subject: pkix.Name{
				CommonName: "custom.example.internal",
			},
			PublicKey: ecKey.Public(),
		}
		customCert, err := ca.Sign(tmpl)
		if err != nil {
			fmt.Fprintf(os.Stderr, "Contract 4 failed: ca.Sign error: %v\n", err)
			os.Exit(1)
		}
		if customCert.SerialNumber.Cmp(customSerial) != 0 {
			fmt.Fprintf(os.Stderr, "Contract 4 failed: SerialNumber not preserved, got %v want %v\n", customCert.SerialNumber, customSerial)
			os.Exit(1)
		}
		if !customCert.NotBefore.Equal(customNotBefore) {
			fmt.Fprintf(os.Stderr, "Contract 4 failed: NotBefore not preserved, got %v want %v\n", customCert.NotBefore, customNotBefore)
			os.Exit(1)
		}
		if !customCert.NotAfter.Equal(customNotAfter) {
			fmt.Fprintf(os.Stderr, "Contract 4 failed: NotAfter not preserved, got %v want %v\n", customCert.NotAfter, customNotAfter)
			os.Exit(1)
		}
	}

	// Assertion 5: minica.CA.Sign sets AuthorityKeyId matching the intermediate CA SubjectKeyId and Issuer matching intermediate CA Subject
	{
		if !bytes.Equal(signedCert.AuthorityKeyId, ca.Intermediate.SubjectKeyId) {
			fmt.Fprintf(os.Stderr, "Contract 5 failed: AuthorityKeyId (%x) does not match intermediate SubjectKeyId (%x)\n", signedCert.AuthorityKeyId, ca.Intermediate.SubjectKeyId)
			os.Exit(1)
		}
		if signedCert.Issuer.CommonName != ca.Intermediate.Subject.CommonName {
			fmt.Fprintf(os.Stderr, "Contract 5 failed: Issuer CommonName (%s) does not match intermediate (%s)\n", signedCert.Issuer.CommonName, ca.Intermediate.Subject.CommonName)
			os.Exit(1)
		}
	}

	// Assertion 6: x509 certificate signed by minica.CA.Sign verifies successfully against intermediate and root CA certificate pools
	{
		roots := x509.NewCertPool()
		roots.AddCert(ca.Root)
		intermediates := x509.NewCertPool()
		intermediates.AddCert(ca.Intermediate)

		opts := x509.VerifyOptions{
			Roots:         roots,
			Intermediates: intermediates,
			DNSName:       "server.example.internal",
		}
		chains, err := signedCert.Verify(opts)
		if err != nil {
			fmt.Fprintf(os.Stderr, "Contract 6 failed: certificate verification error: %v\n", err)
			os.Exit(1)
		}
		if len(chains) == 0 || len(chains[0]) != 3 {
			fmt.Fprintf(os.Stderr, "Contract 6 failed: expected chain depth 3 (cert -> intermediate -> root), got %d chains\n", len(chains))
			os.Exit(1)
		}
	}

	// Assertion 7: minica.CA.Sign signs certificate templates with RSA public keys
	{
		rsaKey, err := rsa.GenerateKey(rand.Reader, 2048)
		if err != nil {
			fmt.Fprintf(os.Stderr, "Contract 7 setup error: RSA key generation failed: %v\n", err)
			os.Exit(1)
		}
		rsaTmpl := &x509.Certificate{
			Subject: pkix.Name{
				CommonName: "rsa.example.internal",
			},
			PublicKey: rsaKey.Public(),
		}
		rsaCert, err := ca.Sign(rsaTmpl)
		if err != nil {
			fmt.Fprintf(os.Stderr, "Contract 7 failed: ca.Sign with RSA key error: %v\n", err)
			os.Exit(1)
		}
		if rsaCert.Subject.CommonName != "rsa.example.internal" {
			fmt.Fprintf(os.Stderr, "Contract 7 failed: RSA cert CommonName mismatch\n")
			os.Exit(1)
		}
	}

	// Assertion 8: minica.CA.Sign returns an error when given an invalid certificate template with a nil public key
	{
		nilKeyTmpl := &x509.Certificate{
			Subject: pkix.Name{
				CommonName: "nilkey.example.internal",
			},
			PublicKey: nil,
		}
		_, err := ca.Sign(nilKeyTmpl)
		if err == nil {
			fmt.Fprintf(os.Stderr, "Contract 8 failed: expected error when signing template with nil PublicKey, got nil\n")
			os.Exit(1)
		}
	}

	fmt.Println("All contract assertions passed.")
}