openssl/test/certs, branch master

Fix EXFLAG_SS set on self-issued rollover CA certificates

2026-09-21T09:37:02Z

ossl_x509v3_cache_extensions() computes the SKID and AKID into temporaries and publishes them under the write lock since 792a760ac2, but the EXFLAG_SS decision still calls X509_check_akid() on the certificate, whose cached SKID is NULL on first build. The keyid comparison inside X509_check_akid() is then skipped, so a self-issued CA rollover certificate (SKID of the new key, AKID keyid of the old key) is wrongly cached as self-signed. That misclassification rejects valid rollover chains (error 19 at depth 1 when the transition certificate is untrusted) and promotes a stored transition certificate to a trust anchor without PARTIAL_CHAIN, silently skipping checks provisioned on the real anchor. Compare the freshly decoded tmp_akid against tmp_skid directly so the decision doesn't depend on cache publication timing. The serial number and issuer name checks of X509_check_akid() and the missing-identifier behavior are retained. Add regression tests with a rollover chain: accept through the untrusted transition certificate, reject when only the transition certificate is trusted, and accept the transition certificate as an explicit PARTIAL_CHAIN anchor. The new certificates are generated by test/certs/setup.sh from the existing test keys. Fixes #32793 Assisted-by: pi:kimi-k3 Reviewed-by: Eugene Syromiatnikov Reviewed-by: Bob Beck Reviewed-by: Tomas Mraz Merge-date: Mon Sep 21 09:37:08 2026 Merged-from: https://github.com/openssl/openssl/pull/32794

add script (setup-mock.sh) to generate test credentials for CMP.

2026-09-16T06:30:40Z

Add script to generate complete test credentials for CMP mock test with option to use classic algorithms (RSA) and Post-Quantum algorithms (ML-DSA, SLH-DSA, and ML-KEM). Remove hard-coded issuer DN and serial number from test_commands.csv and extract them dynamically from the certificate referenced by rsp_cert in server.cnf during test loading. Add PQ algorithm patterns (ML-KEM*, MLKEM*, ML-DSA*, MLDSA*, SLH-DSA*) to mkcert.sh to support key generation for these algorithms. Fixes #29623 setup-mock.sh: replace sort -V with portable awk version check replace CMP test certificate update big_* test cert files with SHA2 certificate added comment in CHANGE.md Reviewed-by: Andrew Dinh Reviewed-by: David von Oheimb MergeDate: Wed Sep 16 06:30:44 2026 (Merged from https://github.com/openssl/openssl/pull/30815)

65-test_cmp_vfy.t etc.: take 2-level and 3-level cert hierarchy from test/certs

2026-09-10T13:24:37Z

Give up using old custom cert hierarchy, which included a meanwhile legacy NIST P-192 curve. Doing so, replace setup_path(CMP_VFY_TEST_FIXTURE **fixture, X509 *wrong, int expired) by setup_path(CMP_VFY_TEST_FIXTURE **fixture, X509 *wrong, int not_yet_valid) because on 32-bit systems, cannot check expiration because normal test certs are valid for 100 years, while 32-bit time_t will wrap around in early 2038. Fixes #24193 Reviewed-by: Mounir Idrassi Reviewed-by: Andrew Dinh MergeDate: Thu Sep 10 13:24:42 2026 (Merged from https://github.com/openssl/openssl/pull/31611)

25-test_verify.t and test/certs/: add mixed 3-level RSA/ECC chain and validation test for it

2026-09-10T13:24:31Z

Reviewed-by: Mounir Idrassi Reviewed-by: Andrew Dinh MergeDate: Thu Sep 10 13:24:41 2026 (Merged from https://github.com/openssl/openssl/pull/31611)

test/certs/mkcert.sh: fix default DAYS to be really 100 years (not one day more than that)

2026-09-10T13:24:31Z

Reviewed-by: Mounir Idrassi Reviewed-by: Andrew Dinh MergeDate: Thu Sep 10 13:24:40 2026 (Merged from https://github.com/openssl/openssl/pull/31611)

Copyright year updates

2026-09-09T13:12:46Z

Reviewed-by: Daniel Kubec Reviewed-by: Eugene Syromiatnikov Merge-date: Wed Sep 9 13:12:46 2026 Release: yes

Fix DSA with SHA-384 / SHA-512 X.509 verification (issue openssl#30432)

2026-07-20T11:10:45Z

Register dsa_with_SHA384 and dsa_with_SHA512 in obj_xref so signature verification resolves digest + DSA key type. Add test_verify regression tests and PEM fixtures; add executable DSA cert generation in test/certs/setup.sh. CHANGES.md and NEWS.md entries for 4.0→4.1. Address review: plan tests 215, remove CHANGES merge artifact, replace comment-only setup.sh notes with actual openssl commands. Fixes openssl#30432 Reviewed-by: Dmitry Belyavskiy Reviewed-by: Nikola Pajkovsky MergeDate: Mon Jul 20 11:10:47 2026 (Merged from https://github.com/openssl/openssl/pull/30655)

Improve TLS handling of EC point formats

2026-07-10T09:21:28Z

Decouple the ec_point_formats extension from TLS 1.2 X.509 selection and acceptance. Remove tls1_check_pkey_comp() and its callers in tls1_check_cert_param() and tls1_check_chain(): TLS 1.3 disregards the extension already, and we can decode any point form a peer might send, so refusing a compressed peer cert in TLS 1.2 because we didn't advertise compressed buys nothing. The RFC 4492/8422 section 5.1.2 requirement that the peer's list contain "uncompressed" used to be enforced in a final hook on the client side only. Move it to the two points where the negotiated ciphersuite is known: the client's ServerHello parse hook, and the server's ServerHello construct hook. Both sites fire the alert only when an ECC TLS 1.2 ciphersuite has been negotiated, so a missing "uncompressed" is ignored under TLS 1.3 or a non-ECC cipher. The client- and server-side parse hooks now share one function. Drop the always-NULL ext.ecpointformats fields on SSL_CTX and SSL; our own list is built directly inside the constructors. The peer's list continues to be stored verbatim, and is also exposed through the SSL_get0_ec_point_formats() accessor (now documented). New tests verify the four corners (ECC vs non-ECC ciphersuite, TLS 1.2 vs 1.3) plus that a compressed point form EC cert is usable on both sides without any opt-in. Reviewed-by: Neil Horman Reviewed-by: Matt Caswell MergeDate: Fri Jul 10 09:21:30 2026 (Merged from https://github.com/openssl/openssl/pull/30940)

Reject delta CRLs as complete CRL candidates

2026-06-17T08:52:51Z

get_crl_score() is used when selecting a complete/base CRL. Its delta CRL rejection was chained after the extended CRL and IDP reason handling, so it could be skipped when extended CRL support was disabled, or when an IDP onlySomeReasons branch was taken. As a result, a CRL with a Delta CRL Indicator could be scored as a complete/base CRL candidate. Since a delta CRL contains only changes relative to a base CRL, this could cause a previously revoked certificate to be accepted as valid when only the delta CRL is presented to the verifier. Reject CRLs with base_crl_number unconditionally in get_crl_score() before IDP reason filtering. Delta CRLs are still considered by get_delta_sk() after a complete CRL is selected and check_delta_base() confirms compatibility. Add verify recipe coverage for a delta CRL being rejected as a complete CRL, and for a delta CRL with IssuingDistributionPoint.onlySomeReasons being rejected under -extended_crl. Reported-by: jujerpig (GitHub issue #31040) Fixes #31040 Reviewed-by: Bob Beck Reviewed-by: Tomas Mraz MergeDate: Wed Jun 17 08:53:02 2026 (Merged from https://github.com/openssl/openssl/pull/31044)

Add a test for a bogus SMTPUTF8 name constraint in a cert.

2026-05-07T16:09:34Z

We will reject these. Reviewed-by: Saša Nedvědický Reviewed-by: Neil Horman MergeDate: Thu May 7 16:09:48 2026 (Merged from https://github.com/openssl/openssl/pull/30329)