openbsd/src/regress/lib/libcrypto/x509, branch master

Prior to this we substring matched and allowed a leading .

2026-04-13T17:04:23+00:00

on a SAN DNSname constraint. This is not correct, as with a DNSname constraint, it may exacly match or match zero or more additional components on the front of the candidte to match. Spotted by Haruto Kimura ok tb@ kenjiro@

Adjust depth check to match change in verifier.

2026-04-01T14:39:11+00:00

Add additional X.509 verifier test cases.

2026-03-31T13:39:48+00:00

The second case (14b) currently triggers a bug in the new verifier.

rfc3779 regress: explain where the range comes from

2026-03-13T06:47:34+00:00

rfc3779 regress: add an actual range

2026-03-13T06:40:56+00:00

This improves the test coverage of make_addressRange() where there is an annoyance with unused bits in the RFC 3779 ASN.1 encoding versus trailing ones in the network encoding that the X509v3_addr_add_range() API expects.

policy test: parital -> partial

2026-01-22T10:15:53+00:00

constaints -> constraints

2025-12-31T17:04:22+00:00

regress/libcrypto/x509/bettertls: switch to eopenssl35

2025-07-23T07:46:12+00:00

merge the x509name test into x509_name_test.c

2025-05-05T06:33:35+00:00

Remove the old x509name test and its Makefile rule. Its logic has been fully integrated into x509_name_test.c using a new table-driven approach. Each x509 name entry is added and validated step by step, checking both the string representation produced by X509_NAME_print_ex() and the internal RDN set structure. This makes the test easier to extend and maintain, and eliminates the need for an external .expected file or output diff. From Kenjiro Nakayama (with tiny tweaks)

Adjust x509_name_regress to the X509_NAME_print() fix in a_strex.c r1.38

2025-03-19T11:19:17+00:00