The generated certificates are valid till 05. Jun 2030.

The certificates are generated using catch-all SAN in the following procedure:

1. Generate the node's keystore:

	export      = flag.Bool("export", false, "export xl.meta")
	djson       = flag.Bool("djson", false, "expect djson format for xl.meta")
	genkey      = flag.Bool("genkey", false, "generate key pair")
)

func main() {
	flag.Parse()

	if *genkey {
		generateKeys()
		os.Exit(0)
	}
	var privateKeys [][]byte
	if *keyHex == "" {
		// Attempt to load private key(s)
		n := 1
		var base, ext string

```sh
openssl ecparam -genkey -name prime256v1 | openssl ec -out private.key
```

A response similar to this one should be displayed:

```
read EC key
writing EC key
```

Alternatively, use the following command to generate a private ECDSA key protected by a password:

```sh
openssl ecparam -genkey -name prime256v1 | openssl ec -aes256 -out private.key -passout pass:PASSWORD

            KerberosCredentials credentials = new KerberosCredentials(LOGIN_CONTEXT_NAME);
            KerberosKey foundKey = credentials.getKey(KEY_TYPE_1);
            assertNotNull(foundKey);
            assertEquals(key1, foundKey);
        }
    }

    /**
     * Test getKey method when the requested key type does not exist.
     *
     * @throws LoginException if login fails.
     */
    @Test

        DocMap docMap = new DocMap(parentMap);

        assertNull(docMap.put("newKey", "newValue"));
        assertEquals("newValue", docMap.get("newKey"));

        assertEquals("newValue", docMap.put("newKey", "updatedValue"));
        assertEquals("updatedValue", docMap.get("newKey"));

        assertNull(docMap.get("nonexistent"));
    }

    @Test
    public void test_remove() {

        // When
        byte[] encKey = Smb3KeyDerivation.deriveEncryptionKey(dialect, sessionKey, preauthIntegrity);

        // Then
        assertNotNull(encKey, "Encryption key should not be null");
        assertEquals(16, encKey.length, "Encryption key should be 16 bytes");
        assertFalse(Arrays.equals(sessionKey, encKey), "Encryption key should be different from session key");
    }

Matt Lloyd <******@****.***> 1745728257 +0100

     *
     * @param keyType the encryption type of the key to retrieve
     * @return the KerberosKey with the specified type, or null if not found
     */
    public KerberosKey getKey(int keyType) {
        KerberosKey serverKey = null;

        Set<Object> serverPrivateCredentials = this.subject.getPrivateCredentials();
        for (Object credential : serverPrivateCredentials) {

        // Given
        byte[] encKey = new byte[16];
        byte[] decKey = new byte[16];
        new SecureRandom().nextBytes(encKey);
        new SecureRandom().nextBytes(decKey);

        // When using try-with-resources
        assertDoesNotThrow(() -> {
            try (Smb2EncryptionContext context = new Smb2EncryptionContext(1, DialectVersion.SMB311, encKey, decKey)) {

        try {
            int expectedKeyLength = getKeyLength();
            byte[] encKey = getEncryptionKey();
            byte[] decKey = getDecryptionKey();

            try {
                boolean valid =
                        encKey != null && encKey.length == expectedKeyLength && decKey != null && decKey.length == expectedKeyLength;
                return valid;
            } finally {