master
Fix DSA with SHA-384 / SHA-512 X.509 verification (issue openssl#30432)
Test for CVE-2026-42766
Add config_diagnostics to our configuration files.
add test for CVE-2016-7053
Fix false success on zero BIO write
Remove remaining atoi()/atol() calls
s_server: test ocsp with "-cert_chain"
Copyright year updates
Port script_34
evp_test: condition CTR-DRBG tests on FIPS version when the df is not used
Implement KEMRecipientInfo (RFC9629) in CMS
Test for CVE-2026-45447 (UAF in PKCS7_verify)
Improve TLS handling of EC point formats
Add BIO bss_file test
Changed the default value of the "ess_cert_id_alg" option
Additonal removals of engine references in tests/*
Correct the instructions for how to run the krb5 external test.
mfail: add sampled and count-only modes to test driver
Update documentation using enable-ssl3 Configure flags
Following the license change, modify the boilerplates in test/
4.0-POST-CLANG-FORMAT-WEBKIT
RSA: Update RSA keygen.
aes_wrap: prevent crash on update without a key
Constify return value of X509_get_X509_PUBKEY()
Don't raise NOT_ENOUGH_DATA on a clean EOF at an object boundary
Missed a spot!
Add parentheses around sizeof arguments
Convert internal use of ASN1_STRING_set and ASN1_STRING_length
Fix broken hex data by reformatting
Use proper compiler features abstraction for older compilers
Eliminate unnecessary type casts of int constants
Fix C99 printf length modifiers with VS2013 CRT
Add mfail test for new BIO dgram mem
Fix BIO_write on file BIOs to report partial writes.
Fixes Coverity issue CID 1681693
test: respect disabled IPv6 in bio_tfo_test
tests: Check the return value of BN_hex2bn()
Fix double-free of tlsmac in cipher dupctx implementations
Remove unused crl_dir setting from config files
test: Invert bad TEST() condition calls
Move *_arch.h to include/arch
test: add regression test for ciphersuite_cb() with empty list elements
cmp_client_test.c: fix partly too generous total_timeout limit for IR session with polling
CMP: Optionally accept missing or non-matching transactionID or recipNonce values
CMS/PKCS7: use EVP_CIPHER_fetch() for SMIMECapabilities
Update copyright year
x509: add delta CRL success test
Add constant-time validation for CRYPTO_memcmp
Add CTLOG_STORE_add0_log() to add CTLOGs to a store programmatically
Apply the correct Apache v2 license
Eliminate/fix repeated word usage
Add last missing TLSA usage/selector/mtype test case
DANE support for X509_verify_cert()
TEST: Make our test data binary
Remove the external BoringSSL test
Encap/decap in pkeyutl - tests
Make the activate setting more intuitive
jitter: add a new provider containing a jitter entropy source alone
EVP_get_default_properties - tests
Add test for recordpadding
fips: Bring back FIPS_mode() as a define
Remove internal-only DRBG_STATUS enum
TEST: Add DTLS 1.2 coverage for Session ID verification
Fix no-dtls1_2 test failure
Use %zu for printing size_t values
Reject unknown TLS 1.3 ServerHello extensions
LMS, DH: harden empty fromdata
Add engine stubs test
evp_get_digest/cipherbyname_ex(): Try to fetch if not found
Reject clearly degenerate RSASVE parameters.
Expand and refactor test_evp_extra2
Enforce mandatory cipher get_params at dispatch parse
test/evp_kdf_test.c: add checks or EVP_KDF_CTX_{,get0_,get1_}kdf()
Testing the EVP_PKEY_CTX_new_from_name without preliminary init
Derive EC public key from private key if missing
Implement RFC 8701 GREASE for TLS ClientHello
test: support key options in the fake cipher provider
test: add evp_extra_test case for cipher pipeline API with fake pipeline provider
Add a few more ASN.1 related StatementMacros
Fix EVP_PKEY_can_sign() handling of NULL from query_operation_name()
test/ffc_internal_test.c: The ffc_params_copy_mfail test needs DSA enabled
provider: add an unquery function to allow providers to clean up.
Add some testing for the case where the FIPS provider fails to load
test: note that a default property query must be included for FIPS validity
test/{handshake-,load_key_certs_crls_,x509_}memfail.c: count allocs properly
Remove parentheses around return arguments
Move const qualifier after static
Remove executable mode attributes of non-executable files
Validate config options during x509 extension creation
Fix macro staircase formatting issue
CONF: Add support for configurations per OSSL_LIB_CTX
Add ossl_list_TYPE_join(head, tail) function
Add base code to load a LMS public key.
Add LMS evp_test using NIST ACVP test data.
Constify the return value of X509_get0_pubkey_bitstr()
Disable clang format around .c includes
test/mem_alloc_test.c: fix my_malloc/my_realloc behaviour on size == 0
Fix of EOF and retry handling in BIO implementations
Add valgrind CT support to ML-DSA
Once initialised, ML-DSA keys should be immutable
ml_kem: return an error on catastrophic failure in decap
Left over doc TODOs
ML-DSA Add Wycheproof test vectors.
ML-KEM: Modify existing ML-KEM keygen tests to not use custom data.
Add various MFAIL tests to excercise ht insert
fix module extension on non-.so platforms
Add a test for no initialisation of the default config file
Deprecate ASN1_BIT_STRING_set()
x509: add ocsptest for the OCSP stapled-response verification path
Add test for NULL uri handling in OSSL_STORE_delete()
test/p_ossltest: fix uninitialised bytes written in TLS1-AAD GCM mode
providers/fips/fipsprov.c, test/p_test.c: remove c_gettable_params static global
FIPS: EC keygen - remove unnecessary self tests.
OSSL_PARAM_BLD_push_octet_*(): Allow NULL buffer with 0 bsize
Add regression test for negative EVP_CIPHER_get_iv_length() in PKCS5_pbe2_set_scrypt
Import of old SSLeay release: SSLeay 0.8.1b
fix UB in priority_queue
test: cover quoted property case variants
quic: reject ACK of an unsent packet number
Make test/quic_fc_test.c clang-format friendly
quic: Add MFAIL coverage for stream map allocation and token caching
quic: add mfail test for RCIDM
quic: add mfail test for multi-packet RXE
test: drop no-cached-fetch mfail guards
quic: report SRTM entry match status via an output argument
quic: fix intermittent idle-test failure in tserver test
rand: instantiate the DRBGs upon first use.
rand: factor out seed source creation and fix store race
Detect and prevent recursive config parsing
test: add Windows RIO notifier smoke test
ECDH and ECDSA cannot be really disabled standalone
test/run_tests.pl: return error if running a non-existent test
Require ServerInfo PEMs to be named "BEGIN SERVERINFO FOR"...
Add a SERVERINFOV2 format test file
test: add SHAKE x4 internal cross-validation tests
Add PKCS#12 UTF-8 interoperability test.
Fix DSO symbol test with MINGW64 and pedantic warnings
slhdsa: add Python script to convert NIST ACVP data to evp_test format
apps/cms.c: Correct -sign output and -verify input with -binary
test/smcont.txt: trigger assertion in bio_enc.c.
Tests for processing zero-length content in SMIME format
Remove support for SSLv3
test/ssl_test.tmpl: make it work with elderly perl.
Use .cnf for config files, not .conf
Reject TLS 1.3 early data when PSK ciphersuite differs
Fix typos
Add stack test for thunked sorted lookup
Fix missing NULL check in statem_clnt_construct_test
test/strtoultest: add coverage for ossl_strtol, ossl_strtoint and test_strtoint
ssl: Fix ssl_do_config to clean up errors on success with ERR_set_mark
Fix a possible crash in ASN1_generate_nconf
Harden asn1 oid loader to invalid inputs
Add private/public key conversion tests
TEST: Check property query support of apps/pkey
fix SM2 privatekey decode(PEM format, ECPrivateKey).
More testing for CLI usage of Ed25519 and Ed448 keys
dgst commandline support for one shot signing algorithms
Change PKCS#7 test data to take account of removal of indefinite length encoding.
Support writing RSA keys using the traditional format again
Add fips checks for rsa encryption
Test that signatures using hash name commands work properly
Tests for creating req from PKCS8 keys with extra attrs
rsa_kmgmt: Return OSSL_PKEY_PARAM_DEFAULT_DIGEST for unrestricted PSS keys
RSA: properly generate algorithm identifier for RSA-PSS signatures
Regenerate testsid.pem
Extend X509 cert checks and error reporting in v3_{purp,crld}.c and x509_{set,vfy}.c
Add a test for converting OSSL_TIME to struct timeval
Make sure we always check return of CRYPTO_UP_REF which can fail.
Removes unused args for new record layers.
test/tls13tickettest.c: check SSL_TICKET_NO_DECRYPT path in tls_parse_ctos_psk()
Extend TLS group list parser test cases
make various test CA certs RFC 5280 compliant w.r.t. X509 extensions
Add valid single field tests
Rework v3nametest for SAN-first matching, add flag and long-name coverage
Fix CMS Ed448 signer NULL digest handling
x509: replace x509_memfail with in-tree mfail tests
Fix memory leak in x509_req_test