Commit dcf8b01f44c4dc5f76ea72093261b61d8a34601b - openssl

Tolerate a Certificate using a non-supported group on server side If a server has been configured to use an ECDSA certificate, we should allow it regardless of whether the server's own supported groups list includes the certificate's group. Fixes #2033 Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/5601) Matt Caswell 6 years ago

5 changed file(s) with 882 addition(s) and 766 deletion(s). Raw diff Collapse all Expand all

-1

ssl/ssl_locl.h less more

2452	2452	# ifndef OPENSSL_NO_EC
2453	2453
2454	2454	__owur const TLS_GROUP_INFO *tls1_group_id_lookup(uint16_t curve_id);
2455		__owur int tls1_check_group_id(SSL *s, uint16_t group_id);
	2455	__owur int tls1_check_group_id(SSL *s, uint16_t group_id, int check_own_curves);
2456	2456	__owur uint16_t tls1_shared_group(SSL *s, int nmatch);
2457	2457	__owur int tls1_set_groups(uint16_t *pext, size_t pextlen,
2458	2458	int *curves, size_t ncurves);

-1

ssl/statem/statem_clnt.c less more

2191	2191	* Check curve is named curve type and one of our preferences, if not
2192	2192	* server has sent an invalid curve.
2193	2193	*/
2194		if (curve_type != NAMED_CURVE_TYPE \|\| !tls1_check_group_id(s, curve_id)) {
	2194	if (curve_type != NAMED_CURVE_TYPE
	2195	\|\| !tls1_check_group_id(s, curve_id, 1)) {
2195	2196	SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PROCESS_SKE_ECDHE,
2196	2197	SSL_R_WRONG_CURVE);
2197	2198	return 0;

+15

-9

ssl/t1_lib.c less more

466	466	}
467	467
468	468	/* Check a group id matches preferences */
469		int tls1_check_group_id(SSL *s, uint16_t group_id)
	469	int tls1_check_group_id(SSL *s, uint16_t group_id, int check_own_groups)
470	470	{
471	471	const uint16_t *groups;
472	472	size_t groups_len;

490	490	}
491	491	}
492	492
493		/* Check group is one of our preferences */
494		tls1_get_supported_groups(s, &groups, &groups_len);
495		if (!tls1_in_list(group_id, groups, groups_len))
496		return 0;
	493	if (check_own_groups) {
	494	/* Check group is one of our preferences */
	495	tls1_get_supported_groups(s, &groups, &groups_len);
	496	if (!tls1_in_list(group_id, groups, groups_len))
	497	return 0;
	498	}
497	499
498	500	if (!tls_curve_allowed(s, group_id, SSL_SECOP_CURVE_CHECK))
499	501	return 0;

553	555	if (!tls1_check_pkey_comp(s, pkey))
554	556	return 0;
555	557	group_id = tls1_get_group_id(pkey);
556		if (!tls1_check_group_id(s, group_id))
	558	/*
	559	* For a server we allow the certificate to not be in our list of supported
	560	* groups.
	561	*/
	562	if (!tls1_check_group_id(s, group_id, !s->server))
557	563	return 0;
558	564	/*
559	565	* Special case for suite B. We MUST sign using SHA256+P-256 or

600	606	* curves permitted.
601	607	*/
602	608	if (cid == TLS1_CK_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256)
603		return tls1_check_group_id(s, TLSEXT_curve_P_256);
	609	return tls1_check_group_id(s, TLSEXT_curve_P_256, 1);
604	610	if (cid == TLS1_CK_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384)
605		return tls1_check_group_id(s, TLSEXT_curve_P_384);
	611	return tls1_check_group_id(s, TLSEXT_curve_P_384, 1);
606	612
607	613	return 0;
608	614	}

978	984	}
979	985	if (!SSL_IS_TLS13(s)) {
980	986	/* Check curve matches extensions */
981		if (!tls1_check_group_id(s, tls1_get_group_id(pkey))) {
	987	if (!tls1_check_group_id(s, tls1_get_group_id(pkey), 1)) {
982	988	SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER,
983	989	SSL_F_TLS12_CHECK_PEER_SIGALG, SSL_R_WRONG_CURVE);
984	990	return 0;

+820

-755

test/ssl-tests/20-cert-select.conf less more

0	0	# Generated with generate_ssl_tests.pl
1	1
2		num_tests = 45
	2	num_tests = 47
3	3
4	4	test-0 = 0-ECDSA CipherString Selection
5		test-1 = 1-Ed25519 CipherString and Signature Algorithm Selection
6		test-2 = 2-Ed448 CipherString and Signature Algorithm Selection
7		test-3 = 3-RSA CipherString Selection
8		test-4 = 4-RSA-PSS Certificate CipherString Selection
9		test-5 = 5-P-256 CipherString and Signature Algorithm Selection
10		test-6 = 6-Ed25519 CipherString and Curves Selection
11		test-7 = 7-Ed448 CipherString and Curves Selection
12		test-8 = 8-ECDSA CipherString Selection, no ECDSA certificate
13		test-9 = 9-ECDSA Signature Algorithm Selection
14		test-10 = 10-ECDSA Signature Algorithm Selection SHA384
15		test-11 = 11-ECDSA Signature Algorithm Selection SHA1
16		test-12 = 12-ECDSA Signature Algorithm Selection compressed point
17		test-13 = 13-ECDSA Signature Algorithm Selection, no ECDSA certificate
18		test-14 = 14-RSA Signature Algorithm Selection
19		test-15 = 15-RSA-PSS Signature Algorithm Selection
20		test-16 = 16-RSA-PSS Certificate Legacy Signature Algorithm Selection
21		test-17 = 17-RSA-PSS Certificate Unified Signature Algorithm Selection
22		test-18 = 18-Only RSA-PSS Certificate
23		test-19 = 19-RSA-PSS Certificate, no PSS signature algorithms
24		test-20 = 20-Suite B P-256 Hash Algorithm Selection
25		test-21 = 21-Suite B P-384 Hash Algorithm Selection
26		test-22 = 22-TLS 1.2 Ed25519 Client Auth
27		test-23 = 23-TLS 1.2 Ed448 Client Auth
28		test-24 = 24-Only RSA-PSS Certificate, TLS v1.1
29		test-25 = 25-TLS 1.3 ECDSA Signature Algorithm Selection
30		test-26 = 26-TLS 1.3 ECDSA Signature Algorithm Selection compressed point
31		test-27 = 27-TLS 1.3 ECDSA Signature Algorithm Selection SHA1
32		test-28 = 28-TLS 1.3 ECDSA Signature Algorithm Selection with PSS
33		test-29 = 29-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS
34		test-30 = 30-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate
35		test-31 = 31-TLS 1.3 RSA Signature Algorithm Selection, no PSS
36		test-32 = 32-TLS 1.3 RSA-PSS Signature Algorithm Selection
37		test-33 = 33-TLS 1.3 Ed25519 Signature Algorithm Selection
38		test-34 = 34-TLS 1.3 Ed448 Signature Algorithm Selection
39		test-35 = 35-TLS 1.3 Ed25519 CipherString and Groups Selection
40		test-36 = 36-TLS 1.3 Ed448 CipherString and Groups Selection
41		test-37 = 37-TLS 1.3 RSA Client Auth Signature Algorithm Selection
42		test-38 = 38-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names
43		test-39 = 39-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection
44		test-40 = 40-TLS 1.3 Ed25519 Client Auth
45		test-41 = 41-TLS 1.3 Ed448 Client Auth
46		test-42 = 42-TLS 1.2 DSA Certificate Test
47		test-43 = 43-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms
48		test-44 = 44-TLS 1.3 DSA Certificate Test
	5	test-1 = 1-ECDSA CipherString Selection
	6	test-2 = 2-ECDSA CipherString Selection
	7	test-3 = 3-Ed25519 CipherString and Signature Algorithm Selection
	8	test-4 = 4-Ed448 CipherString and Signature Algorithm Selection
	9	test-5 = 5-RSA CipherString Selection
	10	test-6 = 6-RSA-PSS Certificate CipherString Selection
	11	test-7 = 7-P-256 CipherString and Signature Algorithm Selection
	12	test-8 = 8-Ed25519 CipherString and Curves Selection
	13	test-9 = 9-Ed448 CipherString and Curves Selection
	14	test-10 = 10-ECDSA CipherString Selection, no ECDSA certificate
	15	test-11 = 11-ECDSA Signature Algorithm Selection
	16	test-12 = 12-ECDSA Signature Algorithm Selection SHA384
	17	test-13 = 13-ECDSA Signature Algorithm Selection SHA1
	18	test-14 = 14-ECDSA Signature Algorithm Selection compressed point
	19	test-15 = 15-ECDSA Signature Algorithm Selection, no ECDSA certificate
	20	test-16 = 16-RSA Signature Algorithm Selection
	21	test-17 = 17-RSA-PSS Signature Algorithm Selection
	22	test-18 = 18-RSA-PSS Certificate Legacy Signature Algorithm Selection
	23	test-19 = 19-RSA-PSS Certificate Unified Signature Algorithm Selection
	24	test-20 = 20-Only RSA-PSS Certificate
	25	test-21 = 21-RSA-PSS Certificate, no PSS signature algorithms
	26	test-22 = 22-Suite B P-256 Hash Algorithm Selection
	27	test-23 = 23-Suite B P-384 Hash Algorithm Selection
	28	test-24 = 24-TLS 1.2 Ed25519 Client Auth
	29	test-25 = 25-TLS 1.2 Ed448 Client Auth
	30	test-26 = 26-Only RSA-PSS Certificate, TLS v1.1
	31	test-27 = 27-TLS 1.3 ECDSA Signature Algorithm Selection
	32	test-28 = 28-TLS 1.3 ECDSA Signature Algorithm Selection compressed point
	33	test-29 = 29-TLS 1.3 ECDSA Signature Algorithm Selection SHA1
	34	test-30 = 30-TLS 1.3 ECDSA Signature Algorithm Selection with PSS
	35	test-31 = 31-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS
	36	test-32 = 32-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate
	37	test-33 = 33-TLS 1.3 RSA Signature Algorithm Selection, no PSS
	38	test-34 = 34-TLS 1.3 RSA-PSS Signature Algorithm Selection
	39	test-35 = 35-TLS 1.3 Ed25519 Signature Algorithm Selection
	40	test-36 = 36-TLS 1.3 Ed448 Signature Algorithm Selection
	41	test-37 = 37-TLS 1.3 Ed25519 CipherString and Groups Selection
	42	test-38 = 38-TLS 1.3 Ed448 CipherString and Groups Selection
	43	test-39 = 39-TLS 1.3 RSA Client Auth Signature Algorithm Selection
	44	test-40 = 40-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names
	45	test-41 = 41-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection
	46	test-42 = 42-TLS 1.3 Ed25519 Client Auth
	47	test-43 = 43-TLS 1.3 Ed448 Client Auth
	48	test-44 = 44-TLS 1.2 DSA Certificate Test
	49	test-45 = 45-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms
	50	test-46 = 46-TLS 1.3 DSA Certificate Test
49	51	# ===========================================================
50	52
51	53	[0-ECDSA CipherString Selection]

83	85
84	86	# ===========================================================
85	87
86		[1-Ed25519 CipherString and Signature Algorithm Selection]
87		ssl_conf = 1-Ed25519 CipherString and Signature Algorithm Selection-ssl
88
89		[1-Ed25519 CipherString and Signature Algorithm Selection-ssl]
90		server = 1-Ed25519 CipherString and Signature Algorithm Selection-server
91		client = 1-Ed25519 CipherString and Signature Algorithm Selection-client
92
93		[1-Ed25519 CipherString and Signature Algorithm Selection-server]
94		Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
95		CipherString = DEFAULT
96		ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
97		ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
98		Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
99		Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
100		Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem
101		Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
102		MaxProtocol = TLSv1.2
103		PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
104
105		[1-Ed25519 CipherString and Signature Algorithm Selection-client]
	88	[1-ECDSA CipherString Selection]
	89	ssl_conf = 1-ECDSA CipherString Selection-ssl
	90
	91	[1-ECDSA CipherString Selection-ssl]
	92	server = 1-ECDSA CipherString Selection-server
	93	client = 1-ECDSA CipherString Selection-client
	94
	95	[1-ECDSA CipherString Selection-server]
	96	Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
	97	CipherString = DEFAULT
	98	ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
	99	ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
	100	Groups = P-384
	101	MaxProtocol = TLSv1.2
	102	PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
	103
	104	[1-ECDSA CipherString Selection-client]
	105	CipherString = aECDSA
	106	Groups = P-256:P-384
	107	MaxProtocol = TLSv1.2
	108	RequestCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
	109	VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
	110	VerifyMode = Peer
	111
	112	[test-1]
	113	ExpectedResult = Success
	114	ExpectedServerCANames = empty
	115	ExpectedServerCertType = P-256
	116	ExpectedServerSignType = EC
	117
	118
	119	# ===========================================================
	120
	121	[2-ECDSA CipherString Selection]
	122	ssl_conf = 2-ECDSA CipherString Selection-ssl
	123
	124	[2-ECDSA CipherString Selection-ssl]
	125	server = 2-ECDSA CipherString Selection-server
	126	client = 2-ECDSA CipherString Selection-client
	127
	128	[2-ECDSA CipherString Selection-server]
	129	Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
	130	CipherString = DEFAULT
	131	ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
	132	ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
	133	Groups = P-256:P-384
	134	MaxProtocol = TLSv1.2
	135	PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
	136
	137	[2-ECDSA CipherString Selection-client]
	138	CipherString = aECDSA
	139	Groups = P-384
	140	MaxProtocol = TLSv1.2
	141	RequestCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
	142	VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
	143	VerifyMode = Peer
	144
	145	[test-2]
	146	ExpectedResult = ServerFail
	147
	148
	149	# ===========================================================
	150
	151	[3-Ed25519 CipherString and Signature Algorithm Selection]
	152	ssl_conf = 3-Ed25519 CipherString and Signature Algorithm Selection-ssl
	153
	154	[3-Ed25519 CipherString and Signature Algorithm Selection-ssl]
	155	server = 3-Ed25519 CipherString and Signature Algorithm Selection-server
	156	client = 3-Ed25519 CipherString and Signature Algorithm Selection-client
	157
	158	[3-Ed25519 CipherString and Signature Algorithm Selection-server]
	159	Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
	160	CipherString = DEFAULT
	161	ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
	162	ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
	163	Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
	164	Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
	165	Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem
	166	Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
	167	MaxProtocol = TLSv1.2
	168	PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
	169
	170	[3-Ed25519 CipherString and Signature Algorithm Selection-client]
106	171	CipherString = aECDSA
107	172	MaxProtocol = TLSv1.2
108	173	RequestCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem

110	175	VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
111	176	VerifyMode = Peer
112	177
113		[test-1]
	178	[test-3]
114	179	ExpectedResult = Success
115	180	ExpectedServerCANames = empty
116	181	ExpectedServerCertType = Ed25519

119	184
120	185	# ===========================================================
121	186
122		[2-Ed448 CipherString and Signature Algorithm Selection]
123		ssl_conf = 2-Ed448 CipherString and Signature Algorithm Selection-ssl
124
125		[2-Ed448 CipherString and Signature Algorithm Selection-ssl]
126		server = 2-Ed448 CipherString and Signature Algorithm Selection-server
127		client = 2-Ed448 CipherString and Signature Algorithm Selection-client
128
129		[2-Ed448 CipherString and Signature Algorithm Selection-server]
130		Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
131		CipherString = DEFAULT
132		ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
133		ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
134		Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
135		Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
136		Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem
137		Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
138		MaxProtocol = TLSv1.2
139		PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
140
141		[2-Ed448 CipherString and Signature Algorithm Selection-client]
	187	[4-Ed448 CipherString and Signature Algorithm Selection]
	188	ssl_conf = 4-Ed448 CipherString and Signature Algorithm Selection-ssl
	189
	190	[4-Ed448 CipherString and Signature Algorithm Selection-ssl]
	191	server = 4-Ed448 CipherString and Signature Algorithm Selection-server
	192	client = 4-Ed448 CipherString and Signature Algorithm Selection-client
	193
	194	[4-Ed448 CipherString and Signature Algorithm Selection-server]
	195	Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
	196	CipherString = DEFAULT
	197	ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
	198	ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
	199	Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
	200	Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
	201	Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem
	202	Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
	203	MaxProtocol = TLSv1.2
	204	PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
	205
	206	[4-Ed448 CipherString and Signature Algorithm Selection-client]
142	207	CipherString = aECDSA
143	208	MaxProtocol = TLSv1.2
144	209	RequestCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem

146	211	VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
147	212	VerifyMode = Peer
148	213
149		[test-2]
	214	[test-4]
150	215	ExpectedResult = Success
151	216	ExpectedServerCANames = empty
152	217	ExpectedServerCertType = Ed448

155	220
156	221	# ===========================================================
157	222
158		[3-RSA CipherString Selection]
159		ssl_conf = 3-RSA CipherString Selection-ssl
160
161		[3-RSA CipherString Selection-ssl]
162		server = 3-RSA CipherString Selection-server
163		client = 3-RSA CipherString Selection-client
164
165		[3-RSA CipherString Selection-server]
166		Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
167		CipherString = DEFAULT
168		ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
169		ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
170		Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
171		Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
172		Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem
173		Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
174		MaxProtocol = TLSv1.2
175		PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
176
177		[3-RSA CipherString Selection-client]
	223	[5-RSA CipherString Selection]
	224	ssl_conf = 5-RSA CipherString Selection-ssl
	225
	226	[5-RSA CipherString Selection-ssl]
	227	server = 5-RSA CipherString Selection-server
	228	client = 5-RSA CipherString Selection-client
	229
	230	[5-RSA CipherString Selection-server]
	231	Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
	232	CipherString = DEFAULT
	233	ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
	234	ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
	235	Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
	236	Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
	237	Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem
	238	Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
	239	MaxProtocol = TLSv1.2
	240	PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
	241
	242	[5-RSA CipherString Selection-client]
178	243	CipherString = aRSA
179	244	MaxProtocol = TLSv1.2
180	245	VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
181	246	VerifyMode = Peer
182	247
183		[test-3]
	248	[test-5]
184	249	ExpectedResult = Success
185	250	ExpectedServerCertType = RSA
186	251	ExpectedServerSignType = RSA-PSS

188	253
189	254	# ===========================================================
190	255
191		[4-RSA-PSS Certificate CipherString Selection]
192		ssl_conf = 4-RSA-PSS Certificate CipherString Selection-ssl
193
194		[4-RSA-PSS Certificate CipherString Selection-ssl]
195		server = 4-RSA-PSS Certificate CipherString Selection-server
196		client = 4-RSA-PSS Certificate CipherString Selection-client
197
198		[4-RSA-PSS Certificate CipherString Selection-server]
	256	[6-RSA-PSS Certificate CipherString Selection]
	257	ssl_conf = 6-RSA-PSS Certificate CipherString Selection-ssl
	258
	259	[6-RSA-PSS Certificate CipherString Selection-ssl]
	260	server = 6-RSA-PSS Certificate CipherString Selection-server
	261	client = 6-RSA-PSS Certificate CipherString Selection-client
	262
	263	[6-RSA-PSS Certificate CipherString Selection-server]
199	264	Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
200	265	CipherString = DEFAULT
201	266	ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem

209	274	PSS.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-pss-key.pem
210	275	PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
211	276
212		[4-RSA-PSS Certificate CipherString Selection-client]
	277	[6-RSA-PSS Certificate CipherString Selection-client]
213	278	CipherString = aRSA
214	279	MaxProtocol = TLSv1.2
215	280	VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
216	281	VerifyMode = Peer
217	282
218		[test-4]
	283	[test-6]
219	284	ExpectedResult = Success
220	285	ExpectedServerCertType = RSA-PSS
221	286	ExpectedServerSignType = RSA-PSS

223	288
224	289	# ===========================================================
225	290
226		[5-P-256 CipherString and Signature Algorithm Selection]
227		ssl_conf = 5-P-256 CipherString and Signature Algorithm Selection-ssl
228
229		[5-P-256 CipherString and Signature Algorithm Selection-ssl]
230		server = 5-P-256 CipherString and Signature Algorithm Selection-server
231		client = 5-P-256 CipherString and Signature Algorithm Selection-client
232
233		[5-P-256 CipherString and Signature Algorithm Selection-server]
234		Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
235		CipherString = DEFAULT
236		ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
237		ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
238		Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
239		Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
240		Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem
241		Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
242		MaxProtocol = TLSv1.2
243		PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
244
245		[5-P-256 CipherString and Signature Algorithm Selection-client]
	291	[7-P-256 CipherString and Signature Algorithm Selection]
	292	ssl_conf = 7-P-256 CipherString and Signature Algorithm Selection-ssl
	293
	294	[7-P-256 CipherString and Signature Algorithm Selection-ssl]
	295	server = 7-P-256 CipherString and Signature Algorithm Selection-server
	296	client = 7-P-256 CipherString and Signature Algorithm Selection-client
	297
	298	[7-P-256 CipherString and Signature Algorithm Selection-server]
	299	Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
	300	CipherString = DEFAULT
	301	ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
	302	ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
	303	Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
	304	Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
	305	Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem
	306	Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
	307	MaxProtocol = TLSv1.2
	308	PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
	309
	310	[7-P-256 CipherString and Signature Algorithm Selection-client]
246	311	CipherString = aECDSA
247	312	MaxProtocol = TLSv1.2
248	313	SignatureAlgorithms = ECDSA+SHA256:ed25519
249	314	VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
250	315	VerifyMode = Peer
251	316
252		[test-5]
	317	[test-7]
253	318	ExpectedResult = Success
254	319	ExpectedServerCertType = P-256
255	320	ExpectedServerSignHash = SHA256

258	323
259	324	# ===========================================================
260	325
261		[6-Ed25519 CipherString and Curves Selection]
262		ssl_conf = 6-Ed25519 CipherString and Curves Selection-ssl
263
264		[6-Ed25519 CipherString and Curves Selection-ssl]
265		server = 6-Ed25519 CipherString and Curves Selection-server
266		client = 6-Ed25519 CipherString and Curves Selection-client
267
268		[6-Ed25519 CipherString and Curves Selection-server]
269		Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
270		CipherString = DEFAULT
271		ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
272		ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
273		Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
274		Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
275		Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem
276		Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
277		MaxProtocol = TLSv1.2
278		PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
279
280		[6-Ed25519 CipherString and Curves Selection-client]
	326	[8-Ed25519 CipherString and Curves Selection]
	327	ssl_conf = 8-Ed25519 CipherString and Curves Selection-ssl
	328
	329	[8-Ed25519 CipherString and Curves Selection-ssl]
	330	server = 8-Ed25519 CipherString and Curves Selection-server
	331	client = 8-Ed25519 CipherString and Curves Selection-client
	332
	333	[8-Ed25519 CipherString and Curves Selection-server]
	334	Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
	335	CipherString = DEFAULT
	336	ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
	337	ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
	338	Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
	339	Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
	340	Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem
	341	Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
	342	MaxProtocol = TLSv1.2
	343	PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
	344
	345	[8-Ed25519 CipherString and Curves Selection-client]
281	346	CipherString = aECDSA
282	347	Curves = X25519
283	348	MaxProtocol = TLSv1.2

285	350	VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
286	351	VerifyMode = Peer
287	352
288		[test-6]
	353	[test-8]
289	354	ExpectedResult = Success
290	355	ExpectedServerCertType = Ed25519
291	356	ExpectedServerSignType = Ed25519

293	358
294	359	# ===========================================================
295	360
296		[7-Ed448 CipherString and Curves Selection]
297		ssl_conf = 7-Ed448 CipherString and Curves Selection-ssl
298
299		[7-Ed448 CipherString and Curves Selection-ssl]
300		server = 7-Ed448 CipherString and Curves Selection-server
301		client = 7-Ed448 CipherString and Curves Selection-client
302
303		[7-Ed448 CipherString and Curves Selection-server]
304		Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
305		CipherString = DEFAULT
306		ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
307		ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
308		Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
309		Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
310		Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem
311		Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
312		MaxProtocol = TLSv1.2
313		PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
314
315		[7-Ed448 CipherString and Curves Selection-client]
	361	[9-Ed448 CipherString and Curves Selection]
	362	ssl_conf = 9-Ed448 CipherString and Curves Selection-ssl
	363
	364	[9-Ed448 CipherString and Curves Selection-ssl]
	365	server = 9-Ed448 CipherString and Curves Selection-server
	366	client = 9-Ed448 CipherString and Curves Selection-client
	367
	368	[9-Ed448 CipherString and Curves Selection-server]
	369	Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
	370	CipherString = DEFAULT
	371	ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
	372	ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
	373	Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
	374	Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
	375	Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem
	376	Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
	377	MaxProtocol = TLSv1.2
	378	PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
	379
	380	[9-Ed448 CipherString and Curves Selection-client]
316	381	CipherString = aECDSA
317	382	Curves = X448
318	383	MaxProtocol = TLSv1.2

320	385	VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
321	386	VerifyMode = Peer
322	387
323		[test-7]
	388	[test-9]
324	389	ExpectedResult = Success
325	390	ExpectedServerCertType = Ed448
326	391	ExpectedServerSignType = Ed448

328	393
329	394	# ===========================================================
330	395
331		[8-ECDSA CipherString Selection, no ECDSA certificate]
332		ssl_conf = 8-ECDSA CipherString Selection, no ECDSA certificate-ssl
333
334		[8-ECDSA CipherString Selection, no ECDSA certificate-ssl]
335		server = 8-ECDSA CipherString Selection, no ECDSA certificate-server
336		client = 8-ECDSA CipherString Selection, no ECDSA certificate-client
337
338		[8-ECDSA CipherString Selection, no ECDSA certificate-server]
339		Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
340		CipherString = DEFAULT
341		MaxProtocol = TLSv1.2
342		PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
343
344		[8-ECDSA CipherString Selection, no ECDSA certificate-client]
	396	[10-ECDSA CipherString Selection, no ECDSA certificate]
	397	ssl_conf = 10-ECDSA CipherString Selection, no ECDSA certificate-ssl
	398
	399	[10-ECDSA CipherString Selection, no ECDSA certificate-ssl]
	400	server = 10-ECDSA CipherString Selection, no ECDSA certificate-server
	401	client = 10-ECDSA CipherString Selection, no ECDSA certificate-client
	402
	403	[10-ECDSA CipherString Selection, no ECDSA certificate-server]
	404	Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
	405	CipherString = DEFAULT
	406	MaxProtocol = TLSv1.2
	407	PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
	408
	409	[10-ECDSA CipherString Selection, no ECDSA certificate-client]
345	410	CipherString = aECDSA
346	411	MaxProtocol = TLSv1.2
347	412	VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
348	413	VerifyMode = Peer
349	414
350		[test-8]
	415	[test-10]
351	416	ExpectedResult = ServerFail
352	417
353	418
354	419	# ===========================================================
355	420
356		[9-ECDSA Signature Algorithm Selection]
357		ssl_conf = 9-ECDSA Signature Algorithm Selection-ssl
358
359		[9-ECDSA Signature Algorithm Selection-ssl]
360		server = 9-ECDSA Signature Algorithm Selection-server
361		client = 9-ECDSA Signature Algorithm Selection-client
362
363		[9-ECDSA Signature Algorithm Selection-server]
364		Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
365		CipherString = DEFAULT
366		ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
367		ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
368		Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
369		Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
370		Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem
371		Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
372		MaxProtocol = TLSv1.2
373		PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
374
375		[9-ECDSA Signature Algorithm Selection-client]
	421	[11-ECDSA Signature Algorithm Selection]
	422	ssl_conf = 11-ECDSA Signature Algorithm Selection-ssl
	423
	424	[11-ECDSA Signature Algorithm Selection-ssl]
	425	server = 11-ECDSA Signature Algorithm Selection-server
	426	client = 11-ECDSA Signature Algorithm Selection-client
	427
	428	[11-ECDSA Signature Algorithm Selection-server]
	429	Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
	430	CipherString = DEFAULT
	431	ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
	432	ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
	433	Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
	434	Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
	435	Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem
	436	Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
	437	MaxProtocol = TLSv1.2
	438	PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
	439
	440	[11-ECDSA Signature Algorithm Selection-client]
376	441	CipherString = DEFAULT
377	442	SignatureAlgorithms = ECDSA+SHA256
378	443	VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
379	444	VerifyMode = Peer
380	445
381		[test-9]
	446	[test-11]
382	447	ExpectedResult = Success
383	448	ExpectedServerCertType = P-256
384	449	ExpectedServerSignHash = SHA256

387	452
388	453	# ===========================================================
389	454
390		[10-ECDSA Signature Algorithm Selection SHA384]
391		ssl_conf = 10-ECDSA Signature Algorithm Selection SHA384-ssl
392
393		[10-ECDSA Signature Algorithm Selection SHA384-ssl]
394		server = 10-ECDSA Signature Algorithm Selection SHA384-server
395		client = 10-ECDSA Signature Algorithm Selection SHA384-client
396
397		[10-ECDSA Signature Algorithm Selection SHA384-server]
398		Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
399		CipherString = DEFAULT
400		ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
401		ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
402		Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
403		Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
404		Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem
405		Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
406		MaxProtocol = TLSv1.2
407		PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
408
409		[10-ECDSA Signature Algorithm Selection SHA384-client]
	455	[12-ECDSA Signature Algorithm Selection SHA384]
	456	ssl_conf = 12-ECDSA Signature Algorithm Selection SHA384-ssl
	457
	458	[12-ECDSA Signature Algorithm Selection SHA384-ssl]
	459	server = 12-ECDSA Signature Algorithm Selection SHA384-server
	460	client = 12-ECDSA Signature Algorithm Selection SHA384-client
	461
	462	[12-ECDSA Signature Algorithm Selection SHA384-server]
	463	Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
	464	CipherString = DEFAULT
	465	ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
	466	ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
	467	Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
	468	Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
	469	Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem
	470	Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
	471	MaxProtocol = TLSv1.2
	472	PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
	473
	474	[12-ECDSA Signature Algorithm Selection SHA384-client]
410	475	CipherString = DEFAULT
411	476	SignatureAlgorithms = ECDSA+SHA384
412	477	VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
413	478	VerifyMode = Peer
414	479
415		[test-10]
	480	[test-12]
416	481	ExpectedResult = Success
417	482	ExpectedServerCertType = P-256
418	483	ExpectedServerSignHash = SHA384

421	486
422	487	# ===========================================================
423	488
424		[11-ECDSA Signature Algorithm Selection SHA1]
425		ssl_conf = 11-ECDSA Signature Algorithm Selection SHA1-ssl
426
427		[11-ECDSA Signature Algorithm Selection SHA1-ssl]
428		server = 11-ECDSA Signature Algorithm Selection SHA1-server
429		client = 11-ECDSA Signature Algorithm Selection SHA1-client
430
431		[11-ECDSA Signature Algorithm Selection SHA1-server]
432		Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
433		CipherString = DEFAULT
434		ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
435		ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
436		Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
437		Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
438		Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem
439		Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
440		MaxProtocol = TLSv1.2
441		PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
442
443		[11-ECDSA Signature Algorithm Selection SHA1-client]
	489	[13-ECDSA Signature Algorithm Selection SHA1]
	490	ssl_conf = 13-ECDSA Signature Algorithm Selection SHA1-ssl
	491
	492	[13-ECDSA Signature Algorithm Selection SHA1-ssl]
	493	server = 13-ECDSA Signature Algorithm Selection SHA1-server
	494	client = 13-ECDSA Signature Algorithm Selection SHA1-client
	495
	496	[13-ECDSA Signature Algorithm Selection SHA1-server]
	497	Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
	498	CipherString = DEFAULT
	499	ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
	500	ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
	501	Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
	502	Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
	503	Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem
	504	Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
	505	MaxProtocol = TLSv1.2
	506	PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
	507
	508	[13-ECDSA Signature Algorithm Selection SHA1-client]
444	509	CipherString = DEFAULT
445	510	SignatureAlgorithms = ECDSA+SHA1
446	511	VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
447	512	VerifyMode = Peer
448	513
449		[test-11]
	514	[test-13]
450	515	ExpectedResult = Success
451	516	ExpectedServerCertType = P-256
452	517	ExpectedServerSignHash = SHA1

455	520
456	521	# ===========================================================
457	522
458		[12-ECDSA Signature Algorithm Selection compressed point]
459		ssl_conf = 12-ECDSA Signature Algorithm Selection compressed point-ssl
460
461		[12-ECDSA Signature Algorithm Selection compressed point-ssl]
462		server = 12-ECDSA Signature Algorithm Selection compressed point-server
463		client = 12-ECDSA Signature Algorithm Selection compressed point-client
464
465		[12-ECDSA Signature Algorithm Selection compressed point-server]
	523	[14-ECDSA Signature Algorithm Selection compressed point]
	524	ssl_conf = 14-ECDSA Signature Algorithm Selection compressed point-ssl
	525
	526	[14-ECDSA Signature Algorithm Selection compressed point-ssl]
	527	server = 14-ECDSA Signature Algorithm Selection compressed point-server
	528	client = 14-ECDSA Signature Algorithm Selection compressed point-client
	529
	530	[14-ECDSA Signature Algorithm Selection compressed point-server]
466	531	Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
467	532	CipherString = DEFAULT
468	533	ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-cecdsa-cert.pem

470	535	MaxProtocol = TLSv1.2
471	536	PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
472	537
473		[12-ECDSA Signature Algorithm Selection compressed point-client]
	538	[14-ECDSA Signature Algorithm Selection compressed point-client]
474	539	CipherString = DEFAULT
475	540	SignatureAlgorithms = ECDSA+SHA256
476	541	VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
477	542	VerifyMode = Peer
478	543
479		[test-12]
	544	[test-14]
480	545	ExpectedResult = Success
481	546	ExpectedServerCertType = P-256
482	547	ExpectedServerSignHash = SHA256

485	550
486	551	# ===========================================================
487	552
488		[13-ECDSA Signature Algorithm Selection, no ECDSA certificate]
489		ssl_conf = 13-ECDSA Signature Algorithm Selection, no ECDSA certificate-ssl
490
491		[13-ECDSA Signature Algorithm Selection, no ECDSA certificate-ssl]
492		server = 13-ECDSA Signature Algorithm Selection, no ECDSA certificate-server
493		client = 13-ECDSA Signature Algorithm Selection, no ECDSA certificate-client
494
495		[13-ECDSA Signature Algorithm Selection, no ECDSA certificate-server]
496		Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
497		CipherString = DEFAULT
498		MaxProtocol = TLSv1.2
499		PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
500
501		[13-ECDSA Signature Algorithm Selection, no ECDSA certificate-client]
	553	[15-ECDSA Signature Algorithm Selection, no ECDSA certificate]
	554	ssl_conf = 15-ECDSA Signature Algorithm Selection, no ECDSA certificate-ssl
	555
	556	[15-ECDSA Signature Algorithm Selection, no ECDSA certificate-ssl]
	557	server = 15-ECDSA Signature Algorithm Selection, no ECDSA certificate-server
	558	client = 15-ECDSA Signature Algorithm Selection, no ECDSA certificate-client
	559
	560	[15-ECDSA Signature Algorithm Selection, no ECDSA certificate-server]
	561	Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
	562	CipherString = DEFAULT
	563	MaxProtocol = TLSv1.2
	564	PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
	565
	566	[15-ECDSA Signature Algorithm Selection, no ECDSA certificate-client]
502	567	CipherString = DEFAULT
503	568	SignatureAlgorithms = ECDSA+SHA256
504	569	VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
505	570	VerifyMode = Peer
506	571
507		[test-13]
	572	[test-15]
508	573	ExpectedResult = ServerFail
509	574
510	575
511	576	# ===========================================================
512	577
513		[14-RSA Signature Algorithm Selection]
514		ssl_conf = 14-RSA Signature Algorithm Selection-ssl
515
516		[14-RSA Signature Algorithm Selection-ssl]
517		server = 14-RSA Signature Algorithm Selection-server
518		client = 14-RSA Signature Algorithm Selection-client
519
520		[14-RSA Signature Algorithm Selection-server]
521		Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
522		CipherString = DEFAULT
523		ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
524		ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
525		Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
526		Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
527		Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem
528		Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
529		MaxProtocol = TLSv1.2
530		PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
531
532		[14-RSA Signature Algorithm Selection-client]
	578	[16-RSA Signature Algorithm Selection]
	579	ssl_conf = 16-RSA Signature Algorithm Selection-ssl
	580
	581	[16-RSA Signature Algorithm Selection-ssl]
	582	server = 16-RSA Signature Algorithm Selection-server
	583	client = 16-RSA Signature Algorithm Selection-client
	584
	585	[16-RSA Signature Algorithm Selection-server]
	586	Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
	587	CipherString = DEFAULT
	588	ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
	589	ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
	590	Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
	591	Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
	592	Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem
	593	Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
	594	MaxProtocol = TLSv1.2
	595	PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
	596
	597	[16-RSA Signature Algorithm Selection-client]
533	598	CipherString = DEFAULT
534	599	SignatureAlgorithms = RSA+SHA256
535	600	VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
536	601	VerifyMode = Peer
537	602
538		[test-14]
	603	[test-16]
539	604	ExpectedResult = Success
540	605	ExpectedServerCertType = RSA
541	606	ExpectedServerSignHash = SHA256

544	609
545	610	# ===========================================================
546	611
547		[15-RSA-PSS Signature Algorithm Selection]
548		ssl_conf = 15-RSA-PSS Signature Algorithm Selection-ssl
549
550		[15-RSA-PSS Signature Algorithm Selection-ssl]
551		server = 15-RSA-PSS Signature Algorithm Selection-server
552		client = 15-RSA-PSS Signature Algorithm Selection-client
553
554		[15-RSA-PSS Signature Algorithm Selection-server]
555		Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
556		CipherString = DEFAULT
557		ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
558		ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
559		Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
560		Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
561		Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem
562		Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
563		MaxProtocol = TLSv1.2
564		PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
565
566		[15-RSA-PSS Signature Algorithm Selection-client]
	612	[17-RSA-PSS Signature Algorithm Selection]
	613	ssl_conf = 17-RSA-PSS Signature Algorithm Selection-ssl
	614
	615	[17-RSA-PSS Signature Algorithm Selection-ssl]
	616	server = 17-RSA-PSS Signature Algorithm Selection-server
	617	client = 17-RSA-PSS Signature Algorithm Selection-client
	618
	619	[17-RSA-PSS Signature Algorithm Selection-server]
	620	Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
	621	CipherString = DEFAULT
	622	ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
	623	ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
	624	Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
	625	Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
	626	Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem
	627	Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
	628	MaxProtocol = TLSv1.2
	629	PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
	630
	631	[17-RSA-PSS Signature Algorithm Selection-client]
567	632	CipherString = DEFAULT
568	633	SignatureAlgorithms = RSA-PSS+SHA256
569	634	VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
570	635	VerifyMode = Peer
571	636
572		[test-15]
	637	[test-17]
573	638	ExpectedResult = Success
574	639	ExpectedServerCertType = RSA
575	640	ExpectedServerSignHash = SHA256

578	643
579	644	# ===========================================================
580	645
581		[16-RSA-PSS Certificate Legacy Signature Algorithm Selection]
582		ssl_conf = 16-RSA-PSS Certificate Legacy Signature Algorithm Selection-ssl
583
584		[16-RSA-PSS Certificate Legacy Signature Algorithm Selection-ssl]
585		server = 16-RSA-PSS Certificate Legacy Signature Algorithm Selection-server
586		client = 16-RSA-PSS Certificate Legacy Signature Algorithm Selection-client
587
588		[16-RSA-PSS Certificate Legacy Signature Algorithm Selection-server]
	646	[18-RSA-PSS Certificate Legacy Signature Algorithm Selection]
	647	ssl_conf = 18-RSA-PSS Certificate Legacy Signature Algorithm Selection-ssl
	648
	649	[18-RSA-PSS Certificate Legacy Signature Algorithm Selection-ssl]
	650	server = 18-RSA-PSS Certificate Legacy Signature Algorithm Selection-server
	651	client = 18-RSA-PSS Certificate Legacy Signature Algorithm Selection-client
	652
	653	[18-RSA-PSS Certificate Legacy Signature Algorithm Selection-server]
589	654	Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
590	655	CipherString = DEFAULT
591	656	ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem

599	664	PSS.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-pss-key.pem
600	665	PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
601	666
602		[16-RSA-PSS Certificate Legacy Signature Algorithm Selection-client]
	667	[18-RSA-PSS Certificate Legacy Signature Algorithm Selection-client]
603	668	CipherString = DEFAULT
604	669	SignatureAlgorithms = RSA-PSS+SHA256
605	670	VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
606	671	VerifyMode = Peer
607	672
608		[test-16]
	673	[test-18]
609	674	ExpectedResult = Success
610	675	ExpectedServerCertType = RSA
611	676	ExpectedServerSignHash = SHA256

614	679
615	680	# ===========================================================
616	681
617		[17-RSA-PSS Certificate Unified Signature Algorithm Selection]
618		ssl_conf = 17-RSA-PSS Certificate Unified Signature Algorithm Selection-ssl
619
620		[17-RSA-PSS Certificate Unified Signature Algorithm Selection-ssl]
621		server = 17-RSA-PSS Certificate Unified Signature Algorithm Selection-server
622		client = 17-RSA-PSS Certificate Unified Signature Algorithm Selection-client
623
624		[17-RSA-PSS Certificate Unified Signature Algorithm Selection-server]
	682	[19-RSA-PSS Certificate Unified Signature Algorithm Selection]
	683	ssl_conf = 19-RSA-PSS Certificate Unified Signature Algorithm Selection-ssl
	684
	685	[19-RSA-PSS Certificate Unified Signature Algorithm Selection-ssl]
	686	server = 19-RSA-PSS Certificate Unified Signature Algorithm Selection-server
	687	client = 19-RSA-PSS Certificate Unified Signature Algorithm Selection-client
	688
	689	[19-RSA-PSS Certificate Unified Signature Algorithm Selection-server]
625	690	Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
626	691	CipherString = DEFAULT
627	692	ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem

635	700	PSS.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-pss-key.pem
636	701	PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
637	702
638		[17-RSA-PSS Certificate Unified Signature Algorithm Selection-client]
	703	[19-RSA-PSS Certificate Unified Signature Algorithm Selection-client]
639	704	CipherString = DEFAULT
640	705	SignatureAlgorithms = rsa_pss_pss_sha256
641	706	VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
642	707	VerifyMode = Peer
643	708
644		[test-17]
	709	[test-19]
645	710	ExpectedResult = Success
646	711	ExpectedServerCertType = RSA-PSS
647	712	ExpectedServerSignHash = SHA256

650	715
651	716	# ===========================================================
652	717
653		[18-Only RSA-PSS Certificate]
654		ssl_conf = 18-Only RSA-PSS Certificate-ssl
655
656		[18-Only RSA-PSS Certificate-ssl]
657		server = 18-Only RSA-PSS Certificate-server
658		client = 18-Only RSA-PSS Certificate-client
659
660		[18-Only RSA-PSS Certificate-server]
	718	[20-Only RSA-PSS Certificate]
	719	ssl_conf = 20-Only RSA-PSS Certificate-ssl
	720
	721	[20-Only RSA-PSS Certificate-ssl]
	722	server = 20-Only RSA-PSS Certificate-server
	723	client = 20-Only RSA-PSS Certificate-client
	724
	725	[20-Only RSA-PSS Certificate-server]
661	726	Certificate = ${ENV::TEST_CERTS_DIR}/server-pss-cert.pem
662	727	CipherString = DEFAULT
663	728	PrivateKey = ${ENV::TEST_CERTS_DIR}/server-pss-key.pem
664	729
665		[18-Only RSA-PSS Certificate-client]
666		CipherString = DEFAULT
667		VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
668		VerifyMode = Peer
669
670		[test-18]
	730	[20-Only RSA-PSS Certificate-client]
	731	CipherString = DEFAULT
	732	VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
	733	VerifyMode = Peer
	734
	735	[test-20]
671	736	ExpectedResult = Success
672	737	ExpectedServerCertType = RSA-PSS
673	738	ExpectedServerSignHash = SHA256

676	741
677	742	# ===========================================================
678	743
679		[19-RSA-PSS Certificate, no PSS signature algorithms]
680		ssl_conf = 19-RSA-PSS Certificate, no PSS signature algorithms-ssl
681
682		[19-RSA-PSS Certificate, no PSS signature algorithms-ssl]
683		server = 19-RSA-PSS Certificate, no PSS signature algorithms-server
684		client = 19-RSA-PSS Certificate, no PSS signature algorithms-client
685
686		[19-RSA-PSS Certificate, no PSS signature algorithms-server]
	744	[21-RSA-PSS Certificate, no PSS signature algorithms]
	745	ssl_conf = 21-RSA-PSS Certificate, no PSS signature algorithms-ssl
	746
	747	[21-RSA-PSS Certificate, no PSS signature algorithms-ssl]
	748	server = 21-RSA-PSS Certificate, no PSS signature algorithms-server
	749	client = 21-RSA-PSS Certificate, no PSS signature algorithms-client
	750
	751	[21-RSA-PSS Certificate, no PSS signature algorithms-server]
687	752	Certificate = ${ENV::TEST_CERTS_DIR}/server-pss-cert.pem
688	753	CipherString = DEFAULT
689	754	PrivateKey = ${ENV::TEST_CERTS_DIR}/server-pss-key.pem
690	755
691		[19-RSA-PSS Certificate, no PSS signature algorithms-client]
	756	[21-RSA-PSS Certificate, no PSS signature algorithms-client]
692	757	CipherString = DEFAULT
693	758	SignatureAlgorithms = RSA+SHA256
694	759	VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
695	760	VerifyMode = Peer
696	761
697		[test-19]
	762	[test-21]
698	763	ExpectedResult = ServerFail
699	764
700	765
701	766	# ===========================================================
702	767
703		[20-Suite B P-256 Hash Algorithm Selection]
704		ssl_conf = 20-Suite B P-256 Hash Algorithm Selection-ssl
705
706		[20-Suite B P-256 Hash Algorithm Selection-ssl]
707		server = 20-Suite B P-256 Hash Algorithm Selection-server
708		client = 20-Suite B P-256 Hash Algorithm Selection-client
709
710		[20-Suite B P-256 Hash Algorithm Selection-server]
	768	[22-Suite B P-256 Hash Algorithm Selection]
	769	ssl_conf = 22-Suite B P-256 Hash Algorithm Selection-ssl
	770
	771	[22-Suite B P-256 Hash Algorithm Selection-ssl]
	772	server = 22-Suite B P-256 Hash Algorithm Selection-server
	773	client = 22-Suite B P-256 Hash Algorithm Selection-client
	774
	775	[22-Suite B P-256 Hash Algorithm Selection-server]
711	776	Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
712	777	CipherString = SUITEB128
713	778	ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/p256-server-cert.pem

715	780	MaxProtocol = TLSv1.2
716	781	PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
717	782
718		[20-Suite B P-256 Hash Algorithm Selection-client]
	783	[22-Suite B P-256 Hash Algorithm Selection-client]
719	784	CipherString = DEFAULT
720	785	SignatureAlgorithms = ECDSA+SHA384:ECDSA+SHA256
721	786	VerifyCAFile = ${ENV::TEST_CERTS_DIR}/p384-root.pem
722	787	VerifyMode = Peer
723	788
724		[test-20]
	789	[test-22]
725	790	ExpectedResult = Success
726	791	ExpectedServerCertType = P-256
727	792	ExpectedServerSignHash = SHA256

730	795
731	796	# ===========================================================
732	797
733		[21-Suite B P-384 Hash Algorithm Selection]
734		ssl_conf = 21-Suite B P-384 Hash Algorithm Selection-ssl
735
736		[21-Suite B P-384 Hash Algorithm Selection-ssl]
737		server = 21-Suite B P-384 Hash Algorithm Selection-server
738		client = 21-Suite B P-384 Hash Algorithm Selection-client
739
740		[21-Suite B P-384 Hash Algorithm Selection-server]
	798	[23-Suite B P-384 Hash Algorithm Selection]
	799	ssl_conf = 23-Suite B P-384 Hash Algorithm Selection-ssl
	800
	801	[23-Suite B P-384 Hash Algorithm Selection-ssl]
	802	server = 23-Suite B P-384 Hash Algorithm Selection-server
	803	client = 23-Suite B P-384 Hash Algorithm Selection-client
	804
	805	[23-Suite B P-384 Hash Algorithm Selection-server]
741	806	Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
742	807	CipherString = SUITEB128
743	808	ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/p384-server-cert.pem

745	810	MaxProtocol = TLSv1.2
746	811	PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
747	812
748		[21-Suite B P-384 Hash Algorithm Selection-client]
	813	[23-Suite B P-384 Hash Algorithm Selection-client]
749	814	CipherString = DEFAULT
750	815	SignatureAlgorithms = ECDSA+SHA256:ECDSA+SHA384
751	816	VerifyCAFile = ${ENV::TEST_CERTS_DIR}/p384-root.pem
752	817	VerifyMode = Peer
753	818
754		[test-21]
	819	[test-23]
755	820	ExpectedResult = Success
756	821	ExpectedServerCertType = P-384
757	822	ExpectedServerSignHash = SHA384

760	825
761	826	# ===========================================================
762	827
763		[22-TLS 1.2 Ed25519 Client Auth]
764		ssl_conf = 22-TLS 1.2 Ed25519 Client Auth-ssl
765
766		[22-TLS 1.2 Ed25519 Client Auth-ssl]
767		server = 22-TLS 1.2 Ed25519 Client Auth-server
768		client = 22-TLS 1.2 Ed25519 Client Auth-client
769
770		[22-TLS 1.2 Ed25519 Client Auth-server]
	828	[24-TLS 1.2 Ed25519 Client Auth]
	829	ssl_conf = 24-TLS 1.2 Ed25519 Client Auth-ssl
	830
	831	[24-TLS 1.2 Ed25519 Client Auth-ssl]
	832	server = 24-TLS 1.2 Ed25519 Client Auth-server
	833	client = 24-TLS 1.2 Ed25519 Client Auth-client
	834
	835	[24-TLS 1.2 Ed25519 Client Auth-server]
771	836	Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
772	837	CipherString = DEFAULT
773	838	PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
774	839	VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
775	840	VerifyMode = Require
776	841
777		[22-TLS 1.2 Ed25519 Client Auth-client]
	842	[24-TLS 1.2 Ed25519 Client Auth-client]
778	843	CipherString = DEFAULT
779	844	Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/client-ed25519-cert.pem
780	845	Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/client-ed25519-key.pem

783	848	VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
784	849	VerifyMode = Peer
785	850
786		[test-22]
	851	[test-24]
787	852	ExpectedClientCertType = Ed25519
788	853	ExpectedClientSignType = Ed25519
789	854	ExpectedResult = Success

791	856
792	857	# ===========================================================
793	858
794		[23-TLS 1.2 Ed448 Client Auth]
795		ssl_conf = 23-TLS 1.2 Ed448 Client Auth-ssl
796
797		[23-TLS 1.2 Ed448 Client Auth-ssl]
798		server = 23-TLS 1.2 Ed448 Client Auth-server
799		client = 23-TLS 1.2 Ed448 Client Auth-client
800
801		[23-TLS 1.2 Ed448 Client Auth-server]
	859	[25-TLS 1.2 Ed448 Client Auth]
	860	ssl_conf = 25-TLS 1.2 Ed448 Client Auth-ssl
	861
	862	[25-TLS 1.2 Ed448 Client Auth-ssl]
	863	server = 25-TLS 1.2 Ed448 Client Auth-server
	864	client = 25-TLS 1.2 Ed448 Client Auth-client
	865
	866	[25-TLS 1.2 Ed448 Client Auth-server]
802	867	Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
803	868	CipherString = DEFAULT
804	869	PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
805	870	VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
806	871	VerifyMode = Require
807	872
808		[23-TLS 1.2 Ed448 Client Auth-client]
	873	[25-TLS 1.2 Ed448 Client Auth-client]
809	874	CipherString = DEFAULT
810	875	Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/client-ed448-cert.pem
811	876	Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/client-ed448-key.pem

814	879	VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
815	880	VerifyMode = Peer
816	881
817		[test-23]
	882	[test-25]
818	883	ExpectedClientCertType = Ed448
819	884	ExpectedClientSignType = Ed448
820	885	ExpectedResult = Success

822	887
823	888	# ===========================================================
824	889
825		[24-Only RSA-PSS Certificate, TLS v1.1]
826		ssl_conf = 24-Only RSA-PSS Certificate, TLS v1.1-ssl
827
828		[24-Only RSA-PSS Certificate, TLS v1.1-ssl]
829		server = 24-Only RSA-PSS Certificate, TLS v1.1-server
830		client = 24-Only RSA-PSS Certificate, TLS v1.1-client
831
832		[24-Only RSA-PSS Certificate, TLS v1.1-server]
	890	[26-Only RSA-PSS Certificate, TLS v1.1]
	891	ssl_conf = 26-Only RSA-PSS Certificate, TLS v1.1-ssl
	892
	893	[26-Only RSA-PSS Certificate, TLS v1.1-ssl]
	894	server = 26-Only RSA-PSS Certificate, TLS v1.1-server
	895	client = 26-Only RSA-PSS Certificate, TLS v1.1-client
	896
	897	[26-Only RSA-PSS Certificate, TLS v1.1-server]
833	898	Certificate = ${ENV::TEST_CERTS_DIR}/server-pss-cert.pem
834	899	CipherString = DEFAULT
835	900	PrivateKey = ${ENV::TEST_CERTS_DIR}/server-pss-key.pem
836	901
837		[24-Only RSA-PSS Certificate, TLS v1.1-client]
	902	[26-Only RSA-PSS Certificate, TLS v1.1-client]
838	903	CipherString = DEFAULT
839	904	MaxProtocol = TLSv1.1
840	905	VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
841	906	VerifyMode = Peer
842	907
843		[test-24]
	908	[test-26]
844	909	ExpectedResult = ServerFail
845	910
846	911
847	912	# ===========================================================
848	913
849		[25-TLS 1.3 ECDSA Signature Algorithm Selection]
850		ssl_conf = 25-TLS 1.3 ECDSA Signature Algorithm Selection-ssl
851
852		[25-TLS 1.3 ECDSA Signature Algorithm Selection-ssl]
853		server = 25-TLS 1.3 ECDSA Signature Algorithm Selection-server
854		client = 25-TLS 1.3 ECDSA Signature Algorithm Selection-client
855
856		[25-TLS 1.3 ECDSA Signature Algorithm Selection-server]
857		Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
858		CipherString = DEFAULT
859		ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
860		ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
861		Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
862		Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
863		Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem
864		Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
865		MaxProtocol = TLSv1.3
866		MinProtocol = TLSv1.3
867		PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
868
869		[25-TLS 1.3 ECDSA Signature Algorithm Selection-client]
	914	[27-TLS 1.3 ECDSA Signature Algorithm Selection]
	915	ssl_conf = 27-TLS 1.3 ECDSA Signature Algorithm Selection-ssl
	916
	917	[27-TLS 1.3 ECDSA Signature Algorithm Selection-ssl]
	918	server = 27-TLS 1.3 ECDSA Signature Algorithm Selection-server
	919	client = 27-TLS 1.3 ECDSA Signature Algorithm Selection-client
	920
	921	[27-TLS 1.3 ECDSA Signature Algorithm Selection-server]
	922	Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
	923	CipherString = DEFAULT
	924	ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
	925	ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
	926	Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
	927	Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
	928	Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem
	929	Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
	930	MaxProtocol = TLSv1.3
	931	MinProtocol = TLSv1.3
	932	PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
	933
	934	[27-TLS 1.3 ECDSA Signature Algorithm Selection-client]
870	935	CipherString = DEFAULT
871	936	SignatureAlgorithms = ECDSA+SHA256
872	937	VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
873	938	VerifyMode = Peer
874	939
875		[test-25]
	940	[test-27]
876	941	ExpectedResult = Success
877	942	ExpectedServerCANames = empty
878	943	ExpectedServerCertType = P-256

882	947
883	948	# ===========================================================
884	949
885		[26-TLS 1.3 ECDSA Signature Algorithm Selection compressed point]
886		ssl_conf = 26-TLS 1.3 ECDSA Signature Algorithm Selection compressed point-ssl
887
888		[26-TLS 1.3 ECDSA Signature Algorithm Selection compressed point-ssl]
889		server = 26-TLS 1.3 ECDSA Signature Algorithm Selection compressed point-server
890		client = 26-TLS 1.3 ECDSA Signature Algorithm Selection compressed point-client
891
892		[26-TLS 1.3 ECDSA Signature Algorithm Selection compressed point-server]
	950	[28-TLS 1.3 ECDSA Signature Algorithm Selection compressed point]
	951	ssl_conf = 28-TLS 1.3 ECDSA Signature Algorithm Selection compressed point-ssl
	952
	953	[28-TLS 1.3 ECDSA Signature Algorithm Selection compressed point-ssl]
	954	server = 28-TLS 1.3 ECDSA Signature Algorithm Selection compressed point-server
	955	client = 28-TLS 1.3 ECDSA Signature Algorithm Selection compressed point-client
	956
	957	[28-TLS 1.3 ECDSA Signature Algorithm Selection compressed point-server]
893	958	Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
894	959	CipherString = DEFAULT
895	960	ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-cecdsa-cert.pem

898	963	MinProtocol = TLSv1.3
899	964	PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
900	965
901		[26-TLS 1.3 ECDSA Signature Algorithm Selection compressed point-client]
	966	[28-TLS 1.3 ECDSA Signature Algorithm Selection compressed point-client]
902	967	CipherString = DEFAULT
903	968	SignatureAlgorithms = ECDSA+SHA256
904	969	VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
905	970	VerifyMode = Peer
906	971
907		[test-26]
	972	[test-28]
908	973	ExpectedResult = ServerFail
909	974
910	975
911	976	# ===========================================================
912	977
913		[27-TLS 1.3 ECDSA Signature Algorithm Selection SHA1]
914		ssl_conf = 27-TLS 1.3 ECDSA Signature Algorithm Selection SHA1-ssl
915
916		[27-TLS 1.3 ECDSA Signature Algorithm Selection SHA1-ssl]
917		server = 27-TLS 1.3 ECDSA Signature Algorithm Selection SHA1-server
918		client = 27-TLS 1.3 ECDSA Signature Algorithm Selection SHA1-client
919
920		[27-TLS 1.3 ECDSA Signature Algorithm Selection SHA1-server]
921		Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
922		CipherString = DEFAULT
923		ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
924		ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
925		Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
926		Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
927		Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem
928		Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
929		MaxProtocol = TLSv1.3
930		MinProtocol = TLSv1.3
931		PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
932
933		[27-TLS 1.3 ECDSA Signature Algorithm Selection SHA1-client]
	978	[29-TLS 1.3 ECDSA Signature Algorithm Selection SHA1]
	979	ssl_conf = 29-TLS 1.3 ECDSA Signature Algorithm Selection SHA1-ssl
	980
	981	[29-TLS 1.3 ECDSA Signature Algorithm Selection SHA1-ssl]
	982	server = 29-TLS 1.3 ECDSA Signature Algorithm Selection SHA1-server
	983	client = 29-TLS 1.3 ECDSA Signature Algorithm Selection SHA1-client
	984
	985	[29-TLS 1.3 ECDSA Signature Algorithm Selection SHA1-server]
	986	Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
	987	CipherString = DEFAULT
	988	ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
	989	ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
	990	Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
	991	Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
	992	Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem
	993	Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
	994	MaxProtocol = TLSv1.3
	995	MinProtocol = TLSv1.3
	996	PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
	997
	998	[29-TLS 1.3 ECDSA Signature Algorithm Selection SHA1-client]
934	999	CipherString = DEFAULT
935	1000	SignatureAlgorithms = ECDSA+SHA1
936	1001	VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
937	1002	VerifyMode = Peer
938	1003
939		[test-27]
	1004	[test-29]
940	1005	ExpectedResult = ServerFail
941	1006
942	1007
943	1008	# ===========================================================
944	1009
945		[28-TLS 1.3 ECDSA Signature Algorithm Selection with PSS]
946		ssl_conf = 28-TLS 1.3 ECDSA Signature Algorithm Selection with PSS-ssl
947
948		[28-TLS 1.3 ECDSA Signature Algorithm Selection with PSS-ssl]
949		server = 28-TLS 1.3 ECDSA Signature Algorithm Selection with PSS-server
950		client = 28-TLS 1.3 ECDSA Signature Algorithm Selection with PSS-client
951
952		[28-TLS 1.3 ECDSA Signature Algorithm Selection with PSS-server]
953		Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
954		CipherString = DEFAULT
955		ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
956		ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
957		Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
958		Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
959		Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem
960		Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
961		MaxProtocol = TLSv1.3
962		MinProtocol = TLSv1.3
963		PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
964
965		[28-TLS 1.3 ECDSA Signature Algorithm Selection with PSS-client]
	1010	[30-TLS 1.3 ECDSA Signature Algorithm Selection with PSS]
	1011	ssl_conf = 30-TLS 1.3 ECDSA Signature Algorithm Selection with PSS-ssl
	1012
	1013	[30-TLS 1.3 ECDSA Signature Algorithm Selection with PSS-ssl]
	1014	server = 30-TLS 1.3 ECDSA Signature Algorithm Selection with PSS-server
	1015	client = 30-TLS 1.3 ECDSA Signature Algorithm Selection with PSS-client
	1016
	1017	[30-TLS 1.3 ECDSA Signature Algorithm Selection with PSS-server]
	1018	Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
	1019	CipherString = DEFAULT
	1020	ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
	1021	ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
	1022	Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
	1023	Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
	1024	Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem
	1025	Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
	1026	MaxProtocol = TLSv1.3
	1027	MinProtocol = TLSv1.3
	1028	PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
	1029
	1030	[30-TLS 1.3 ECDSA Signature Algorithm Selection with PSS-client]
966	1031	CipherString = DEFAULT
967	1032	RequestCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
968	1033	SignatureAlgorithms = ECDSA+SHA256:RSA-PSS+SHA256
969	1034	VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
970	1035	VerifyMode = Peer
971	1036
972		[test-28]
	1037	[test-30]
973	1038	ExpectedResult = Success
974	1039	ExpectedServerCANames = ${ENV::TEST_CERTS_DIR}/root-cert.pem
975	1040	ExpectedServerCertType = P-256

979	1044
980	1045	# ===========================================================
981	1046
982		[29-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS]
983		ssl_conf = 29-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS-ssl
984
985		[29-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS-ssl]
986		server = 29-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS-server
987		client = 29-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS-client
988
989		[29-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS-server]
990		Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
991		CipherString = DEFAULT
992		ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
993		ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
994		Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
995		Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
996		Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem
997		Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
998		MaxProtocol = TLSv1.3
999		MinProtocol = TLSv1.3
1000		PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
1001
1002		[29-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS-client]
	1047	[31-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS]
	1048	ssl_conf = 31-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS-ssl
	1049
	1050	[31-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS-ssl]
	1051	server = 31-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS-server
	1052	client = 31-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS-client
	1053
	1054	[31-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS-server]
	1055	Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
	1056	CipherString = DEFAULT
	1057	ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
	1058	ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
	1059	Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
	1060	Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
	1061	Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem
	1062	Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
	1063	MaxProtocol = TLSv1.3
	1064	MinProtocol = TLSv1.3
	1065	PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
	1066
	1067	[31-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS-client]
1003	1068	CipherString = DEFAULT
1004	1069	SignatureAlgorithms = ECDSA+SHA384:RSA-PSS+SHA384
1005	1070	VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
1006	1071	VerifyMode = Peer
1007	1072
1008		[test-29]
	1073	[test-31]
1009	1074	ExpectedResult = Success
1010	1075	ExpectedServerCertType = RSA
1011	1076	ExpectedServerSignHash = SHA384

1014	1079
1015	1080	# ===========================================================
1016	1081
1017		[30-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate]
1018		ssl_conf = 30-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate-ssl
1019
1020		[30-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate-ssl]
1021		server = 30-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate-server
1022		client = 30-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate-client
1023
1024		[30-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate-server]
1025		Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
1026		CipherString = DEFAULT
1027		MaxProtocol = TLSv1.3
1028		MinProtocol = TLSv1.3
1029		PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
1030
1031		[30-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate-client]
	1082	[32-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate]
	1083	ssl_conf = 32-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate-ssl
	1084
	1085	[32-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate-ssl]
	1086	server = 32-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate-server
	1087	client = 32-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate-client
	1088
	1089	[32-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate-server]
	1090	Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
	1091	CipherString = DEFAULT
	1092	MaxProtocol = TLSv1.3
	1093	MinProtocol = TLSv1.3
	1094	PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
	1095
	1096	[32-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate-client]
1032	1097	CipherString = DEFAULT
1033	1098	SignatureAlgorithms = ECDSA+SHA256
1034	1099	VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
1035	1100	VerifyMode = Peer
1036	1101
1037		[test-30]
	1102	[test-32]
1038	1103	ExpectedResult = ServerFail
1039	1104
1040	1105
1041	1106	# ===========================================================
1042	1107
1043		[31-TLS 1.3 RSA Signature Algorithm Selection, no PSS]
1044		ssl_conf = 31-TLS 1.3 RSA Signature Algorithm Selection, no PSS-ssl
1045
1046		[31-TLS 1.3 RSA Signature Algorithm Selection, no PSS-ssl]
1047		server = 31-TLS 1.3 RSA Signature Algorithm Selection, no PSS-server
1048		client = 31-TLS 1.3 RSA Signature Algorithm Selection, no PSS-client
1049
1050		[31-TLS 1.3 RSA Signature Algorithm Selection, no PSS-server]
1051		Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
1052		CipherString = DEFAULT
1053		ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
1054		ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
1055		Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
1056		Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
1057		Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem
1058		Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
1059		MaxProtocol = TLSv1.3
1060		MinProtocol = TLSv1.3
1061		PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
1062
1063		[31-TLS 1.3 RSA Signature Algorithm Selection, no PSS-client]
	1108	[33-TLS 1.3 RSA Signature Algorithm Selection, no PSS]
	1109	ssl_conf = 33-TLS 1.3 RSA Signature Algorithm Selection, no PSS-ssl
	1110
	1111	[33-TLS 1.3 RSA Signature Algorithm Selection, no PSS-ssl]
	1112	server = 33-TLS 1.3 RSA Signature Algorithm Selection, no PSS-server
	1113	client = 33-TLS 1.3 RSA Signature Algorithm Selection, no PSS-client
	1114
	1115	[33-TLS 1.3 RSA Signature Algorithm Selection, no PSS-server]
	1116	Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
	1117	CipherString = DEFAULT
	1118	ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
	1119	ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
	1120	Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
	1121	Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
	1122	Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem
	1123	Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
	1124	MaxProtocol = TLSv1.3
	1125	MinProtocol = TLSv1.3
	1126	PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
	1127
	1128	[33-TLS 1.3 RSA Signature Algorithm Selection, no PSS-client]
1064	1129	CipherString = DEFAULT
1065	1130	SignatureAlgorithms = RSA+SHA256
1066	1131	VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
1067	1132	VerifyMode = Peer
1068	1133
1069		[test-31]
	1134	[test-33]
1070	1135	ExpectedResult = ServerFail
1071	1136
1072	1137
1073	1138	# ===========================================================
1074	1139
1075		[32-TLS 1.3 RSA-PSS Signature Algorithm Selection]
1076		ssl_conf = 32-TLS 1.3 RSA-PSS Signature Algorithm Selection-ssl
1077
1078		[32-TLS 1.3 RSA-PSS Signature Algorithm Selection-ssl]
1079		server = 32-TLS 1.3 RSA-PSS Signature Algorithm Selection-server
1080		client = 32-TLS 1.3 RSA-PSS Signature Algorithm Selection-client
1081
1082		[32-TLS 1.3 RSA-PSS Signature Algorithm Selection-server]
1083		Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
1084		CipherString = DEFAULT
1085		ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
1086		ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
1087		Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
1088		Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
1089		Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem
1090		Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
1091		MaxProtocol = TLSv1.3
1092		MinProtocol = TLSv1.3
1093		PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
1094
1095		[32-TLS 1.3 RSA-PSS Signature Algorithm Selection-client]
	1140	[34-TLS 1.3 RSA-PSS Signature Algorithm Selection]
	1141	ssl_conf = 34-TLS 1.3 RSA-PSS Signature Algorithm Selection-ssl
	1142
	1143	[34-TLS 1.3 RSA-PSS Signature Algorithm Selection-ssl]
	1144	server = 34-TLS 1.3 RSA-PSS Signature Algorithm Selection-server
	1145	client = 34-TLS 1.3 RSA-PSS Signature Algorithm Selection-client
	1146
	1147	[34-TLS 1.3 RSA-PSS Signature Algorithm Selection-server]
	1148	Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
	1149	CipherString = DEFAULT
	1150	ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
	1151	ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
	1152	Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
	1153	Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
	1154	Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem
	1155	Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
	1156	MaxProtocol = TLSv1.3
	1157	MinProtocol = TLSv1.3
	1158	PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
	1159
	1160	[34-TLS 1.3 RSA-PSS Signature Algorithm Selection-client]
1096	1161	CipherString = DEFAULT
1097	1162	SignatureAlgorithms = RSA-PSS+SHA256
1098	1163	VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
1099	1164	VerifyMode = Peer
1100	1165
1101		[test-32]
	1166	[test-34]
1102	1167	ExpectedResult = Success
1103	1168	ExpectedServerCertType = RSA
1104	1169	ExpectedServerSignHash = SHA256

1107	1172
1108	1173	# ===========================================================
1109	1174
1110		[33-TLS 1.3 Ed25519 Signature Algorithm Selection]
1111		ssl_conf = 33-TLS 1.3 Ed25519 Signature Algorithm Selection-ssl
1112
1113		[33-TLS 1.3 Ed25519 Signature Algorithm Selection-ssl]
1114		server = 33-TLS 1.3 Ed25519 Signature Algorithm Selection-server
1115		client = 33-TLS 1.3 Ed25519 Signature Algorithm Selection-client
1116
1117		[33-TLS 1.3 Ed25519 Signature Algorithm Selection-server]
1118		Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
1119		CipherString = DEFAULT
1120		ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
1121		ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
1122		Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
1123		Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
1124		Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem
1125		Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
1126		MaxProtocol = TLSv1.3
1127		MinProtocol = TLSv1.3
1128		PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
1129
1130		[33-TLS 1.3 Ed25519 Signature Algorithm Selection-client]
	1175	[35-TLS 1.3 Ed25519 Signature Algorithm Selection]
	1176	ssl_conf = 35-TLS 1.3 Ed25519 Signature Algorithm Selection-ssl
	1177
	1178	[35-TLS 1.3 Ed25519 Signature Algorithm Selection-ssl]
	1179	server = 35-TLS 1.3 Ed25519 Signature Algorithm Selection-server
	1180	client = 35-TLS 1.3 Ed25519 Signature Algorithm Selection-client
	1181
	1182	[35-TLS 1.3 Ed25519 Signature Algorithm Selection-server]
	1183	Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
	1184	CipherString = DEFAULT
	1185	ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
	1186	ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
	1187	Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
	1188	Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
	1189	Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem
	1190	Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
	1191	MaxProtocol = TLSv1.3
	1192	MinProtocol = TLSv1.3
	1193	PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
	1194
	1195	[35-TLS 1.3 Ed25519 Signature Algorithm Selection-client]
1131	1196	CipherString = DEFAULT
1132	1197	SignatureAlgorithms = ed25519
1133	1198	VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
1134	1199	VerifyMode = Peer
1135	1200
1136		[test-33]
	1201	[test-35]
1137	1202	ExpectedResult = Success
1138	1203	ExpectedServerCertType = Ed25519
1139	1204	ExpectedServerSignType = Ed25519

1141	1206
1142	1207	# ===========================================================
1143	1208
1144		[34-TLS 1.3 Ed448 Signature Algorithm Selection]
1145		ssl_conf = 34-TLS 1.3 Ed448 Signature Algorithm Selection-ssl
1146
1147		[34-TLS 1.3 Ed448 Signature Algorithm Selection-ssl]
1148		server = 34-TLS 1.3 Ed448 Signature Algorithm Selection-server
1149		client = 34-TLS 1.3 Ed448 Signature Algorithm Selection-client
1150
1151		[34-TLS 1.3 Ed448 Signature Algorithm Selection-server]
1152		Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
1153		CipherString = DEFAULT
1154		ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
1155		ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
1156		Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
1157		Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
1158		Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem
1159		Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
1160		MaxProtocol = TLSv1.3
1161		MinProtocol = TLSv1.3
1162		PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
1163
1164		[34-TLS 1.3 Ed448 Signature Algorithm Selection-client]
	1209	[36-TLS 1.3 Ed448 Signature Algorithm Selection]
	1210	ssl_conf = 36-TLS 1.3 Ed448 Signature Algorithm Selection-ssl
	1211
	1212	[36-TLS 1.3 Ed448 Signature Algorithm Selection-ssl]
	1213	server = 36-TLS 1.3 Ed448 Signature Algorithm Selection-server
	1214	client = 36-TLS 1.3 Ed448 Signature Algorithm Selection-client
	1215
	1216	[36-TLS 1.3 Ed448 Signature Algorithm Selection-server]
	1217	Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
	1218	CipherString = DEFAULT
	1219	ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
	1220	ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
	1221	Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
	1222	Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
	1223	Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem
	1224	Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
	1225	MaxProtocol = TLSv1.3
	1226	MinProtocol = TLSv1.3
	1227	PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
	1228
	1229	[36-TLS 1.3 Ed448 Signature Algorithm Selection-client]
1165	1230	CipherString = DEFAULT
1166	1231	SignatureAlgorithms = ed448
1167	1232	VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
1168	1233	VerifyMode = Peer
1169	1234
1170		[test-34]
	1235	[test-36]
1171	1236	ExpectedResult = Success
1172	1237	ExpectedServerCertType = Ed448
1173	1238	ExpectedServerSignType = Ed448

1175	1240
1176	1241	# ===========================================================
1177	1242
1178		[35-TLS 1.3 Ed25519 CipherString and Groups Selection]
1179		ssl_conf = 35-TLS 1.3 Ed25519 CipherString and Groups Selection-ssl
1180
1181		[35-TLS 1.3 Ed25519 CipherString and Groups Selection-ssl]
1182		server = 35-TLS 1.3 Ed25519 CipherString and Groups Selection-server
1183		client = 35-TLS 1.3 Ed25519 CipherString and Groups Selection-client
1184
1185		[35-TLS 1.3 Ed25519 CipherString and Groups Selection-server]
1186		Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
1187		CipherString = DEFAULT
1188		ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
1189		ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
1190		Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
1191		Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
1192		Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem
1193		Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
1194		MaxProtocol = TLSv1.3
1195		MinProtocol = TLSv1.3
1196		PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
1197
1198		[35-TLS 1.3 Ed25519 CipherString and Groups Selection-client]
	1243	[37-TLS 1.3 Ed25519 CipherString and Groups Selection]
	1244	ssl_conf = 37-TLS 1.3 Ed25519 CipherString and Groups Selection-ssl
	1245
	1246	[37-TLS 1.3 Ed25519 CipherString and Groups Selection-ssl]
	1247	server = 37-TLS 1.3 Ed25519 CipherString and Groups Selection-server
	1248	client = 37-TLS 1.3 Ed25519 CipherString and Groups Selection-client
	1249
	1250	[37-TLS 1.3 Ed25519 CipherString and Groups Selection-server]
	1251	Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
	1252	CipherString = DEFAULT
	1253	ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
	1254	ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
	1255	Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
	1256	Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
	1257	Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem
	1258	Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
	1259	MaxProtocol = TLSv1.3
	1260	MinProtocol = TLSv1.3
	1261	PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
	1262
	1263	[37-TLS 1.3 Ed25519 CipherString and Groups Selection-client]
1199	1264	CipherString = DEFAULT
1200	1265	Groups = X25519
1201	1266	SignatureAlgorithms = ECDSA+SHA256:ed25519
1202	1267	VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
1203	1268	VerifyMode = Peer
1204	1269
1205		[test-35]
	1270	[test-37]
1206	1271	ExpectedResult = Success
1207	1272	ExpectedServerCertType = P-256
1208	1273	ExpectedServerSignType = EC

1210	1275
1211	1276	# ===========================================================
1212	1277
1213		[36-TLS 1.3 Ed448 CipherString and Groups Selection]
1214		ssl_conf = 36-TLS 1.3 Ed448 CipherString and Groups Selection-ssl
1215
1216		[36-TLS 1.3 Ed448 CipherString and Groups Selection-ssl]
1217		server = 36-TLS 1.3 Ed448 CipherString and Groups Selection-server
1218		client = 36-TLS 1.3 Ed448 CipherString and Groups Selection-client
1219
1220		[36-TLS 1.3 Ed448 CipherString and Groups Selection-server]
1221		Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
1222		CipherString = DEFAULT
1223		ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
1224		ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
1225		Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
1226		Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
1227		Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem
1228		Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
1229		MaxProtocol = TLSv1.3
1230		MinProtocol = TLSv1.3
1231		PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
1232
1233		[36-TLS 1.3 Ed448 CipherString and Groups Selection-client]
	1278	[38-TLS 1.3 Ed448 CipherString and Groups Selection]
	1279	ssl_conf = 38-TLS 1.3 Ed448 CipherString and Groups Selection-ssl
	1280
	1281	[38-TLS 1.3 Ed448 CipherString and Groups Selection-ssl]
	1282	server = 38-TLS 1.3 Ed448 CipherString and Groups Selection-server
	1283	client = 38-TLS 1.3 Ed448 CipherString and Groups Selection-client
	1284
	1285	[38-TLS 1.3 Ed448 CipherString and Groups Selection-server]
	1286	Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
	1287	CipherString = DEFAULT
	1288	ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
	1289	ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
	1290	Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
	1291	Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
	1292	Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem
	1293	Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
	1294	MaxProtocol = TLSv1.3
	1295	MinProtocol = TLSv1.3
	1296	PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
	1297
	1298	[38-TLS 1.3 Ed448 CipherString and Groups Selection-client]
1234	1299	CipherString = DEFAULT
1235	1300	Groups = X448
1236	1301	SignatureAlgorithms = ECDSA+SHA256:ed448
1237	1302	VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
1238	1303	VerifyMode = Peer
1239	1304
1240		[test-36]
	1305	[test-38]
1241	1306	ExpectedResult = Success
1242	1307	ExpectedServerCertType = P-256
1243	1308	ExpectedServerSignType = EC

1245	1310
1246	1311	# ===========================================================
1247	1312
1248		[37-TLS 1.3 RSA Client Auth Signature Algorithm Selection]
1249		ssl_conf = 37-TLS 1.3 RSA Client Auth Signature Algorithm Selection-ssl
1250
1251		[37-TLS 1.3 RSA Client Auth Signature Algorithm Selection-ssl]
1252		server = 37-TLS 1.3 RSA Client Auth Signature Algorithm Selection-server
1253		client = 37-TLS 1.3 RSA Client Auth Signature Algorithm Selection-client
1254
1255		[37-TLS 1.3 RSA Client Auth Signature Algorithm Selection-server]
	1313	[39-TLS 1.3 RSA Client Auth Signature Algorithm Selection]
	1314	ssl_conf = 39-TLS 1.3 RSA Client Auth Signature Algorithm Selection-ssl
	1315
	1316	[39-TLS 1.3 RSA Client Auth Signature Algorithm Selection-ssl]
	1317	server = 39-TLS 1.3 RSA Client Auth Signature Algorithm Selection-server
	1318	client = 39-TLS 1.3 RSA Client Auth Signature Algorithm Selection-client
	1319
	1320	[39-TLS 1.3 RSA Client Auth Signature Algorithm Selection-server]
1256	1321	Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
1257	1322	CipherString = DEFAULT
1258	1323	ClientSignatureAlgorithms = PSS+SHA256

1260	1325	VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
1261	1326	VerifyMode = Require
1262	1327
1263		[37-TLS 1.3 RSA Client Auth Signature Algorithm Selection-client]
	1328	[39-TLS 1.3 RSA Client Auth Signature Algorithm Selection-client]
1264	1329	CipherString = DEFAULT
1265	1330	ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/ee-ecdsa-client-chain.pem
1266	1331	ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/ee-ecdsa-key.pem

1271	1336	VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
1272	1337	VerifyMode = Peer
1273	1338
1274		[test-37]
	1339	[test-39]
1275	1340	ExpectedClientCANames = empty
1276	1341	ExpectedClientCertType = RSA
1277	1342	ExpectedClientSignHash = SHA256

1281	1346
1282	1347	# ===========================================================
1283	1348
1284		[38-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names]
1285		ssl_conf = 38-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names-ssl
1286
1287		[38-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names-ssl]
1288		server = 38-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names-server
1289		client = 38-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names-client
1290
1291		[38-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names-server]
	1349	[40-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names]
	1350	ssl_conf = 40-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names-ssl
	1351
	1352	[40-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names-ssl]
	1353	server = 40-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names-server
	1354	client = 40-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names-client
	1355
	1356	[40-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names-server]
1292	1357	Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
1293	1358	CipherString = DEFAULT
1294	1359	ClientSignatureAlgorithms = PSS+SHA256

1297	1362	VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
1298	1363	VerifyMode = Require
1299	1364
1300		[38-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names-client]
	1365	[40-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names-client]
1301	1366	CipherString = DEFAULT
1302	1367	ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/ee-ecdsa-client-chain.pem
1303	1368	ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/ee-ecdsa-key.pem

1308	1373	VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
1309	1374	VerifyMode = Peer
1310	1375
1311		[test-38]
	1376	[test-40]
1312	1377	ExpectedClientCANames = ${ENV::TEST_CERTS_DIR}/root-cert.pem
1313	1378	ExpectedClientCertType = RSA
1314	1379	ExpectedClientSignHash = SHA256

1318	1383
1319	1384	# ===========================================================
1320	1385
1321		[39-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection]
1322		ssl_conf = 39-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection-ssl
1323
1324		[39-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection-ssl]
1325		server = 39-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection-server
1326		client = 39-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection-client
1327
1328		[39-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection-server]
	1386	[41-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection]
	1387	ssl_conf = 41-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection-ssl
	1388
	1389	[41-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection-ssl]
	1390	server = 41-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection-server
	1391	client = 41-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection-client
	1392
	1393	[41-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection-server]
1329	1394	Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
1330	1395	CipherString = DEFAULT
1331	1396	ClientSignatureAlgorithms = ECDSA+SHA256

1333	1398	VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
1334	1399	VerifyMode = Require
1335	1400
1336		[39-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection-client]
	1401	[41-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection-client]
1337	1402	CipherString = DEFAULT
1338	1403	ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/ee-ecdsa-client-chain.pem
1339	1404	ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/ee-ecdsa-key.pem

1344	1409	VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
1345	1410	VerifyMode = Peer
1346	1411
1347		[test-39]
	1412	[test-41]
1348	1413	ExpectedClientCertType = P-256
1349	1414	ExpectedClientSignHash = SHA256
1350	1415	ExpectedClientSignType = EC

1353	1418
1354	1419	# ===========================================================
1355	1420
1356		[40-TLS 1.3 Ed25519 Client Auth]
1357		ssl_conf = 40-TLS 1.3 Ed25519 Client Auth-ssl
1358
1359		[40-TLS 1.3 Ed25519 Client Auth-ssl]
1360		server = 40-TLS 1.3 Ed25519 Client Auth-server
1361		client = 40-TLS 1.3 Ed25519 Client Auth-client
1362
1363		[40-TLS 1.3 Ed25519 Client Auth-server]
	1421	[42-TLS 1.3 Ed25519 Client Auth]
	1422	ssl_conf = 42-TLS 1.3 Ed25519 Client Auth-ssl
	1423
	1424	[42-TLS 1.3 Ed25519 Client Auth-ssl]
	1425	server = 42-TLS 1.3 Ed25519 Client Auth-server
	1426	client = 42-TLS 1.3 Ed25519 Client Auth-client
	1427
	1428	[42-TLS 1.3 Ed25519 Client Auth-server]
1364	1429	Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
1365	1430	CipherString = DEFAULT
1366	1431	PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
1367	1432	VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
1368	1433	VerifyMode = Require
1369	1434
1370		[40-TLS 1.3 Ed25519 Client Auth-client]
	1435	[42-TLS 1.3 Ed25519 Client Auth-client]
1371	1436	CipherString = DEFAULT
1372	1437	EdDSA.Certificate = ${ENV::TEST_CERTS_DIR}/client-ed25519-cert.pem
1373	1438	EdDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/client-ed25519-key.pem

1376	1441	VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
1377	1442	VerifyMode = Peer
1378	1443
1379		[test-40]
	1444	[test-42]
1380	1445	ExpectedClientCertType = Ed25519
1381	1446	ExpectedClientSignType = Ed25519
1382	1447	ExpectedResult = Success

1384	1449
1385	1450	# ===========================================================
1386	1451
1387		[41-TLS 1.3 Ed448 Client Auth]
1388		ssl_conf = 41-TLS 1.3 Ed448 Client Auth-ssl
1389
1390		[41-TLS 1.3 Ed448 Client Auth-ssl]
1391		server = 41-TLS 1.3 Ed448 Client Auth-server
1392		client = 41-TLS 1.3 Ed448 Client Auth-client
1393
1394		[41-TLS 1.3 Ed448 Client Auth-server]
	1452	[43-TLS 1.3 Ed448 Client Auth]
	1453	ssl_conf = 43-TLS 1.3 Ed448 Client Auth-ssl
	1454
	1455	[43-TLS 1.3 Ed448 Client Auth-ssl]
	1456	server = 43-TLS 1.3 Ed448 Client Auth-server
	1457	client = 43-TLS 1.3 Ed448 Client Auth-client
	1458
	1459	[43-TLS 1.3 Ed448 Client Auth-server]
1395	1460	Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
1396	1461	CipherString = DEFAULT
1397	1462	PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
1398	1463	VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
1399	1464	VerifyMode = Require
1400	1465
1401		[41-TLS 1.3 Ed448 Client Auth-client]
	1466	[43-TLS 1.3 Ed448 Client Auth-client]
1402	1467	CipherString = DEFAULT
1403	1468	EdDSA.Certificate = ${ENV::TEST_CERTS_DIR}/client-ed448-cert.pem
1404	1469	EdDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/client-ed448-key.pem

1407	1472	VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
1408	1473	VerifyMode = Peer
1409	1474
1410		[test-41]
	1475	[test-43]
1411	1476	ExpectedClientCertType = Ed448
1412	1477	ExpectedClientSignType = Ed448
1413	1478	ExpectedResult = Success

1415	1480
1416	1481	# ===========================================================
1417	1482
1418		[42-TLS 1.2 DSA Certificate Test]
1419		ssl_conf = 42-TLS 1.2 DSA Certificate Test-ssl
1420
1421		[42-TLS 1.2 DSA Certificate Test-ssl]
1422		server = 42-TLS 1.2 DSA Certificate Test-server
1423		client = 42-TLS 1.2 DSA Certificate Test-client
1424
1425		[42-TLS 1.2 DSA Certificate Test-server]
	1483	[44-TLS 1.2 DSA Certificate Test]
	1484	ssl_conf = 44-TLS 1.2 DSA Certificate Test-ssl
	1485
	1486	[44-TLS 1.2 DSA Certificate Test-ssl]
	1487	server = 44-TLS 1.2 DSA Certificate Test-server
	1488	client = 44-TLS 1.2 DSA Certificate Test-client
	1489
	1490	[44-TLS 1.2 DSA Certificate Test-server]
1426	1491	Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
1427	1492	CipherString = ALL
1428	1493	DHParameters = ${ENV::TEST_CERTS_DIR}/dhp2048.pem

1432	1497	MinProtocol = TLSv1.2
1433	1498	PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
1434	1499
1435		[42-TLS 1.2 DSA Certificate Test-client]
	1500	[44-TLS 1.2 DSA Certificate Test-client]
1436	1501	CipherString = ALL
1437	1502	SignatureAlgorithms = DSA+SHA256:DSA+SHA1
1438	1503	VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
1439	1504	VerifyMode = Peer
1440	1505
1441		[test-42]
1442		ExpectedResult = Success
1443
1444
1445		# ===========================================================
1446
1447		[43-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms]
1448		ssl_conf = 43-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms-ssl
1449
1450		[43-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms-ssl]
1451		server = 43-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms-server
1452		client = 43-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms-client
1453
1454		[43-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms-server]
	1506	[test-44]
	1507	ExpectedResult = Success
	1508
	1509
	1510	# ===========================================================
	1511
	1512	[45-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms]
	1513	ssl_conf = 45-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms-ssl
	1514
	1515	[45-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms-ssl]
	1516	server = 45-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms-server
	1517	client = 45-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms-client
	1518
	1519	[45-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms-server]
1455	1520	Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
1456	1521	CipherString = DEFAULT
1457	1522	ClientSignatureAlgorithms = ECDSA+SHA1:DSA+SHA256:RSA+SHA256

1459	1524	VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
1460	1525	VerifyMode = Request
1461	1526
1462		[43-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms-client]
1463		CipherString = DEFAULT
1464		VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
1465		VerifyMode = Peer
1466
1467		[test-43]
	1527	[45-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms-client]
	1528	CipherString = DEFAULT
	1529	VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
	1530	VerifyMode = Peer
	1531
	1532	[test-45]
1468	1533	ExpectedResult = ServerFail
1469	1534
1470	1535
1471	1536	# ===========================================================
1472	1537
1473		[44-TLS 1.3 DSA Certificate Test]
1474		ssl_conf = 44-TLS 1.3 DSA Certificate Test-ssl
1475
1476		[44-TLS 1.3 DSA Certificate Test-ssl]
1477		server = 44-TLS 1.3 DSA Certificate Test-server
1478		client = 44-TLS 1.3 DSA Certificate Test-client
1479
1480		[44-TLS 1.3 DSA Certificate Test-server]
	1538	[46-TLS 1.3 DSA Certificate Test]
	1539	ssl_conf = 46-TLS 1.3 DSA Certificate Test-ssl
	1540
	1541	[46-TLS 1.3 DSA Certificate Test-ssl]
	1542	server = 46-TLS 1.3 DSA Certificate Test-server
	1543	client = 46-TLS 1.3 DSA Certificate Test-client
	1544
	1545	[46-TLS 1.3 DSA Certificate Test-server]
1481	1546	Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
1482	1547	CipherString = ALL
1483	1548	DSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-dsa-cert.pem

1486	1551	MinProtocol = TLSv1.3
1487	1552	PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
1488	1553
1489		[44-TLS 1.3 DSA Certificate Test-client]
	1554	[46-TLS 1.3 DSA Certificate Test-client]
1490	1555	CipherString = ALL
1491	1556	SignatureAlgorithms = DSA+SHA1:DSA+SHA256:ECDSA+SHA256
1492	1557	VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
1493	1558	VerifyMode = Peer
1494	1559
1495		[test-44]
	1560	[test-46]
1496	1561	ExpectedResult = ServerFail
1497	1562
1498	1563

+44

-0

test/ssl-tests/20-cert-select.conf.in less more

50	50	# Note: certificate_authorities not sent for TLS < 1.3
51	51	"ExpectedServerCANames" =>, "empty",
52	52	"ExpectedResult" => "Success"
	53	},
	54	},
	55	{
	56	name => "ECDSA CipherString Selection",
	57	server => {
	58	"ECDSA.Certificate" => test_pem("server-ecdsa-cert.pem"),
	59	"ECDSA.PrivateKey" => test_pem("server-ecdsa-key.pem"),
	60	"MaxProtocol" => "TLSv1.2",
	61	#Deliberately set supported_groups to one not in the cert. This
	62	#should be tolerated
	63	"Groups" => "P-384"
	64	},
	65	client => {
	66	"CipherString" => "aECDSA",
	67	"MaxProtocol" => "TLSv1.2",
	68	"Groups" => "P-256:P-384",
	69	"RequestCAFile" => test_pem("root-cert.pem"),
	70	},
	71	test => {
	72	"ExpectedServerCertType" =>, "P-256",
	73	"ExpectedServerSignType" =>, "EC",
	74	# Note: certificate_authorities not sent for TLS < 1.3
	75	"ExpectedServerCANames" =>, "empty",
	76	"ExpectedResult" => "Success"
	77	},
	78	},
	79	{
	80	name => "ECDSA CipherString Selection",
	81	server => {
	82	"ECDSA.Certificate" => test_pem("server-ecdsa-cert.pem"),
	83	"ECDSA.PrivateKey" => test_pem("server-ecdsa-key.pem"),
	84	"MaxProtocol" => "TLSv1.2",
	85	"Groups" => "P-256:P-384"
	86	},
	87	client => {
	88	"CipherString" => "aECDSA",
	89	"MaxProtocol" => "TLSv1.2",
	90	#Deliberately set groups to not include the certificate group. This
	91	#should fail
	92	"Groups" => "P-384",
	93	"RequestCAFile" => test_pem("root-cert.pem"),
	94	},
	95	test => {
	96	"ExpectedResult" => "ServerFail"
53	97	},
54	98	},
55	99	{