Use the new certificates/chains in regress.

The new certificates are more representative of the real world. The old
certificates use weak algorithms and expire in the very near future. Most
of our regress has already been switched over, this changes the remainder.

Thanks to Bernhard M. Wiedemann for reminding us of the upcoming expiry.

ok tb@

1 files changed, 5 insertions, 4 deletions

diff --git a/src/regress/lib/libssl/dtls/Makefile b/src/regress/lib/libssl/dtls/Makefile
index 438cd5c7ff..b58dae61b6 100644
--- a/src/regress/lib/libssl/dtls/Makefile
+++ b/src/regress/lib/libssl/dtls/Makefile
@@ -1,4 +1,4 @@
-#       $OpenBSD: Makefile,v 1.3 2022/01/07 09:07:00 tb Exp $
+#       $OpenBSD: Makefile,v 1.4 2024/03/20 10:38:05 jsing Exp $
 
 PROG=           dtlstest
 LDADD=          ${SSL_INT} -lcrypto
@@ -11,10 +11,11 @@ CFLAGS+=	-I${.CURDIR}/../../../../lib/libssl
 REGRESS_TARGETS= \
         regress-dtlstest
 
+# XXX(jsing): use CA root and chain
 regress-dtlstest: ${PROG}
         ./dtlstest \
-            ${.CURDIR}/../../libssl/certs/server.pem \
-            ${.CURDIR}/../../libssl/certs/server.pem \
-            ${.CURDIR}/../../libssl/certs/ca.pem
+            ${.CURDIR}/../../libssl/certs/server1-rsa.pem \
+            ${.CURDIR}/../../libssl/certs/server1-rsa.pem \
+            ${.CURDIR}/../../libssl/certs/ca-int-rsa.pem
 
 .include <bsd.regress.mk>