Switch ssltest to using the newly generated certs that use SHA-256 instead

of SHA-1. This helps the switch to security-level aware ssltest.

From jsing

2 files changed, 6 insertions, 8 deletions

diff --git a/src/regress/lib/libssl/ssl/Makefile b/src/regress/lib/libssl/ssl/Makefile
index 582dd1c8af..91abaae85e 100644
--- a/src/regress/lib/libssl/ssl/Makefile
+++ b/src/regress/lib/libssl/ssl/Makefile
@@ -1,4 +1,4 @@
-#       $OpenBSD: Makefile,v 1.4 2021/10/15 16:49:12 jsing Exp $
+#       $OpenBSD: Makefile,v 1.5 2022/07/07 11:40:17 tb Exp $
 
 PROG=   ssltest
 LDADD=  -lcrypto -lssl
@@ -11,7 +11,7 @@ REGRESS_TARGETS=regress-ssltest
 
 regress-ssltest: ${PROG}
         sh ${.CURDIR}/testssl \
-          ${.CURDIR}/../certs/server.pem ${.CURDIR}/../certs/server.pem \
-          ${.CURDIR}/../certs/ca.pem
+          ${.CURDIR}/../certs/server1-rsa.pem ${.CURDIR}/../certs/server1-rsa-chain.pem \
+          ${.CURDIR}/../certs/ca-root-rsa.pem
 
 .include <bsd.regress.mk>
diff --git a/src/regress/lib/libssl/ssl/ssltest.c b/src/regress/lib/libssl/ssl/ssltest.c
index 32253844b2..0deac3e736 100644
--- a/src/regress/lib/libssl/ssl/ssltest.c
+++ b/src/regress/lib/libssl/ssl/ssltest.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: ssltest.c,v 1.33 2021/11/21 21:40:45 tb Exp $ */
+/*      $OpenBSD: ssltest.c,v 1.34 2022/07/07 11:40:17 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -659,8 +659,7 @@ bad:
                 EC_KEY_free(ecdh);
         }
 
-        if (!SSL_CTX_use_certificate_file(s_ctx, server_cert,
-            SSL_FILETYPE_PEM)) {
+        if (!SSL_CTX_use_certificate_chain_file(s_ctx, server_cert)) {
                 ERR_print_errors(bio_err);
         } else if (!SSL_CTX_use_PrivateKey_file(s_ctx,
             (server_key ? server_key : server_cert), SSL_FILETYPE_PEM)) {
@@ -669,8 +668,7 @@ bad:
         }
 
         if (client_auth) {
-                SSL_CTX_use_certificate_file(c_ctx, client_cert,
-                    SSL_FILETYPE_PEM);
+                SSL_CTX_use_certificate_chain_file(c_ctx, client_cert);
                 SSL_CTX_use_PrivateKey_file(c_ctx,
                     (client_key ? client_key : client_cert),
                     SSL_FILETYPE_PEM);