diff --git a/spec/bundler/fetcher/gem_remote_fetcher_local_ssl_server_spec.rb b/spec/bundler/fetcher/gem_remote_fetcher_local_ssl_server_spec.rb
index 91f02005586f..2a287af19587 100644
--- a/spec/bundler/fetcher/gem_remote_fetcher_local_ssl_server_spec.rb
+++ b/spec/bundler/fetcher/gem_remote_fetcher_local_ssl_server_spec.rb
@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "bundler/fetcher"
+require Spec::Path.rubygems_test_dir.join("pem_utilities")
 require Spec::Path.rubygems_test_dir.join("local_ssl_server_utilities")
 
 RSpec.describe "Bundler::Fetcher local SSL server", if: Gem::HAVE_OPENSSL do
@@ -19,7 +20,7 @@
       it "connects" do
         ssl_server = start_ssl_server
         allow(Bundler.settings).to receive(:[]).and_call_original
-        allow(Bundler.settings).to receive(:[]).with(:ssl_ca_cert).and_return(File.join(certs_dir, "ca_cert.pem"))
+        allow(Bundler.settings).to receive(:[]).with(:ssl_ca_cert).and_return(Gem::PemUtilities::CA_CERT_FILE)
         response = fetch_path("https://localhost:#{ssl_server.addr[1]}/yaml")
         expect(response.code).to eq("200")
       end
@@ -29,8 +30,8 @@
           verify_mode: OpenSSL::SSL::VERIFY_PEER | OpenSSL::SSL::VERIFY_FAIL_IF_NO_PEER_CERT
         )
         allow(Bundler.settings).to receive(:[]).and_call_original
-        allow(Bundler.settings).to receive(:[]).with(:ssl_ca_cert).and_return(File.join(certs_dir, "ca_cert.pem"))
-        allow(Bundler.settings).to receive(:[]).with(:ssl_client_cert).and_return(File.join(certs_dir, "client.pem"))
+        allow(Bundler.settings).to receive(:[]).with(:ssl_ca_cert).and_return(Gem::PemUtilities::CA_CERT_FILE)
+        allow(Bundler.settings).to receive(:[]).with(:ssl_client_cert).and_return(Gem::PemUtilities::CLIENT_FILE)
         response = fetch_path("https://localhost:#{ssl_server.addr[1]}/yaml")
         expect(response.code).to eq("200")
       end
@@ -44,7 +45,7 @@
       it "connects" do
         ssl_server = start_ssl_server(mode: :pqc)
         allow(Bundler.settings).to receive(:[]).and_call_original
-        allow(Bundler.settings).to receive(:[]).with(:ssl_ca_cert).and_return(File.join(certs_dir, "mldsa65_ca_cert.pem"))
+        allow(Bundler.settings).to receive(:[]).with(:ssl_ca_cert).and_return(Gem::PemUtilities::MLDSA65_CA_CERT_FILE)
         response = fetch_path("https://localhost:#{ssl_server.addr[1]}/yaml")
         expect(response.code).to eq("200")
       end
@@ -55,8 +56,8 @@
           verify_mode: OpenSSL::SSL::VERIFY_PEER | OpenSSL::SSL::VERIFY_FAIL_IF_NO_PEER_CERT
         )
         allow(Bundler.settings).to receive(:[]).and_call_original
-        allow(Bundler.settings).to receive(:[]).with(:ssl_ca_cert).and_return(File.join(certs_dir, "mldsa65_ca_cert.pem"))
-        allow(Bundler.settings).to receive(:[]).with(:ssl_client_cert).and_return(File.join(certs_dir, "mldsa65_client.pem"))
+        allow(Bundler.settings).to receive(:[]).with(:ssl_ca_cert).and_return(Gem::PemUtilities::MLDSA65_CA_CERT_FILE)
+        allow(Bundler.settings).to receive(:[]).with(:ssl_client_cert).and_return(Gem::PemUtilities::MLDSA65_CLIENT_FILE)
         response = fetch_path("https://localhost:#{ssl_server.addr[1]}/yaml")
         expect(response.code).to eq("200")
       end
diff --git a/test/rubygems/private_ec_key.pem b/test/rubygems/ec_private_key.pem
similarity index 100%
rename from test/rubygems/private_ec_key.pem
rename to test/rubygems/ec_private_key.pem
diff --git a/test/rubygems/helper.rb b/test/rubygems/helper.rb
index 1a4f49ad6417..174bd258168b 100644
--- a/test/rubygems/helper.rb
+++ b/test/rubygems/helper.rb
@@ -46,6 +46,7 @@
 require "rubygems/vendor/uri/lib/uri"
 require "zlib"
 require_relative "mock_gem_ui"
+require_relative "pem_utilities"
 
 # JRuby on Windows raises TypeError inside File.symlink (the wincode helper
 # trips on a nil path), so any test that exercises Gem::Installer's symlink
@@ -1658,75 +1659,7 @@ def prefetch(reqs) # :nodoc:
     end
   end
 
-  ##
-  # Loads certificate named +cert_name+ from <tt>test/rubygems/</tt>.
-
-  def self.load_cert(cert_name)
-    cert_file = cert_path cert_name
-
-    cert = File.read cert_file
-
-    OpenSSL::X509::Certificate.new cert
-  end
-
-  ##
-  # Returns the path to the certificate named +cert_name+ from
-  # <tt>test/rubygems/</tt>.
-
-  def self.cert_path(cert_name)
-    if begin
-         Time.at(2**32)
-       rescue StandardError
-         32
-       end == 32
-      cert_file = "#{__dir__}/#{cert_name}_cert_32.pem"
-
-      return cert_file if File.exist? cert_file
-    end
-
-    "#{__dir__}/#{cert_name}_cert.pem"
-  end
-
-  ##
-  # Loads a private key named +key_name+ with +passphrase+ in <tt>test/rubygems/</tt>
-
-  def self.load_key(key_name, passphrase = nil)
-    key_file = key_path key_name
-
-    key = File.read key_file
-
-    OpenSSL::PKey.read key, passphrase
-  end
-
-  ##
-  # Returns the path to the key named +key_name+ from <tt>test/rubygems</tt>
-
-  def self.key_path(key_name)
-    "#{__dir__}/#{key_name}_key.pem"
-  end
-
-  # :stopdoc:
-  # only available in RubyGems tests
-
-  PRIVATE_KEY_PASSPHRASE = "Foo bar"
-
-  begin
-    PRIVATE_KEY                 = load_key "private"
-    PRIVATE_KEY_PATH            = key_path "private"
-
-    # ENCRYPTED_PRIVATE_KEY is PRIVATE_KEY encrypted with PRIVATE_KEY_PASSPHRASE
-    ENCRYPTED_PRIVATE_KEY       = load_key "encrypted_private", PRIVATE_KEY_PASSPHRASE
-    ENCRYPTED_PRIVATE_KEY_PATH  = key_path "encrypted_private"
-
-    PUBLIC_KEY                  = PRIVATE_KEY.public_key
-
-    PUBLIC_CERT                 = load_cert "public"
-    PUBLIC_CERT_PATH            = cert_path "public"
-  rescue Errno::ENOENT
-    PRIVATE_KEY = nil
-    PUBLIC_KEY  = nil
-    PUBLIC_CERT = nil
-  end if Gem::HAVE_OPENSSL
+  include Gem::PemUtilities
 end
 
 # https://github.com/seattlerb/minitest/blob/13c48a03d84a2a87855a4de0c959f96800100357/lib/minitest/mock.rb#L192
diff --git a/test/rubygems/local_ssl_server_utilities.rb b/test/rubygems/local_ssl_server_utilities.rb
index a068efa9642d..d0d73dbd1219 100644
--- a/test/rubygems/local_ssl_server_utilities.rb
+++ b/test/rubygems/local_ssl_server_utilities.rb
@@ -5,14 +5,10 @@
 
 require "socket"
 require "openssl"
+require_relative "pem_utilities"
 
 module Gem::LocalSSLServerUtilities
-  CERTS_DIR = __dir__
-
-  def certs_dir
-    CERTS_DIR
-  end
-
+  include Gem::PemUtilities
   def initialize_ssl_server
     @ssl_server_thread = nil
     @ssl_server = nil
@@ -40,13 +36,13 @@ def start_ssl_server(config = {})
 
     case mode
     when :non_pqc
-      ctx.cert = cert("ssl_cert.pem")
-      ctx.key = key("ssl_key.pem")
-      ctx.ca_file = File.join(certs_dir, "ca_cert.pem")
+      ctx.cert = SSL_CERT
+      ctx.key = SSL_KEY
+      ctx.ca_file = CA_CERT_FILE
     when :pqc
-      ctx.cert = cert("mldsa65_ssl_cert.pem")
-      ctx.key = key("mldsa65_ssl_key.pem")
-      ctx.ca_file = File.join(certs_dir, "mldsa65_ca_cert.pem")
+      ctx.cert = MLDSA65_SSL_CERT
+      ctx.key = MLDSA65_SSL_KEY
+      ctx.ca_file = MLDSA65_CA_CERT_FILE
       ctx.groups = "X25519MLKEM768"
     end
 
@@ -79,14 +75,6 @@ def handle_request(client)
     end
   end
 
-  def cert(filename)
-    OpenSSL::X509::Certificate.new(File.read(File.join(certs_dir, filename)))
-  end
-
-  def key(filename)
-    OpenSSL::PKey.read(File.read(File.join(certs_dir, filename)))
-  end
-
   def without_pqc_support(&block)
     # PQC algorithms ML-KEM and ML-DSA require OpenSSL >= 3.5.
     # https://openssl-library.org/post/2025-04-08-openssl-35-final-release/
@@ -123,8 +111,8 @@ def self.support_pqc_handshake?
   def self.probe_pqc_handshake
     server = TCPServer.new("127.0.0.1", 0)
     ctx = OpenSSL::SSL::SSLContext.new
-    ctx.cert = OpenSSL::X509::Certificate.new(File.read(File.join(CERTS_DIR, "mldsa65_ssl_cert.pem")))
-    ctx.key = OpenSSL::PKey.read(File.read(File.join(CERTS_DIR, "mldsa65_ssl_key.pem")))
+    ctx.cert = Gem::PemUtilities::MLDSA65_SSL_CERT
+    ctx.key = Gem::PemUtilities::MLDSA65_SSL_KEY
     ctx.groups = "X25519MLKEM768"
     ssl_server = OpenSSL::SSL::SSLServer.new(server, ctx)
 
diff --git a/test/rubygems/pem_utilities.rb b/test/rubygems/pem_utilities.rb
new file mode 100644
index 000000000000..bec08d9a38dd
--- /dev/null
+++ b/test/rubygems/pem_utilities.rb
@@ -0,0 +1,130 @@
+# frozen_string_literal: true
+
+# This file can be loaded by RubyGems test-unit files and Bundler rspec files.
+# Don't add test-unit or rspec dependent logic in this file.
+
+require "rubygems/openssl"
+
+module Gem::PemUtilities
+  ##
+  # Loads certificate named +cert_name+ from <tt>test/rubygems/</tt>.
+
+  def self.load_cert(cert_name)
+    cert = File.read(cert_file(cert_name))
+    OpenSSL::X509::Certificate.new cert
+  end
+
+  ##
+  # Returns the file path to the certificate named +cert_name+ from
+  # <tt>test/rubygems/</tt>.
+
+  def self.cert_file(cert_name)
+    if begin
+         Time.at(2**32)
+       rescue StandardError
+         32
+       end == 32
+      cert_file = "#{__dir__}/#{cert_name}_cert_32.pem"
+
+      return cert_file if File.exist? cert_file
+    end
+
+    "#{__dir__}/#{cert_name}_cert.pem"
+  end
+
+  ##
+  # Loads a private key named +key_name+ with +passphrase+ in <tt>test/rubygems/</tt>
+
+  def self.load_key(key_name, passphrase = nil)
+    key = File.read(key_file(key_name))
+
+    # Rescue if unsupported key algorithm's file is read with old OpenSSL versions.
+    begin
+      OpenSSL::PKey.read key, passphrase
+    rescue OpenSSL::PKey::PKeyError
+      nil
+    end
+  end
+
+  ##
+  # Returns the file path to the key named +key_name+ from <tt>test/rubygems</tt>
+
+  def self.key_file(key_name)
+    "#{__dir__}/#{key_name}_key.pem"
+  end
+
+  ##
+  # Returns the file path to the PEM file named +pem_name+ from <tt>test/rubygems</tt>
+
+  def self.pem_file(pem_name)
+    "#{__dir__}/#{pem_name}.pem"
+  end
+
+  # :stopdoc:
+
+  PRIVATE_KEY_PASSPHRASE = "Foo bar"
+
+  if Gem::HAVE_OPENSSL
+    # Only the key and certificate constants used in tests are managed here. Add
+    # constants here when adding or using new .pem files. The constant naming
+    # convention is <algorithm>_<name>.
+
+    # Keys and certificates mostly generated by create_certs.sh
+    # RSA CA
+    CA_CERT                     = load_cert "ca"
+    CA_CERT_FILE                = cert_file "ca"
+    # RSA server
+    SSL_KEY                     = load_key "ssl"
+    SSL_KEY_FILE                = key_file "ssl"
+    SSL_CERT                    = load_cert "ssl"
+    SSL_CERT_FILE               = cert_file "ssl"
+    # RSA client key/cert pair
+    CLIENT_FILE                 = pem_file "client"
+    # RSA invalid client manually created without script
+    INVALID_CLIENT_FILE         = pem_file "invalid_client"
+    # ML-DSA-65 CA
+    MLDSA65_CA_CERT_FILE        = cert_file "mldsa65_ca"
+    # ML-DSA-65 server
+    MLDSA65_SSL_KEY             = load_key "mldsa65_ssl"
+    MLDSA65_SSL_KEY_FILE        = key_file "mldsa65_ssl"
+    MLDSA65_SSL_CERT            = load_cert "mldsa65_ssl"
+    MLDSA65_SSL_CERT_FILE       = cert_file "mldsa65_ssl"
+    # ML-DSA-65 client key/cert pair
+    MLDSA65_CLIENT_FILE         = pem_file "mldsa65_client"
+
+    # Keys and certificates generated by create_certs.rb
+    PRIVATE_KEY                 = load_key "private"
+    PRIVATE_KEY_FILE            = key_file "private"
+    # ENCRYPTED_PRIVATE_KEY is PRIVATE_KEY encrypted with PRIVATE_KEY_PASSPHRASE
+    ENCRYPTED_PRIVATE_KEY       = load_key "encrypted_private", PRIVATE_KEY_PASSPHRASE
+    ENCRYPTED_PRIVATE_KEY_FILE  = key_file "encrypted_private"
+    PUBLIC_KEY                  = PRIVATE_KEY.public_key
+    PUBLIC_KEY_FILE             = key_file "public"
+    PUBLIC_CERT                 = load_cert "public"
+    PUBLIC_CERT_FILE            = cert_file "public"
+    ALTERNATE_KEY               = load_key "alternate"
+    ALTERNATE_KEY_FILE          = key_file "alternate"
+    ALTERNATE_CERT              = load_cert "alternate"
+    ALTERNATE_CERT_FILE         = cert_file "alternate"
+    CHILD_KEY                   = load_key "child"
+    CHILD_CERT                  = load_cert "child"
+    CHILD_CERT_FILE             = cert_file "child"
+    GRANDCHILD_CERT             = load_cert "grandchild"
+    INVALID_ISSUER_CERT         = load_cert "invalid_issuer"
+    INVALID_SIGNER_CERT         = load_cert "invalid_signer"
+    INVALIDCHILD_CERT           = load_cert "invalidchild"
+    EXPIRED_CERT                = load_cert "expired"
+    EXPIRED_CERT_FILE           = cert_file "expired"
+    FUTURE_CERT                 = load_cert "future"
+    WRONG_KEY_CERT              = load_cert "wrong_key"
+
+    # Keys and certificates manually created without script
+    # RSA 3072 bits
+    RSA3072_PRIVATE_KEY_FILE    = key_file "rsa3072_private"
+    RSA3072_PUBLIC_CERT         = load_cert "rsa3072_public"
+    RSA3072_PUBLIC_CERT_FILE    = cert_file "rsa3072_public"
+    # EC
+    EC_PRIVATE_KEY              = load_key "ec_private", PRIVATE_KEY_PASSPHRASE
+    EC_PRIVATE_KEY_FILE         = key_file "ec_private"
+  end
+end
diff --git a/test/rubygems/private3072_key.pem b/test/rubygems/rsa3072_private_key.pem
similarity index 100%
rename from test/rubygems/private3072_key.pem
rename to test/rubygems/rsa3072_private_key.pem
diff --git a/test/rubygems/public3072_cert.pem b/test/rubygems/rsa3072_public_cert.pem
similarity index 100%
rename from test/rubygems/public3072_cert.pem
rename to test/rubygems/rsa3072_public_cert.pem
diff --git a/test/rubygems/test_gem_commands_build_command.rb b/test/rubygems/test_gem_commands_build_command.rb
index 9339f41f7cb8..cd88421c0754 100644
--- a/test/rubygems/test_gem_commands_build_command.rb
+++ b/test/rubygems/test_gem_commands_build_command.rb
@@ -5,12 +5,6 @@
 require "rubygems/package"
 
 class TestGemCommandsBuildCommand < Gem::TestCase
-  CERT_FILE = cert_path "public3072"
-  SIGNING_KEY = key_path "private3072"
-
-  EXPIRED_CERT_FILE = cert_path "expired"
-  PRIVATE_KEY_FILE  = key_path "private"
-
   def setup
     super
 
@@ -591,8 +585,8 @@ def test_build_signed_gem
     trust_dir = Gem::Security.trust_dir
 
     spec = util_spec "some_gem" do |s|
-      s.signing_key = SIGNING_KEY
-      s.cert_chain = [CERT_FILE]
+      s.signing_key = RSA3072_PRIVATE_KEY_FILE
+      s.cert_chain = [RSA3072_PUBLIC_CERT_FILE]
     end
 
     gemspec_file = File.join(@tempdir, spec.spec_name)
@@ -605,7 +599,7 @@ def test_build_signed_gem
 
     util_test_build_gem spec
 
-    trust_dir.trust_cert OpenSSL::X509::Certificate.new(File.read(CERT_FILE))
+    trust_dir.trust_cert RSA3072_PUBLIC_CERT
 
     gem = Gem::Package.new(File.join(@tempdir, spec.file_name),
                            Gem::Security::HighSecurity)
diff --git a/test/rubygems/test_gem_commands_cert_command.rb b/test/rubygems/test_gem_commands_cert_command.rb
index b9207cdcbcd3..17fe3d789a6f 100644
--- a/test/rubygems/test_gem_commands_cert_command.rb
+++ b/test/rubygems/test_gem_commands_cert_command.rb
@@ -12,19 +12,6 @@
 end
 
 class TestGemCommandsCertCommand < Gem::TestCase
-  ALTERNATE_CERT = load_cert "alternate"
-  EXPIRED_PUBLIC_CERT = load_cert "expired"
-
-  ALTERNATE_KEY_FILE  = key_path "alternate"
-  PRIVATE_KEY_FILE    = key_path "private"
-  PRIVATE_EC_KEY_FILE = key_path "private_ec"
-  PUBLIC_KEY_FILE     = key_path "public"
-
-  ALTERNATE_CERT_FILE      = cert_path "alternate"
-  CHILD_CERT_FILE          = cert_path "child"
-  PUBLIC_CERT_FILE         = cert_path "public"
-  EXPIRED_PUBLIC_CERT_FILE = cert_path "expired"
-
   def setup
     super
 
@@ -84,8 +71,6 @@ def test_execute_add
   end
 
   def test_execute_add_twice
-    self.class.cert_path "alternate"
-
     @cmd.handle_options %W[
       --add #{PUBLIC_CERT_FILE}
       --add #{ALTERNATE_CERT_FILE}
@@ -289,7 +274,7 @@ def test_execute_build_key
   def test_execute_build_encrypted_key
     @cmd.handle_options %W[
       --build nobody@example.com
-      --private-key #{ENCRYPTED_PRIVATE_KEY_PATH}
+      --private-key #{ENCRYPTED_PRIVATE_KEY_FILE}
     ]
 
     use_ui @ui do
@@ -310,7 +295,7 @@ def test_execute_build_encrypted_key
   def test_execute_build_ec_key
     @cmd.handle_options %W[
       --build nobody@example.com
-      --private-key #{PRIVATE_EC_KEY_FILE}
+      --private-key #{EC_PRIVATE_KEY_FILE}
     ]
 
     use_ui @ui do
@@ -397,7 +382,7 @@ def test_execute_private_key
 
   def test_execute_encrypted_private_key
     use_ui @ui do
-      @cmd.send :handle_options, %W[--private-key #{ENCRYPTED_PRIVATE_KEY_PATH}]
+      @cmd.send :handle_options, %W[--private-key #{ENCRYPTED_PRIVATE_KEY_FILE}]
     end
 
     assert_equal "", @ui.output
@@ -517,7 +502,7 @@ def test_execute_sign_encrypted_key
     assert_equal "/CN=alternate/DC=example", ALTERNATE_CERT.issuer.to_s
 
     @cmd.handle_options %W[
-      --private-key #{ENCRYPTED_PRIVATE_KEY_PATH}
+      --private-key #{ENCRYPTED_PRIVATE_KEY_FILE}
       --certificate #{PUBLIC_CERT_FILE}
 
       --sign #{path}
@@ -684,12 +669,12 @@ def test_execute_re_sign
     Dir.mkdir gem_path
 
     path = File.join @tempdir, "cert.pem"
-    Gem::Security.write_certificate EXPIRED_PUBLIC_CERT, path, 0o600
+    Gem::Security.write_certificate EXPIRED_CERT, path, 0o600
 
-    assert_equal "/CN=nobody/DC=example", EXPIRED_PUBLIC_CERT.issuer.to_s
+    assert_equal "/CN=nobody/DC=example", EXPIRED_CERT.issuer.to_s
 
-    tmp_expired_cert_file = File.join(@tempdir, File.basename(EXPIRED_PUBLIC_CERT_FILE))
-    File.write(tmp_expired_cert_file, File.read(EXPIRED_PUBLIC_CERT_FILE))
+    tmp_expired_cert_file = File.join(@tempdir, File.basename(EXPIRED_CERT_FILE))
+    File.write(tmp_expired_cert_file, File.read(EXPIRED_CERT_FILE))
 
     @cmd.handle_options %W[
       --private-key #{PRIVATE_KEY_FILE}
@@ -716,12 +701,12 @@ def test_execute_re_sign_with_cert_expiration_length_days
     Dir.mkdir gem_path
 
     path = File.join @tempdir, "cert.pem"
-    Gem::Security.write_certificate EXPIRED_PUBLIC_CERT, path, 0o600
+    Gem::Security.write_certificate EXPIRED_CERT, path, 0o600
 
-    assert_equal "/CN=nobody/DC=example", EXPIRED_PUBLIC_CERT.issuer.to_s
+    assert_equal "/CN=nobody/DC=example", EXPIRED_CERT.issuer.to_s
 
-    tmp_expired_cert_file = File.join(@tempdir, File.basename(EXPIRED_PUBLIC_CERT_FILE))
-    File.write(tmp_expired_cert_file, File.read(EXPIRED_PUBLIC_CERT_FILE))
+    tmp_expired_cert_file = File.join(@tempdir, File.basename(EXPIRED_CERT_FILE))
+    File.write(tmp_expired_cert_file, File.read(EXPIRED_CERT_FILE))
 
     @cmd.handle_options %W[
       --private-key #{PRIVATE_KEY_FILE}
@@ -851,7 +836,7 @@ def test_handle_options_sign
   def test_handle_options_sign_encrypted_key
     @cmd.handle_options %W[
       --private-key #{ALTERNATE_KEY_FILE}
-      --private-key #{ENCRYPTED_PRIVATE_KEY_PATH}
+      --private-key #{ENCRYPTED_PRIVATE_KEY_FILE}
 
       --certificate #{ALTERNATE_CERT_FILE}
       --certificate #{PUBLIC_CERT_FILE}
diff --git a/test/rubygems/test_gem_package.rb b/test/rubygems/test_gem_package.rb
index 99763f4df19e..7b8ac4736d2f 100644
--- a/test/rubygems/test_gem_package.rb
+++ b/test/rubygems/test_gem_package.rb
@@ -275,7 +275,7 @@ def test_build_auto_signed
     Gem::Security.write_private_key PRIVATE_KEY, private_key_path
 
     public_cert_path = File.join Gem.user_home, ".gem", "gem-public_cert.pem"
-    FileUtils.cp PUBLIC_CERT_PATH, public_cert_path
+    FileUtils.cp PUBLIC_CERT_FILE, public_cert_path
 
     spec = Gem::Specification.new "build", "1"
     spec.summary = "build"
@@ -315,7 +315,7 @@ def test_build_auto_signed_encrypted_key
     FileUtils.mkdir_p File.join(Gem.user_home, ".gem")
 
     private_key_path = File.join Gem.user_home, ".gem", "gem-private_key.pem"
-    FileUtils.cp ENCRYPTED_PRIVATE_KEY_PATH, private_key_path
+    FileUtils.cp ENCRYPTED_PRIVATE_KEY_FILE, private_key_path
 
     public_cert_path = File.join Gem.user_home, ".gem", "gem-public_cert.pem"
     Gem::Security.write_certificate PUBLIC_CERT, public_cert_path
diff --git a/test/rubygems/test_gem_remote_fetcher_local_ssl_server.rb b/test/rubygems/test_gem_remote_fetcher_local_ssl_server.rb
index 95e6d3ac65a8..813e8e2f0265 100644
--- a/test/rubygems/test_gem_remote_fetcher_local_ssl_server.rb
+++ b/test/rubygems/test_gem_remote_fetcher_local_ssl_server.rb
@@ -26,7 +26,7 @@ def teardown
 
   def test_ssl_connection
     ssl_server = start_ssl_server
-    temp_ca_cert = File.join(certs_dir, "ca_cert.pem")
+    temp_ca_cert = CA_CERT_FILE
     with_configured_fetcher(":ssl_ca_cert: #{temp_ca_cert}") do |fetcher|
       fetcher.fetch_path("https://localhost:#{ssl_server.addr[1]}/yaml")
     end
@@ -36,7 +36,7 @@ def test_pqc_ssl_connection
     omit_unless_support_pqc
 
     ssl_server = start_ssl_server(mode: :pqc)
-    temp_ca_cert = File.join(certs_dir, "mldsa65_ca_cert.pem")
+    temp_ca_cert = MLDSA65_CA_CERT_FILE
     with_configured_fetcher(":ssl_ca_cert: #{temp_ca_cert}") do |fetcher|
       fetcher.fetch_path("https://localhost:#{ssl_server.addr[1]}/yaml")
     end
@@ -47,8 +47,8 @@ def test_ssl_client_cert_auth_connection
       { verify_mode: OpenSSL::SSL::VERIFY_PEER | OpenSSL::SSL::VERIFY_FAIL_IF_NO_PEER_CERT }
     )
 
-    temp_ca_cert = File.join(certs_dir, "ca_cert.pem")
-    temp_client_cert = File.join(certs_dir, "client.pem")
+    temp_ca_cert = CA_CERT_FILE
+    temp_client_cert = CLIENT_FILE
 
     with_configured_fetcher(
       ":ssl_ca_cert: #{temp_ca_cert}\n" \
@@ -66,8 +66,8 @@ def test_pqc_ssl_client_cert_auth_connection
       verify_mode: OpenSSL::SSL::VERIFY_PEER | OpenSSL::SSL::VERIFY_FAIL_IF_NO_PEER_CERT
     )
 
-    temp_ca_cert = File.join(certs_dir, "mldsa65_ca_cert.pem")
-    temp_client_cert = File.join(certs_dir, "mldsa65_client.pem")
+    temp_ca_cert = MLDSA65_CA_CERT_FILE
+    temp_client_cert = MLDSA65_CLIENT_FILE
 
     with_configured_fetcher(
       ":ssl_ca_cert: #{temp_ca_cert}\n" \
@@ -82,8 +82,8 @@ def test_do_not_allow_invalid_client_cert_auth_connection
       { verify_mode: OpenSSL::SSL::VERIFY_PEER | OpenSSL::SSL::VERIFY_FAIL_IF_NO_PEER_CERT }
     )
 
-    temp_ca_cert = File.join(certs_dir, "ca_cert.pem")
-    temp_client_cert = File.join(certs_dir, "invalid_client.pem")
+    temp_ca_cert = CA_CERT_FILE
+    temp_client_cert = INVALID_CLIENT_FILE
 
     with_configured_fetcher(
       ":ssl_ca_cert: #{temp_ca_cert}\n" \
@@ -114,7 +114,7 @@ def test_ssl_connection_allow_verify_none
   def test_do_not_follow_insecure_redirect
     @server_uri = "http://example.com"
     ssl_server = start_ssl_server
-    temp_ca_cert = File.join(certs_dir, "ca_cert.pem")
+    temp_ca_cert = CA_CERT_FILE
     expected_error_message =
       "redirecting to non-https resource: #{@server_uri} (https://localhost:#{ssl_server.addr[1]}/insecure_redirect?to=#{@server_uri})"
 
diff --git a/test/rubygems/test_gem_request.rb b/test/rubygems/test_gem_request.rb
index cd0a416e79c0..cee7e8943f23 100644
--- a/test/rubygems/test_gem_request.rb
+++ b/test/rubygems/test_gem_request.rb
@@ -8,13 +8,6 @@
 end
 
 class TestGemRequest < Gem::TestCase
-  CA_CERT_FILE     = cert_path "ca"
-  CHILD_CERT       = load_cert "child"
-  EXPIRED_CERT     = load_cert "expired"
-  PUBLIC_CERT      = load_cert "public"
-  PUBLIC_CERT_FILE = cert_path "public"
-  SSL_CERT         = load_cert "ssl"
-
   def make_request(uri, request_class, last_modified, proxy)
     Gem::Request.create_with_proxy uri, request_class, last_modified, proxy
   end
diff --git a/test/rubygems/test_gem_security.rb b/test/rubygems/test_gem_security.rb
index e97af3b959e9..20f4b9fa8951 100644
--- a/test/rubygems/test_gem_security.rb
+++ b/test/rubygems/test_gem_security.rb
@@ -12,13 +12,6 @@
 end
 
 class TestGemSecurity < Gem::TestCase
-  CHILD_KEY = load_key "child"
-  EC_KEY = load_key "private_ec", "Foo bar"
-
-  ALTERNATE_CERT = load_cert "child"
-  CHILD_CERT     = load_cert "child"
-  EXPIRED_CERT   = load_cert "expired"
-
   def test_class_create_cert
     name = PUBLIC_CERT.subject
     key = PRIVATE_KEY
@@ -122,7 +115,7 @@ def test_class_get_public_key_rsa
   end
 
   def test_class_get_public_key_ec
-    pkey = Gem::Security.get_public_key(EC_KEY)
+    pkey = Gem::Security.get_public_key(EC_PRIVATE_KEY)
 
     assert_respond_to pkey, :public_to_pem
   end
@@ -163,7 +156,7 @@ def test_class_re_sign_not_self_signed
     end
 
     assert_equal "#{child_alt_name.value} is not self-signed, contact " \
-                 "#{ALTERNATE_CERT.issuer} to obtain a valid certificate",
+                 "#{CHILD_CERT.issuer} to obtain a valid certificate",
                  e.message
   end
 
diff --git a/test/rubygems/test_gem_security_policy.rb b/test/rubygems/test_gem_security_policy.rb
index 2f4fb1ce2875..30116ae9ef42 100644
--- a/test/rubygems/test_gem_security_policy.rb
+++ b/test/rubygems/test_gem_security_policy.rb
@@ -7,23 +7,6 @@
 end
 
 class TestGemSecurityPolicy < Gem::TestCase
-  ALTERNATE_KEY    = load_key "alternate"
-  INVALID_KEY      = load_key "invalid"
-  CHILD_KEY        = load_key "child"
-  GRANDCHILD_KEY   = load_key "grandchild"
-  INVALIDCHILD_KEY = load_key "invalidchild"
-
-  ALTERNATE_CERT      = load_cert "alternate"
-  CA_CERT             = load_cert "ca"
-  CHILD_CERT          = load_cert "child"
-  EXPIRED_CERT        = load_cert "expired"
-  FUTURE_CERT         = load_cert "future"
-  GRANDCHILD_CERT     = load_cert "grandchild"
-  INVALIDCHILD_CERT   = load_cert "invalidchild"
-  INVALID_ISSUER_CERT = load_cert "invalid_issuer"
-  INVALID_SIGNER_CERT = load_cert "invalid_signer"
-  WRONG_KEY_CERT      = load_cert "wrong_key"
-
   def setup
     super
 
diff --git a/test/rubygems/test_gem_security_signer.rb b/test/rubygems/test_gem_security_signer.rb
index d0541b0a341f..59a379322b63 100644
--- a/test/rubygems/test_gem_security_signer.rb
+++ b/test/rubygems/test_gem_security_signer.rb
@@ -7,14 +7,6 @@
 end
 
 class TestGemSecuritySigner < Gem::TestCase
-  ALTERNATE_KEY  = load_key "alternate"
-  CHILD_KEY      = load_key "child"
-  GRANDCHILD_KEY = load_key "grandchild"
-
-  CHILD_CERT      = load_cert "child"
-  GRANDCHILD_CERT = load_cert "grandchild"
-  EXPIRED_CERT    = load_cert "expired"
-
   def setup
     super
 
@@ -70,7 +62,7 @@ def test_initialize_default
   end
 
   def test_initialize_key_path
-    key_file = PRIVATE_KEY_PATH
+    key_file = PRIVATE_KEY_FILE
 
     signer = Gem::Security::Signer.new key_file, nil
 
@@ -78,7 +70,7 @@ def test_initialize_key_path
   end
 
   def test_initialize_encrypted_key_path
-    key_file = ENCRYPTED_PRIVATE_KEY_PATH
+    key_file = ENCRYPTED_PRIVATE_KEY_FILE
 
     signer = Gem::Security::Signer.new key_file, nil, PRIVATE_KEY_PASSPHRASE
 
diff --git a/test/rubygems/test_gem_security_trust_dir.rb b/test/rubygems/test_gem_security_trust_dir.rb
index bd3dfb86c231..57d7d1e4e8c0 100644
--- a/test/rubygems/test_gem_security_trust_dir.rb
+++ b/test/rubygems/test_gem_security_trust_dir.rb
@@ -7,8 +7,6 @@
 end
 
 class TestGemSecurityTrustDir < Gem::TestCase
-  CHILD_CERT = load_cert "child"
-
   def setup
     super