openssl/test/certs, branch dependabot/github_actions/actions/setup-python-7

Fix DSA with SHA-384 / SHA-512 X.509 verification (issue openssl#30432)

2026-07-20T11:10:45Z

Register dsa_with_SHA384 and dsa_with_SHA512 in obj_xref so signature verification resolves digest + DSA key type. Add test_verify regression tests and PEM fixtures; add executable DSA cert generation in test/certs/setup.sh. CHANGES.md and NEWS.md entries for 4.0→4.1. Address review: plan tests 215, remove CHANGES merge artifact, replace comment-only setup.sh notes with actual openssl commands. Fixes openssl#30432 Reviewed-by: Dmitry Belyavskiy Reviewed-by: Nikola Pajkovsky MergeDate: Mon Jul 20 11:10:47 2026 (Merged from https://github.com/openssl/openssl/pull/30655)

Improve TLS handling of EC point formats

2026-07-10T09:21:28Z

Decouple the ec_point_formats extension from TLS 1.2 X.509 selection and acceptance. Remove tls1_check_pkey_comp() and its callers in tls1_check_cert_param() and tls1_check_chain(): TLS 1.3 disregards the extension already, and we can decode any point form a peer might send, so refusing a compressed peer cert in TLS 1.2 because we didn't advertise compressed buys nothing. The RFC 4492/8422 section 5.1.2 requirement that the peer's list contain "uncompressed" used to be enforced in a final hook on the client side only. Move it to the two points where the negotiated ciphersuite is known: the client's ServerHello parse hook, and the server's ServerHello construct hook. Both sites fire the alert only when an ECC TLS 1.2 ciphersuite has been negotiated, so a missing "uncompressed" is ignored under TLS 1.3 or a non-ECC cipher. The client- and server-side parse hooks now share one function. Drop the always-NULL ext.ecpointformats fields on SSL_CTX and SSL; our own list is built directly inside the constructors. The peer's list continues to be stored verbatim, and is also exposed through the SSL_get0_ec_point_formats() accessor (now documented). New tests verify the four corners (ECC vs non-ECC ciphersuite, TLS 1.2 vs 1.3) plus that a compressed point form EC cert is usable on both sides without any opt-in. Reviewed-by: Neil Horman Reviewed-by: Matt Caswell MergeDate: Fri Jul 10 09:21:30 2026 (Merged from https://github.com/openssl/openssl/pull/30940)

Reject delta CRLs as complete CRL candidates

2026-06-17T08:52:51Z

get_crl_score() is used when selecting a complete/base CRL. Its delta CRL rejection was chained after the extended CRL and IDP reason handling, so it could be skipped when extended CRL support was disabled, or when an IDP onlySomeReasons branch was taken. As a result, a CRL with a Delta CRL Indicator could be scored as a complete/base CRL candidate. Since a delta CRL contains only changes relative to a base CRL, this could cause a previously revoked certificate to be accepted as valid when only the delta CRL is presented to the verifier. Reject CRLs with base_crl_number unconditionally in get_crl_score() before IDP reason filtering. Delta CRLs are still considered by get_delta_sk() after a complete CRL is selected and check_delta_base() confirms compatibility. Add verify recipe coverage for a delta CRL being rejected as a complete CRL, and for a delta CRL with IssuingDistributionPoint.onlySomeReasons being rejected under -extended_crl. Reported-by: jujerpig (GitHub issue #31040) Fixes #31040 Reviewed-by: Bob Beck Reviewed-by: Tomas Mraz MergeDate: Wed Jun 17 08:53:02 2026 (Merged from https://github.com/openssl/openssl/pull/31044)

Add a test for a bogus SMTPUTF8 name constraint in a cert.

2026-05-07T16:09:34Z

We will reject these. Reviewed-by: Saša Nedvědický Reviewed-by: Neil Horman MergeDate: Thu May 7 16:09:48 2026 (Merged from https://github.com/openssl/openssl/pull/30329)

Added test for CVE-2026-28388

2026-04-06T19:26:43Z

Reviewed-by: Saša Nedvědický Reviewed-by: Tomas Mraz MergeDate: Mon Apr 6 19:27:17 2026

Fixed missing subjectAltName when issuing a cert with mkcert.sh genee

2026-03-27T16:53:17Z

Just add %s to make subjectAltName appear before [alts]. Reviewed-by: Eugene Syromiatnikov Reviewed-by: Tomas Mraz MergeDate: Fri Mar 27 16:53:28 2026 (Merged from https://github.com/openssl/openssl/pull/30585)

x509: fix bug in timeSpecification printing

2026-03-20T18:46:29Z

Fix i2r_OSSL_DAY_TIME() to check dt->second before decoding the optional seconds field. Add a regression certificate and x509 recipe coverage for the periodic timeSpecification case with no seconds. Resolves: https://github.com/openssl/openssl/issues/30424 Fixes: 70b17e5a00da "feat: support the timeSpecification X.509v3 extension" Reviewed-by: Eugene Syromiatnikov Reviewed-by: Paul Dale Reviewed-by: Nikola Pajkovsky MergeDate: Fri Mar 20 18:47:04 2026 (Merged from https://github.com/openssl/openssl/pull/30425)

ECH: chunk-size bug fix and non-regression changes

2026-03-19T10:35:54Z

Reviewed-by: Tomas Mraz Reviewed-by: Matt Caswell MergeDate: Thu Mar 19 10:35:56 2026 (Merged from https://github.com/openssl/openssl/pull/30417)

fips: Align PKCS5_PBKDF2_HMAC defaults with EVP_KDF-PBKDF2

2026-03-04T17:24:45Z

EVP_KDF-PBKDF2 has provider-dependent runtime behaviour w.r.t. lower bounds checks. The default provider does not enforce them, but can opt into them. The fips provider does enforce them, but can opt out. The same is not true for the PKCS5_PBKDF2_HMAC, which always opts out of the lower bound checks. This leads to unexpected behaviour without user consent, they may expect in error that when using FIPS provider the lower bound checks will be enforced by default. There are two popular tools for ACVP testing: - https://github.com/cisco/libacvp/blob/9ee15db6e6c6f123f5fdd72e453eca261482ea94/app/app_kdf.c#L411 - https://github.com/smuellerDD/acvpparser/blob/e1c094ae3a708a9c45cb8b270e96c252365a5376/backends/backend_openssl_common.c#L1836 One of them creates params and then calls the one-shot EVP_KDF_derive api, whilst the other calls the PKCS5_PBKDF2_HMAC convenience wrapper. For the same ACVP test vectors the two produce different results: with and without lower bounds checks. But it seems like PKCS5_PBKDF2_HMAC is popular, as it outnumbers EVP_KDF_derive 8x when doing a global code search on github (anecdotal, as results are skewed by the number of forks). This thus comes down to the expectations end users have. And it feels like, at least for this API, the FIPS 140-3 users expectation would be for the lower bound checks to be enforced. Modify the PKCS5_PBKDF2_HMAC wrapper around EVP_KDF_derive to not set PKCS5 parameter, such that the provider implicit default is used instead. Thus no change for default provider users, and FIPS enforcement by default in the FIPS case like it always has done when calling via EVP_KDF_derive. Test fixes: Tests with too short salt would fail with fips provider. Add test that FIPS provider rejects invalid salt length. test/certs: Re-encrypt leaf-encrypted.key with a longer salt. This way test cases can work with a FIPS provider Reviewed-by: Paul Dale Reviewed-by: Shane Lontis Reviewed-by: Tomas Mraz MergeDate: Wed Mar 4 17:25:55 2026 (Merged from https://github.com/openssl/openssl/pull/27431)

Add tests and documentation and fix a couple of issues identified by added tests

2026-02-20T16:40:25Z

Reviewed-by: Tomas Mraz Reviewed-by: Matt Caswell MergeDate: Mon Feb 16 15:41:15 2026 (Merged from https://github.com/openssl/openssl/pull/29200)