[openssl-commits] [openssl] OpenSSL_1_1_1-stable update
Matt Caswell
matt at openssl.org
Mon Nov 12 11:23:19 UTC 2018
The branch OpenSSL_1_1_1-stable has been updated
via 7bd5405ac94549003dd1e7114542914075b5aaf5 (commit)
via b3b9049259979c549039cb2fed62531356be8767 (commit)
via 6f54ae7a9079983ea51593d4a91699d14a9c9a99 (commit)
from 61e78e7ace6c5d65910379556d7da7d23492291c (commit)
- Log -----------------------------------------------------------------
commit 7bd5405ac94549003dd1e7114542914075b5aaf5
Author: Matt Caswell <matt at openssl.org>
Date: Wed Oct 24 14:48:44 2018 +0100
Test use of a brainpool ECDSA certificate
Reviewed-by: Viktor Dukhovni <viktor at openssl.org>
(Merged from https://github.com/openssl/openssl/pull/7442)
(cherry picked from commit 24ae00388fb9e25af8f94d36b7c191ae90061586)
commit b3b9049259979c549039cb2fed62531356be8767
Author: Matt Caswell <matt at openssl.org>
Date: Wed Oct 24 12:15:56 2018 +0100
Add some test brainpool certificates
Reviewed-by: Viktor Dukhovni <viktor at openssl.org>
(Merged from https://github.com/openssl/openssl/pull/7442)
(cherry picked from commit 83c81eebed52aa84b6b34d26e984c859158ca1c0)
commit 6f54ae7a9079983ea51593d4a91699d14a9c9a99
Author: Matt Caswell <matt at openssl.org>
Date: Fri Oct 19 14:01:22 2018 +0100
Don't negotiate TLSv1.3 if our EC cert isn't TLSv1.3 capable
TLSv1.3 is more restrictive about the curve used. There must be a matching
sig alg defined for that curve. Therefore if we are using some other curve
in our certificate then we should not negotiate TLSv1.3.
Fixes #7435
Reviewed-by: Viktor Dukhovni <viktor at openssl.org>
(Merged from https://github.com/openssl/openssl/pull/7442)
(cherry picked from commit de4dc598024fd0a9c2b7a466fd5323755d369522)
-----------------------------------------------------------------------
Summary of changes:
ssl/ssl_locl.h | 1 +
ssl/statem/statem_lib.c | 18 +-
ssl/t1_lib.c | 31 +
test/certs/server-ecdsa-brainpoolP256r1-cert.pem | 16 +
test/certs/server-ecdsa-brainpoolP256r1-key.pem | 5 +
test/certs/setup.sh | 4 +
test/ssl-tests/20-cert-select.conf | 853 ++++++++++++-----------
test/ssl-tests/20-cert-select.conf.in | 39 ++
8 files changed, 568 insertions(+), 399 deletions(-)
create mode 100644 test/certs/server-ecdsa-brainpoolP256r1-cert.pem
create mode 100644 test/certs/server-ecdsa-brainpoolP256r1-key.pem
diff --git a/ssl/ssl_locl.h b/ssl/ssl_locl.h
index c22c1f9..46719b0 100644
--- a/ssl/ssl_locl.h
+++ b/ssl/ssl_locl.h
@@ -2564,6 +2564,7 @@ __owur int tls1_process_sigalgs(SSL *s);
__owur int tls1_set_peer_legacy_sigalg(SSL *s, const EVP_PKEY *pkey);
__owur int tls1_lookup_md(const SIGALG_LOOKUP *lu, const EVP_MD **pmd);
__owur size_t tls12_get_psigalgs(SSL *s, int sent, const uint16_t **psigs);
+__owur int tls_check_sigalg_curve(const SSL *s, int curve);
__owur int tls12_check_peer_sigalg(SSL *s, uint16_t, EVP_PKEY *pkey);
__owur int ssl_set_client_disabled(SSL *s);
__owur int ssl_cipher_disabled(SSL *s, const SSL_CIPHER *c, int op, int echde);
diff --git a/ssl/statem/statem_lib.c b/ssl/statem/statem_lib.c
index 75cf321..dc2bd20 100644
--- a/ssl/statem/statem_lib.c
+++ b/ssl/statem/statem_lib.c
@@ -1506,7 +1506,8 @@ static int ssl_method_error(const SSL *s, const SSL_METHOD *method)
*/
static int is_tls13_capable(const SSL *s)
{
- int i;
+ int i, curve;
+ EC_KEY *eckey;
#ifndef OPENSSL_NO_PSK
if (s->psk_server_callback != NULL)
@@ -1527,7 +1528,20 @@ static int is_tls13_capable(const SSL *s)
default:
break;
}
- if (ssl_has_cert(s, i))
+ if (!ssl_has_cert(s, i))
+ continue;
+ if (i != SSL_PKEY_ECC)
+ return 1;
+ /*
+ * Prior to TLSv1.3 sig algs allowed any curve to be used. TLSv1.3 is
+ * more restrictive so check that our sig algs are consistent with this
+ * EC cert. See section 4.2.3 of RFC8446.
+ */
+ eckey = EVP_PKEY_get0_EC_KEY(s->cert->pkeys[SSL_PKEY_ECC].privatekey);
+ if (eckey == NULL)
+ continue;
+ curve = EC_GROUP_get_curve_name(EC_KEY_get0_group(eckey));
+ if (tls_check_sigalg_curve(s, curve))
return 1;
}
diff --git a/ssl/t1_lib.c b/ssl/t1_lib.c
index b8b9fbd..8e73d06 100644
--- a/ssl/t1_lib.c
+++ b/ssl/t1_lib.c
@@ -950,6 +950,37 @@ size_t tls12_get_psigalgs(SSL *s, int sent, const uint16_t **psigs)
}
/*
+ * Called by servers only. Checks that we have a sig alg that supports the
+ * specified EC curve.
+ */
+int tls_check_sigalg_curve(const SSL *s, int curve)
+{
+ const uint16_t *sigs;
+ size_t siglen, i;
+
+ if (s->cert->conf_sigalgs) {
+ sigs = s->cert->conf_sigalgs;
+ siglen = s->cert->conf_sigalgslen;
+ } else {
+ sigs = tls12_sigalgs;
+ siglen = OSSL_NELEM(tls12_sigalgs);
+ }
+
+ for (i = 0; i < siglen; i++) {
+ const SIGALG_LOOKUP *lu = tls1_lookup_sigalg(sigs[i]);
+
+ if (lu == NULL)
+ continue;
+ if (lu->sig == EVP_PKEY_EC
+ && lu->curve != NID_undef
+ && curve == lu->curve)
+ return 1;
+ }
+
+ return 0;
+}
+
+/*
* Check signature algorithm is consistent with sent supported signature
* algorithms and if so set relevant digest and signature scheme in
* s.
diff --git a/test/certs/server-ecdsa-brainpoolP256r1-cert.pem b/test/certs/server-ecdsa-brainpoolP256r1-cert.pem
new file mode 100644
index 0000000..bb41f99
--- /dev/null
+++ b/test/certs/server-ecdsa-brainpoolP256r1-cert.pem
@@ -0,0 +1,16 @@
+-----BEGIN CERTIFICATE-----
+MIICgzCCAWugAwIBAgIBAjANBgkqhkiG9w0BAQsFADASMRAwDgYDVQQDDAdSb290
+IENBMCAXDTE4MTAyNDEzNDUwOFoYDzIxMTgxMDI1MTM0NTA4WjAsMSowKAYDVQQD
+DCFTZXJ2ZXIgRUNEU0EgYnJhaW5wb29sUDI1NnIxIGNlcnQwWjAUBgcqhkjOPQIB
+BgkrJAMDAggBAQcDQgAETYDLIgpvvoxSBJxB5apcNrTZ0vYpVyG18hDEOplqkyln
+W7kekN9a83WtIwPRoSwhczgFg/MhvLZ/BHQJW2SU3qOBkTCBjjAdBgNVHQ4EFgQU
+it8K0UIpDYE264JfNmQ/44H1WMUwHwYDVR0jBBgwFoAUcH8uroNoWZgEIyrN6z4X
+zSTdAUkwCQYDVR0TBAIwADATBgNVHSUEDDAKBggrBgEFBQcDATAsBgNVHREEJTAj
+giFTZXJ2ZXIgRUNEU0EgYnJhaW5wb29sUDI1NnIxIGNlcnQwDQYJKoZIhvcNAQEL
+BQADggEBAKCEUMQlB+M6crHe2zfGmQJnsEGzY4fJUFYdFfOM359dXR8Xs+JHF2XP
+0BHJ64BHLzy+3eoa9w/B+/i6OVJo3VhCoCChcP+gnGzQVQy5Maxq55DlsVdpellS
+Tml/BnLcqcZFAP63qEpcuZuC4CytZcHYCU+NLI/3JGzH1/xHxk4UgRTa2B7OhjXt
+Ptl3vLaSqJXEmVeCP0hibhhiszs0zR14fJqmVn0V5MKC7twmG8CBlW03ksLjzzvn
+m7WAy7q5WcFcAcrFR3zAPqcx4UQSS9FiwJ+OOZGqIasMk9i9zxqh0ic5M5ls7Qaf
+roudyLLkkvDFkcb88RwYGKrdVFGDgF0=
+-----END CERTIFICATE-----
diff --git a/test/certs/server-ecdsa-brainpoolP256r1-key.pem b/test/certs/server-ecdsa-brainpoolP256r1-key.pem
new file mode 100644
index 0000000..c9d233f
--- /dev/null
+++ b/test/certs/server-ecdsa-brainpoolP256r1-key.pem
@@ -0,0 +1,5 @@
+-----BEGIN PRIVATE KEY-----
+MIGIAgEAMBQGByqGSM49AgEGCSskAwMCCAEBBwRtMGsCAQEEIKZSRhbD6lGhKbIm
+5JVgxnN8MHGB0whroUsSf0zmsAz+oUQDQgAETYDLIgpvvoxSBJxB5apcNrTZ0vYp
+VyG18hDEOplqkylnW7kekN9a83WtIwPRoSwhczgFg/MhvLZ/BHQJW2SU3g==
+-----END PRIVATE KEY-----
diff --git a/test/certs/setup.sh b/test/certs/setup.sh
index aa69de1..53d4a80 100755
--- a/test/certs/setup.sh
+++ b/test/certs/setup.sh
@@ -365,3 +365,7 @@ REQMASK=MASK:0x800 ./mkcert.sh req badalt7-key "O = Bad NC Test Certificate 7" \
# SHA256
./mkcert.sh genee PSS-SHA256 ee-key ee-pss-sha256-cert ca-key ca-cert \
-sha256 -sigopt rsa_padding_mode:pss -sigopt rsa_pss_saltlen:digest
+
+OPENSSL_KEYALG=ec OPENSSL_KEYBITS=brainpoolP256r1 ./mkcert.sh genee \
+ "Server ECDSA brainpoolP256r1 cert" server-ecdsa-brainpoolP256r1-key \
+ server-ecdsa-brainpoolP256r1-cert rootkey rootcert
diff --git a/test/ssl-tests/20-cert-select.conf b/test/ssl-tests/20-cert-select.conf
index 1bf81c1..0bcd23d 100644
--- a/test/ssl-tests/20-cert-select.conf
+++ b/test/ssl-tests/20-cert-select.conf
@@ -1,56 +1,58 @@
# Generated with generate_ssl_tests.pl
-num_tests = 49
+num_tests = 51
test-0 = 0-ECDSA CipherString Selection
test-1 = 1-ECDSA CipherString Selection
test-2 = 2-ECDSA CipherString Selection
test-3 = 3-Ed25519 CipherString and Signature Algorithm Selection
test-4 = 4-Ed448 CipherString and Signature Algorithm Selection
-test-5 = 5-RSA CipherString Selection
-test-6 = 6-RSA-PSS Certificate CipherString Selection
-test-7 = 7-P-256 CipherString and Signature Algorithm Selection
-test-8 = 8-Ed25519 CipherString and Curves Selection
-test-9 = 9-Ed448 CipherString and Curves Selection
-test-10 = 10-ECDSA CipherString Selection, no ECDSA certificate
-test-11 = 11-ECDSA Signature Algorithm Selection
-test-12 = 12-ECDSA Signature Algorithm Selection SHA384
-test-13 = 13-ECDSA Signature Algorithm Selection SHA1
-test-14 = 14-ECDSA Signature Algorithm Selection compressed point
-test-15 = 15-ECDSA Signature Algorithm Selection, no ECDSA certificate
-test-16 = 16-RSA Signature Algorithm Selection
-test-17 = 17-RSA-PSS Signature Algorithm Selection
-test-18 = 18-RSA-PSS Certificate Legacy Signature Algorithm Selection
-test-19 = 19-RSA-PSS Certificate Unified Signature Algorithm Selection
-test-20 = 20-Only RSA-PSS Certificate
-test-21 = 21-RSA-PSS Certificate, no PSS signature algorithms
-test-22 = 22-RSA key exchange with all RSA certificate types
-test-23 = 23-RSA key exchange with only RSA-PSS certificate
-test-24 = 24-Suite B P-256 Hash Algorithm Selection
-test-25 = 25-Suite B P-384 Hash Algorithm Selection
-test-26 = 26-TLS 1.2 Ed25519 Client Auth
-test-27 = 27-TLS 1.2 Ed448 Client Auth
-test-28 = 28-Only RSA-PSS Certificate, TLS v1.1
-test-29 = 29-TLS 1.3 ECDSA Signature Algorithm Selection
-test-30 = 30-TLS 1.3 ECDSA Signature Algorithm Selection compressed point
-test-31 = 31-TLS 1.3 ECDSA Signature Algorithm Selection SHA1
-test-32 = 32-TLS 1.3 ECDSA Signature Algorithm Selection with PSS
-test-33 = 33-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS
-test-34 = 34-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate
-test-35 = 35-TLS 1.3 RSA Signature Algorithm Selection, no PSS
-test-36 = 36-TLS 1.3 RSA-PSS Signature Algorithm Selection
-test-37 = 37-TLS 1.3 Ed25519 Signature Algorithm Selection
-test-38 = 38-TLS 1.3 Ed448 Signature Algorithm Selection
-test-39 = 39-TLS 1.3 Ed25519 CipherString and Groups Selection
-test-40 = 40-TLS 1.3 Ed448 CipherString and Groups Selection
-test-41 = 41-TLS 1.3 RSA Client Auth Signature Algorithm Selection
-test-42 = 42-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names
-test-43 = 43-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection
-test-44 = 44-TLS 1.3 Ed25519 Client Auth
-test-45 = 45-TLS 1.3 Ed448 Client Auth
-test-46 = 46-TLS 1.2 DSA Certificate Test
-test-47 = 47-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms
-test-48 = 48-TLS 1.3 DSA Certificate Test
+test-5 = 5-ECDSA with brainpool
+test-6 = 6-RSA CipherString Selection
+test-7 = 7-RSA-PSS Certificate CipherString Selection
+test-8 = 8-P-256 CipherString and Signature Algorithm Selection
+test-9 = 9-Ed25519 CipherString and Curves Selection
+test-10 = 10-Ed448 CipherString and Curves Selection
+test-11 = 11-ECDSA CipherString Selection, no ECDSA certificate
+test-12 = 12-ECDSA Signature Algorithm Selection
+test-13 = 13-ECDSA Signature Algorithm Selection SHA384
+test-14 = 14-ECDSA Signature Algorithm Selection SHA1
+test-15 = 15-ECDSA Signature Algorithm Selection compressed point
+test-16 = 16-ECDSA Signature Algorithm Selection, no ECDSA certificate
+test-17 = 17-RSA Signature Algorithm Selection
+test-18 = 18-RSA-PSS Signature Algorithm Selection
+test-19 = 19-RSA-PSS Certificate Legacy Signature Algorithm Selection
+test-20 = 20-RSA-PSS Certificate Unified Signature Algorithm Selection
+test-21 = 21-Only RSA-PSS Certificate
+test-22 = 22-RSA-PSS Certificate, no PSS signature algorithms
+test-23 = 23-RSA key exchange with all RSA certificate types
+test-24 = 24-RSA key exchange with only RSA-PSS certificate
+test-25 = 25-Suite B P-256 Hash Algorithm Selection
+test-26 = 26-Suite B P-384 Hash Algorithm Selection
+test-27 = 27-TLS 1.2 Ed25519 Client Auth
+test-28 = 28-TLS 1.2 Ed448 Client Auth
+test-29 = 29-Only RSA-PSS Certificate, TLS v1.1
+test-30 = 30-TLS 1.3 ECDSA Signature Algorithm Selection
+test-31 = 31-TLS 1.3 ECDSA Signature Algorithm Selection compressed point
+test-32 = 32-TLS 1.3 ECDSA Signature Algorithm Selection SHA1
+test-33 = 33-TLS 1.3 ECDSA Signature Algorithm Selection with PSS
+test-34 = 34-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS
+test-35 = 35-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate
+test-36 = 36-TLS 1.3 RSA Signature Algorithm Selection, no PSS
+test-37 = 37-TLS 1.3 RSA-PSS Signature Algorithm Selection
+test-38 = 38-TLS 1.3 Ed25519 Signature Algorithm Selection
+test-39 = 39-TLS 1.3 Ed448 Signature Algorithm Selection
+test-40 = 40-TLS 1.3 Ed25519 CipherString and Groups Selection
+test-41 = 41-TLS 1.3 Ed448 CipherString and Groups Selection
+test-42 = 42-TLS 1.3 RSA Client Auth Signature Algorithm Selection
+test-43 = 43-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names
+test-44 = 44-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection
+test-45 = 45-TLS 1.3 Ed25519 Client Auth
+test-46 = 46-TLS 1.3 Ed448 Client Auth
+test-47 = 47-TLS 1.3 ECDSA with brainpool
+test-48 = 48-TLS 1.2 DSA Certificate Test
+test-49 = 49-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms
+test-50 = 50-TLS 1.3 DSA Certificate Test
# ===========================================================
[0-ECDSA CipherString Selection]
@@ -223,14 +225,43 @@ ExpectedServerSignType = Ed448
# ===========================================================
-[5-RSA CipherString Selection]
-ssl_conf = 5-RSA CipherString Selection-ssl
+[5-ECDSA with brainpool]
+ssl_conf = 5-ECDSA with brainpool-ssl
-[5-RSA CipherString Selection-ssl]
-server = 5-RSA CipherString Selection-server
-client = 5-RSA CipherString Selection-client
+[5-ECDSA with brainpool-ssl]
+server = 5-ECDSA with brainpool-server
+client = 5-ECDSA with brainpool-client
-[5-RSA CipherString Selection-server]
+[5-ECDSA with brainpool-server]
+Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-brainpoolP256r1-cert.pem
+CipherString = DEFAULT
+Groups = brainpoolP256r1
+PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-brainpoolP256r1-key.pem
+
+[5-ECDSA with brainpool-client]
+CipherString = aECDSA
+Groups = brainpoolP256r1
+RequestCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
+VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
+VerifyMode = Peer
+
+[test-5]
+ExpectedResult = Success
+ExpectedServerCANames = empty
+ExpectedServerCertType = brainpoolP256r1
+ExpectedServerSignType = EC
+
+
+# ===========================================================
+
+[6-RSA CipherString Selection]
+ssl_conf = 6-RSA CipherString Selection-ssl
+
+[6-RSA CipherString Selection-ssl]
+server = 6-RSA CipherString Selection-server
+client = 6-RSA CipherString Selection-client
+
+[6-RSA CipherString Selection-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
@@ -242,13 +273,13 @@ Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
-[5-RSA CipherString Selection-client]
+[6-RSA CipherString Selection-client]
CipherString = aRSA
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
-[test-5]
+[test-6]
ExpectedResult = Success
ExpectedServerCertType = RSA
ExpectedServerSignType = RSA-PSS
@@ -256,14 +287,14 @@ ExpectedServerSignType = RSA-PSS
# ===========================================================
-[6-RSA-PSS Certificate CipherString Selection]
-ssl_conf = 6-RSA-PSS Certificate CipherString Selection-ssl
+[7-RSA-PSS Certificate CipherString Selection]
+ssl_conf = 7-RSA-PSS Certificate CipherString Selection-ssl
-[6-RSA-PSS Certificate CipherString Selection-ssl]
-server = 6-RSA-PSS Certificate CipherString Selection-server
-client = 6-RSA-PSS Certificate CipherString Selection-client
+[7-RSA-PSS Certificate CipherString Selection-ssl]
+server = 7-RSA-PSS Certificate CipherString Selection-server
+client = 7-RSA-PSS Certificate CipherString Selection-client
-[6-RSA-PSS Certificate CipherString Selection-server]
+[7-RSA-PSS Certificate CipherString Selection-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
@@ -277,13 +308,13 @@ PSS.Certificate = ${ENV::TEST_CERTS_DIR}/server-pss-cert.pem
PSS.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-pss-key.pem
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
-[6-RSA-PSS Certificate CipherString Selection-client]
+[7-RSA-PSS Certificate CipherString Selection-client]
CipherString = aRSA
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
-[test-6]
+[test-7]
ExpectedResult = Success
ExpectedServerCertType = RSA-PSS
ExpectedServerSignType = RSA-PSS
@@ -291,14 +322,14 @@ ExpectedServerSignType = RSA-PSS
# ===========================================================
-[7-P-256 CipherString and Signature Algorithm Selection]
-ssl_conf = 7-P-256 CipherString and Signature Algorithm Selection-ssl
+[8-P-256 CipherString and Signature Algorithm Selection]
+ssl_conf = 8-P-256 CipherString and Signature Algorithm Selection-ssl
-[7-P-256 CipherString and Signature Algorithm Selection-ssl]
-server = 7-P-256 CipherString and Signature Algorithm Selection-server
-client = 7-P-256 CipherString and Signature Algorithm Selection-client
+[8-P-256 CipherString and Signature Algorithm Selection-ssl]
+server = 8-P-256 CipherString and Signature Algorithm Selection-server
+client = 8-P-256 CipherString and Signature Algorithm Selection-client
-[7-P-256 CipherString and Signature Algorithm Selection-server]
+[8-P-256 CipherString and Signature Algorithm Selection-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
@@ -310,14 +341,14 @@ Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
-[7-P-256 CipherString and Signature Algorithm Selection-client]
+[8-P-256 CipherString and Signature Algorithm Selection-client]
CipherString = aECDSA
MaxProtocol = TLSv1.2
SignatureAlgorithms = ECDSA+SHA256:ed25519
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
-[test-7]
+[test-8]
ExpectedResult = Success
ExpectedServerCertType = P-256
ExpectedServerSignHash = SHA256
@@ -326,14 +357,14 @@ ExpectedServerSignType = EC
# ===========================================================
-[8-Ed25519 CipherString and Curves Selection]
-ssl_conf = 8-Ed25519 CipherString and Curves Selection-ssl
+[9-Ed25519 CipherString and Curves Selection]
+ssl_conf = 9-Ed25519 CipherString and Curves Selection-ssl
-[8-Ed25519 CipherString and Curves Selection-ssl]
-server = 8-Ed25519 CipherString and Curves Selection-server
-client = 8-Ed25519 CipherString and Curves Selection-client
+[9-Ed25519 CipherString and Curves Selection-ssl]
+server = 9-Ed25519 CipherString and Curves Selection-server
+client = 9-Ed25519 CipherString and Curves Selection-client
-[8-Ed25519 CipherString and Curves Selection-server]
+[9-Ed25519 CipherString and Curves Selection-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
@@ -345,7 +376,7 @@ Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
-[8-Ed25519 CipherString and Curves Selection-client]
+[9-Ed25519 CipherString and Curves Selection-client]
CipherString = aECDSA
Curves = X25519
MaxProtocol = TLSv1.2
@@ -353,7 +384,7 @@ SignatureAlgorithms = ECDSA+SHA256:ed25519
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
-[test-8]
+[test-9]
ExpectedResult = Success
ExpectedServerCertType = Ed25519
ExpectedServerSignType = Ed25519
@@ -361,14 +392,14 @@ ExpectedServerSignType = Ed25519
# ===========================================================
-[9-Ed448 CipherString and Curves Selection]
-ssl_conf = 9-Ed448 CipherString and Curves Selection-ssl
+[10-Ed448 CipherString and Curves Selection]
+ssl_conf = 10-Ed448 CipherString and Curves Selection-ssl
-[9-Ed448 CipherString and Curves Selection-ssl]
-server = 9-Ed448 CipherString and Curves Selection-server
-client = 9-Ed448 CipherString and Curves Selection-client
+[10-Ed448 CipherString and Curves Selection-ssl]
+server = 10-Ed448 CipherString and Curves Selection-server
+client = 10-Ed448 CipherString and Curves Selection-client
-[9-Ed448 CipherString and Curves Selection-server]
+[10-Ed448 CipherString and Curves Selection-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
@@ -380,7 +411,7 @@ Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
-[9-Ed448 CipherString and Curves Selection-client]
+[10-Ed448 CipherString and Curves Selection-client]
CipherString = aECDSA
Curves = X448
MaxProtocol = TLSv1.2
@@ -388,7 +419,7 @@ SignatureAlgorithms = ECDSA+SHA256:ed448
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
-[test-9]
+[test-10]
ExpectedResult = Success
ExpectedServerCertType = Ed448
ExpectedServerSignType = Ed448
@@ -396,39 +427,39 @@ ExpectedServerSignType = Ed448
# ===========================================================
-[10-ECDSA CipherString Selection, no ECDSA certificate]
-ssl_conf = 10-ECDSA CipherString Selection, no ECDSA certificate-ssl
+[11-ECDSA CipherString Selection, no ECDSA certificate]
+ssl_conf = 11-ECDSA CipherString Selection, no ECDSA certificate-ssl
-[10-ECDSA CipherString Selection, no ECDSA certificate-ssl]
-server = 10-ECDSA CipherString Selection, no ECDSA certificate-server
-client = 10-ECDSA CipherString Selection, no ECDSA certificate-client
+[11-ECDSA CipherString Selection, no ECDSA certificate-ssl]
+server = 11-ECDSA CipherString Selection, no ECDSA certificate-server
+client = 11-ECDSA CipherString Selection, no ECDSA certificate-client
-[10-ECDSA CipherString Selection, no ECDSA certificate-server]
+[11-ECDSA CipherString Selection, no ECDSA certificate-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
-[10-ECDSA CipherString Selection, no ECDSA certificate-client]
+[11-ECDSA CipherString Selection, no ECDSA certificate-client]
CipherString = aECDSA
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
-[test-10]
+[test-11]
ExpectedResult = ServerFail
# ===========================================================
-[11-ECDSA Signature Algorithm Selection]
-ssl_conf = 11-ECDSA Signature Algorithm Selection-ssl
+[12-ECDSA Signature Algorithm Selection]
+ssl_conf = 12-ECDSA Signature Algorithm Selection-ssl
-[11-ECDSA Signature Algorithm Selection-ssl]
-server = 11-ECDSA Signature Algorithm Selection-server
-client = 11-ECDSA Signature Algorithm Selection-client
+[12-ECDSA Signature Algorithm Selection-ssl]
+server = 12-ECDSA Signature Algorithm Selection-server
+client = 12-ECDSA Signature Algorithm Selection-client
-[11-ECDSA Signature Algorithm Selection-server]
+[12-ECDSA Signature Algorithm Selection-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
@@ -440,13 +471,13 @@ Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
-[11-ECDSA Signature Algorithm Selection-client]
+[12-ECDSA Signature Algorithm Selection-client]
CipherString = DEFAULT
SignatureAlgorithms = ECDSA+SHA256
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
-[test-11]
+[test-12]
ExpectedResult = Success
ExpectedServerCertType = P-256
ExpectedServerSignHash = SHA256
@@ -455,14 +486,14 @@ ExpectedServerSignType = EC
# ===========================================================
-[12-ECDSA Signature Algorithm Selection SHA384]
-ssl_conf = 12-ECDSA Signature Algorithm Selection SHA384-ssl
+[13-ECDSA Signature Algorithm Selection SHA384]
+ssl_conf = 13-ECDSA Signature Algorithm Selection SHA384-ssl
-[12-ECDSA Signature Algorithm Selection SHA384-ssl]
-server = 12-ECDSA Signature Algorithm Selection SHA384-server
-client = 12-ECDSA Signature Algorithm Selection SHA384-client
+[13-ECDSA Signature Algorithm Selection SHA384-ssl]
+server = 13-ECDSA Signature Algorithm Selection SHA384-server
+client = 13-ECDSA Signature Algorithm Selection SHA384-client
-[12-ECDSA Signature Algorithm Selection SHA384-server]
+[13-ECDSA Signature Algorithm Selection SHA384-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
@@ -474,13 +505,13 @@ Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
-[12-ECDSA Signature Algorithm Selection SHA384-client]
+[13-ECDSA Signature Algorithm Selection SHA384-client]
CipherString = DEFAULT
SignatureAlgorithms = ECDSA+SHA384
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
-[test-12]
+[test-13]
ExpectedResult = Success
ExpectedServerCertType = P-256
ExpectedServerSignHash = SHA384
@@ -489,14 +520,14 @@ ExpectedServerSignType = EC
# ===========================================================
-[13-ECDSA Signature Algorithm Selection SHA1]
-ssl_conf = 13-ECDSA Signature Algorithm Selection SHA1-ssl
+[14-ECDSA Signature Algorithm Selection SHA1]
+ssl_conf = 14-ECDSA Signature Algorithm Selection SHA1-ssl
-[13-ECDSA Signature Algorithm Selection SHA1-ssl]
-server = 13-ECDSA Signature Algorithm Selection SHA1-server
-client = 13-ECDSA Signature Algorithm Selection SHA1-client
+[14-ECDSA Signature Algorithm Selection SHA1-ssl]
+server = 14-ECDSA Signature Algorithm Selection SHA1-server
+client = 14-ECDSA Signature Algorithm Selection SHA1-client
-[13-ECDSA Signature Algorithm Selection SHA1-server]
+[14-ECDSA Signature Algorithm Selection SHA1-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
@@ -508,13 +539,13 @@ Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
-[13-ECDSA Signature Algorithm Selection SHA1-client]
+[14-ECDSA Signature Algorithm Selection SHA1-client]
CipherString = DEFAULT
SignatureAlgorithms = ECDSA+SHA1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
-[test-13]
+[test-14]
ExpectedResult = Success
ExpectedServerCertType = P-256
ExpectedServerSignHash = SHA1
@@ -523,14 +554,14 @@ ExpectedServerSignType = EC
# ===========================================================
-[14-ECDSA Signature Algorithm Selection compressed point]
-ssl_conf = 14-ECDSA Signature Algorithm Selection compressed point-ssl
+[15-ECDSA Signature Algorithm Selection compressed point]
+ssl_conf = 15-ECDSA Signature Algorithm Selection compressed point-ssl
-[14-ECDSA Signature Algorithm Selection compressed point-ssl]
-server = 14-ECDSA Signature Algorithm Selection compressed point-server
-client = 14-ECDSA Signature Algorithm Selection compressed point-client
+[15-ECDSA Signature Algorithm Selection compressed point-ssl]
+server = 15-ECDSA Signature Algorithm Selection compressed point-server
+client = 15-ECDSA Signature Algorithm Selection compressed point-client
-[14-ECDSA Signature Algorithm Selection compressed point-server]
+[15-ECDSA Signature Algorithm Selection compressed point-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-cecdsa-cert.pem
@@ -538,13 +569,13 @@ ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-cecdsa-key.pem
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
-[14-ECDSA Signature Algorithm Selection compressed point-client]
+[15-ECDSA Signature Algorithm Selection compressed point-client]
CipherString = DEFAULT
SignatureAlgorithms = ECDSA+SHA256
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
-[test-14]
+[test-15]
ExpectedResult = Success
ExpectedServerCertType = P-256
ExpectedServerSignHash = SHA256
@@ -553,39 +584,39 @@ ExpectedServerSignType = EC
# ===========================================================
-[15-ECDSA Signature Algorithm Selection, no ECDSA certificate]
-ssl_conf = 15-ECDSA Signature Algorithm Selection, no ECDSA certificate-ssl
+[16-ECDSA Signature Algorithm Selection, no ECDSA certificate]
+ssl_conf = 16-ECDSA Signature Algorithm Selection, no ECDSA certificate-ssl
-[15-ECDSA Signature Algorithm Selection, no ECDSA certificate-ssl]
-server = 15-ECDSA Signature Algorithm Selection, no ECDSA certificate-server
-client = 15-ECDSA Signature Algorithm Selection, no ECDSA certificate-client
+[16-ECDSA Signature Algorithm Selection, no ECDSA certificate-ssl]
+server = 16-ECDSA Signature Algorithm Selection, no ECDSA certificate-server
+client = 16-ECDSA Signature Algorithm Selection, no ECDSA certificate-client
-[15-ECDSA Signature Algorithm Selection, no ECDSA certificate-server]
+[16-ECDSA Signature Algorithm Selection, no ECDSA certificate-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
-[15-ECDSA Signature Algorithm Selection, no ECDSA certificate-client]
+[16-ECDSA Signature Algorithm Selection, no ECDSA certificate-client]
CipherString = DEFAULT
SignatureAlgorithms = ECDSA+SHA256
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
-[test-15]
+[test-16]
ExpectedResult = ServerFail
# ===========================================================
-[16-RSA Signature Algorithm Selection]
-ssl_conf = 16-RSA Signature Algorithm Selection-ssl
+[17-RSA Signature Algorithm Selection]
+ssl_conf = 17-RSA Signature Algorithm Selection-ssl
-[16-RSA Signature Algorithm Selection-ssl]
-server = 16-RSA Signature Algorithm Selection-server
-client = 16-RSA Signature Algorithm Selection-client
+[17-RSA Signature Algorithm Selection-ssl]
+server = 17-RSA Signature Algorithm Selection-server
+client = 17-RSA Signature Algorithm Selection-client
-[16-RSA Signature Algorithm Selection-server]
+[17-RSA Signature Algorithm Selection-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
@@ -597,13 +628,13 @@ Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
-[16-RSA Signature Algorithm Selection-client]
+[17-RSA Signature Algorithm Selection-client]
CipherString = DEFAULT
SignatureAlgorithms = RSA+SHA256
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
-[test-16]
+[test-17]
ExpectedResult = Success
ExpectedServerCertType = RSA
ExpectedServerSignHash = SHA256
@@ -612,14 +643,14 @@ ExpectedServerSignType = RSA
# ===========================================================
-[17-RSA-PSS Signature Algorithm Selection]
-ssl_conf = 17-RSA-PSS Signature Algorithm Selection-ssl
+[18-RSA-PSS Signature Algorithm Selection]
+ssl_conf = 18-RSA-PSS Signature Algorithm Selection-ssl
-[17-RSA-PSS Signature Algorithm Selection-ssl]
-server = 17-RSA-PSS Signature Algorithm Selection-server
-client = 17-RSA-PSS Signature Algorithm Selection-client
+[18-RSA-PSS Signature Algorithm Selection-ssl]
+server = 18-RSA-PSS Signature Algorithm Selection-server
+client = 18-RSA-PSS Signature Algorithm Selection-client
-[17-RSA-PSS Signature Algorithm Selection-server]
+[18-RSA-PSS Signature Algorithm Selection-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
@@ -631,13 +662,13 @@ Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
-[17-RSA-PSS Signature Algorithm Selection-client]
+[18-RSA-PSS Signature Algorithm Selection-client]
CipherString = DEFAULT
SignatureAlgorithms = RSA-PSS+SHA256
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
-[test-17]
+[test-18]
ExpectedResult = Success
ExpectedServerCertType = RSA
ExpectedServerSignHash = SHA256
@@ -646,14 +677,14 @@ ExpectedServerSignType = RSA-PSS
# ===========================================================
-[18-RSA-PSS Certificate Legacy Signature Algorithm Selection]
-ssl_conf = 18-RSA-PSS Certificate Legacy Signature Algorithm Selection-ssl
+[19-RSA-PSS Certificate Legacy Signature Algorithm Selection]
+ssl_conf = 19-RSA-PSS Certificate Legacy Signature Algorithm Selection-ssl
-[18-RSA-PSS Certificate Legacy Signature Algorithm Selection-ssl]
-server = 18-RSA-PSS Certificate Legacy Signature Algorithm Selection-server
-client = 18-RSA-PSS Certificate Legacy Signature Algorithm Selection-client
+[19-RSA-PSS Certificate Legacy Signature Algorithm Selection-ssl]
+server = 19-RSA-PSS Certificate Legacy Signature Algorithm Selection-server
+client = 19-RSA-PSS Certificate Legacy Signature Algorithm Selection-client
-[18-RSA-PSS Certificate Legacy Signature Algorithm Selection-server]
+[19-RSA-PSS Certificate Legacy Signature Algorithm Selection-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
@@ -667,13 +698,13 @@ PSS.Certificate = ${ENV::TEST_CERTS_DIR}/server-pss-cert.pem
PSS.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-pss-key.pem
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
-[18-RSA-PSS Certificate Legacy Signature Algorithm Selection-client]
+[19-RSA-PSS Certificate Legacy Signature Algorithm Selection-client]
CipherString = DEFAULT
SignatureAlgorithms = RSA-PSS+SHA256
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
-[test-18]
+[test-19]
ExpectedResult = Success
ExpectedServerCertType = RSA
ExpectedServerSignHash = SHA256
@@ -682,14 +713,14 @@ ExpectedServerSignType = RSA-PSS
# ===========================================================
-[19-RSA-PSS Certificate Unified Signature Algorithm Selection]
-ssl_conf = 19-RSA-PSS Certificate Unified Signature Algorithm Selection-ssl
+[20-RSA-PSS Certificate Unified Signature Algorithm Selection]
+ssl_conf = 20-RSA-PSS Certificate Unified Signature Algorithm Selection-ssl
-[19-RSA-PSS Certificate Unified Signature Algorithm Selection-ssl]
-server = 19-RSA-PSS Certificate Unified Signature Algorithm Selection-server
-client = 19-RSA-PSS Certificate Unified Signature Algorithm Selection-client
+[20-RSA-PSS Certificate Unified Signature Algorithm Selection-ssl]
+server = 20-RSA-PSS Certificate Unified Signature Algorithm Selection-server
+client = 20-RSA-PSS Certificate Unified Signature Algorithm Selection-client
-[19-RSA-PSS Certificate Unified Signature Algorithm Selection-server]
+[20-RSA-PSS Certificate Unified Signature Algorithm Selection-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
@@ -703,13 +734,13 @@ PSS.Certificate = ${ENV::TEST_CERTS_DIR}/server-pss-cert.pem
PSS.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-pss-key.pem
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
-[19-RSA-PSS Certificate Unified Signature Algorithm Selection-client]
+[20-RSA-PSS Certificate Unified Signature Algorithm Selection-client]
CipherString = DEFAULT
SignatureAlgorithms = rsa_pss_pss_sha256
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
-[test-19]
+[test-20]
ExpectedResult = Success
ExpectedServerCertType = RSA-PSS
ExpectedServerSignHash = SHA256
@@ -718,24 +749,24 @@ ExpectedServerSignType = RSA-PSS
# ===========================================================
-[20-Only RSA-PSS Certificate]
-ssl_conf = 20-Only RSA-PSS Certificate-ssl
+[21-Only RSA-PSS Certificate]
+ssl_conf = 21-Only RSA-PSS Certificate-ssl
-[20-Only RSA-PSS Certificate-ssl]
-server = 20-Only RSA-PSS Certificate-server
-client = 20-Only RSA-PSS Certificate-client
+[21-Only RSA-PSS Certificate-ssl]
+server = 21-Only RSA-PSS Certificate-server
+client = 21-Only RSA-PSS Certificate-client
-[20-Only RSA-PSS Certificate-server]
+[21-Only RSA-PSS Certificate-server]
Certificate = ${ENV::TEST_CERTS_DIR}/server-pss-cert.pem
CipherString = DEFAULT
PrivateKey = ${ENV::TEST_CERTS_DIR}/server-pss-key.pem
-[20-Only RSA-PSS Certificate-client]
+[21-Only RSA-PSS Certificate-client]
CipherString = DEFAULT
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
-[test-20]
+[test-21]
ExpectedResult = Success
ExpectedServerCertType = RSA-PSS
ExpectedServerSignHash = SHA256
@@ -744,89 +775,89 @@ ExpectedServerSignType = RSA-PSS
# ===========================================================
-[21-RSA-PSS Certificate, no PSS signature algorithms]
-ssl_conf = 21-RSA-PSS Certificate, no PSS signature algorithms-ssl
+[22-RSA-PSS Certificate, no PSS signature algorithms]
+ssl_conf = 22-RSA-PSS Certificate, no PSS signature algorithms-ssl
-[21-RSA-PSS Certificate, no PSS signature algorithms-ssl]
-server = 21-RSA-PSS Certificate, no PSS signature algorithms-server
-client = 21-RSA-PSS Certificate, no PSS signature algorithms-client
+[22-RSA-PSS Certificate, no PSS signature algorithms-ssl]
+server = 22-RSA-PSS Certificate, no PSS signature algorithms-server
+client = 22-RSA-PSS Certificate, no PSS signature algorithms-client
-[21-RSA-PSS Certificate, no PSS signature algorithms-server]
+[22-RSA-PSS Certificate, no PSS signature algorithms-server]
Certificate = ${ENV::TEST_CERTS_DIR}/server-pss-cert.pem
CipherString = DEFAULT
PrivateKey = ${ENV::TEST_CERTS_DIR}/server-pss-key.pem
-[21-RSA-PSS Certificate, no PSS signature algorithms-client]
+[22-RSA-PSS Certificate, no PSS signature algorithms-client]
CipherString = DEFAULT
SignatureAlgorithms = RSA+SHA256
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
-[test-21]
+[test-22]
ExpectedResult = ServerFail
# ===========================================================
-[22-RSA key exchange with all RSA certificate types]
-ssl_conf = 22-RSA key exchange with all RSA certificate types-ssl
+[23-RSA key exchange with all RSA certificate types]
+ssl_conf = 23-RSA key exchange with all RSA certificate types-ssl
-[22-RSA key exchange with all RSA certificate types-ssl]
-server = 22-RSA key exchange with all RSA certificate types-server
-client = 22-RSA key exchange with all RSA certificate types-client
+[23-RSA key exchange with all RSA certificate types-ssl]
+server = 23-RSA key exchange with all RSA certificate types-server
+client = 23-RSA key exchange with all RSA certificate types-client
-[22-RSA key exchange with all RSA certificate types-server]
+[23-RSA key exchange with all RSA certificate types-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
PSS.Certificate = ${ENV::TEST_CERTS_DIR}/server-pss-cert.pem
PSS.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-pss-key.pem
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
-[22-RSA key exchange with all RSA certificate types-client]
+[23-RSA key exchange with all RSA certificate types-client]
CipherString = kRSA
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
-[test-22]
+[test-23]
ExpectedResult = Success
ExpectedServerCertType = RSA
# ===========================================================
-[23-RSA key exchange with only RSA-PSS certificate]
-ssl_conf = 23-RSA key exchange with only RSA-PSS certificate-ssl
+[24-RSA key exchange with only RSA-PSS certificate]
+ssl_conf = 24-RSA key exchange with only RSA-PSS certificate-ssl
-[23-RSA key exchange with only RSA-PSS certificate-ssl]
-server = 23-RSA key exchange with only RSA-PSS certificate-server
-client = 23-RSA key exchange with only RSA-PSS certificate-client
+[24-RSA key exchange with only RSA-PSS certificate-ssl]
+server = 24-RSA key exchange with only RSA-PSS certificate-server
+client = 24-RSA key exchange with only RSA-PSS certificate-client
-[23-RSA key exchange with only RSA-PSS certificate-server]
+[24-RSA key exchange with only RSA-PSS certificate-server]
Certificate = ${ENV::TEST_CERTS_DIR}/server-pss-cert.pem
CipherString = DEFAULT
PrivateKey = ${ENV::TEST_CERTS_DIR}/server-pss-key.pem
-[23-RSA key exchange with only RSA-PSS certificate-client]
+[24-RSA key exchange with only RSA-PSS certificate-client]
CipherString = kRSA
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
-[test-23]
+[test-24]
ExpectedResult = ServerFail
# ===========================================================
-[24-Suite B P-256 Hash Algorithm Selection]
-ssl_conf = 24-Suite B P-256 Hash Algorithm Selection-ssl
+[25-Suite B P-256 Hash Algorithm Selection]
+ssl_conf = 25-Suite B P-256 Hash Algorithm Selection-ssl
-[24-Suite B P-256 Hash Algorithm Selection-ssl]
-server = 24-Suite B P-256 Hash Algorithm Selection-server
-client = 24-Suite B P-256 Hash Algorithm Selection-client
+[25-Suite B P-256 Hash Algorithm Selection-ssl]
+server = 25-Suite B P-256 Hash Algorithm Selection-server
+client = 25-Suite B P-256 Hash Algorithm Selection-client
-[24-Suite B P-256 Hash Algorithm Selection-server]
+[25-Suite B P-256 Hash Algorithm Selection-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = SUITEB128
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/p256-server-cert.pem
@@ -834,13 +865,13 @@ ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/p256-server-key.pem
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
-[24-Suite B P-256 Hash Algorithm Selection-client]
+[25-Suite B P-256 Hash Algorithm Selection-client]
CipherString = DEFAULT
SignatureAlgorithms = ECDSA+SHA384:ECDSA+SHA256
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/p384-root.pem
VerifyMode = Peer
-[test-24]
+[test-25]
ExpectedResult = Success
ExpectedServerCertType = P-256
ExpectedServerSignHash = SHA256
@@ -849,14 +880,14 @@ ExpectedServerSignType = EC
# ===========================================================
-[25-Suite B P-384 Hash Algorithm Selection]
-ssl_conf = 25-Suite B P-384 Hash Algorithm Selection-ssl
+[26-Suite B P-384 Hash Algorithm Selection]
+ssl_conf = 26-Suite B P-384 Hash Algorithm Selection-ssl
-[25-Suite B P-384 Hash Algorithm Selection-ssl]
-server = 25-Suite B P-384 Hash Algorithm Selection-server
-client = 25-Suite B P-384 Hash Algorithm Selection-client
+[26-Suite B P-384 Hash Algorithm Selection-ssl]
+server = 26-Suite B P-384 Hash Algorithm Selection-server
+client = 26-Suite B P-384 Hash Algorithm Selection-client
-[25-Suite B P-384 Hash Algorithm Selection-server]
+[26-Suite B P-384 Hash Algorithm Selection-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = SUITEB128
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/p384-server-cert.pem
@@ -864,13 +895,13 @@ ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/p384-server-key.pem
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
-[25-Suite B P-384 Hash Algorithm Selection-client]
+[26-Suite B P-384 Hash Algorithm Selection-client]
CipherString = DEFAULT
SignatureAlgorithms = ECDSA+SHA256:ECDSA+SHA384
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/p384-root.pem
VerifyMode = Peer
-[test-25]
+[test-26]
ExpectedResult = Success
ExpectedServerCertType = P-384
ExpectedServerSignHash = SHA384
@@ -879,21 +910,21 @@ ExpectedServerSignType = EC
# ===========================================================
-[26-TLS 1.2 Ed25519 Client Auth]
-ssl_conf = 26-TLS 1.2 Ed25519 Client Auth-ssl
+[27-TLS 1.2 Ed25519 Client Auth]
+ssl_conf = 27-TLS 1.2 Ed25519 Client Auth-ssl
-[26-TLS 1.2 Ed25519 Client Auth-ssl]
-server = 26-TLS 1.2 Ed25519 Client Auth-server
-client = 26-TLS 1.2 Ed25519 Client Auth-client
+[27-TLS 1.2 Ed25519 Client Auth-ssl]
+server = 27-TLS 1.2 Ed25519 Client Auth-server
+client = 27-TLS 1.2 Ed25519 Client Auth-client
-[26-TLS 1.2 Ed25519 Client Auth-server]
+[27-TLS 1.2 Ed25519 Client Auth-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
VerifyMode = Require
-[26-TLS 1.2 Ed25519 Client Auth-client]
+[27-TLS 1.2 Ed25519 Client Auth-client]
CipherString = DEFAULT
Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/client-ed25519-cert.pem
Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/client-ed25519-key.pem
@@ -902,7 +933,7 @@ MinProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
-[test-26]
+[test-27]
ExpectedClientCertType = Ed25519
ExpectedClientSignType = Ed25519
ExpectedResult = Success
@@ -910,21 +941,21 @@ ExpectedResult = Success
# ===========================================================
-[27-TLS 1.2 Ed448 Client Auth]
-ssl_conf = 27-TLS 1.2 Ed448 Client Auth-ssl
+[28-TLS 1.2 Ed448 Client Auth]
+ssl_conf = 28-TLS 1.2 Ed448 Client Auth-ssl
-[27-TLS 1.2 Ed448 Client Auth-ssl]
-server = 27-TLS 1.2 Ed448 Client Auth-server
-client = 27-TLS 1.2 Ed448 Client Auth-client
+[28-TLS 1.2 Ed448 Client Auth-ssl]
+server = 28-TLS 1.2 Ed448 Client Auth-server
+client = 28-TLS 1.2 Ed448 Client Auth-client
-[27-TLS 1.2 Ed448 Client Auth-server]
+[28-TLS 1.2 Ed448 Client Auth-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
VerifyMode = Require
-[27-TLS 1.2 Ed448 Client Auth-client]
+[28-TLS 1.2 Ed448 Client Auth-client]
CipherString = DEFAULT
Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/client-ed448-cert.pem
Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/client-ed448-key.pem
@@ -933,7 +964,7 @@ MinProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
-[test-27]
+[test-28]
ExpectedClientCertType = Ed448
ExpectedClientSignType = Ed448
ExpectedResult = Success
@@ -941,38 +972,38 @@ ExpectedResult = Success
# ===========================================================
-[28-Only RSA-PSS Certificate, TLS v1.1]
-ssl_conf = 28-Only RSA-PSS Certificate, TLS v1.1-ssl
+[29-Only RSA-PSS Certificate, TLS v1.1]
+ssl_conf = 29-Only RSA-PSS Certificate, TLS v1.1-ssl
-[28-Only RSA-PSS Certificate, TLS v1.1-ssl]
-server = 28-Only RSA-PSS Certificate, TLS v1.1-server
-client = 28-Only RSA-PSS Certificate, TLS v1.1-client
+[29-Only RSA-PSS Certificate, TLS v1.1-ssl]
+server = 29-Only RSA-PSS Certificate, TLS v1.1-server
+client = 29-Only RSA-PSS Certificate, TLS v1.1-client
-[28-Only RSA-PSS Certificate, TLS v1.1-server]
+[29-Only RSA-PSS Certificate, TLS v1.1-server]
Certificate = ${ENV::TEST_CERTS_DIR}/server-pss-cert.pem
CipherString = DEFAULT
PrivateKey = ${ENV::TEST_CERTS_DIR}/server-pss-key.pem
-[28-Only RSA-PSS Certificate, TLS v1.1-client]
+[29-Only RSA-PSS Certificate, TLS v1.1-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
-[test-28]
+[test-29]
ExpectedResult = ServerFail
# ===========================================================
-[29-TLS 1.3 ECDSA Signature Algorithm Selection]
-ssl_conf = 29-TLS 1.3 ECDSA Signature Algorithm Selection-ssl
+[30-TLS 1.3 ECDSA Signature Algorithm Selection]
+ssl_conf = 30-TLS 1.3 ECDSA Signature Algorithm Selection-ssl
-[29-TLS 1.3 ECDSA Signature Algorithm Selection-ssl]
-server = 29-TLS 1.3 ECDSA Signature Algorithm Selection-server
-client = 29-TLS 1.3 ECDSA Signature Algorithm Selection-client
+[30-TLS 1.3 ECDSA Signature Algorithm Selection-ssl]
+server = 30-TLS 1.3 ECDSA Signature Algorithm Selection-server
+client = 30-TLS 1.3 ECDSA Signature Algorithm Selection-client
-[29-TLS 1.3 ECDSA Signature Algorithm Selection-server]
+[30-TLS 1.3 ECDSA Signature Algorithm Selection-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
@@ -985,13 +1016,13 @@ MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
-[29-TLS 1.3 ECDSA Signature Algorithm Selection-client]
+[30-TLS 1.3 ECDSA Signature Algorithm Selection-client]
CipherString = DEFAULT
SignatureAlgorithms = ECDSA+SHA256
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
-[test-29]
+[test-30]
ExpectedResult = Success
ExpectedServerCANames = empty
ExpectedServerCertType = P-256
@@ -1001,14 +1032,14 @@ ExpectedServerSignType = EC
# ===========================================================
-[30-TLS 1.3 ECDSA Signature Algorithm Selection compressed point]
-ssl_conf = 30-TLS 1.3 ECDSA Signature Algorithm Selection compressed point-ssl
+[31-TLS 1.3 ECDSA Signature Algorithm Selection compressed point]
+ssl_conf = 31-TLS 1.3 ECDSA Signature Algorithm Selection compressed point-ssl
-[30-TLS 1.3 ECDSA Signature Algorithm Selection compressed point-ssl]
-server = 30-TLS 1.3 ECDSA Signature Algorithm Selection compressed point-server
-client = 30-TLS 1.3 ECDSA Signature Algorithm Selection compressed point-client
+[31-TLS 1.3 ECDSA Signature Algorithm Selection compressed point-ssl]
+server = 31-TLS 1.3 ECDSA Signature Algorithm Selection compressed point-server
+client = 31-TLS 1.3 ECDSA Signature Algorithm Selection compressed point-client
-[30-TLS 1.3 ECDSA Signature Algorithm Selection compressed point-server]
+[31-TLS 1.3 ECDSA Signature Algorithm Selection compressed point-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-cecdsa-cert.pem
@@ -1017,13 +1048,13 @@ MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
-[30-TLS 1.3 ECDSA Signature Algorithm Selection compressed point-client]
+[31-TLS 1.3 ECDSA Signature Algorithm Selection compressed point-client]
CipherString = DEFAULT
SignatureAlgorithms = ECDSA+SHA256
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
-[test-30]
+[test-31]
ExpectedResult = Success
ExpectedServerCANames = empty
ExpectedServerCertType = P-256
@@ -1033,14 +1064,14 @@ ExpectedServerSignType = EC
# ===========================================================
-[31-TLS 1.3 ECDSA Signature Algorithm Selection SHA1]
-ssl_conf = 31-TLS 1.3 ECDSA Signature Algorithm Selection SHA1-ssl
+[32-TLS 1.3 ECDSA Signature Algorithm Selection SHA1]
+ssl_conf = 32-TLS 1.3 ECDSA Signature Algorithm Selection SHA1-ssl
-[31-TLS 1.3 ECDSA Signature Algorithm Selection SHA1-ssl]
-server = 31-TLS 1.3 ECDSA Signature Algorithm Selection SHA1-server
-client = 31-TLS 1.3 ECDSA Signature Algorithm Selection SHA1-client
+[32-TLS 1.3 ECDSA Signature Algorithm Selection SHA1-ssl]
+server = 32-TLS 1.3 ECDSA Signature Algorithm Selection SHA1-server
+client = 32-TLS 1.3 ECDSA Signature Algorithm Selection SHA1-client
-[31-TLS 1.3 ECDSA Signature Algorithm Selection SHA1-server]
+[32-TLS 1.3 ECDSA Signature Algorithm Selection SHA1-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
@@ -1053,26 +1084,26 @@ MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
-[31-TLS 1.3 ECDSA Signature Algorithm Selection SHA1-client]
+[32-TLS 1.3 ECDSA Signature Algorithm Selection SHA1-client]
CipherString = DEFAULT
SignatureAlgorithms = ECDSA+SHA1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
-[test-31]
+[test-32]
ExpectedResult = ServerFail
# ===========================================================
-[32-TLS 1.3 ECDSA Signature Algorithm Selection with PSS]
-ssl_conf = 32-TLS 1.3 ECDSA Signature Algorithm Selection with PSS-ssl
+[33-TLS 1.3 ECDSA Signature Algorithm Selection with PSS]
+ssl_conf = 33-TLS 1.3 ECDSA Signature Algorithm Selection with PSS-ssl
-[32-TLS 1.3 ECDSA Signature Algorithm Selection with PSS-ssl]
-server = 32-TLS 1.3 ECDSA Signature Algorithm Selection with PSS-server
-client = 32-TLS 1.3 ECDSA Signature Algorithm Selection with PSS-client
+[33-TLS 1.3 ECDSA Signature Algorithm Selection with PSS-ssl]
+server = 33-TLS 1.3 ECDSA Signature Algorithm Selection with PSS-server
+client = 33-TLS 1.3 ECDSA Signature Algorithm Selection with PSS-client
-[32-TLS 1.3 ECDSA Signature Algorithm Selection with PSS-server]
+[33-TLS 1.3 ECDSA Signature Algorithm Selection with PSS-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
@@ -1085,14 +1116,14 @@ MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
-[32-TLS 1.3 ECDSA Signature Algorithm Selection with PSS-client]
+[33-TLS 1.3 ECDSA Signature Algorithm Selection with PSS-client]
CipherString = DEFAULT
RequestCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
SignatureAlgorithms = ECDSA+SHA256:RSA-PSS+SHA256
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
-[test-32]
+[test-33]
ExpectedResult = Success
ExpectedServerCANames = ${ENV::TEST_CERTS_DIR}/root-cert.pem
ExpectedServerCertType = P-256
@@ -1102,14 +1133,14 @@ ExpectedServerSignType = EC
# ===========================================================
-[33-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS]
-ssl_conf = 33-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS-ssl
+[34-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS]
+ssl_conf = 34-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS-ssl
-[33-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS-ssl]
-server = 33-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS-server
-client = 33-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS-client
+[34-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS-ssl]
+server = 34-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS-server
+client = 34-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS-client
-[33-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS-server]
+[34-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
@@ -1122,13 +1153,13 @@ MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
-[33-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS-client]
+[34-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS-client]
CipherString = DEFAULT
SignatureAlgorithms = ECDSA+SHA384:RSA-PSS+SHA384
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
-[test-33]
+[test-34]
ExpectedResult = Success
ExpectedServerCertType = RSA
ExpectedServerSignHash = SHA384
@@ -1137,40 +1168,40 @@ ExpectedServerSignType = RSA-PSS
# ===========================================================
-[34-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate]
-ssl_conf = 34-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate-ssl
+[35-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate]
+ssl_conf = 35-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate-ssl
-[34-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate-ssl]
-server = 34-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate-server
-client = 34-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate-client
+[35-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate-ssl]
+server = 35-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate-server
+client = 35-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate-client
-[34-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate-server]
+[35-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
-[34-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate-client]
+[35-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate-client]
CipherString = DEFAULT
SignatureAlgorithms = ECDSA+SHA256
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
-[test-34]
+[test-35]
ExpectedResult = ServerFail
# ===========================================================
-[35-TLS 1.3 RSA Signature Algorithm Selection, no PSS]
-ssl_conf = 35-TLS 1.3 RSA Signature Algorithm Selection, no PSS-ssl
+[36-TLS 1.3 RSA Signature Algorithm Selection, no PSS]
+ssl_conf = 36-TLS 1.3 RSA Signature Algorithm Selection, no PSS-ssl
-[35-TLS 1.3 RSA Signature Algorithm Selection, no PSS-ssl]
-server = 35-TLS 1.3 RSA Signature Algorithm Selection, no PSS-server
-client = 35-TLS 1.3 RSA Signature Algorithm Selection, no PSS-client
+[36-TLS 1.3 RSA Signature Algorithm Selection, no PSS-ssl]
+server = 36-TLS 1.3 RSA Signature Algorithm Selection, no PSS-server
+client = 36-TLS 1.3 RSA Signature Algorithm Selection, no PSS-client
-[35-TLS 1.3 RSA Signature Algorithm Selection, no PSS-server]
+[36-TLS 1.3 RSA Signature Algorithm Selection, no PSS-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
@@ -1183,26 +1214,26 @@ MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
-[35-TLS 1.3 RSA Signature Algorithm Selection, no PSS-client]
+[36-TLS 1.3 RSA Signature Algorithm Selection, no PSS-client]
CipherString = DEFAULT
SignatureAlgorithms = RSA+SHA256
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
-[test-35]
+[test-36]
ExpectedResult = ServerFail
# ===========================================================
-[36-TLS 1.3 RSA-PSS Signature Algorithm Selection]
-ssl_conf = 36-TLS 1.3 RSA-PSS Signature Algorithm Selection-ssl
+[37-TLS 1.3 RSA-PSS Signature Algorithm Selection]
+ssl_conf = 37-TLS 1.3 RSA-PSS Signature Algorithm Selection-ssl
-[36-TLS 1.3 RSA-PSS Signature Algorithm Selection-ssl]
-server = 36-TLS 1.3 RSA-PSS Signature Algorithm Selection-server
-client = 36-TLS 1.3 RSA-PSS Signature Algorithm Selection-client
+[37-TLS 1.3 RSA-PSS Signature Algorithm Selection-ssl]
+server = 37-TLS 1.3 RSA-PSS Signature Algorithm Selection-server
+client = 37-TLS 1.3 RSA-PSS Signature Algorithm Selection-client
-[36-TLS 1.3 RSA-PSS Signature Algorithm Selection-server]
+[37-TLS 1.3 RSA-PSS Signature Algorithm Selection-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
@@ -1215,13 +1246,13 @@ MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
-[36-TLS 1.3 RSA-PSS Signature Algorithm Selection-client]
+[37-TLS 1.3 RSA-PSS Signature Algorithm Selection-client]
CipherString = DEFAULT
SignatureAlgorithms = RSA-PSS+SHA256
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
-[test-36]
+[test-37]
ExpectedResult = Success
ExpectedServerCertType = RSA
ExpectedServerSignHash = SHA256
@@ -1230,14 +1261,14 @@ ExpectedServerSignType = RSA-PSS
# ===========================================================
-[37-TLS 1.3 Ed25519 Signature Algorithm Selection]
-ssl_conf = 37-TLS 1.3 Ed25519 Signature Algorithm Selection-ssl
+[38-TLS 1.3 Ed25519 Signature Algorithm Selection]
+ssl_conf = 38-TLS 1.3 Ed25519 Signature Algorithm Selection-ssl
-[37-TLS 1.3 Ed25519 Signature Algorithm Selection-ssl]
-server = 37-TLS 1.3 Ed25519 Signature Algorithm Selection-server
-client = 37-TLS 1.3 Ed25519 Signature Algorithm Selection-client
+[38-TLS 1.3 Ed25519 Signature Algorithm Selection-ssl]
+server = 38-TLS 1.3 Ed25519 Signature Algorithm Selection-server
+client = 38-TLS 1.3 Ed25519 Signature Algorithm Selection-client
-[37-TLS 1.3 Ed25519 Signature Algorithm Selection-server]
+[38-TLS 1.3 Ed25519 Signature Algorithm Selection-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
@@ -1250,13 +1281,13 @@ MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
-[37-TLS 1.3 Ed25519 Signature Algorithm Selection-client]
+[38-TLS 1.3 Ed25519 Signature Algorithm Selection-client]
CipherString = DEFAULT
SignatureAlgorithms = ed25519
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
-[test-37]
+[test-38]
ExpectedResult = Success
ExpectedServerCertType = Ed25519
ExpectedServerSignType = Ed25519
@@ -1264,14 +1295,14 @@ ExpectedServerSignType = Ed25519
# ===========================================================
-[38-TLS 1.3 Ed448 Signature Algorithm Selection]
-ssl_conf = 38-TLS 1.3 Ed448 Signature Algorithm Selection-ssl
+[39-TLS 1.3 Ed448 Signature Algorithm Selection]
+ssl_conf = 39-TLS 1.3 Ed448 Signature Algorithm Selection-ssl
-[38-TLS 1.3 Ed448 Signature Algorithm Selection-ssl]
-server = 38-TLS 1.3 Ed448 Signature Algorithm Selection-server
-client = 38-TLS 1.3 Ed448 Signature Algorithm Selection-client
+[39-TLS 1.3 Ed448 Signature Algorithm Selection-ssl]
+server = 39-TLS 1.3 Ed448 Signature Algorithm Selection-server
+client = 39-TLS 1.3 Ed448 Signature Algorithm Selection-client
-[38-TLS 1.3 Ed448 Signature Algorithm Selection-server]
+[39-TLS 1.3 Ed448 Signature Algorithm Selection-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
@@ -1284,13 +1315,13 @@ MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
-[38-TLS 1.3 Ed448 Signature Algorithm Selection-client]
+[39-TLS 1.3 Ed448 Signature Algorithm Selection-client]
CipherString = DEFAULT
SignatureAlgorithms = ed448
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
-[test-38]
+[test-39]
ExpectedResult = Success
ExpectedServerCertType = Ed448
ExpectedServerSignType = Ed448
@@ -1298,14 +1329,14 @@ ExpectedServerSignType = Ed448
# ===========================================================
-[39-TLS 1.3 Ed25519 CipherString and Groups Selection]
-ssl_conf = 39-TLS 1.3 Ed25519 CipherString and Groups Selection-ssl
+[40-TLS 1.3 Ed25519 CipherString and Groups Selection]
+ssl_conf = 40-TLS 1.3 Ed25519 CipherString and Groups Selection-ssl
-[39-TLS 1.3 Ed25519 CipherString and Groups Selection-ssl]
-server = 39-TLS 1.3 Ed25519 CipherString and Groups Selection-server
-client = 39-TLS 1.3 Ed25519 CipherString and Groups Selection-client
+[40-TLS 1.3 Ed25519 CipherString and Groups Selection-ssl]
+server = 40-TLS 1.3 Ed25519 CipherString and Groups Selection-server
+client = 40-TLS 1.3 Ed25519 CipherString and Groups Selection-client
-[39-TLS 1.3 Ed25519 CipherString and Groups Selection-server]
+[40-TLS 1.3 Ed25519 CipherString and Groups Selection-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
@@ -1318,14 +1349,14 @@ MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
-[39-TLS 1.3 Ed25519 CipherString and Groups Selection-client]
+[40-TLS 1.3 Ed25519 CipherString and Groups Selection-client]
CipherString = DEFAULT
Groups = X25519
SignatureAlgorithms = ECDSA+SHA256:ed25519
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
-[test-39]
+[test-40]
ExpectedResult = Success
ExpectedServerCertType = P-256
ExpectedServerSignType = EC
@@ -1333,14 +1364,14 @@ ExpectedServerSignType = EC
# ===========================================================
-[40-TLS 1.3 Ed448 CipherString and Groups Selection]
-ssl_conf = 40-TLS 1.3 Ed448 CipherString and Groups Selection-ssl
+[41-TLS 1.3 Ed448 CipherString and Groups Selection]
+ssl_conf = 41-TLS 1.3 Ed448 CipherString and Groups Selection-ssl
-[40-TLS 1.3 Ed448 CipherString and Groups Selection-ssl]
-server = 40-TLS 1.3 Ed448 CipherString and Groups Selection-server
-client = 40-TLS 1.3 Ed448 CipherString and Groups Selection-client
+[41-TLS 1.3 Ed448 CipherString and Groups Selection-ssl]
+server = 41-TLS 1.3 Ed448 CipherString and Groups Selection-server
+client = 41-TLS 1.3 Ed448 CipherString and Groups Selection-client
-[40-TLS 1.3 Ed448 CipherString and Groups Selection-server]
+[41-TLS 1.3 Ed448 CipherString and Groups Selection-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
@@ -1353,14 +1384,14 @@ MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
-[40-TLS 1.3 Ed448 CipherString and Groups Selection-client]
+[41-TLS 1.3 Ed448 CipherString and Groups Selection-client]
CipherString = DEFAULT
Groups = X448
SignatureAlgorithms = ECDSA+SHA256:ed448
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
-[test-40]
+[test-41]
ExpectedResult = Success
ExpectedServerCertType = P-256
ExpectedServerSignType = EC
@@ -1368,14 +1399,14 @@ ExpectedServerSignType = EC
# ===========================================================
-[41-TLS 1.3 RSA Client Auth Signature Algorithm Selection]
-ssl_conf = 41-TLS 1.3 RSA Client Auth Signature Algorithm Selection-ssl
+[42-TLS 1.3 RSA Client Auth Signature Algorithm Selection]
+ssl_conf = 42-TLS 1.3 RSA Client Auth Signature Algorithm Selection-ssl
-[41-TLS 1.3 RSA Client Auth Signature Algorithm Selection-ssl]
-server = 41-TLS 1.3 RSA Client Auth Signature Algorithm Selection-server
-client = 41-TLS 1.3 RSA Client Auth Signature Algorithm Selection-client
+[42-TLS 1.3 RSA Client Auth Signature Algorithm Selection-ssl]
+server = 42-TLS 1.3 RSA Client Auth Signature Algorithm Selection-server
+client = 42-TLS 1.3 RSA Client Auth Signature Algorithm Selection-client
-[41-TLS 1.3 RSA Client Auth Signature Algorithm Selection-server]
+[42-TLS 1.3 RSA Client Auth Signature Algorithm Selection-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ClientSignatureAlgorithms = PSS+SHA256
@@ -1383,7 +1414,7 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
VerifyMode = Require
-[41-TLS 1.3 RSA Client Auth Signature Algorithm Selection-client]
+[42-TLS 1.3 RSA Client Auth Signature Algorithm Selection-client]
CipherString = DEFAULT
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/ee-ecdsa-client-chain.pem
ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/ee-ecdsa-key.pem
@@ -1394,7 +1425,7 @@ RSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/ee-key.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
-[test-41]
+[test-42]
ExpectedClientCANames = empty
ExpectedClientCertType = RSA
ExpectedClientSignHash = SHA256
@@ -1404,14 +1435,14 @@ ExpectedResult = Success
# ===========================================================
-[42-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names]
-ssl_conf = 42-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names-ssl
+[43-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names]
+ssl_conf = 43-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names-ssl
-[42-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names-ssl]
-server = 42-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names-server
-client = 42-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names-client
+[43-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names-ssl]
+server = 43-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names-server
+client = 43-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names-client
-[42-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names-server]
+[43-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ClientSignatureAlgorithms = PSS+SHA256
@@ -1420,7 +1451,7 @@ RequestCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
VerifyMode = Require
-[42-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names-client]
+[43-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names-client]
CipherString = DEFAULT
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/ee-ecdsa-client-chain.pem
ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/ee-ecdsa-key.pem
@@ -1431,7 +1462,7 @@ RSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/ee-key.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
-[test-42]
+[test-43]
ExpectedClientCANames = ${ENV::TEST_CERTS_DIR}/root-cert.pem
ExpectedClientCertType = RSA
ExpectedClientSignHash = SHA256
@@ -1441,14 +1472,14 @@ ExpectedResult = Success
# ===========================================================
-[43-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection]
-ssl_conf = 43-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection-ssl
+[44-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection]
+ssl_conf = 44-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection-ssl
-[43-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection-ssl]
-server = 43-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection-server
-client = 43-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection-client
+[44-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection-ssl]
+server = 44-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection-server
+client = 44-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection-client
-[43-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection-server]
+[44-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ClientSignatureAlgorithms = ECDSA+SHA256
@@ -1456,7 +1487,7 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
VerifyMode = Require
-[43-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection-client]
+[44-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection-client]
CipherString = DEFAULT
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/ee-ecdsa-client-chain.pem
ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/ee-ecdsa-key.pem
@@ -1467,7 +1498,7 @@ RSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/ee-key.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
-[test-43]
+[test-44]
ExpectedClientCertType = P-256
ExpectedClientSignHash = SHA256
ExpectedClientSignType = EC
@@ -1476,21 +1507,21 @@ ExpectedResult = Success
# ===========================================================
-[44-TLS 1.3 Ed25519 Client Auth]
-ssl_conf = 44-TLS 1.3 Ed25519 Client Auth-ssl
+[45-TLS 1.3 Ed25519 Client Auth]
+ssl_conf = 45-TLS 1.3 Ed25519 Client Auth-ssl
-[44-TLS 1.3 Ed25519 Client Auth-ssl]
-server = 44-TLS 1.3 Ed25519 Client Auth-server
-client = 44-TLS 1.3 Ed25519 Client Auth-client
+[45-TLS 1.3 Ed25519 Client Auth-ssl]
+server = 45-TLS 1.3 Ed25519 Client Auth-server
+client = 45-TLS 1.3 Ed25519 Client Auth-client
-[44-TLS 1.3 Ed25519 Client Auth-server]
+[45-TLS 1.3 Ed25519 Client Auth-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
VerifyMode = Require
-[44-TLS 1.3 Ed25519 Client Auth-client]
+[45-TLS 1.3 Ed25519 Client Auth-client]
CipherString = DEFAULT
EdDSA.Certificate = ${ENV::TEST_CERTS_DIR}/client-ed25519-cert.pem
EdDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/client-ed25519-key.pem
@@ -1499,7 +1530,7 @@ MinProtocol = TLSv1.3
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
-[test-44]
+[test-45]
ExpectedClientCertType = Ed25519
ExpectedClientSignType = Ed25519
ExpectedResult = Success
@@ -1507,21 +1538,21 @@ ExpectedResult = Success
# ===========================================================
-[45-TLS 1.3 Ed448 Client Auth]
-ssl_conf = 45-TLS 1.3 Ed448 Client Auth-ssl
+[46-TLS 1.3 Ed448 Client Auth]
+ssl_conf = 46-TLS 1.3 Ed448 Client Auth-ssl
-[45-TLS 1.3 Ed448 Client Auth-ssl]
-server = 45-TLS 1.3 Ed448 Client Auth-server
-client = 45-TLS 1.3 Ed448 Client Auth-client
+[46-TLS 1.3 Ed448 Client Auth-ssl]
+server = 46-TLS 1.3 Ed448 Client Auth-server
+client = 46-TLS 1.3 Ed448 Client Auth-client
-[45-TLS 1.3 Ed448 Client Auth-server]
+[46-TLS 1.3 Ed448 Client Auth-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
VerifyMode = Require
-[45-TLS 1.3 Ed448 Client Auth-client]
+[46-TLS 1.3 Ed448 Client Auth-client]
CipherString = DEFAULT
EdDSA.Certificate = ${ENV::TEST_CERTS_DIR}/client-ed448-cert.pem
EdDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/client-ed448-key.pem
@@ -1530,7 +1561,7 @@ MinProtocol = TLSv1.3
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
-[test-45]
+[test-46]
ExpectedClientCertType = Ed448
ExpectedClientSignType = Ed448
ExpectedResult = Success
@@ -1538,14 +1569,42 @@ ExpectedResult = Success
# ===========================================================
-[46-TLS 1.2 DSA Certificate Test]
-ssl_conf = 46-TLS 1.2 DSA Certificate Test-ssl
+[47-TLS 1.3 ECDSA with brainpool]
+ssl_conf = 47-TLS 1.3 ECDSA with brainpool-ssl
+
+[47-TLS 1.3 ECDSA with brainpool-ssl]
+server = 47-TLS 1.3 ECDSA with brainpool-server
+client = 47-TLS 1.3 ECDSA with brainpool-client
+
+[47-TLS 1.3 ECDSA with brainpool-server]
+Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-brainpoolP256r1-cert.pem
+CipherString = DEFAULT
+Groups = brainpoolP256r1
+PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-brainpoolP256r1-key.pem
+
+[47-TLS 1.3 ECDSA with brainpool-client]
+CipherString = DEFAULT
+Groups = brainpoolP256r1
+MaxProtocol = TLSv1.3
+MinProtocol = TLSv1.3
+RequestCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
+VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
+VerifyMode = Peer
+
+[test-47]
+ExpectedResult = ServerFail
+
+
+# ===========================================================
+
+[48-TLS 1.2 DSA Certificate Test]
+ssl_conf = 48-TLS 1.2 DSA Certificate Test-ssl
-[46-TLS 1.2 DSA Certificate Test-ssl]
-server = 46-TLS 1.2 DSA Certificate Test-server
-client = 46-TLS 1.2 DSA Certificate Test-client
+[48-TLS 1.2 DSA Certificate Test-ssl]
+server = 48-TLS 1.2 DSA Certificate Test-server
+client = 48-TLS 1.2 DSA Certificate Test-client
-[46-TLS 1.2 DSA Certificate Test-server]
+[48-TLS 1.2 DSA Certificate Test-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = ALL
DHParameters = ${ENV::TEST_CERTS_DIR}/dhp2048.pem
@@ -1555,26 +1614,26 @@ MaxProtocol = TLSv1.2
MinProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
-[46-TLS 1.2 DSA Certificate Test-client]
+[48-TLS 1.2 DSA Certificate Test-client]
CipherString = ALL
SignatureAlgorithms = DSA+SHA256:DSA+SHA1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
-[test-46]
+[test-48]
ExpectedResult = Success
# ===========================================================
-[47-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms]
-ssl_conf = 47-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms-ssl
+[49-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms]
+ssl_conf = 49-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms-ssl
-[47-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms-ssl]
-server = 47-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms-server
-client = 47-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms-client
+[49-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms-ssl]
+server = 49-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms-server
+client = 49-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms-client
-[47-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms-server]
+[49-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ClientSignatureAlgorithms = ECDSA+SHA1:DSA+SHA256:RSA+SHA256
@@ -1582,25 +1641,25 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
VerifyMode = Request
-[47-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms-client]
+[49-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms-client]
CipherString = DEFAULT
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
-[test-47]
+[test-49]
ExpectedResult = ServerFail
# ===========================================================
-[48-TLS 1.3 DSA Certificate Test]
-ssl_conf = 48-TLS 1.3 DSA Certificate Test-ssl
+[50-TLS 1.3 DSA Certificate Test]
+ssl_conf = 50-TLS 1.3 DSA Certificate Test-ssl
-[48-TLS 1.3 DSA Certificate Test-ssl]
-server = 48-TLS 1.3 DSA Certificate Test-server
-client = 48-TLS 1.3 DSA Certificate Test-client
+[50-TLS 1.3 DSA Certificate Test-ssl]
+server = 50-TLS 1.3 DSA Certificate Test-server
+client = 50-TLS 1.3 DSA Certificate Test-client
-[48-TLS 1.3 DSA Certificate Test-server]
+[50-TLS 1.3 DSA Certificate Test-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = ALL
DSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-dsa-cert.pem
@@ -1609,13 +1668,13 @@ MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
-[48-TLS 1.3 DSA Certificate Test-client]
+[50-TLS 1.3 DSA Certificate Test-client]
CipherString = ALL
SignatureAlgorithms = DSA+SHA1:DSA+SHA256:ECDSA+SHA256
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
-[test-48]
+[test-50]
ExpectedResult = ServerFail
diff --git a/test/ssl-tests/20-cert-select.conf.in b/test/ssl-tests/20-cert-select.conf.in
index 2038bdf..bdf53c6 100644
--- a/test/ssl-tests/20-cert-select.conf.in
+++ b/test/ssl-tests/20-cert-select.conf.in
@@ -139,6 +139,28 @@ our @tests = (
},
},
{
+ name => "ECDSA with brainpool",
+ server => {
+ "Certificate" => test_pem("server-ecdsa-brainpoolP256r1-cert.pem"),
+ "PrivateKey" => test_pem("server-ecdsa-brainpoolP256r1-key.pem"),
+ "Groups" => "brainpoolP256r1",
+ },
+ client => {
+ #We don't restrict this to TLSv1.2, although use of brainpool
+ #should force this anyway so that this should succeed
+ "CipherString" => "aECDSA",
+ "RequestCAFile" => test_pem("root-cert.pem"),
+ "Groups" => "brainpoolP256r1",
+ },
+ test => {
+ "ExpectedServerCertType" =>, "brainpoolP256r1",
+ "ExpectedServerSignType" =>, "EC",
+ # Note: certificate_authorities not sent for TLS < 1.3
+ "ExpectedServerCANames" =>, "empty",
+ "ExpectedResult" => "Success"
+ },
+ },
+ {
name => "RSA CipherString Selection",
server => $server,
client => {
@@ -762,6 +784,23 @@ my @tests_tls_1_3 = (
"ExpectedResult" => "Success"
},
},
+ {
+ name => "TLS 1.3 ECDSA with brainpool",
+ server => {
+ "Certificate" => test_pem("server-ecdsa-brainpoolP256r1-cert.pem"),
+ "PrivateKey" => test_pem("server-ecdsa-brainpoolP256r1-key.pem"),
+ "Groups" => "brainpoolP256r1",
+ },
+ client => {
+ "RequestCAFile" => test_pem("root-cert.pem"),
+ "Groups" => "brainpoolP256r1",
+ "MinProtocol" => "TLSv1.3",
+ "MaxProtocol" => "TLSv1.3"
+ },
+ test => {
+ "ExpectedResult" => "ServerFail"
+ },
+ },
);
push @tests, @tests_tls_1_3 unless disabled("tls1_3");
More information about the openssl-commits
mailing list