master
ECH: chunk-size bug fix and non-regression changes
x509_acert: Add simple API tests
x509_acert: Add more parsing and printing tests
Limit scope of CN name constraints
Extend mkcert.sh to support nameConstraints generation and more complex subject alternate names.
Add a test for a bogus SMTPUTF8 name constraint in a cert.
Add testcase for nc_match_single type confusion
Test a bad SmtpUTF8Mailbox name constraint
Create some proxy certificates
Add test for CVE-2015-1793
Compat self-signed trust with reject-only aux data
Commit pre-generated test_verify certs
make various test CA certs RFC 5280 compliant w.r.t. X509 extensions
Move peer chain security checks into x509_vfy.c
Disallow certs with explicit curve in verification chain
Generate some certificates with the certificatePolicies extension
check_sig_alg_match(): weaken sig nid comparison to allow RSA{,PSS} key verify RSA-PSS
test/certs/setup.sh: Fix two glitches
test_pem_reading: Test loading a key from a file with multiple PEM data
Add Ed25519 EE certificates
Update tests for TLS Ed448
Enable setting SSL_CERT_FLAG_TLS_STRICT with ssl config
Test for DANE cross cert fix
Create a new embeddedSCTs1 that's signed using SHA256
Added test for CVE-2026-28388
Change hexdump width to a multiple of 8 bytes
test/x509: Test for issuer being overwritten when printing.
Switch command-line utils to new nameopt API.
Reject delta CRLs as complete CRL candidates
TEST: Prefer using precomputed RSA and DH keys for more efficient tests
test_ssl_new: X448, X25519, and EdDSA are supported with fips
d2i_PrivateKey{,_ex}() and PEM_X509_INFO_read_bio_ex(): Fix handling of RSA/DSA/EC private key
ECH external APIs
Add some additional test certificates/keys
Implement treatment of id-pkix-ocsp-no-check extension for OCSP_basic_verify()
Fix DSA with SHA-384 / SHA-512 X.509 verification (issue openssl#30432)
test: add verify test for EC cert signed with SHA3
Update client authentication tests
X509: add tests for purpose code signing in verify application
Add ECDSA client certificates
Update the validity period of ed25519 cerificates
Bring in boundary test from #28584
update test/certs/ee-pathlen.pem to contain SKID and AKID
Add certificates with PSS signatures
Add test for ASN1_item_verify()
ee-self-signed.pem: Restore original version, adding -attime to 25-test_verify.t
25-test_verify.t: Add test case: accept trusted self-signed EE cert with key usage keyCertSign also when strict
Add test cases for verification of time stamping certificates
Change the SCT issuer key to RSA 2048
Tests for parsing and printing certificates containing SCTs
CT policy validation
test: aAissuingDistributionPoint X.509v3 extension
test: add tests for acceptable policies exts
test: allowedAttributeAssignments X.509v3 extension
Support subjectDirectoryAttributes and associatedInformation exts
test: the attributeDescriptor X.509v3 extension
test: the attributeMappings X.509v3 extension
test: auditIdentity X.509v3 extension decoding and display
test: authorityAttributeIdentifier X.509v3 extension
test: the basicAttConstraints X.509v3 extension
25-test_req.t: Add systematic SKID+AKID tests for self-issued (incl. self-signed) certs
feat: add delegatedNameConstraints and holderNameConstraints exts
Support all NULL-syntax X.509v3 extensions
test: issuedOnBehalfOf X.509v3 extension
test: the roleSpecCertIdentifier X.509v3 extension
Add support for targetingInformation X.509v3 extension
test: the timeSpecification X.509v3 extension
x509: fix bug in timeSpecification printing
test: userNotice X.509v3 extension
Add support for unusal 'othername' subjectAltNames
Add a new Name Constraints test cert
Add a TLS test for name constraints with an EE cert without a SAN
Issuer Sign Tool extention support
X509_cmp(): Fix comparison in case x509v3_cache_extensions() failed to due to invalid cert
PEM_X509_INFO_read_bio_ex(): Generalize to allow parsing any type of private key
Fix NULL access in ssl_build_cert_chain() when ctx is NULL.
fips: Align PKCS5_PBKDF2_HMAC defaults with EVP_KDF-PBKDF2
Guard against DoS in name constraints handling.
Fixed missing subjectAltName when issuing a cert with mkcert.sh genee
x509: allow SAN URIs to contain userinfo
Add tests for non-ca trusted roots and intermediates
Fix sigalg corner cases
Add P-384 root and P-384, P-256 EE certificates.
Add some accessor API's
test: add test case for deadlock reported in #19643
Check chain extensions also for trusted certificates
Fix cert with rsa instead of rsaEncryption as public key algorithm
Configure: make C++ build tests optional and configurable
Generate new Ed488 certificates
ML-DSA: Add TLS certificate test
More X509_verify_cert() tests via verify(1).
Resign test/certs/rootCA.pem to expire in 100 years
EC certificate with compression point
Add DH parameters, DSA cert and key
Prune low-level ASN.1 parse errors from error queue in der2key_decode() etc.
Improve TLS handling of EC point formats
Add some test brainpool certificates
add ECDSA test server certificate
Add RSA-PSS test certificates
Add Restricted PSS certificate and key
Update further expiring certificates that affect tests
Support SM2 certificate signing
Add a test for pkeyutl encrypt/decrypt using SM2
Support raw input data in apps/pkeyutl
apps: Escape control characters in DNs by default
Rename the "timing" program to "timing_load_creds" and integrate it with test/build.info
apps: make use of OSSL_STORE for generalized certs and CRLs loading
Add test cases for X509_check_private_key
Make x509_req_test ANSI Compatible