lab-private-ca.crt — name-constrained to *.private.createlab.org; install instructions on the "Lab Kubernetes" Notion page. Valid to 2036-08.