Add demo modules and historical certificate detection

- Add real modules to modules/ directory for CI validation
- Add legacy-tls-library module referencing Historical cert #2345
- Fix CMVP test data (remove expired sunset date from Historical cert)

Workflow will now show:
- 3 modules validated
- WARNING for Historical certificate (demonstrates detection)

Author: ethanolivertroy

cmvp-cache/certificates/test-data.json

@@ -27,8 +27,7 @@
     "vendorName": "Legacy Systems Inc",
     "standard": "FIPS 140-2",
     "securityLevel": 1,
-    "validationDate": "2018-01-20",
-    "sunsetDate": "2023-01-20"
+    "validationDate": "2018-01-20"
   },
   "4523": {
     "certificateNumber": 4523,

modules/data-at-rest/aws-kms.yaml

@@ -0,0 +1,49 @@
+apiVersion: fedramp20x-poc/v1
+kind: CryptographicModule
+metadata:
+  name: aws-kms-hsm
+  uuid: 7a2c4d8f-3e91-4b56-a012-5c89d7e6f4a3
+  labels:
+    data-classification:
+      - DAR
+    environment: production
+    component: key-management
+  annotations:
+    ssp-reference: "SC-12, SC-13"
+
+spec:
+  module:
+    name: "AWS Key Management Service HSM"
+    vendor:
+      name: "Amazon Web Services"
+      url: "https://aws.amazon.com/kms/"
+    type: hardware
+    embodiment: multi-chip-standalone
+    description: "Hardware security module backing AWS KMS for key storage and cryptographic operations"
+
+  validation:
+    standard: "FIPS 140-3"
+    certificateNumber: 4523
+    securityLevel: 3
+    validationDate: "2024-03-15"
+    sunsetDate: "2029-03-15"
+    cmvpUrl: "https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/4523"
+    algorithms:
+      - AES
+      - RSA
+      - ECDSA
+      - HMAC
+      - DRBG
+      - KDF
+
+  usage:
+    dataClassification:
+      - data-at-rest
+    location: "AWS Cloud Infrastructure - Key Management"
+    purpose: "Envelope encryption key management for data at rest"
+    inherited: true
+    inheritedFrom: "FR1234567890"
+
+status:
+  cmvpStatus: Active
+  complianceStatus: compliant

modules/data-in-transit/legacy-tls-library.yaml

@@ -0,0 +1,30 @@
+apiVersion: fedramp20x-poc/v1
+kind: CryptographicModule
+metadata:
+  name: legacy-tls-library
+  uuid: cafebabe-cafe-babe-cafe-babecafebabe
+  labels:
+    data-classification:
+      - DIT
+    environment: production
+    component: legacy-app
+spec:
+  module:
+    name: "Legacy TLS Library"
+    vendor:
+      name: "Legacy Systems Inc"
+    type: software
+    versions:
+      software: "2.1.0"
+  validation:
+    standard: "FIPS 140-2"
+    certificateNumber: 2345
+    securityLevel: 1
+    validationDate: "2018-01-20"
+  usage:
+    dataClassification:
+      - data-in-transit
+    location: "Legacy Application Server"
+    purpose: "TLS encryption for legacy application - migration planned"
+  portProtocolServiceRef:
+    - pps-legacy-001

modules/data-in-transit/openssl-fips-provider.yaml

@@ -0,0 +1,61 @@
+apiVersion: fedramp20x-poc/v1
+kind: CryptographicModule
+metadata:
+  name: openssl-fips-provider
+  uuid: 95beec7e-6f82-4aaa-8211-969cd7c1f1ab
+  labels:
+    data-classification:
+      - DIT
+      - DAR
+    environment: production
+    component: api-gateway
+  annotations:
+    ssp-reference: "SC-13"
+    last-assessment: "2025-01-15"
+
+spec:
+  module:
+    name: "OpenSSL FIPS Provider"
+    vendor:
+      name: "OpenSSL Software Foundation"
+      url: "https://www.openssl.org"
+    type: software
+    embodiment: multi-chip-standalone
+    versions:
+      software: "3.0.8"
+    description: "FIPS 140-3 validated cryptographic provider for OpenSSL 3.x"
+
+  validation:
+    standard: "FIPS 140-3"
+    certificateNumber: 4282
+    securityLevel: 1
+    validationDate: "2023-10-03"
+    sunsetDate: "2028-10-03"
+    cmvpUrl: "https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/4282"
+    algorithms:
+      - AES
+      - RSA
+      - ECDSA
+      - SHA-2
+      - SHA-3
+      - HMAC
+      - KDF
+      - DRBG
+    caveats:
+      - "No assurance of minimum strength of generated SSPs"
+
+  usage:
+    dataClassification:
+      - data-in-transit
+    location: "Application Server - TLS Termination"
+    purpose: "TLS 1.3 encryption for API endpoints"
+    inherited: false
+
+  portProtocolServiceRef:
+    - "pps-001"
+    - "pps-002"
+
+status:
+  cmvpStatus: Active
+  lastValidated: "2025-12-07T10:30:00Z"
+  complianceStatus: compliant