From: Dr. Stephen Henson <steve@openssl.org>
Date: Mon, 24 Apr 2017 23:10:33 +0000 (+0100)
Subject: Add PSS certificate signature tests
X-Git-Tag: OpenSSL_1_1_1-pre1~1672
X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=451a0c3dc8bd1c2372f893e252b741937f303e21;p=oweals%2Fopenssl.git

Add PSS certificate signature tests

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3301)
---

diff --git a/test/recipes/25-test_verify.t b/test/recipes/25-test_verify.t
index 23f8f32d95..9c425c01e4 100644
--- a/test/recipes/25-test_verify.t
+++ b/test/recipes/25-test_verify.t
@@ -26,7 +26,7 @@ sub verify {
     run(app([@args]));
 }
 
-plan tests => 121;
+plan tests => 125;
 
 # Canonical success
 ok(verify("ee-cert", "sslserver", ["root-cert"], ["ca-cert"]),
@@ -328,3 +328,15 @@ ok(!verify("badalt9-cert", "sslserver", ["root-cert"], ["ncca1-cert", "ncca3-cer
 
 ok(!verify("badalt10-cert", "sslserver", ["root-cert"], ["ncca1-cert", "ncca3-cert"], ),
    "Name constaints nested DNS name excluded");
+
+ok(verify("ee-pss-sha1-cert", "sslserver", ["root-cert"], ["ca-cert"], ),
+    "Certificate PSS signature using SHA1");
+
+ok(verify("ee-pss-sha256-cert", "sslserver", ["root-cert"], ["ca-cert"], ),
+    "CA with PSS signature using SHA256");
+
+ok(!verify("ee-pss-sha1-cert", "sslserver", ["root-cert"], ["ca-cert"], "-auth_level", "2"),
+    "Reject PSS signature using SHA1 and auth level 2");
+
+ok(verify("ee-pss-sha256-cert", "sslserver", ["root-cert"], ["ca-cert"], "-auth_level", "2"),
+    "PSS signature using SHA256 and auth level 2");