215 files changed, 5334 insertions, 3834 deletions

diff --git a/src/lib/libc/include/namespace.h b/src/lib/libc/include/namespace.h
index cc83735b90..9058230429 100644
--- a/src/lib/libc/include/namespace.h
+++ b/src/lib/libc/include/namespace.h
@@ -1,4 +1,4 @@
-/*      $OpenBSD: namespace.h,v 1.17 2025/10/23 19:06:10 miod Exp $     */
+/*      $OpenBSD: namespace.h,v 1.18 2026/06/30 19:18:53 kettenis Exp $ */
 
 #ifndef _LIBC_NAMESPACE_H_
 #define _LIBC_NAMESPACE_H_
@@ -85,11 +85,15 @@
 BUILTIN void    *memmove(void *, const void *, __size_t);
 BUILTIN void    *memcpy(void *__restrict, const void *__restrict, __size_t);
 BUILTIN void    *memset(void *, int, __size_t);
+BUILTIN __size_t strlen(const char *);
+BUILTIN __size_t wcslen(const __wchar_t *);
 BUILTIN void    __stack_smash_handler(const char [], int __unused);
 #if !defined(__clang__)
 PROTO_NORMAL(memmove);
 PROTO_NORMAL(memcpy);
 PROTO_NORMAL(memset);
+PROTO_NORMAL(strlen);
+PROTO_NORMAL(wcslen);
 PROTO_NORMAL(__stack_smash_handler);
 #endif
 #undef  BUILTIN
diff --git a/src/lib/libc/net/getnameinfo.3 b/src/lib/libc/net/getnameinfo.3
index 4e97b5d07b..d71df07ddd 100644
--- a/src/lib/libc/net/getnameinfo.3
+++ b/src/lib/libc/net/getnameinfo.3
@@ -1,4 +1,4 @@
-.\"     $OpenBSD: getnameinfo.3,v 1.49 2022/09/11 06:38:10 jmc Exp $
+.\"     $OpenBSD: getnameinfo.3,v 1.50 2026/08/05 08:23:13 claudio Exp $
 .\"     $KAME: getnameinfo.3,v 1.37 2005/01/05 03:23:05 itojun Exp $
 .\"
 .\" Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
@@ -16,7 +16,7 @@
 .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 .\" PERFORMANCE OF THIS SOFTWARE.
 .\"
-.Dd $Mdocdate: September 11 2022 $
+.Dd $Mdocdate: August 5 2026 $
 .Dt GETNAMEINFO 3
 .Os
 .Sh NAME
@@ -99,9 +99,9 @@ If the host name cannot be found in DNS and this flag is set,
 a non-zero error code is returned.
 If the host name is not found and the flag is not set, the
 address is returned in numeric form.
-.It NI_NUMERICSERV
+.It Dv NI_NUMERICSERV
 The service name is returned as a digit string representing the port number.
-.It NI_DGRAM
+.It Dv NI_DGRAM
 Specifies that the service being looked up is a datagram
 service, and causes
 .Xr getservbyport 3
diff --git a/src/lib/libc/stdlib/hcreate.3 b/src/lib/libc/stdlib/hcreate.3
index 90bde1995f..48dffd4ff8 100644
--- a/src/lib/libc/stdlib/hcreate.3
+++ b/src/lib/libc/stdlib/hcreate.3
@@ -1,4 +1,4 @@
-.\"     $OpenBSD: hcreate.3,v 1.8 2018/01/30 11:37:58 jmc Exp $
+.\"     $OpenBSD: hcreate.3,v 1.9 2026/08/10 22:02:41 daniel Exp $
 .\"     $NetBSD: hcreate.3,v 1.8 2010/05/01 06:18:03 jruoho Exp $
 .\"
 .\" Copyright (c) 1999 The NetBSD Foundation, Inc.
@@ -28,7 +28,7 @@
 .\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 .\" POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd $Mdocdate: January 30 2018 $
+.Dd $Mdocdate: August 10 2026 $
 .Dt HCREATE 3
 .Os
 .Sh NAME
@@ -127,30 +127,6 @@ key must not be modified during the lifetime of the hash table.
 Search the hash table without inserting
 .Fa item .
 .El
-.Pp
-Note that the comparison
-.Fa key
-must be allocated using
-.Xr malloc 3
-or
-.Xr calloc 3
-if action is
-.Dv ENTER
-and
-.Fn hdestroy
-will be called.
-This is because
-.Fn hdestroy
-will call
-.Xr free 3
-for each comparison
-.Fa key
-(but not
-.Fa data ) .
-Typically the comparison
-.Fa key
-is allocated by using
-.Xr strdup 3 .
 .Sh RETURN VALUES
 If successful, the
 .Fn hcreate
@@ -189,7 +165,6 @@ Insufficient memory is available.
 .Sh SEE ALSO
 .Xr bsearch 3 ,
 .Xr lsearch 3 ,
-.Xr malloc 3 ,
 .Xr strcmp 3
 .Sh STANDARDS
 The
@@ -214,21 +189,4 @@ At least the following limitations can be mentioned:
 The interface permits the use of only one hash table at a time.
 .It
 Individual hash table entries can be added, but not deleted.
-.It
-The standard is indecipherable about the
-internal memory usage of the functions,
-mentioning only that
-.Do
-.Fn hcreate
-and
-.Fn hsearch
-functions may use
-.Fn malloc
-to allocate space
-.Dc .
-This limits the portability of the functions,
-given that other implementations may not
-.Xr free 3
-the buffer pointed by
-.Fa key .
 .El
diff --git a/src/lib/libc/stdlib/hcreate.c b/src/lib/libc/stdlib/hcreate.c
index b31108a90e..ca6d8d16c4 100644
--- a/src/lib/libc/stdlib/hcreate.c
+++ b/src/lib/libc/stdlib/hcreate.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: hcreate.c,v 1.7 2016/05/29 20:47:49 guenther Exp $    */
+/*      $OpenBSD: hcreate.c,v 1.8 2026/08/10 22:02:41 daniel Exp $      */
 /*      $NetBSD: hcreate.c,v 1.5 2004/04/23 02:48:12 simonb Exp $       */
 
 /*
@@ -142,7 +142,6 @@ hdestroy(void)
                 while (!SLIST_EMPTY(&htable[idx])) {
                         ie = SLIST_FIRST(&htable[idx]);
                         SLIST_REMOVE_HEAD(&htable[idx], link);
-                        free(ie->ent.key);
                         free(ie);
                 }
         }
diff --git a/src/lib/libc/stdlib/icdb_new.3 b/src/lib/libc/stdlib/icdb_new.3
index 9fc07bda80..d8627fe802 100644
--- a/src/lib/libc/stdlib/icdb_new.3
+++ b/src/lib/libc/stdlib/icdb_new.3
@@ -1,4 +1,4 @@
-.\"     $OpenBSD: icdb_new.3,v 1.2 2016/09/04 19:05:09 jmc Exp $
+.\"     $OpenBSD: icdb_new.3,v 1.3 2026/08/25 05:47:52 jsg Exp $
 .\"
 .\" Copyright (c) Ted Unangst
 .\"
@@ -15,8 +15,8 @@
 .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 .\"
 .\"
-.Dd $Mdocdate: September 4 2016 $
-.Dt ICBB_NEW 3
+.Dd $Mdocdate: August 25 2026 $
+.Dt ICDB_NEW 3
 .Os
 .Sh NAME
 .Nm icdb_new ,
diff --git a/src/lib/libc/stdlib/malloc.3 b/src/lib/libc/stdlib/malloc.3
index ee13b01bd4..f66bd1cbb6 100644
--- a/src/lib/libc/stdlib/malloc.3
+++ b/src/lib/libc/stdlib/malloc.3
@@ -30,9 +30,9 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.\"     $OpenBSD: malloc.3,v 1.147 2025/06/04 00:38:01 yasuoka Exp $
+.\"     $OpenBSD: malloc.3,v 1.148 2026/08/22 12:22:16 schwarze Exp $
 .\"
-.Dd $Mdocdate: June 4 2025 $
+.Dd $Mdocdate: August 22 2026 $
 .Dt MALLOC 3
 .Os
 .Sh NAME
@@ -315,6 +315,76 @@ or
 to record deeper call stacks.
 These malloc options imply
 .Cm D .
+.Pp
+The report begins with a header line showing the following integer variables:
+.Pp
+.Bl -tag -width Ds -compact
+.It M
+the number of pools used
+.It I
+internal
+.Fn recallocarray
+and
+.Fn freezero
+used (0 or 1)
+.It F
+whether the
+.Cm F Dq freecheck
+option is used (0 or 1)
+.It U
+whether the
+.Cm U Dq free unmap
+option is used (0 or 1)
+.It J
+the number of
+.Cm J Dq junking
+options used (0, 1, or 2)
+.It R
+whether the
+.Cm R Dq realloc
+option is used (0 or 1)
+.It X
+whether the
+.Cm X Dq xmalloc
+option is used (0 or 1)
+.It C
+whether the
+.Cm C Dq canaries
+option is used (0 or 1)
+.It cache
+the cache size in pages
+.It G
+the size of guard pages in bytes (0 or
+.Dv MALLOC_PAGESIZE )
+.El
+.Pp
+The leak report consists of five columns:
+.Pp
+.Bl -bullet -compact
+.It
+the address from where the allocation function was called
+.It
+the total number of bytes leaked from that location
+.It
+the number of allocations leaked from that location
+.It
+the average size in bytes per leak from that location,
+i.e. the quotient of the two preceding columns
+.It
+an
+.Xr addr2line 1
+invocation using the pathname of the object file calling
+the allocation function and the offset from where it is called
+to find the source file name and line number of the call site
+.El
+.Pp
+With malloc options
+.Cm 2 ,
+.Cm 3 ,
+or
+.Cm 4 ,
+each line of the leak report is followed by 1, 2, or 3 additional lines,
+respectively, giving the addresses, pathnames and offsets of indirect callers.
 .It Cm F
 .Dq Freecheck .
 Enable more extensive double free and write after free detection.
diff --git a/src/lib/libc/string/memmem.c b/src/lib/libc/string/memmem.c
index 3b180b4a62..e87c7be37a 100644
--- a/src/lib/libc/string/memmem.c
+++ b/src/lib/libc/string/memmem.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: memmem.c,v 1.5 2020/04/16 12:39:28 claudio Exp $ */
+/*      $OpenBSD: memmem.c,v 1.6 2026/06/23 13:09:11 tim Exp $ */
 
 /*
  * Copyright (c) 2005-2020 Rich Felker, et al.
@@ -38,8 +38,8 @@ twobyte_memmem(const unsigned char *h, size_t k, const unsigned char *n)
 static char *
 threebyte_memmem(const unsigned char *h, size_t k, const unsigned char *n)
 {
-        uint32_t nw = n[0]<<24 | n[1]<<16 | n[2]<<8;
-        uint32_t hw = h[0]<<24 | h[1]<<16 | h[2]<<8;
+        uint32_t nw = (uint32_t)n[0]<<24 | n[1]<<16 | n[2]<<8;
+        uint32_t hw = (uint32_t)h[0]<<24 | h[1]<<16 | h[2]<<8;
         for (h+=3, k-=3; k; k--, hw = (hw|*h++)<<8)
                 if (hw == nw) return (char *)h-3;
         return hw == nw ? (char *)h-3 : 0;
@@ -48,8 +48,8 @@ threebyte_memmem(const unsigned char *h, size_t k, const unsigned char *n)
 static char *
 fourbyte_memmem(const unsigned char *h, size_t k, const unsigned char *n)
 {
-        uint32_t nw = n[0]<<24 | n[1]<<16 | n[2]<<8 | n[3];
-        uint32_t hw = h[0]<<24 | h[1]<<16 | h[2]<<8 | h[3];
+        uint32_t nw = (uint32_t)n[0]<<24 | n[1]<<16 | n[2]<<8 | n[3];
+        uint32_t hw = (uint32_t)h[0]<<24 | h[1]<<16 | h[2]<<8 | h[3];
         for (h+=4, k-=4; k; k--, hw = hw<<8 | *h++)
                 if (hw == nw) return (char *)h-4;
         return hw == nw ? (char *)h-4 : 0;
diff --git a/src/lib/libc/string/strlen.c b/src/lib/libc/string/strlen.c
index a5721d3e7f..cf3cd8cf86 100644
--- a/src/lib/libc/string/strlen.c
+++ b/src/lib/libc/string/strlen.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: strlen.c,v 1.9 2015/08/31 02:53:57 guenther Exp $     */
+/*      $OpenBSD: strlen.c,v 1.10 2026/06/30 19:18:54 kettenis Exp $    */
 
 /*-
  * Copyright (c) 1990, 1993
@@ -41,4 +41,4 @@ strlen(const char *str)
         return (s - str);
 }
 
-DEF_STRONG(strlen);
+DEF_BUILTIN(strlen);
diff --git a/src/lib/libc/string/strstr.c b/src/lib/libc/string/strstr.c
index 241a080e7a..f5f460a251 100644
--- a/src/lib/libc/string/strstr.c
+++ b/src/lib/libc/string/strstr.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: strstr.c,v 1.9 2020/04/16 12:37:52 claudio Exp $ */
+/*      $OpenBSD: strstr.c,v 1.11 2026/06/23 13:10:40 tim Exp $ */
 
 /*
  * Copyright (c) 2005-2018 Rich Felker
@@ -37,8 +37,8 @@ twobyte_strstr(const unsigned char *h, const unsigned char *n)
 static char *
 threebyte_strstr(const unsigned char *h, const unsigned char *n)
 {
-        uint32_t nw = n[0]<<24 | n[1]<<16 | n[2]<<8;
-        uint32_t hw = h[0]<<24 | h[1]<<16 | h[2]<<8;
+        uint32_t nw = (uint32_t)n[0]<<24 | n[1]<<16 | n[2]<<8;
+        uint32_t hw = (uint32_t)h[0]<<24 | h[1]<<16 | h[2]<<8;
         for (h+=2; *h && hw != nw; hw = (hw|*++h)<<8);
         return *h ? (char *)h-2 : 0;
 }
@@ -46,8 +46,8 @@ threebyte_strstr(const unsigned char *h, const unsigned char *n)
 static char *
 fourbyte_strstr(const unsigned char *h, const unsigned char *n)
 {
-        uint32_t nw = n[0]<<24 | n[1]<<16 | n[2]<<8 | n[3];
-        uint32_t hw = h[0]<<24 | h[1]<<16 | h[2]<<8 | h[3];
+        uint32_t nw = (uint32_t)n[0]<<24 | n[1]<<16 | n[2]<<8 | n[3];
+        uint32_t hw = (uint32_t)h[0]<<24 | h[1]<<16 | h[2]<<8 | h[3];
         for (h+=3; *h && hw != nw; hw = hw<<8 | *++h);
         return *h ? (char *)h-3 : 0;
 }
@@ -129,7 +129,7 @@ twoway_strstr(const unsigned char *h, const unsigned char *n)
         for (;;) {
                 /* Update incremental end-of-haystack pointer */
                 if (z-h < l) {
-                        /* Fast estimate for MIN(l,63) */
+                        /* Fast estimate for MAX(l,63) */
                         size_t grow = l | 63;
                         const unsigned char *z2 = memchr(z, 0, grow);
                         if (z2) {
diff --git a/src/lib/libc/string/wcslen.c b/src/lib/libc/string/wcslen.c
index 16d4bba128..937d352e31 100644
--- a/src/lib/libc/string/wcslen.c
+++ b/src/lib/libc/string/wcslen.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: wcslen.c,v 1.4 2015/09/12 16:23:14 guenther Exp $     */
+/*      $OpenBSD: wcslen.c,v 1.5 2026/06/30 19:18:54 kettenis Exp $     */
 /*      $NetBSD: wcslen.c,v 1.2 2001/01/03 14:29:36 lukem Exp $ */
 
 /*-
@@ -42,4 +42,4 @@ wcslen(const wchar_t *s)
 
         return p - s;
 }
-DEF_STRONG(wcslen);
+DEF_BUILTIN(wcslen);
diff --git a/src/lib/libcrypto/aes/aes.c b/src/lib/libcrypto/aes/aes.c
index 9cffe6b7cd..db693d2dd8 100644
--- a/src/lib/libcrypto/aes/aes.c
+++ b/src/lib/libcrypto/aes/aes.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: aes.c,v 1.17 2025/09/15 07:36:12 tb Exp $ */
+/* $OpenBSD: aes.c,v 1.19 2026/07/31 03:59:50 kenjiro Exp $ */
 /* ====================================================================
  * Copyright (c) 2002-2006 The OpenSSL Project.  All rights reserved.
  *
@@ -55,6 +55,7 @@
 #include <openssl/crypto.h>
 #include <openssl/modes.h>
 
+#include "aes_local.h"
 #include "crypto_arch.h"
 #include "crypto_internal.h"
 #include "modes_local.h"
@@ -135,7 +136,7 @@ aes_encrypt_block128(const unsigned char *in, unsigned char *out, const void *ke
         aes_encrypt_internal(in, out, key);
 }
 
-void
+static void
 aes_decrypt_block128(const unsigned char *in, unsigned char *out, const void *key)
 {
         aes_decrypt_internal(in, out, key);
diff --git a/src/lib/libcrypto/aes/asm/aes-586.pl b/src/lib/libcrypto/aes/asm/aes-586.pl
index 402a1a3c46..cd565896fe 100644
--- a/src/lib/libcrypto/aes/asm/aes-586.pl
+++ b/src/lib/libcrypto/aes/asm/aes-586.pl
@@ -166,7 +166,7 @@
 # effectively slow down the operation by several *orders* of magnitute,
 # by ratio of time slice to duration of handful of AES rounds, which
 # unlikely to remain unnoticed. Not to mention that this also means
-# that he would spend correspondigly more time to collect enough
+# that he would spend correspondingly more time to collect enough
 # statistical data to mount the attack. It's probably appropriate to
 # say that if adeversary reckons that this attack is beneficial and
 # risks to be noticed, you probably have larger problems having him
diff --git a/src/lib/libcrypto/arch/aarch64/crypto_cpu_caps.c b/src/lib/libcrypto/arch/aarch64/crypto_cpu_caps.c
index b31a50ef75..5022bed262 100644
--- a/src/lib/libcrypto/arch/aarch64/crypto_cpu_caps.c
+++ b/src/lib/libcrypto/arch/aarch64/crypto_cpu_caps.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: crypto_cpu_caps.c,v 1.2 2024/11/12 13:52:31 jsing Exp $ */
+/* $OpenBSD: crypto_cpu_caps.c,v 1.5 2026/08/08 21:37:19 naddy Exp $ */
 /*
  * Copyright (c) 2023 Joel Sing <jsing@openbsd.org>
  *
@@ -15,10 +15,7 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-#include <sys/types.h>
-#include <sys/sysctl.h>
-
-#include <machine/cpu.h>
+#include <sys/auxv.h>
 
 #include <stddef.h>
 #include <stdio.h>
@@ -28,70 +25,29 @@
 /* Machine dependent CPU capabilities. */
 uint64_t crypto_cpu_caps_aarch64;
 
-static inline uint64_t
-extract_bits(uint64_t val, int start, int end)
-{
-        return (val >> end) & (1ULL << (1 + start - end)) - 1;
-}
-
-static uint64_t
-parse_isar0(uint64_t isar0)
+void
+crypto_cpu_caps_init(void)
 {
-        uint64_t caps = 0;
-        uint64_t feature;
-
-        /* AES - bits [7:4] */
-        feature = extract_bits(isar0, 7, 4);
-        if (feature >= 1)
-                caps |= CRYPTO_CPU_CAPS_AARCH64_AES;
-        if (feature >= 2)
-                caps |= CRYPTO_CPU_CAPS_AARCH64_PMULL;
-
-        /* SHA1 - bits [11:8] */
-        feature = extract_bits(isar0, 11, 8);
-        if (feature >= 1)
-                caps |= CRYPTO_CPU_CAPS_AARCH64_SHA1;
-
-        /* SHA2 - bits [15:12] */
-        feature = extract_bits(isar0, 15, 12);
-        if (feature >= 1)
-                caps |= CRYPTO_CPU_CAPS_AARCH64_SHA2;
-        if (feature >= 2)
-                caps |= CRYPTO_CPU_CAPS_AARCH64_SHA512;
-
-        /* SHA3 - bits [35:32] */
-        feature = extract_bits(isar0, 35, 32);
-        if (feature >= 1)
-                caps |= CRYPTO_CPU_CAPS_AARCH64_SHA3;
+        unsigned long hwcap;
 
-        return caps;
-}
+        if (elf_aux_info(AT_HWCAP, &hwcap, sizeof(hwcap)) != 0)
+                return;
 
-static int
-read_isar0(uint64_t *isar0)
-{
-        uint64_t isar;
-        int mib[2];
-        size_t len;
+        if (hwcap & HWCAP_AES)
+                crypto_cpu_caps_aarch64 |= CRYPTO_CPU_CAPS_AARCH64_AES;
 
-        mib[0] = CTL_MACHDEP;
-        mib[1] = CPU_ID_AA64ISAR0;
-        len = sizeof(isar);
-        if (sysctl(mib, 2, &isar, &len, NULL, 0) == -1)
-                return 0;
+        if (hwcap & HWCAP_PMULL)
+                crypto_cpu_caps_aarch64 |= CRYPTO_CPU_CAPS_AARCH64_PMULL;
 
-        *isar0 = isar;
+        if (hwcap & HWCAP_SHA1)
+                crypto_cpu_caps_aarch64 |= CRYPTO_CPU_CAPS_AARCH64_SHA1;
 
-        return 1;
-}
+        if (hwcap & HWCAP_SHA2)
+                crypto_cpu_caps_aarch64 |= CRYPTO_CPU_CAPS_AARCH64_SHA2;
 
-void
-crypto_cpu_caps_init(void)
-{
-        uint64_t isar = 0;
-
-        if (!read_isar0(&isar))
-                return;
+        if (hwcap & HWCAP_SHA512)
+                crypto_cpu_caps_aarch64 |= CRYPTO_CPU_CAPS_AARCH64_SHA512;
 
-        crypto_cpu_caps_aarch64 = parse_isar0(isar);
+        if (hwcap & HWCAP_SHA3)
+                crypto_cpu_caps_aarch64 |= CRYPTO_CPU_CAPS_AARCH64_SHA3;
 }
diff --git a/src/lib/libcrypto/asn1/a_int.c b/src/lib/libcrypto/asn1/a_int.c
index f171e330f6..5d05c2022c 100644
--- a/src/lib/libcrypto/asn1/a_int.c
+++ b/src/lib/libcrypto/asn1/a_int.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: a_int.c,v 1.49 2025/05/10 05:54:38 tb Exp $ */
+/* $OpenBSD: a_int.c,v 1.50 2026/07/31 00:50:52 kenjiro Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -65,6 +65,7 @@
 #include <openssl/bn.h>
 #include <openssl/buffer.h>
 
+#include "asn1_local.h"
 #include "bytestring.h"
 #include "err_local.h"
 
diff --git a/src/lib/libcrypto/asn1/a_mbstr.c b/src/lib/libcrypto/asn1/a_mbstr.c
index 38398ad1d1..21368543ce 100644
--- a/src/lib/libcrypto/asn1/a_mbstr.c
+++ b/src/lib/libcrypto/asn1/a_mbstr.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: a_mbstr.c,v 1.28 2025/05/10 05:54:38 tb Exp $ */
+/* $OpenBSD: a_mbstr.c,v 1.29 2026/06/09 12:29:47 tb Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 1999.
  */
@@ -57,6 +57,7 @@
  */
 
 #include <ctype.h>
+#include <limits.h>
 #include <stdio.h>
 #include <string.h>
 
@@ -105,8 +106,16 @@ ASN1_mbstring_ncopy(ASN1_STRING **out, const unsigned char *in, int len,
         int nchar;
         int (*cpyfunc)(unsigned long, void *) = NULL;
 
-        if (len < 0)
-                len = strlen((const char *)in);
+        if (len < 0) {
+                size_t length;
+
+                if ((length = strlen((const char *)in)) >= INT_MAX) {
+                        ASN1error(ASN1_R_STRING_TOO_LONG);
+                        return -1;
+                }
+                len = length;
+        }
+
         if (!mask)
                 mask = DIRSTRING_TYPE;
 
@@ -221,11 +230,19 @@ ASN1_mbstring_ncopy(ASN1_STRING **out, const unsigned char *in, int len,
                 break;
 
         case MBSTRING_BMP:
+                if (nchar > INT_MAX / 2) {
+                        ASN1error(ASN1_R_STRING_TOO_LONG);
+                        goto err;
+                }
                 outlen = nchar << 1;
                 cpyfunc = cpy_bmp;
                 break;
 
         case MBSTRING_UNIV:
+                if (nchar > INT_MAX / 4) {
+                        ASN1error(ASN1_R_STRING_TOO_LONG);
+                        goto err;
+                }
                 outlen = nchar << 2;
                 cpyfunc = cpy_univ;
                 break;
diff --git a/src/lib/libcrypto/asn1/a_time_posix.c b/src/lib/libcrypto/asn1/a_time_posix.c
index d4439b4701..da21ae7cbc 100644
--- a/src/lib/libcrypto/asn1/a_time_posix.c
+++ b/src/lib/libcrypto/asn1/a_time_posix.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: a_time_posix.c,v 1.5 2024/02/18 16:28:38 tb Exp $ */
+/* $OpenBSD: a_time_posix.c,v 1.6 2026/07/31 00:50:52 kenjiro Exp $ */
 /*
  * Copyright (c) 2022, Google Inc.
  * Copyright (c) 2022, Bob Beck <beck@obtuse.com>
@@ -30,6 +30,7 @@
 #include <openssl/asn1.h>
 #include <openssl/posix_time.h>
 
+#include "asn1_local.h"
 #include "crypto_internal.h"
 
 #define SECS_PER_HOUR (int64_t)(60 * 60)
diff --git a/src/lib/libcrypto/asn1/a_time_tm.c b/src/lib/libcrypto/asn1/a_time_tm.c
index dd2893167f..b5210641a6 100644
--- a/src/lib/libcrypto/asn1/a_time_tm.c
+++ b/src/lib/libcrypto/asn1/a_time_tm.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: a_time_tm.c,v 1.43 2025/05/10 05:54:38 tb Exp $ */
+/* $OpenBSD: a_time_tm.c,v 1.44 2026/07/31 00:50:52 kenjiro Exp $ */
 /*
  * Copyright (c) 2015 Bob Beck <beck@openbsd.org>
  *
@@ -26,6 +26,7 @@
 #include "asn1_local.h"
 #include "bytestring.h"
 #include "err_local.h"
+#include "x509_internal.h"
 
 #define RFC5280 0
 #define GENTIME_LENGTH 15
diff --git a/src/lib/libcrypto/asn1/a_type.c b/src/lib/libcrypto/asn1/a_type.c
index 0615de1ccb..3f9157de4a 100644
--- a/src/lib/libcrypto/asn1/a_type.c
+++ b/src/lib/libcrypto/asn1/a_type.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: a_type.c,v 1.29 2025/12/05 14:19:27 tb Exp $ */
+/* $OpenBSD: a_type.c,v 1.30 2026/09/02 07:01:54 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -119,6 +119,7 @@ ASN1_TYPE_get(const ASN1_TYPE *a)
 }
 LCRYPTO_ALIAS(ASN1_TYPE_get);
 
+/* XXX - add ASN1_TYPE_set0() for internal use? */
 void
 ASN1_TYPE_set(ASN1_TYPE *a, int type, void *value)
 {
diff --git a/src/lib/libcrypto/asn1/asn1_gen.c b/src/lib/libcrypto/asn1/asn1_gen.c
index b409e83c7d..bb58843bbf 100644
--- a/src/lib/libcrypto/asn1/asn1_gen.c
+++ b/src/lib/libcrypto/asn1/asn1_gen.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: asn1_gen.c,v 1.28 2025/05/10 05:54:38 tb Exp $ */
+/* $OpenBSD: asn1_gen.c,v 1.35 2026/09/02 07:15:01 tb Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 2002.
  */
@@ -436,57 +436,63 @@ parse_tagging(const char *vstart, int vlen, int *ptag, int *pclass)
 static ASN1_TYPE *
 asn1_multi(int utype, const char *section, X509V3_CTX *cnf)
 {
-        ASN1_TYPE *ret = NULL;
         STACK_OF(ASN1_TYPE) *sk = NULL;
         STACK_OF(CONF_VALUE) *sect = NULL;
+        ASN1_TYPE *ret = NULL, *typ = NULL;
+        ASN1_STRING *astr = NULL;
         unsigned char *der = NULL;
         int derlen;
         int i;
-        sk = sk_ASN1_TYPE_new_null();
-        if (!sk)
-                goto bad;
-        if (section) {
-                if (!cnf)
-                        goto bad;
-                sect = X509V3_get0_section(cnf, section);
-                if (!sect)
-                        goto bad;
+
+        if ((sk = sk_ASN1_TYPE_new_null()) == NULL)
+                goto err;
+
+        if (section != NULL) {
+                if (cnf == NULL)
+                        goto err;
+
+                if ((sect = X509V3_get0_section(cnf, section)) == NULL)
+                        goto err;
+
                 for (i = 0; i < sk_CONF_VALUE_num(sect); i++) {
-                        ASN1_TYPE *typ = ASN1_generate_v3(
-                            sk_CONF_VALUE_value(sect, i)->value, cnf);
-                        if (!typ)
-                                goto bad;
-                        if (!sk_ASN1_TYPE_push(sk, typ))
-                                goto bad;
+                        CONF_VALUE *val = sk_CONF_VALUE_value(sect, i);
+
+                        if ((typ = ASN1_generate_v3(val->value, cnf)) == NULL)
+                                goto err;
+                        if (sk_ASN1_TYPE_push(sk, typ) <= 0)
+                                goto err;
+                        typ = NULL;
                 }
         }
 
-        /* Now we has a STACK of the components, convert to the correct form */
-
+        /* DER encode the stack as a SET or a SEQUENCE per utype. */
         if (utype == V_ASN1_SET)
                 derlen = i2d_ASN1_SET_ANY(sk, &der);
         else
                 derlen = i2d_ASN1_SEQUENCE_ANY(sk, &der);
 
         if (derlen < 0)
-                goto bad;
-
-        if (!(ret = ASN1_TYPE_new()))
-                goto bad;
+                goto err;
 
-        if (!(ret->value.asn1_string = ASN1_STRING_type_new(utype)))
-                goto bad;
+        if ((astr = ASN1_STRING_type_new(utype)) == NULL)
+                goto err;
+        ASN1_STRING_set0(astr, der, derlen);
+        der = NULL;
+        derlen = 0;
 
-        ret->type = utype;
+        if ((typ = ASN1_TYPE_new()) == NULL)
+                goto err;
+        ASN1_TYPE_set(typ, utype, astr);
+        astr = NULL;
 
-        ret->value.asn1_string->data = der;
-        ret->value.asn1_string->length = derlen;
+        ret = typ;
+        typ = NULL;
 
-        der = NULL;
-
- bad:
-        free(der);
+ err:
         sk_ASN1_TYPE_pop_free(sk, ASN1_TYPE_free);
+        ASN1_TYPE_free(typ);
+        ASN1_STRING_free(astr);
+        free(der);
 
         return ret;
 }
diff --git a/src/lib/libcrypto/asn1/asn1_lib.c b/src/lib/libcrypto/asn1/asn1_lib.c
index ac8da0e61d..6d65dc9d68 100644
--- a/src/lib/libcrypto/asn1/asn1_lib.c
+++ b/src/lib/libcrypto/asn1/asn1_lib.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: asn1_lib.c,v 1.54 2022/05/05 19:18:56 jsing Exp $ */
+/* $OpenBSD: asn1_lib.c,v 1.55 2026/07/31 00:50:52 kenjiro Exp $ */
 /*
  * Copyright (c) 2021 Joel Sing <jsing@openbsd.org>
  *
@@ -18,6 +18,7 @@
 #include <limits.h>
 #include <stdlib.h>
 
+#include "asn1_local.h"
 #include "bytestring.h"
 
 int
diff --git a/src/lib/libcrypto/asn1/asn1_local.h b/src/lib/libcrypto/asn1/asn1_local.h
index d61cfaa7b9..723c6574df 100644
--- a/src/lib/libcrypto/asn1/asn1_local.h
+++ b/src/lib/libcrypto/asn1/asn1_local.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: asn1_local.h,v 1.11 2025/11/26 10:19:57 tb Exp $ */
+/* $OpenBSD: asn1_local.h,v 1.12 2026/07/31 00:50:52 kenjiro Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 2006.
  */
@@ -59,6 +59,8 @@
 #ifndef HEADER_ASN1_LOCAL_H
 #define HEADER_ASN1_LOCAL_H
 
+#include <openssl/asn1.h>
+
 #include "bytestring.h"
 
 __BEGIN_HIDDEN_DECLS
diff --git a/src/lib/libcrypto/asn1/asn1_types.c b/src/lib/libcrypto/asn1/asn1_types.c
index 5f9644a718..712c2297fb 100644
--- a/src/lib/libcrypto/asn1/asn1_types.c
+++ b/src/lib/libcrypto/asn1/asn1_types.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: asn1_types.c,v 1.3 2023/07/05 21:23:36 beck Exp $ */
+/* $OpenBSD: asn1_types.c,v 1.4 2026/07/31 00:50:52 kenjiro Exp $ */
 /*
  * Copyright (c) 2021 Joel Sing <jsing@openbsd.org>
  *
@@ -19,6 +19,8 @@
 
 #include <openssl/asn1.h>
 
+#include "asn1_local.h"
+
 #define ASN1_ENCODING_CONSTRUCTED_ONLY  1
 #define ASN1_ENCODING_PRIMITIVE_ONLY    2
 
diff --git a/src/lib/libcrypto/asn1/bio_asn1.c b/src/lib/libcrypto/asn1/bio_asn1.c
index b9f54cd4ef..acd0f4f146 100644
--- a/src/lib/libcrypto/asn1/bio_asn1.c
+++ b/src/lib/libcrypto/asn1/bio_asn1.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: bio_asn1.c,v 1.23 2023/07/28 09:58:30 tb Exp $ */
+/* $OpenBSD: bio_asn1.c,v 1.24 2026/07/31 00:50:52 kenjiro Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project.
  */
@@ -67,6 +67,7 @@
 #include <openssl/bio.h>
 #include <openssl/asn1.h>
 
+#include "asn1_local.h"
 #include "bio_local.h"
 
 #define BIO_C_SET_PREFIX                        149
diff --git a/src/lib/libcrypto/asn1/tasn_prn.c b/src/lib/libcrypto/asn1/tasn_prn.c
index 4db6d61111..61b11dd542 100644
--- a/src/lib/libcrypto/asn1/tasn_prn.c
+++ b/src/lib/libcrypto/asn1/tasn_prn.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: tasn_prn.c,v 1.29 2025/06/07 09:28:00 tb Exp $ */
+/* $OpenBSD: tasn_prn.c,v 1.30 2026/05/16 07:06:35 tb Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 2000.
  */
@@ -392,7 +392,7 @@ asn1_print_obstring_ctx(BIO *out, ASN1_STRING *str, int indent,
         } else if (BIO_puts(out, "\n") <= 0)
                 return 0;
         if ((str->length > 0) &&
-            BIO_dump_indent(out, (char *)str->data, str->length,
+            BIO_dump_indent(out, (const char *)str->data, str->length,
             indent + 2) <= 0)
                 return 0;
         return 1;
diff --git a/src/lib/libcrypto/asn1/tasn_typ.c b/src/lib/libcrypto/asn1/tasn_typ.c
index 64faad7240..a30a06918d 100644
--- a/src/lib/libcrypto/asn1/tasn_typ.c
+++ b/src/lib/libcrypto/asn1/tasn_typ.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: tasn_typ.c,v 1.21 2025/08/22 14:07:34 tb Exp $ */
+/* $OpenBSD: tasn_typ.c,v 1.22 2026/07/31 00:50:52 kenjiro Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 2000.
  */
@@ -59,6 +59,8 @@
 #include <openssl/asn1.h>
 #include <openssl/asn1t.h>
 
+#include "asn1_local.h"
+
 /* Declarations for string types */
 
 const ASN1_ITEM ASN1_NULL_it = {
diff --git a/src/lib/libcrypto/asn1/tasn_utl.c b/src/lib/libcrypto/asn1/tasn_utl.c
index 178a364c89..69b2187357 100644
--- a/src/lib/libcrypto/asn1/tasn_utl.c
+++ b/src/lib/libcrypto/asn1/tasn_utl.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: tasn_utl.c,v 1.19 2025/05/10 05:54:38 tb Exp $ */
+/* $OpenBSD: tasn_utl.c,v 1.20 2026/07/31 00:50:52 kenjiro Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 2000.
  */
@@ -64,6 +64,7 @@
 #include <openssl/asn1t.h>
 #include <openssl/objects.h>
 
+#include "asn1_local.h"
 #include "bytestring.h"
 #include "err_local.h"
 
diff --git a/src/lib/libcrypto/asn1/x_crl.c b/src/lib/libcrypto/asn1/x_crl.c
index d95b044a89..0b8631e65d 100644
--- a/src/lib/libcrypto/asn1/x_crl.c
+++ b/src/lib/libcrypto/asn1/x_crl.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: x_crl.c,v 1.52 2026/04/07 12:52:19 tb Exp $ */
+/* $OpenBSD: x_crl.c,v 1.53 2026/06/23 08:28:06 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -326,7 +326,7 @@ crl_cb(int operation, ASN1_VALUE **pval, const ASN1_ITEM *it, void *exarg)
                                 if (nid == NID_issuing_distribution_point ||
                                     nid == NID_authority_key_identifier ||
                                     nid == NID_delta_crl)
-                                        break;
+                                        continue;
                                 crl->flags |= EXFLAG_CRITICAL;
                                 break;
                         }
diff --git a/src/lib/libcrypto/bio/bio_meth.c b/src/lib/libcrypto/bio/bio_meth.c
index 37f866a0c4..8c3435d9e1 100644
--- a/src/lib/libcrypto/bio/bio_meth.c
+++ b/src/lib/libcrypto/bio/bio_meth.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: bio_meth.c,v 1.9 2023/07/05 21:23:37 beck Exp $       */
+/*      $OpenBSD: bio_meth.c,v 1.10 2026/06/22 09:25:17 tb Exp $        */
 /*
  * Copyright (c) 2018 Theo Buehler <tb@openbsd.org>
  *
@@ -51,9 +51,9 @@ int
 LCRYPTO_ALIAS(BIO_meth_get_write);
 
 int
-BIO_meth_set_write(BIO_METHOD *biom, int (*write)(BIO *, const char *, int))
+BIO_meth_set_write(BIO_METHOD *biom, int (*bwrite)(BIO *, const char *, int))
 {
-        biom->bwrite = write;
+        biom->bwrite = bwrite;
         return 1;
 }
 LCRYPTO_ALIAS(BIO_meth_set_write);
@@ -66,9 +66,9 @@ int
 LCRYPTO_ALIAS(BIO_meth_get_read);
 
 int
-BIO_meth_set_read(BIO_METHOD *biom, int (*read)(BIO *, char *, int))
+BIO_meth_set_read(BIO_METHOD *biom, int (*bread)(BIO *, char *, int))
 {
-        biom->bread = read;
+        biom->bread = bread;
         return 1;
 }
 LCRYPTO_ALIAS(BIO_meth_set_read);
@@ -81,9 +81,9 @@ int
 LCRYPTO_ALIAS(BIO_meth_get_puts);
 
 int
-BIO_meth_set_puts(BIO_METHOD *biom, int (*puts)(BIO *, const char *))
+BIO_meth_set_puts(BIO_METHOD *biom, int (*bputs)(BIO *, const char *))
 {
-        biom->bputs = puts;
+        biom->bputs = bputs;
         return 1;
 }
 LCRYPTO_ALIAS(BIO_meth_set_puts);
@@ -96,9 +96,9 @@ int
 LCRYPTO_ALIAS(BIO_meth_get_gets);
 
 int
-BIO_meth_set_gets(BIO_METHOD *biom, int (*gets)(BIO *, char *, int))
+BIO_meth_set_gets(BIO_METHOD *biom, int (*bgets)(BIO *, char *, int))
 {
-        biom->bgets = gets;
+        biom->bgets = bgets;
         return 1;
 }
 LCRYPTO_ALIAS(BIO_meth_set_gets);
diff --git a/src/lib/libcrypto/bn/bn_const.c b/src/lib/libcrypto/bn/bn_const.c
index 389e95ca15..746e1f269a 100644
--- a/src/lib/libcrypto/bn/bn_const.c
+++ b/src/lib/libcrypto/bn/bn_const.c
@@ -1,8 +1,10 @@
-/* $OpenBSD: bn_const.c,v 1.9 2026/01/23 08:29:04 tb Exp $ */
+/* $OpenBSD: bn_const.c,v 1.10 2026/07/31 00:50:52 kenjiro Exp $ */
 /* Insert boilerplate */
 
 #include <openssl/bn.h>
 
+#include "bn_local.h"
+
 /*
  * "First Oakley Default Group" from RFC2409, section 6.1.
  *
diff --git a/src/lib/libcrypto/buffer/buffer.c b/src/lib/libcrypto/buffer/buffer.c
index 4a0c17c598..d6e3fa7f7f 100644
--- a/src/lib/libcrypto/buffer/buffer.c
+++ b/src/lib/libcrypto/buffer/buffer.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: buffer.c,v 1.29 2025/05/10 05:54:38 tb Exp $ */
+/* $OpenBSD: buffer.c,v 1.30 2026/07/31 01:05:27 kenjiro Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -133,24 +133,3 @@ BUF_MEM_grow_clean(BUF_MEM *str, size_t len)
         return (len);
 }
 LCRYPTO_ALIAS(BUF_MEM_grow_clean);
-
-void
-BUF_reverse(unsigned char *out, const unsigned char *in, size_t size)
-{
-        size_t i;
-
-        if (in) {
-                out += size - 1;
-                for (i = 0; i < size; i++)
-                        *out-- = *in++;
-        } else {
-                unsigned char *q;
-                char c;
-                q = out + size - 1;
-                for (i = 0; i < size / 2; i++) {
-                        c = *q;
-                        *q-- = *out;
-                        *out++ = c;
-                }
-        }
-}
diff --git a/src/lib/libcrypto/cert.pem b/src/lib/libcrypto/cert.pem
index c086041e28..dc75965828 100644
--- a/src/lib/libcrypto/cert.pem
+++ b/src/lib/libcrypto/cert.pem
@@ -1,4 +1,4 @@
-# $OpenBSD: cert.pem,v 1.34 2026/03/18 21:50:06 sthen Exp $
+# $OpenBSD: cert.pem,v 1.36 2026/08/20 16:22:21 sthen Exp $
 ### /C=ES/CN=Autoridad de Certificacion Firmaprofesional CIF A62634068
 
 === /C=ES/CN=Autoridad de Certificacion Firmaprofesional CIF A62634068
@@ -265,169 +265,6 @@ LysRJyU3eExRarDzzFhdFPFqSBX/wge2sY0PjlxQRrM9vwGYT7JZVEc+NHt4bVaT
 LnPqZih4zR0Uv6CPLy64Lo7yFIrM6bV8+2ydDKXhlg==
 -----END CERTIFICATE-----
 
-### AffirmTrust
-
-=== /C=US/O=AffirmTrust/CN=AffirmTrust Commercial
-Certificate:
-    Data:
-        Version: 3 (0x2)
-        Serial Number: 8608355977964138876 (0x7777062726a9b17c)
-    Signature Algorithm: sha256WithRSAEncryption
-        Validity
-            Not Before: Jan 29 14:06:06 2010 GMT
-            Not After : Dec 31 14:06:06 2030 GMT
-        Subject: C=US, O=AffirmTrust, CN=AffirmTrust Commercial
-        X509v3 extensions:
-            X509v3 Subject Key Identifier:
-                9D:93:C6:53:8B:5E:CA:AF:3F:9F:1E:0F:E5:99:95:BC:24:F6:94:8F
-            X509v3 Basic Constraints: critical
-                CA:TRUE
-            X509v3 Key Usage: critical
-                Certificate Sign, CRL Sign
-SHA1 Fingerprint=F9:B5:B6:32:45:5F:9C:BE:EC:57:5F:80:DC:E9:6E:2C:C7:B2:78:B7
-SHA256 Fingerprint=03:76:AB:1D:54:C5:F9:80:3C:E4:B2:E2:01:A0:EE:7E:EF:7B:57:B6:36:E8:A9:3C:9B:8D:48:60:C9:6F:5F:A7
------BEGIN CERTIFICATE-----
-MIIDTDCCAjSgAwIBAgIId3cGJyapsXwwDQYJKoZIhvcNAQELBQAwRDELMAkGA1UE
-BhMCVVMxFDASBgNVBAoMC0FmZmlybVRydXN0MR8wHQYDVQQDDBZBZmZpcm1UcnVz
-dCBDb21tZXJjaWFsMB4XDTEwMDEyOTE0MDYwNloXDTMwMTIzMTE0MDYwNlowRDEL
-MAkGA1UEBhMCVVMxFDASBgNVBAoMC0FmZmlybVRydXN0MR8wHQYDVQQDDBZBZmZp
-cm1UcnVzdCBDb21tZXJjaWFsMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
-AQEA9htPZwcroRX1BiLLHwGy43NFBkRJLLtJJRTWzsO3qyxPxkEylFf6EqdbDuKP
-Hx6GGaeqtS25Xw2Kwq+FNXkyLbscYjfysVtKPcrNcV/pQr6U6Mje+SJIZMblq8Yr
-ba0F8PrVC8+a5fBQpIs7R6UjW3p6+DM/uO+Zl+MgwdYoic+U+7lF7eNAFxHUdPAL
-MeIrJmqbTFeurCA+ukV6BfO9m2kVrn1OIGPENXY6BwLJN/3HR+7o8XYdcxXyl6S1
-yHp52UKqK39c/s4mT6NmgTWvRLpUHhwwMmWd5jyTXlBOeuM61G7MGvv50jeuJCqr
-VwMiKA1JdX+3KNp1v47j3A55MQIDAQABo0IwQDAdBgNVHQ4EFgQUnZPGU4teyq8/
-nx4P5ZmVvCT2lI8wDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYwDQYJ
-KoZIhvcNAQELBQADggEBAFis9AQOzcAN/wr91LoWXym9e2iZWEnStB03TX8nfUYG
-XUPGhi4+c7ImfU+TqbbEKpqrIZcUsd6M06uJFdhrJNTxFq7YpFzUf1GO7RgBsZNj
-vbz4YYCanrHOQnDiqX0GJX0nof5v7LMeJNrjS1UaADs1tDvZ110w/YETifLCBivt
-Z8SOyUOyXGsViQK8YvxO8rUzqrJv0wqiUOP2O+guRMLbZjipM1ZI8W0bM40NjD9g
-N53Tym1+NH4Nn3J2ixufcv1SNUFFApYvHLKac0khsUlHRUe072o0EclNmsxZt9YC
-nlpOZbWUrhvfKbAW8b8Angc6F2S1BLUjIZkKlTuXfO8=
------END CERTIFICATE-----
-=== /C=US/O=AffirmTrust/CN=AffirmTrust Networking
-Certificate:
-    Data:
-        Version: 3 (0x2)
-        Serial Number: 8957382827206547757 (0x7c4f04391cd4992d)
-    Signature Algorithm: sha1WithRSAEncryption
-        Validity
-            Not Before: Jan 29 14:08:24 2010 GMT
-            Not After : Dec 31 14:08:24 2030 GMT
-        Subject: C=US, O=AffirmTrust, CN=AffirmTrust Networking
-        X509v3 extensions:
-            X509v3 Subject Key Identifier:
-                07:1F:D2:E7:9C:DA:C2:6E:A2:40:B4:B0:7A:50:10:50:74:C4:C8:BD
-            X509v3 Basic Constraints: critical
-                CA:TRUE
-            X509v3 Key Usage: critical
-                Certificate Sign, CRL Sign
-SHA1 Fingerprint=29:36:21:02:8B:20:ED:02:F5:66:C5:32:D1:D6:ED:90:9F:45:00:2F
-SHA256 Fingerprint=0A:81:EC:5A:92:97:77:F1:45:90:4A:F3:8D:5D:50:9F:66:B5:E2:C5:8F:CD:B5:31:05:8B:0E:17:F3:F0:B4:1B
------BEGIN CERTIFICATE-----
-MIIDTDCCAjSgAwIBAgIIfE8EORzUmS0wDQYJKoZIhvcNAQEFBQAwRDELMAkGA1UE
-BhMCVVMxFDASBgNVBAoMC0FmZmlybVRydXN0MR8wHQYDVQQDDBZBZmZpcm1UcnVz
-dCBOZXR3b3JraW5nMB4XDTEwMDEyOTE0MDgyNFoXDTMwMTIzMTE0MDgyNFowRDEL
-MAkGA1UEBhMCVVMxFDASBgNVBAoMC0FmZmlybVRydXN0MR8wHQYDVQQDDBZBZmZp
-cm1UcnVzdCBOZXR3b3JraW5nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
-AQEAtITMMxcua5Rsa2FSoOujz3mUTOWUgJnLVWREZY9nZOIG41w3SfYvm4SEHi3y
-YJ0wTsyEheIszx6e/jarM3c1RNg1lho9Nuh6DtjVR6FqaYvZ/Ls6rnla1fTWcbua
-kCNrmreIdIcMHl+5ni36q1Mr3Lt2PpNMCAiMHqIjHNRqrSK6mQEubWXLviRmVSRL
-QESxG9fhwoXA3hA/Pe24/PHxI1Pcv2WXb9n5QHGNfb2V1M6+oF4nI979ptAmDgAp
-6zxG8D1gvz9Q0twmQVGeFDdCBKNwV6gbh+0t+nvujArjqWaJGctB+d1ENmHP4ndG
-yH329JKBNv3bNPFyfvMMFr20FQIDAQABo0IwQDAdBgNVHQ4EFgQUBx/S55zawm6i
-QLSwelAQUHTEyL0wDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYwDQYJ
-KoZIhvcNAQEFBQADggEBAIlXshZ6qML91tmbmzTCnLQyFE2npN/svqe++EPbkTfO
-tDIuUFUaNU52Q3Eg75N3ThVwLofDwR1t3Mu1J9QsVtFSUzpE0nPIxBsFZVpikpzu
-QY0x2+c06lkh1QF612S4ZDnNye2v7UsDSKegmQGA3GWjNq5lWUhPgkvIZfFXHeVZ
-Lgo/bNjR9eUJtGxUAArgFU2HdW23WJZa3W3SAKD0m0i+wzekujbgfIeFlxoVot4u
-olu9rxj5kFDNcFn4J2dHy8egBzp90SxdbBk6ZrV9/ZFvgrG+CJPbFEfxojfHRZ48
-x3evZKiT3/Zpg4Jg8klCNO1aAFSFHBY2kgxc+qatv9s=
------END CERTIFICATE-----
-=== /C=US/O=AffirmTrust/CN=AffirmTrust Premium
-Certificate:
-    Data:
-        Version: 3 (0x2)
-        Serial Number: 7893706540734352110 (0x6d8c1446b1a60aee)
-    Signature Algorithm: sha384WithRSAEncryption
-        Validity
-            Not Before: Jan 29 14:10:36 2010 GMT
-            Not After : Dec 31 14:10:36 2040 GMT
-        Subject: C=US, O=AffirmTrust, CN=AffirmTrust Premium
-        X509v3 extensions:
-            X509v3 Subject Key Identifier:
-                9D:C0:67:A6:0C:22:D9:26:F5:45:AB:A6:65:52:11:27:D8:45:AC:63
-            X509v3 Basic Constraints: critical
-                CA:TRUE
-            X509v3 Key Usage: critical
-                Certificate Sign, CRL Sign
-SHA1 Fingerprint=D8:A6:33:2C:E0:03:6F:B1:85:F6:63:4F:7D:6A:06:65:26:32:28:27
-SHA256 Fingerprint=70:A7:3F:7F:37:6B:60:07:42:48:90:45:34:B1:14:82:D5:BF:0E:69:8E:CC:49:8D:F5:25:77:EB:F2:E9:3B:9A
------BEGIN CERTIFICATE-----
-MIIFRjCCAy6gAwIBAgIIbYwURrGmCu4wDQYJKoZIhvcNAQEMBQAwQTELMAkGA1UE
-BhMCVVMxFDASBgNVBAoMC0FmZmlybVRydXN0MRwwGgYDVQQDDBNBZmZpcm1UcnVz
-dCBQcmVtaXVtMB4XDTEwMDEyOTE0MTAzNloXDTQwMTIzMTE0MTAzNlowQTELMAkG
-A1UEBhMCVVMxFDASBgNVBAoMC0FmZmlybVRydXN0MRwwGgYDVQQDDBNBZmZpcm1U
-cnVzdCBQcmVtaXVtMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAxBLf
-qV/+Qd3d9Z+K4/as4Tx4mrzY8H96oDMq3I0gW64tb+eT2TZwamjPjlGjhVtnBKAQ
-JG9dKILBl1fYSCkTtuG+kU3fhQxTGJoeJKJPj/CihQvL9Cl/0qRY7iZNyaqoe5rZ
-+jjeRFcV5fiMyNlI4g0WJx0eyIOFJbe6qlVBzAMiSy2RjYvmia9mx+n/K+k8rNrS
-s8PhaJyJ+HoAVt70VZVs+7pk3WKL3wt3MutizCaam7uqYoNMtAZ6MMgpv+0GTZe5
-HMQxK9VfvFMSF5yZVylmd2EhMQcuJUmdGPLu8ytxjLW6OQdJd/zvLpKQBY0tL3d7
-70O/Nbua2Plzpyzy0FfuKE4mX4+QaAkvuPjcBukumj5Rp9EixAqnOEhss/n/fauG
-V+O61oV4d7pD6kh/9ti+I20ev9E2bFhc8e6kGVQa9QPSdubhjL08s9NIS+LI+H+S
-qHZGnEJlPqQewQcDWkYtuJfzt9WyVSHvutxMAJf7FJUnM7/oQ0dG0giZFmA7mn7S
-5u046uwBHjxIVkkJx0w3AJ6IDsBz4W9m6XJHMD4Q5QsDyZpCAGzFlH5hxIrff4Ia
-C1nEWTJ3s7xgaVY5/bQGeyzWZDbZvUjthB9+pSKPKrhC9IK31FOQeE4tGv2Bb0TX
-OwF0lkLgAOIua+rF7nKsu7/+6qqo+Nz2snmKtmcCAwEAAaNCMEAwHQYDVR0OBBYE
-FJ3AZ6YMItkm9UWrpmVSESfYRaxjMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/
-BAQDAgEGMA0GCSqGSIb3DQEBDAUAA4ICAQCzV00QYk465KzquByvMiPIs0laUZx2
-KI15qldGF9X1Uva3ROgIRL8YhNILgM3FEv0AVQVhh0HctSSePMTYyPtwni94loMg
-Nt58D2kTiKV1NpgIpsbfrM7jWNa3Pt668+s0QNiigfV4Py/VpfzZotReBA4Xrf5B
-8OWycvpEgjNC6C1Y91aMYj+6QrCcDFx+LmUmXFNPALJ4fqENmS2NuB2OosSw/WDQ
-MKSOyARiqcTtNd56l+0OOF6SL5Nwpamcb6d9Ex1+xghIsV5n61EIJenmJWtSKZGc
-0jlzCFfemQa0W50QBuHCAKi4HEoCChTQwUHK+4w1IX2COPKpVJEZNZOUbWo6xbLQ
-u4mGk+ibyQ86p3q4ofB4Rvr8Ny/lioTz3/4E2aFooC8k4gmVBtWVyuEklut89pMF
-u+1z6S3RdTnX5yTb2E5fQ4+e0BQ5v1VwSJlXMbSc7kqYA5YwH2AG7hsj/oFgIxpH
-YoWlzBk0gG+zrBrjn/B7SK3VAdlntqlyk+otZrWyuOQ9PLLvTIzq6we/qzWaVYa8
-GKa1qF60g2xraUDTn9zxw2lrueFtCfTxqlB2Cnp9ehehVZZCmTEJ3WARjQUwfuaO
-RtGdFNrHF+QFlozEJLUbzxQHskD4o55BhrwE0GuWyCqANP2/7waj3VjFhT0+j/6e
-KeC2uAloGRwYQw==
------END CERTIFICATE-----
-=== /C=US/O=AffirmTrust/CN=AffirmTrust Premium ECC
-Certificate:
-    Data:
-        Version: 3 (0x2)
-        Serial Number: 8401224907861490260 (0x7497258ac73f7a54)
-    Signature Algorithm: ecdsa-with-SHA384
-        Validity
-            Not Before: Jan 29 14:20:24 2010 GMT
-            Not After : Dec 31 14:20:24 2040 GMT
-        Subject: C=US, O=AffirmTrust, CN=AffirmTrust Premium ECC
-        X509v3 extensions:
-            X509v3 Subject Key Identifier:
-                9A:AF:29:7A:C0:11:35:35:26:51:30:00:C3:6A:FE:40:D5:AE:D6:3C
-            X509v3 Basic Constraints: critical
-                CA:TRUE
-            X509v3 Key Usage: critical
-                Certificate Sign, CRL Sign
-SHA1 Fingerprint=B8:23:6B:00:2F:1D:16:86:53:01:55:6C:11:A4:37:CA:EB:FF:C3:BB
-SHA256 Fingerprint=BD:71:FD:F6:DA:97:E4:CF:62:D1:64:7A:DD:25:81:B0:7D:79:AD:F8:39:7E:B4:EC:BA:9C:5E:84:88:82:14:23
------BEGIN CERTIFICATE-----
-MIIB/jCCAYWgAwIBAgIIdJclisc/elQwCgYIKoZIzj0EAwMwRTELMAkGA1UEBhMC
-VVMxFDASBgNVBAoMC0FmZmlybVRydXN0MSAwHgYDVQQDDBdBZmZpcm1UcnVzdCBQ
-cmVtaXVtIEVDQzAeFw0xMDAxMjkxNDIwMjRaFw00MDEyMzExNDIwMjRaMEUxCzAJ
-BgNVBAYTAlVTMRQwEgYDVQQKDAtBZmZpcm1UcnVzdDEgMB4GA1UEAwwXQWZmaXJt
-VHJ1c3QgUHJlbWl1bSBFQ0MwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAQNMF4bFZ0D
-0KF5Nbc6PJJ6yhUczWLznCZcBz3lVPqj1swS6vQUX+iOGasvLkjmrBhDeKzQN8O9
-ss0s5kfiGuZjuD0uL3jET9v0D6RoTFVya5UdThhClXjMNzyR4ptlKymjQjBAMB0G
-A1UdDgQWBBSaryl6wBE1NSZRMADDav5A1a7WPDAPBgNVHRMBAf8EBTADAQH/MA4G
-A1UdDwEB/wQEAwIBBjAKBggqhkjOPQQDAwNnADBkAjAXCfOHiFBar8jAQr9HX/Vs
-aobgxCd05DhT1wV/GzTjxi+zygk8N53X57hG8f2h4nECMEJZh0PUUd+60wkyWs6I
-flc9nF9Ca/UHLbXwgpP5WW+uZPpY5Yse42O+tYHNbwKMeQ==
------END CERTIFICATE-----
-
 ### Agence Nationale de Certification Electronique
 
 === /C=TN/O=Agence Nationale de Certification Electronique/CN=TunTrust Root CA
@@ -739,52 +576,6 @@ E2Efv4WstK2tBZQIgx51F9NxO5NQI1mg7TyRVJ12AMXDuDjb
 
 ### Atos
 
-=== /CN=Atos TrustedRoot 2011/O=Atos/C=DE
-Certificate:
-    Data:
-        Version: 3 (0x2)
-        Serial Number: 6643877497813316402 (0x5c33cb622c5fb332)
-    Signature Algorithm: sha256WithRSAEncryption
-        Validity
-            Not Before: Jul  7 14:58:30 2011 GMT
-            Not After : Dec 31 23:59:59 2030 GMT
-        Subject: CN=Atos TrustedRoot 2011, O=Atos, C=DE
-        X509v3 extensions:
-            X509v3 Subject Key Identifier:
-                A7:A5:06:B1:2C:A6:09:60:EE:D1:97:E9:70:AE:BC:3B:19:6C:DB:21
-            X509v3 Basic Constraints: critical
-                CA:TRUE
-            X509v3 Authority Key Identifier:
-                keyid:A7:A5:06:B1:2C:A6:09:60:EE:D1:97:E9:70:AE:BC:3B:19:6C:DB:21
-
-            X509v3 Certificate Policies:
-                Policy: 1.3.6.1.4.1.6189.3.4.1.1
-
-            X509v3 Key Usage: critical
-                Digital Signature, Certificate Sign, CRL Sign
-SHA1 Fingerprint=2B:B1:F5:3E:55:0C:1D:C5:F1:D4:E6:B7:6A:46:4B:55:06:02:AC:21
-SHA256 Fingerprint=F3:56:BE:A2:44:B7:A9:1E:B3:5D:53:CA:9A:D7:86:4A:CE:01:8E:2D:35:D5:F8:F9:6D:DF:68:A6:F4:1A:A4:74
------BEGIN CERTIFICATE-----
-MIIDdzCCAl+gAwIBAgIIXDPLYixfszIwDQYJKoZIhvcNAQELBQAwPDEeMBwGA1UE
-AwwVQXRvcyBUcnVzdGVkUm9vdCAyMDExMQ0wCwYDVQQKDARBdG9zMQswCQYDVQQG
-EwJERTAeFw0xMTA3MDcxNDU4MzBaFw0zMDEyMzEyMzU5NTlaMDwxHjAcBgNVBAMM
-FUF0b3MgVHJ1c3RlZFJvb3QgMjAxMTENMAsGA1UECgwEQXRvczELMAkGA1UEBhMC
-REUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCVhTuXbyo7LjvPpvMp
-Nb7PGKw+qtn4TaA+Gke5vJrf8v7MPkfoepbCJI419KkM/IL9bcFyYie96mvr54rM
-VD6QUM+A1JX76LWC1BTFtqlVJVfbsVD2sGBkWXppzwO3bw2+yj5vdHLqqjAqc2K+
-SZFhyBH+DgMq92og3AIVDV4VavzjgsG1xZ1kCWyjWZgHJ8cblithdHFsQ/H3NYkQ
-4J7sVaE3IqKHBAUsR320HLliKWYoyrfhk/WklAOZuXCFteZI6o1Q/NnezG8HDt0L
-cp2AMBYHlT8oDv3FdU9T1nSatCQujgKRz3bFmx5VdJx4IbHwLfELn8LVlhgf8FQi
-eowHAgMBAAGjfTB7MB0GA1UdDgQWBBSnpQaxLKYJYO7Rl+lwrrw7GWzbITAPBgNV
-HRMBAf8EBTADAQH/MB8GA1UdIwQYMBaAFKelBrEspglg7tGX6XCuvDsZbNshMBgG
-A1UdIAQRMA8wDQYLKwYBBAGwLQMEAQEwDgYDVR0PAQH/BAQDAgGGMA0GCSqGSIb3
-DQEBCwUAA4IBAQAmdzTblEiGKkGdLD4GkGDEjKwLVLgfuXvTBznk+j57sj1O7Z8j
-vZfza1zv7v1Apt+hk6EKhqzvINB5Ab149xnYJDE0BAGmuhWawyfc2E8PzBhj/5kP
-DpFrdRbhIfzYJsdHt6bPWHJxfrrhTZVHO8mvbaG0weyJ9rQPOLXiZNwlz6bb65pc
-maHFCN795trV1lpFDMS3wrUU77QR/w4VtfX128a961qn8FYiqTxlVMYVqL2Gns2D
-lmh6cYGJ4Qvh6hEbaAjMaZ7snkGeRDImeuKHCnE96+RapNLbxc3G3mB/ufNPRJLv
-KrcYPqcZ2Qt9sTdBQrC6YB3y/gkRsPCHe6ed
------END CERTIFICATE-----
 === /CN=Atos TrustedRoot Root CA ECC TLS 2021/O=Atos/C=DE
 Certificate:
     Data:
@@ -1119,56 +910,6 @@ QRBdJ3NghVdJIgc=
 
 ### COMODO CA Limited
 
-=== /C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO Certification Authority
-Certificate:
-    Data:
-        Version: 3 (0x2)
-        Serial Number:
-            4e:81:2d:8a:82:65:e0:0b:02:ee:3e:35:02:46:e5:3d
-    Signature Algorithm: sha1WithRSAEncryption
-        Validity
-            Not Before: Dec  1 00:00:00 2006 GMT
-            Not After : Dec 31 23:59:59 2029 GMT
-        Subject: C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO Certification Authority
-        X509v3 extensions:
-            X509v3 Subject Key Identifier:
-                0B:58:E5:8B:C6:4C:15:37:A4:40:A9:30:A9:21:BE:47:36:5A:56:FF
-            X509v3 Key Usage: critical
-                Certificate Sign, CRL Sign
-            X509v3 Basic Constraints: critical
-                CA:TRUE
-            X509v3 CRL Distribution Points:
-
-                Full Name:
-                  URI:http://crl.comodoca.com/COMODOCertificationAuthority.crl
-
-SHA1 Fingerprint=66:31:BF:9E:F7:4F:9E:B6:C9:D5:A6:0C:BA:6A:BE:D1:F7:BD:EF:7B
-SHA256 Fingerprint=0C:2C:D6:3D:F7:80:6F:A3:99:ED:E8:09:11:6B:57:5B:F8:79:89:F0:65:18:F9:80:8C:86:05:03:17:8B:AF:66
------BEGIN CERTIFICATE-----
-MIIEHTCCAwWgAwIBAgIQToEtioJl4AsC7j41AkblPTANBgkqhkiG9w0BAQUFADCB
-gTELMAkGA1UEBhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4G
-A1UEBxMHU2FsZm9yZDEaMBgGA1UEChMRQ09NT0RPIENBIExpbWl0ZWQxJzAlBgNV
-BAMTHkNPTU9ETyBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0wNjEyMDEwMDAw
-MDBaFw0yOTEyMzEyMzU5NTlaMIGBMQswCQYDVQQGEwJHQjEbMBkGA1UECBMSR3Jl
-YXRlciBNYW5jaGVzdGVyMRAwDgYDVQQHEwdTYWxmb3JkMRowGAYDVQQKExFDT01P
-RE8gQ0EgTGltaXRlZDEnMCUGA1UEAxMeQ09NT0RPIENlcnRpZmljYXRpb24gQXV0
-aG9yaXR5MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0ECLi3LjkRv3
-UcEbVASY06m/weaKXTuH+7uIzg3jLz8GlvCiKVCZrts7oVewdFFxze1CkU1B/qnI
-2GqGd0S7WWaXUF601CxwRM/aN5VCaTwwxHGzUvAhTaHYujl8HJ6jJJ3ygxaYqhZ8
-Q5sVW7euNJH+1GImGEaaP+vB+fGQV+useg2L23IwambV4EajcNxo2f8ESIl33rXp
-+2dtQem8Ob0y2WIC8bGoPW43nOIv4tOiJovGuFVDiOEjPqXSJDlqR6sA1KGzqSX+
-DT+nHbrTUcELpNqsOO9VUCQFZUaTNE8tja3G1CEZ0o7KBWFxB3NH5YoZEr0ETc5O
-nKVIrLsm9wIDAQABo4GOMIGLMB0GA1UdDgQWBBQLWOWLxkwVN6RAqTCpIb5HNlpW
-/zAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zBJBgNVHR8EQjBAMD6g
-PKA6hjhodHRwOi8vY3JsLmNvbW9kb2NhLmNvbS9DT01PRE9DZXJ0aWZpY2F0aW9u
-QXV0aG9yaXR5LmNybDANBgkqhkiG9w0BAQUFAAOCAQEAPpiem/Yb6dc5t3iuHXIY
-SdOH5EOC6z/JqvWote9VfCFSZfnVDeFs9D6Mk3ORLgLETgdxb8CPOGEIqB6BCsAv
-IC9Bi5HcSEW88cbeunZrM8gALTFGTO3nnc+IlP8zwFboJIYmuNg4ON8qa90SzMc/
-RxdMosIGlgnW2/4/PEZB31jiVg88O8EckzXZOFKs7sjsLjBOlDW0JB9LeGna8gI4
-zJVSk/BwJVmcIGfE7vmLV2H0knZ9P4SNVbfo5azV8fUZVqZa+5Acr5Pr5RzUZ5dd
-BA6+C4OmF4O5MBKgxTMVBbkN+8cFduPYSo38NBejxiEovjBFMR7HeL5YYTisO+IB
-ZQ==
------END CERTIFICATE-----
 === /C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO ECC Certification Authority
 Certificate:
     Data:
@@ -1457,104 +1198,9 @@ kkVbbiVghUbN0aqwdmaTd5a+g744tiROJgvM7XpWGuDpWsZkrUx6AEhEL7lAuxM+
 vhV4nYWBSipX3tUZQ9rbyltHhoMLP7YNdnhzeSJesYAfz77RP1YQmCuVh6EfnWQU
 YDksswBVLuT1sw5XxJFBAJw/6KXf6vb/yPCtbVKoF6ubYfwSUTXkJf2vqmqGOQ==
 -----END CERTIFICATE-----
-=== /C=TW/O=Chunghwa Telecom Co., Ltd./OU=ePKI Root Certification Authority
-Certificate:
-    Data:
-        Version: 3 (0x2)
-        Serial Number:
-            15:c8:bd:65:47:5c:af:b8:97:00:5e:e4:06:d2:bc:9d
-    Signature Algorithm: sha1WithRSAEncryption
-        Validity
-            Not Before: Dec 20 02:31:27 2004 GMT
-            Not After : Dec 20 02:31:27 2034 GMT
-        Subject: C=TW, O=Chunghwa Telecom Co., Ltd., OU=ePKI Root Certification Authority
-        X509v3 extensions:
-            X509v3 Subject Key Identifier:
-                1E:0C:F7:B6:67:F2:E1:92:26:09:45:C0:55:39:2E:77:3F:42:4A:A2
-            X509v3 Basic Constraints:
-                CA:TRUE
-            setCext-hashedRoot:
-                0/0-...0...+......0...g*.....E...
-V|.[x....S.....
-SHA1 Fingerprint=67:65:0D:F1:7E:8E:7E:5B:82:40:A4:F4:56:4B:CF:E2:3D:69:C6:F0
-SHA256 Fingerprint=C0:A6:F4:DC:63:A2:4B:FD:CF:54:EF:2A:6A:08:2A:0A:72:DE:35:80:3E:2F:F5:FF:52:7A:E5:D8:72:06:DF:D5
------BEGIN CERTIFICATE-----
-MIIFsDCCA5igAwIBAgIQFci9ZUdcr7iXAF7kBtK8nTANBgkqhkiG9w0BAQUFADBe
-MQswCQYDVQQGEwJUVzEjMCEGA1UECgwaQ2h1bmdod2EgVGVsZWNvbSBDby4sIEx0
-ZC4xKjAoBgNVBAsMIWVQS0kgUm9vdCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAe
-Fw0wNDEyMjAwMjMxMjdaFw0zNDEyMjAwMjMxMjdaMF4xCzAJBgNVBAYTAlRXMSMw
-IQYDVQQKDBpDaHVuZ2h3YSBUZWxlY29tIENvLiwgTHRkLjEqMCgGA1UECwwhZVBL
-SSBSb290IENlcnRpZmljYXRpb24gQXV0aG9yaXR5MIICIjANBgkqhkiG9w0BAQEF
-AAOCAg8AMIICCgKCAgEA4SUP7o3biDN1Z82tH306Tm2d0y8U82N0ywEhajfqhFAH
-SyZbCUNsIZ5qyNUD9WBpj8zwIuQf5/dqIjG3LBXy4P4AakP/h2XGtRrBp0xtInAh
-ijHyl3SJCRImHJ7K2RKilTza6We/CKBk49ZCt0Xvl/T29de1ShUCWH2YWEtgvM3X
-DZoTM1PRYfl61dd4s5oz9wCGzh1NlDivqOx4UXCKXBCDUSH3ET00hl7lSM2XgYI1
-TBnsZfZrxQWh7kcT1rMhJ5QQCtkkO7q+RBNGMD+XPNjX12ruOzjjK9SXDrkb5wdJ
-fzcq+Xd4z1TtW0ado4AOkUPB1ltfFLqfpo0kR0BZv3I4sjZsN/+Z0V0OWQqraffA
-sgRFelQArr5T9rXn4fg8ozHSqf4hUmTFpmfwdQcGlBSBVcYn5AGPF8Fqcde+S/uU
-WH1+ETOxQvdibBjWzwloPn9s9h6PYq2lY9sJpx8iQkEeb5mKPtf5P0B6ebClAZLS
-nT0IFaUQAS2zMnaolQ2zepr7BxB4EW/hj8e6DyUadCrlHJhBmd8hh+iVBmoKs2pH
-dmX2Os+PYhcZewoozRrSgx4hxyy/vv9haLdnG7t4TY3OZ+XkwY63I2binZB1NJip
-NiuKmpS5nezMirH4JYlcWrYvjB9teSSnUmjDhDXiZo1jDiVN1Rmy5nk3pyKdVDEC
-AwEAAaNqMGgwHQYDVR0OBBYEFB4M97Zn8uGSJglFwFU5Lnc/QkqiMAwGA1UdEwQF
-MAMBAf8wOQYEZyoHAAQxMC8wLQIBADAJBgUrDgMCGgUAMAcGBWcqAwAABBRFsMLH
-ClZ87lt4DJX5GFPBphzYEDANBgkqhkiG9w0BAQUFAAOCAgEACbODU1kBPpVJufGB
-uvl2ICO1J2B01GqZNF5sAFPZn/KmsSQHRGoqxqWOeBLoR9lYGxMqXnmbnwoqZ6Yl
-PwZpVnPDimZI+ymBV3QGypzqKOg4ZyYr8dW1P2WT+DZdjo2NQCCHGervJ8A9tDkP
-JXtoUHRVnAxZfVo9QZQlUgjgRywVMRnVvwdVxrsStZf0X4OFunHB2WyBEXYKCrC/
-gpf36j36+uwtqSiUO1bd0lEursC9CBWMd1I0ltabrNMdjmEPNXubrjlpC2JgQCA2
-j6/7Nu4tCEoduL+bXPjqpRugc6bY+G7gMwRfaKonh+3ZwZCc7b3jajWvY9+rGNm6
-5ulK6lCKD2GTHuItGeIwlDWSXQ62B68ZgI9HkFFLLk3dheLSClIKF5r8GrBQAuUB
-o2M3IUxExJtRmREOc5wGj1QupyheRDmHVi03vYVElOEMSyycw5KFNGHLD7ibSkNS
-/jQ6fbjpKdx2qcgw+BRxgMYeNkh0IkFch4LoGHGLQYlE535YW6i4jRPpp2zDR+2z
-Gp1iro2C6pSe3VkQw63d4k3jMdXH7OjysP6SHhYKGvzZ8/gntsm+HbRsZJB/9OTE
-W9c3rkIO3aQab3yIVMUWbuF6aC74Or8NpDyJO3inTmODBCEIZ43ygknQW/2xzQ+D
-hNQ+IIX3Sj0rnP0qCglN6oH4EZw=
------END CERTIFICATE-----
 
 ### Cybertrust Japan Co., Ltd.
 
-=== /C=JP/O=Cybertrust Japan Co., Ltd./CN=SecureSign Root CA12
-Certificate:
-    Data:
-        Version: 3 (0x2)
-        Serial Number:
-            66:f9:c7:c1:af:ec:c2:51:b4:ed:53:97:e6:e6:82:c3:2b:1c:90:16
-    Signature Algorithm: sha256WithRSAEncryption
-        Validity
-            Not Before: Apr  8 05:36:46 2020 GMT
-            Not After : Apr  8 05:36:46 2040 GMT
-        Subject: C=JP, O=Cybertrust Japan Co., Ltd., CN=SecureSign Root CA12
-        X509v3 extensions:
-            X509v3 Basic Constraints: critical
-                CA:TRUE
-            X509v3 Key Usage: critical
-                Certificate Sign, CRL Sign
-            X509v3 Subject Key Identifier:
-                57:34:F3:74:CF:04:4B:D5:25:E6:F1:40:B6:2C:4C:D9:2D:E9:A0:AD
-SHA1 Fingerprint=7A:22:1E:3D:DE:1B:06:AC:9E:C8:47:70:16:8E:3C:E5:F7:6B:06:F4
-SHA256 Fingerprint=3F:03:4B:B5:70:4D:44:B2:D0:85:45:A0:20:57:DE:93:EB:F3:90:5F:CE:72:1A:CB:C7:30:C0:6D:DA:EE:90:4E
------BEGIN CERTIFICATE-----
-MIIDcjCCAlqgAwIBAgIUZvnHwa/swlG07VOX5uaCwysckBYwDQYJKoZIhvcNAQEL
-BQAwUTELMAkGA1UEBhMCSlAxIzAhBgNVBAoTGkN5YmVydHJ1c3QgSmFwYW4gQ28u
-LCBMdGQuMR0wGwYDVQQDExRTZWN1cmVTaWduIFJvb3QgQ0ExMjAeFw0yMDA0MDgw
-NTM2NDZaFw00MDA0MDgwNTM2NDZaMFExCzAJBgNVBAYTAkpQMSMwIQYDVQQKExpD
-eWJlcnRydXN0IEphcGFuIENvLiwgTHRkLjEdMBsGA1UEAxMUU2VjdXJlU2lnbiBS
-b290IENBMTIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC6OcE3emhF
-KxS06+QT61d1I02PJC0W6K6OyX2kVzsqdiUzg2zqMoqUm048luT9Ub+ZyZN+v/mt
-p7JIKwccJ/VMvHASd6SFVLX9kHrko+RRWAPNEHl57muTH2SOa2SroxPjcf59q5zd
-J1M3s6oYwlkm7Fsf0uZlfO+TvdhYXAvA42VvPMfKWeP+bl+sg779XSVOKik71gur
-FzJ4pOE+lEa+Ym6b3kaosRbnhW70CEBFEaCeVESE99g2zvVQR9wsMJvuwPWW0v4J
-hscGWa5Pro4RmHvzC1KqYiaqId+OJTN5lxZJjfU+1UefNzFJM3IFTQy2VYzxV4+K
-h9GtxRESOaCtAgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQD
-AgEGMB0GA1UdDgQWBBRXNPN0zwRL1SXm8UC2LEzZLemgrTANBgkqhkiG9w0BAQsF
-AAOCAQEAPrvbFxbS8hQBICw4g0utvsqFepq2m2um4fylOqyttCg6r9cBg0krY6Ld
-mmQOmFxv3Y67ilQiLUoT865AQ9tPkbeGGuwAtEGBpE/6aouIs3YIcipJQMPTw4WJ
-mBClnW8Zt7vPemVV2zfrPIpyMpcemik+rY3moxtt9XUa5rBouVui7mlHJzWhhpmA
-8zNL4WukJsPvdFlseqJkth5Ew1DgDzk9qTPxpfPSvWKErI4cqc1avTc7bgoitPQV
-55FYxTpE05Uo2cBl6XLK0A+9H7MV2anjpEcJnuDLN/v9vZfVvhgaaaI5gdka9at/
-yOPiZwud9AzqVN/Ssq+xIvEg37xEHA==
------END CERTIFICATE-----
 === /C=JP/O=Cybertrust Japan Co., Ltd./CN=SecureSign Root CA14
 Certificate:
     Data:
@@ -2053,55 +1699,6 @@ dTdmQRCsu/WU48IxK63nI1bMNSWSs1A=
 
 ### Dhimyotis
 
-=== /C=FR/O=Dhimyotis/CN=Certigna
-Certificate:
-    Data:
-        Version: 3 (0x2)
-        Serial Number:
-            fe:dc:e3:01:0f:c9:48:ff
-    Signature Algorithm: sha1WithRSAEncryption
-        Validity
-            Not Before: Jun 29 15:13:05 2007 GMT
-            Not After : Jun 29 15:13:05 2027 GMT
-        Subject: C=FR, O=Dhimyotis, CN=Certigna
-        X509v3 extensions:
-            X509v3 Basic Constraints: critical
-                CA:TRUE
-            X509v3 Subject Key Identifier:
-                1A:ED:FE:41:39:90:B4:24:59:BE:01:F2:52:D5:45:F6:5A:39:DC:11
-            X509v3 Authority Key Identifier:
-                keyid:1A:ED:FE:41:39:90:B4:24:59:BE:01:F2:52:D5:45:F6:5A:39:DC:11
-                DirName:/C=FR/O=Dhimyotis/CN=Certigna
-                serial:FE:DC:E3:01:0F:C9:48:FF
-
-            X509v3 Key Usage: critical
-                Certificate Sign, CRL Sign
-            Netscape Cert Type:
-                SSL CA, S/MIME CA, Object Signing CA
-SHA1 Fingerprint=B1:2E:13:63:45:86:A4:6F:1A:B2:60:68:37:58:2D:C4:AC:FD:94:97
-SHA256 Fingerprint=E3:B6:A2:DB:2E:D7:CE:48:84:2F:7A:C5:32:41:C7:B7:1D:54:14:4B:FB:40:C1:1F:3F:1D:0B:42:F5:EE:A1:2D
------BEGIN CERTIFICATE-----
-MIIDqDCCApCgAwIBAgIJAP7c4wEPyUj/MA0GCSqGSIb3DQEBBQUAMDQxCzAJBgNV
-BAYTAkZSMRIwEAYDVQQKDAlEaGlteW90aXMxETAPBgNVBAMMCENlcnRpZ25hMB4X
-DTA3MDYyOTE1MTMwNVoXDTI3MDYyOTE1MTMwNVowNDELMAkGA1UEBhMCRlIxEjAQ
-BgNVBAoMCURoaW15b3RpczERMA8GA1UEAwwIQ2VydGlnbmEwggEiMA0GCSqGSIb3
-DQEBAQUAA4IBDwAwggEKAoIBAQDIaPHJ1tazNHUmgh7stL7qXOEm7RFHYeGifBZ4
-QCHkYJ5ayGPhxLGWkv8YbWkj4Sti993iNi+RB7lIzw7sebYs5zRLcAglozyHGxny
-gQcPOJAZ0xH+hrTy0V4eHpbNgGzOOzGTtvKg0KmVEn2lmsxryIRWijOp5yIVUxbw
-zBfsV1/pogqYCd7jX5xv3EjjhQsVWqa6n6xI4wmy9/Qy3l40vhx4XUJbzg4ij02Q
-130yGLMLLGq/jj8UEYkgDncUtT2UCIf3JR7VsmAA7G8qKCVuKj4YYxclPz5EIBb2
-JsglrgVKtOdjLPOMFlN+XPsRGgjBRmKfIrjxwo1p3Po6WAbfAgMBAAGjgbwwgbkw
-DwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUGu3+QTmQtCRZvgHyUtVF9lo53BEw
-ZAYDVR0jBF0wW4AUGu3+QTmQtCRZvgHyUtVF9lo53BGhOKQ2MDQxCzAJBgNVBAYT
-AkZSMRIwEAYDVQQKDAlEaGlteW90aXMxETAPBgNVBAMMCENlcnRpZ25hggkA/tzj
-AQ/JSP8wDgYDVR0PAQH/BAQDAgEGMBEGCWCGSAGG+EIBAQQEAwIABzANBgkqhkiG
-9w0BAQUFAAOCAQEAhQMeknH2Qq/ho2Ge6/PAD/Kl1NqV5ta+aDY9fm4fTIrv0Q8h
-bV6lUmPOEvjvKtpv6zf+EwLHyzs+ImvaYS5/1HI93TDhHkxAGYwP15zRgzB7mFnc
-fca5DClMoTOi62c6ZYTTluLtdkVwj7Ur3vkj1kluPBS1xp81HlDQwY9qcEQCYsuu
-HWhBp6pX6FOqB9IG9tUUBguRA3UsbHK1YZWaDYu5Def131TN3ubY1gkIl2PlwS6w
-t0QmwCbAr1UwnjvVNioZBPRcHv/PLLf/0P2HQBHVESO7SMAhqaQoLf0V+LBOK/Qw
-WyH8EZE0vkHve52Xdf+XlcCWWC/qu0bXu+TZLg==
------END CERTIFICATE-----
 === /C=FR/O=Dhimyotis/OU=0002 48146308100036/CN=Certigna Root CA
 Certificate:
     Data:
@@ -2176,51 +1773,6 @@ jWZSaX5LaAzHHjcng6WMxwLkFM1JAbBzs/3GkDpv0mztO+7skb6iQ12LAEpmJURw
 
 ### DigiCert Inc
 
-=== /C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert Assured ID Root CA
-Certificate:
-    Data:
-        Version: 3 (0x2)
-        Serial Number:
-            0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39
-    Signature Algorithm: sha1WithRSAEncryption
-        Validity
-            Not Before: Nov 10 00:00:00 2006 GMT
-            Not After : Nov 10 00:00:00 2031 GMT
-        Subject: C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Assured ID Root CA
-        X509v3 extensions:
-            X509v3 Key Usage: critical
-                Digital Signature, Certificate Sign, CRL Sign
-            X509v3 Basic Constraints: critical
-                CA:TRUE
-            X509v3 Subject Key Identifier:
-                45:EB:A2:AF:F4:92:CB:82:31:2D:51:8B:A7:A7:21:9D:F3:6D:C8:0F
-            X509v3 Authority Key Identifier:
-                keyid:45:EB:A2:AF:F4:92:CB:82:31:2D:51:8B:A7:A7:21:9D:F3:6D:C8:0F
-
-SHA1 Fingerprint=05:63:B8:63:0D:62:D7:5A:BB:C8:AB:1E:4B:DF:B5:A8:99:B2:4D:43
-SHA256 Fingerprint=3E:90:99:B5:01:5E:8F:48:6C:00:BC:EA:9D:11:1E:E7:21:FA:BA:35:5A:89:BC:F1:DF:69:56:1E:3D:C6:32:5C
------BEGIN CERTIFICATE-----
-MIIDtzCCAp+gAwIBAgIQDOfg5RfYRv6P5WD8G/AwOTANBgkqhkiG9w0BAQUFADBl
-MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
-d3cuZGlnaWNlcnQuY29tMSQwIgYDVQQDExtEaWdpQ2VydCBBc3N1cmVkIElEIFJv
-b3QgQ0EwHhcNMDYxMTEwMDAwMDAwWhcNMzExMTEwMDAwMDAwWjBlMQswCQYDVQQG
-EwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNl
-cnQuY29tMSQwIgYDVQQDExtEaWdpQ2VydCBBc3N1cmVkIElEIFJvb3QgQ0EwggEi
-MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCtDhXO5EOAXLGH87dg+XESpa7c
-JpSIqvTO9SA5KFhgDPiA2qkVlTJhPLWxKISKityfCgyDF3qPkKyK53lTXDGEKvYP
-mDI2dsze3Tyoou9q+yHyUmHfnyDXH+Kx2f4YZNISW1/5WBg1vEfNoTb5a3/UsDg+
-wRvDjDPZ2C8Y/igPs6eD1sNuRMBhNZYW/lmci3Zt1/GiSw0r/wty2p5g0I6QNcZ4
-VYcgoc/lbQrISXwxmDNsIumH0DJaoroTghHtORedmTpyoeb6pNnVFzF1roV9Iq4/
-AUaG9ih5yLHa5FcXxH4cDrC0kqZWs72yl+2qp/C3xag/lRbQ/6GW6whfGHdPAgMB
-AAGjYzBhMA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQW
-BBRF66Kv9JLLgjEtUYunpyGd823IDzAfBgNVHSMEGDAWgBRF66Kv9JLLgjEtUYun
-pyGd823IDzANBgkqhkiG9w0BAQUFAAOCAQEAog683+Lt8ONyc3pklL/3cmbYMuRC
-dWKuh+vy1dneVrOfzM4UKLkNl2BcEkxY5NM9g0lFWJc1aRqoR+pWxnmrEthngYTf
-fwk8lOa4JiwgvT2zKIn3X/8i4peEH+ll74fg38FnSbNd67IJKusm7Xi+fT8r87cm
-NW1fiQG2SVufAQWbqz0lwcy2f8Lxb4bG+mRo64EtlOtCt/qMHt1i8b5QZ7dsvfPx
-H2sMNgcWfzd8qVttevESRmCD1ycEvkvOl77DZypoEd+A5wwzZr8TDRRu838fYxAe
-+o0bJW1sj6W3YQGx0qMmoRBxna3iw/nDmVG3KwcIzi7mULKn+gpFL6Lw8g==
------END CERTIFICATE-----
 === /C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert Assured ID Root G2
 Certificate:
     Data:
@@ -2298,51 +1850,6 @@ AwNnADBkAjAlpIFFAmsSS3V0T8gj43DydXLefInwz5FyYZ5eEJJZVrmDxxDnOOlY
 JjZ91eQ0hjkCMHw2U/Aw5WJjOpnitqM7mzT6HtoQknFekROn3aRukswy1vUhZscv
 6pZjamVFkpUBtA==
 -----END CERTIFICATE-----
-=== /C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert Global Root CA
-Certificate:
-    Data:
-        Version: 3 (0x2)
-        Serial Number:
-            08:3b:e0:56:90:42:46:b1:a1:75:6a:c9:59:91:c7:4a
-    Signature Algorithm: sha1WithRSAEncryption
-        Validity
-            Not Before: Nov 10 00:00:00 2006 GMT
-            Not After : Nov 10 00:00:00 2031 GMT
-        Subject: C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Global Root CA
-        X509v3 extensions:
-            X509v3 Key Usage: critical
-                Digital Signature, Certificate Sign, CRL Sign
-            X509v3 Basic Constraints: critical
-                CA:TRUE
-            X509v3 Subject Key Identifier:
-                03:DE:50:35:56:D1:4C:BB:66:F0:A3:E2:1B:1B:C3:97:B2:3D:D1:55
-            X509v3 Authority Key Identifier:
-                keyid:03:DE:50:35:56:D1:4C:BB:66:F0:A3:E2:1B:1B:C3:97:B2:3D:D1:55
-
-SHA1 Fingerprint=A8:98:5D:3A:65:E5:E5:C4:B2:D7:D6:6D:40:C6:DD:2F:B1:9C:54:36
-SHA256 Fingerprint=43:48:A0:E9:44:4C:78:CB:26:5E:05:8D:5E:89:44:B4:D8:4F:96:62:BD:26:DB:25:7F:89:34:A4:43:C7:01:61
------BEGIN CERTIFICATE-----
-MIIDrzCCApegAwIBAgIQCDvgVpBCRrGhdWrJWZHHSjANBgkqhkiG9w0BAQUFADBh
-MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
-d3cuZGlnaWNlcnQuY29tMSAwHgYDVQQDExdEaWdpQ2VydCBHbG9iYWwgUm9vdCBD
-QTAeFw0wNjExMTAwMDAwMDBaFw0zMTExMTAwMDAwMDBaMGExCzAJBgNVBAYTAlVT
-MRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5j
-b20xIDAeBgNVBAMTF0RpZ2lDZXJ0IEdsb2JhbCBSb290IENBMIIBIjANBgkqhkiG
-9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4jvhEXLeqKTTo1eqUKKPC3eQyaKl7hLOllsB
-CSDMAZOnTjC3U/dDxGkAV53ijSLdhwZAAIEJzs4bg7/fzTtxRuLWZscFs3YnFo97
-nh6Vfe63SKMI2tavegw5BmV/Sl0fvBf4q77uKNd0f3p4mVmFaG5cIzJLv07A6Fpt
-43C/dxC//AH2hdmoRBBYMql1GNXRor5H4idq9Joz+EkIYIvUX7Q6hL+hqkpMfT7P
-T19sdl6gSzeRntwi5m3OFBqOasv+zbMUZBfHWymeMr/y7vrTC0LUq7dBMtoM1O/4
-gdW7jVg/tRvoSSiicNoxBN33shbyTApOB6jtSj1etX+jkMOvJwIDAQABo2MwYTAO
-BgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUA95QNVbR
-TLtm8KPiGxvDl7I90VUwHwYDVR0jBBgwFoAUA95QNVbRTLtm8KPiGxvDl7I90VUw
-DQYJKoZIhvcNAQEFBQADggEBAMucN6pIExIK+t1EnE9SsPTfrgT1eXkIoyQY/Esr
-hMAtudXH/vTBH1jLuG2cenTnmCmrEbXjcKChzUyImZOMkXDiqw8cvpOp/2PV5Adg
-06O/nVsJ8dWO41P0jmP6P6fbtGbfYmbW0W5BjfIttep3Sp+dWOIrWcBAI+0tKIJF
-PnlUkiaY4IBIqDfv8NZ5YBberOgOzW6sRBc4L0na4UU+Krk2U886UAb3LujEV0ls
-YSEY1QSteDwsOoBrp+uvFRTp2InBuThs4pFsiv9kuXclVzDAGySj4dzp30d8tbQk
-CAUw7C29C79Fv1C5qfPrmAESrciIxpg0X40KPMbp1ZWVbd4=
------END CERTIFICATE-----
 === /C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert Global Root G2
 Certificate:
     Data:
@@ -2420,52 +1927,6 @@ AK288mw/EkrRLTnDCgmXc/SINoyIJ7vmiI1Qhadj+Z4y3maTD/HMsQmP3Wyr+mt/
 oAIwOWZbwmSNuJ5Q3KjVSaLtx9zRSX8XAbjIho9OjIgrqJqpisXRAL34VOKa5Vt8
 sycX
 -----END CERTIFICATE-----
-=== /C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert High Assurance EV Root CA
-Certificate:
-    Data:
-        Version: 3 (0x2)
-        Serial Number:
-            02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77
-    Signature Algorithm: sha1WithRSAEncryption
-        Validity
-            Not Before: Nov 10 00:00:00 2006 GMT
-            Not After : Nov 10 00:00:00 2031 GMT
-        Subject: C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance EV Root CA
-        X509v3 extensions:
-            X509v3 Key Usage: critical
-                Digital Signature, Certificate Sign, CRL Sign
-            X509v3 Basic Constraints: critical
-                CA:TRUE
-            X509v3 Subject Key Identifier:
-                B1:3E:C3:69:03:F8:BF:47:01:D4:98:26:1A:08:02:EF:63:64:2B:C3
-            X509v3 Authority Key Identifier:
-                keyid:B1:3E:C3:69:03:F8:BF:47:01:D4:98:26:1A:08:02:EF:63:64:2B:C3
-
-SHA1 Fingerprint=5F:B7:EE:06:33:E2:59:DB:AD:0C:4C:9A:E6:D3:8F:1A:61:C7:DC:25
-SHA256 Fingerprint=74:31:E5:F4:C3:C1:CE:46:90:77:4F:0B:61:E0:54:40:88:3B:A9:A0:1E:D0:0B:A6:AB:D7:80:6E:D3:B1:18:CF
------BEGIN CERTIFICATE-----
-MIIDxTCCAq2gAwIBAgIQAqxcJmoLQJuPC3nyrkYldzANBgkqhkiG9w0BAQUFADBs
-MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
-d3cuZGlnaWNlcnQuY29tMSswKQYDVQQDEyJEaWdpQ2VydCBIaWdoIEFzc3VyYW5j
-ZSBFViBSb290IENBMB4XDTA2MTExMDAwMDAwMFoXDTMxMTExMDAwMDAwMFowbDEL
-MAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3
-LmRpZ2ljZXJ0LmNvbTErMCkGA1UEAxMiRGlnaUNlcnQgSGlnaCBBc3N1cmFuY2Ug
-RVYgUm9vdCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMbM5XPm
-+9S75S0tMqbf5YE/yc0lSbZxKsPVlDRnogocsF9ppkCxxLeyj9CYpKlBWTrT3JTW
-PNt0OKRKzE0lgvdKpVMSOO7zSW1xkX5jtqumX8OkhPhPYlG++MXs2ziS4wblCJEM
-xChBVfvLWokVfnHoNb9Ncgk9vjo4UFt3MRuNs8ckRZqnrG0AFFoEt7oT61EKmEFB
-Ik5lYYeBQVCmeVyJ3hlKV9Uu5l0cUyx+mM0aBhakaHPQNAQTXKFx01p8VdteZOE3
-hzBWBOURtCmAEvF5OYiiAhF8J2a3iLd48soKqDirCmTCv2ZdlYTBoSUeh10aUAsg
-EsxBu24LUTi4S8sCAwEAAaNjMGEwDgYDVR0PAQH/BAQDAgGGMA8GA1UdEwEB/wQF
-MAMBAf8wHQYDVR0OBBYEFLE+w2kD+L9HAdSYJhoIAu9jZCvDMB8GA1UdIwQYMBaA
-FLE+w2kD+L9HAdSYJhoIAu9jZCvDMA0GCSqGSIb3DQEBBQUAA4IBAQAcGgaX3Nec
-nzyIZgYIVyHbIUf4KmeqvxgydkAQV8GK83rZEWWONfqe/EW1ntlMMUu4kehDLI6z
-eM7b41N5cdblIZQB2lWHmiRk9opmzN6cN82oNLFpmyPInngiK3BD41VHMWEZ71jF
-hS9OMPagMRYjyOfiZRYzy78aG6A9+MpeizGLYAiJLQwGXFK3xPkKmNEVX58Svnw2
-Yzi9RKR/5CYrCsSXaQ3pjOLAEFe4yHYSkVXySGnYvCoCWw9E1CAx2/S6cCZdkGCe
-vEsXCS+0yx5DaMkHJ8HSXPfqIbloEpw8nL+e/IBcm2PN7EeqJSdnoDfzAIJ9VNep
-+OkuE6N36B9K
------END CERTIFICATE-----
 === /C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert Trusted Root G4
 Certificate:
     Data:
@@ -2661,144 +2122,6 @@ zMOl6W8KjptlwlCFtaOgUxLMVYdh84GuEEZhvUQhuMI9dM9+JDX6HAcOmz0iyu8x
 L4ysEr3vQCj8KWefshNPZiTEUxnpHikV7+ZtsH8tZ/3zbBt1RqPlShfppNcL
 -----END CERTIFICATE-----
 
-### Entrust, Inc.
-
-=== /C=US/O=Entrust, Inc./OU=See www.entrust.net/legal-terms/OU=(c) 2009 Entrust, Inc. - for authorized use only/CN=Entrust Root Certification Authority - G2
-Certificate:
-    Data:
-        Version: 3 (0x2)
-        Serial Number: 1246989352 (0x4a538c28)
-    Signature Algorithm: sha256WithRSAEncryption
-        Validity
-            Not Before: Jul  7 17:25:54 2009 GMT
-            Not After : Dec  7 17:55:54 2030 GMT
-        Subject: C=US, O=Entrust, Inc., OU=See www.entrust.net/legal-terms, OU=(c) 2009 Entrust, Inc. - for authorized use only, CN=Entrust Root Certification Authority - G2
-        X509v3 extensions:
-            X509v3 Key Usage: critical
-                Certificate Sign, CRL Sign
-            X509v3 Basic Constraints: critical
-                CA:TRUE
-            X509v3 Subject Key Identifier:
-                6A:72:26:7A:D0:1E:EF:7D:E7:3B:69:51:D4:6C:8D:9F:90:12:66:AB
-SHA1 Fingerprint=8C:F4:27:FD:79:0C:3A:D1:66:06:8D:E8:1E:57:EF:BB:93:22:72:D4
-SHA256 Fingerprint=43:DF:57:74:B0:3E:7F:EF:5F:E4:0D:93:1A:7B:ED:F1:BB:2E:6B:42:73:8C:4E:6D:38:41:10:3D:3A:A7:F3:39
------BEGIN CERTIFICATE-----
-MIIEPjCCAyagAwIBAgIESlOMKDANBgkqhkiG9w0BAQsFADCBvjELMAkGA1UEBhMC
-VVMxFjAUBgNVBAoTDUVudHJ1c3QsIEluYy4xKDAmBgNVBAsTH1NlZSB3d3cuZW50
-cnVzdC5uZXQvbGVnYWwtdGVybXMxOTA3BgNVBAsTMChjKSAyMDA5IEVudHJ1c3Qs
-IEluYy4gLSBmb3IgYXV0aG9yaXplZCB1c2Ugb25seTEyMDAGA1UEAxMpRW50cnVz
-dCBSb290IENlcnRpZmljYXRpb24gQXV0aG9yaXR5IC0gRzIwHhcNMDkwNzA3MTcy
-NTU0WhcNMzAxMjA3MTc1NTU0WjCBvjELMAkGA1UEBhMCVVMxFjAUBgNVBAoTDUVu
-dHJ1c3QsIEluYy4xKDAmBgNVBAsTH1NlZSB3d3cuZW50cnVzdC5uZXQvbGVnYWwt
-dGVybXMxOTA3BgNVBAsTMChjKSAyMDA5IEVudHJ1c3QsIEluYy4gLSBmb3IgYXV0
-aG9yaXplZCB1c2Ugb25seTEyMDAGA1UEAxMpRW50cnVzdCBSb290IENlcnRpZmlj
-YXRpb24gQXV0aG9yaXR5IC0gRzIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
-AoIBAQC6hLZy254Ma+KZ6TABp3bqMriVQRrJ2mFOWHLP/vaCeb9zYQYKpSfYs1/T
-RU4cctZOMvJyig/3gxnQaoCAAEUesMfnmr8SVycco2gvCoe9amsOXmXzHHfV1IWN
-cCG0szLni6LVhjkCsbjSR87kyUnEO6fe+1R9V77w6G7CebI6C1XiUJgWMhNcL3hW
-wcKUs/Ja5CeanyTXxuzQmyWC48zCxEXFjJd6BmsqEZ+pCm5IO2/b1BEZQvePB7/1
-U1+cPvQXLOZprE4yTGJ36rfo5bs0vBmLrpxR57d+tVOxMyLlbc9wPBr64ptntoP0
-jaWvYkxN4FisZDQSA/i2jZRjJKRxAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAP
-BgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBRqciZ60B7vfec7aVHUbI2fkBJmqzAN
-BgkqhkiG9w0BAQsFAAOCAQEAeZ8dlsa2eT8ijYfThwMEYGprmi5ZiXMRrEPR9RP/
-jTkrwPK9T3CMqS/qF8QLVJ7UG5aYMzyorWKiAHarWWluBh1+xLlEjZivEtRh2woZ
-Rkfz6/djwUAFQKXSt/S1mja/qYh2iARVBCuch38aNzx+LaUa2NSJXsq9rD1s2G2v
-1fN2D807iDginWyTmsQ9v4IbZT+mD12q/OWyFcq1rca8PdCE6OoGcrBNOTJ4vz4R
-nAuknZoh8/CbCzB428Hch0P+vGOaysXCHMnHjf87ElgI5rY97HosTvuDls4MPGmH
-VHOkc8KT/1EQrBVUAdj8BbGJoX90g5pJ19xOe4pIb4tF9g==
------END CERTIFICATE-----
-=== /C=US/O=Entrust, Inc./OU=See www.entrust.net/legal-terms/OU=(c) 2012 Entrust, Inc. - for authorized use only/CN=Entrust Root Certification Authority - EC1
-Certificate:
-    Data:
-        Version: 3 (0x2)
-        Serial Number:
-            a6:8b:79:29:00:00:00:00:50:d0:91:f9
-    Signature Algorithm: ecdsa-with-SHA384
-        Validity
-            Not Before: Dec 18 15:25:36 2012 GMT
-            Not After : Dec 18 15:55:36 2037 GMT
-        Subject: C=US, O=Entrust, Inc., OU=See www.entrust.net/legal-terms, OU=(c) 2012 Entrust, Inc. - for authorized use only, CN=Entrust Root Certification Authority - EC1
-        X509v3 extensions:
-            X509v3 Key Usage: critical
-                Certificate Sign, CRL Sign
-            X509v3 Basic Constraints: critical
-                CA:TRUE
-            X509v3 Subject Key Identifier:
-                B7:63:E7:1A:DD:8D:E9:08:A6:55:83:A4:E0:6A:50:41:65:11:42:49
-SHA1 Fingerprint=20:D8:06:40:DF:9B:25:F5:12:25:3A:11:EA:F7:59:8A:EB:14:B5:47
-SHA256 Fingerprint=02:ED:0E:B2:8C:14:DA:45:16:5C:56:67:91:70:0D:64:51:D7:FB:56:F0:B2:AB:1D:3B:8E:B0:70:E5:6E:DF:F5
------BEGIN CERTIFICATE-----
-MIIC+TCCAoCgAwIBAgINAKaLeSkAAAAAUNCR+TAKBggqhkjOPQQDAzCBvzELMAkG
-A1UEBhMCVVMxFjAUBgNVBAoTDUVudHJ1c3QsIEluYy4xKDAmBgNVBAsTH1NlZSB3
-d3cuZW50cnVzdC5uZXQvbGVnYWwtdGVybXMxOTA3BgNVBAsTMChjKSAyMDEyIEVu
-dHJ1c3QsIEluYy4gLSBmb3IgYXV0aG9yaXplZCB1c2Ugb25seTEzMDEGA1UEAxMq
-RW50cnVzdCBSb290IENlcnRpZmljYXRpb24gQXV0aG9yaXR5IC0gRUMxMB4XDTEy
-MTIxODE1MjUzNloXDTM3MTIxODE1NTUzNlowgb8xCzAJBgNVBAYTAlVTMRYwFAYD
-VQQKEw1FbnRydXN0LCBJbmMuMSgwJgYDVQQLEx9TZWUgd3d3LmVudHJ1c3QubmV0
-L2xlZ2FsLXRlcm1zMTkwNwYDVQQLEzAoYykgMjAxMiBFbnRydXN0LCBJbmMuIC0g
-Zm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxMzAxBgNVBAMTKkVudHJ1c3QgUm9vdCBD
-ZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAtIEVDMTB2MBAGByqGSM49AgEGBSuBBAAi
-A2IABIQTydC6bUF74mzQ61VfZgIaJPRbiWlH47jCffHyAsWfoPZb1YsGGYZPUxBt
-ByQnoaD41UcZYUx9ypMn6nQM72+WCf5j7HBdNq1nd67JnXxVRDqiY1Ef9eNi1KlH
-Bz7MIKNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0O
-BBYEFLdj5xrdjekIplWDpOBqUEFlEUJJMAoGCCqGSM49BAMDA2cAMGQCMGF52OVC
-R98crlOZF7ZvHH3hvxGU0QOIdeSNiaSKd0bebWHvAvX7td/M/k7//qnmpwIwW5nX
-hTcGtXsI/esni0qU+eH6p44mCOh8kmhtc9hvJqwhAriZtyZBWyVgrtBIGu4G
------END CERTIFICATE-----
-=== /C=US/O=Entrust, Inc./OU=www.entrust.net/CPS is incorporated by reference/OU=(c) 2006 Entrust, Inc./CN=Entrust Root Certification Authority
-Certificate:
-    Data:
-        Version: 3 (0x2)
-        Serial Number: 1164660820 (0x456b5054)
-    Signature Algorithm: sha1WithRSAEncryption
-        Validity
-            Not Before: Nov 27 20:23:42 2006 GMT
-            Not After : Nov 27 20:53:42 2026 GMT
-        Subject: C=US, O=Entrust, Inc., OU=www.entrust.net/CPS is incorporated by reference, OU=(c) 2006 Entrust, Inc., CN=Entrust Root Certification Authority
-        X509v3 extensions:
-            X509v3 Key Usage: critical
-                Certificate Sign, CRL Sign
-            X509v3 Basic Constraints: critical
-                CA:TRUE
-            X509v3 Private Key Usage Period:
-                Not Before: Nov 27 20:23:42 2006 GMT, Not After: Nov 27 20:53:42 2026 GMT
-            X509v3 Authority Key Identifier:
-                keyid:68:90:E4:67:A4:A6:53:80:C7:86:66:A4:F1:F7:4B:43:FB:84:BD:6D
-
-            X509v3 Subject Key Identifier:
-                68:90:E4:67:A4:A6:53:80:C7:86:66:A4:F1:F7:4B:43:FB:84:BD:6D
-            1.2.840.113533.7.65.0:
-                0...V7.1:4.0....
-SHA1 Fingerprint=B3:1E:B1:B7:40:E3:6C:84:02:DA:DC:37:D4:4D:F5:D4:67:49:52:F9
-SHA256 Fingerprint=73:C1:76:43:4F:1B:C6:D5:AD:F4:5B:0E:76:E7:27:28:7C:8D:E5:76:16:C1:E6:E6:14:1A:2B:2C:BC:7D:8E:4C
------BEGIN CERTIFICATE-----
-MIIEkTCCA3mgAwIBAgIERWtQVDANBgkqhkiG9w0BAQUFADCBsDELMAkGA1UEBhMC
-VVMxFjAUBgNVBAoTDUVudHJ1c3QsIEluYy4xOTA3BgNVBAsTMHd3dy5lbnRydXN0
-Lm5ldC9DUFMgaXMgaW5jb3Jwb3JhdGVkIGJ5IHJlZmVyZW5jZTEfMB0GA1UECxMW
-KGMpIDIwMDYgRW50cnVzdCwgSW5jLjEtMCsGA1UEAxMkRW50cnVzdCBSb290IENl
-cnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTA2MTEyNzIwMjM0MloXDTI2MTEyNzIw
-NTM0MlowgbAxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1FbnRydXN0LCBJbmMuMTkw
-NwYDVQQLEzB3d3cuZW50cnVzdC5uZXQvQ1BTIGlzIGluY29ycG9yYXRlZCBieSBy
-ZWZlcmVuY2UxHzAdBgNVBAsTFihjKSAyMDA2IEVudHJ1c3QsIEluYy4xLTArBgNV
-BAMTJEVudHJ1c3QgUm9vdCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTCCASIwDQYJ
-KoZIhvcNAQEBBQADggEPADCCAQoCggEBALaVtkNC+sZtKm9I35RMOVcF7sN5EUFo
-Nu3s/poBj6E4KPz3EEZmLk0eGrEaTsbRwJWIsMn/MYszA9u3g3s+IIRe7bJWKKf4
-4LlAcTfFy0cOlypowCKVYhXbR9n10Cv/gkvJrT7eTNuQgFA/CYqEAOwwCj0Yzfv9
-KlmaI5UXLEWeH25DeW0MXJj+SKfFI0dcXv1u5x609mhF0YaDW6KKjbHjKYD+JXGI
-rb68j6xSlkuqUY3kEzEZ6E5Nn9uss2rVvDlUccp6en+Q3X0dgNmBu1kmwhH+5pPi
-94DkZfs0Nw4pgHBNrziGLp5/V6+eF67rHMsoIV+2HNjnogQi+dPa2MsCAwEAAaOB
-sDCBrTAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zArBgNVHRAEJDAi
-gA8yMDA2MTEyNzIwMjM0MlqBDzIwMjYxMTI3MjA1MzQyWjAfBgNVHSMEGDAWgBRo
-kORnpKZTgMeGZqTx90tD+4S9bTAdBgNVHQ4EFgQUaJDkZ6SmU4DHhmak8fdLQ/uE
-vW0wHQYJKoZIhvZ9B0EABBAwDhsIVjcuMTo0LjADAgSQMA0GCSqGSIb3DQEBBQUA
-A4IBAQCT1DCw1wMgKtD5Y+iRDAUgqV8ZyntyTtSx29CW+1RaGSwMCPeyvIWonX9t
-O1KzKtvn1ISMY/YPyyYBkVBs9F8U4pN0wBOeMDpQ47RgxRzwIkSNcUesyBrJ6Zua
-AGAT/3B+XxFNSRuzFVJ7yVTav52Vr2ua2J7p8eRDjeIRRDq/r72DQnNSi6q7pynP
-9WQcCk3RvKqsnyrQ/39/2n3qse0wJcGE2jTSW3iDVuycNsMm4hH2Z0kdkquM++v/
-eu6FSqdQgPCnXEqULl8FmTxSQeDNtGPPAUO6nIPcj2A781q0tHuu2guQOHXvgR1m
-0vdXcDazv/wor3ElhVsT/h5/WrQ8
------END CERTIFICATE-----
-
 ### FNMT-RCM
 
 === /C=ES/O=FNMT-RCM/OU=AC RAIZ FNMT-RCM
@@ -2894,48 +2217,6 @@ MQD6SmxgiHPz7riYYqnOK8LZiqZwMR2vsJRM60/G49HzYqc8/5MuB1xJAWdpEgJy
 v+c=
 -----END CERTIFICATE-----
 
-### Firmaprofesional SA
-
-=== /C=ES/O=Firmaprofesional SA/2.5.4.97=VATES-A62634068/CN=FIRMAPROFESIONAL CA ROOT-A WEB
-Certificate:
-    Data:
-        Version: 3 (0x2)
-        Serial Number:
-            31:97:21:ed:af:89:42:7f:35:41:87:a1:67:56:4c:6d
-    Signature Algorithm: ecdsa-with-SHA384
-        Validity
-            Not Before: Apr  6 09:01:36 2022 GMT
-            Not After : Mar 31 09:01:36 2047 GMT
-        Subject: C=ES, O=Firmaprofesional SA, 2.5.4.97=VATES-A62634068, CN=FIRMAPROFESIONAL CA ROOT-A WEB
-        X509v3 extensions:
-            X509v3 Basic Constraints: critical
-                CA:TRUE
-            X509v3 Authority Key Identifier:
-                keyid:93:E1:43:63:5C:3C:9D:D6:27:F3:52:EC:17:B2:A9:AF:2C:F7:76:F8
-
-            X509v3 Subject Key Identifier:
-                93:E1:43:63:5C:3C:9D:D6:27:F3:52:EC:17:B2:A9:AF:2C:F7:76:F8
-            X509v3 Key Usage: critical
-                Certificate Sign, CRL Sign
-SHA1 Fingerprint=A8:31:11:74:A6:14:15:0D:CA:77:DD:0E:E4:0C:5D:58:FC:A0:72:A5
-SHA256 Fingerprint=BE:F2:56:DA:F2:6E:9C:69:BD:EC:16:02:35:97:98:F3:CA:F7:18:21:A0:3E:01:82:57:C5:3C:65:61:7F:3D:4A
------BEGIN CERTIFICATE-----
-MIICejCCAgCgAwIBAgIQMZch7a+JQn81QYehZ1ZMbTAKBggqhkjOPQQDAzBuMQsw
-CQYDVQQGEwJFUzEcMBoGA1UECgwTRmlybWFwcm9mZXNpb25hbCBTQTEYMBYGA1UE
-YQwPVkFURVMtQTYyNjM0MDY4MScwJQYDVQQDDB5GSVJNQVBST0ZFU0lPTkFMIENB
-IFJPT1QtQSBXRUIwHhcNMjIwNDA2MDkwMTM2WhcNNDcwMzMxMDkwMTM2WjBuMQsw
-CQYDVQQGEwJFUzEcMBoGA1UECgwTRmlybWFwcm9mZXNpb25hbCBTQTEYMBYGA1UE
-YQwPVkFURVMtQTYyNjM0MDY4MScwJQYDVQQDDB5GSVJNQVBST0ZFU0lPTkFMIENB
-IFJPT1QtQSBXRUIwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAARHU+osEaR3xyrq89Zf
-e9MEkVz6iMYiuYMQYneEMy3pA4jU4DP37XcsSmDq5G+tbbT4TIqk5B/K6k84Si6C
-cyvHZpsKjECcfIr28jlgst7L7Ljkb+qbXbdTkBgyVcUgt5SjYzBhMA8GA1UdEwEB
-/wQFMAMBAf8wHwYDVR0jBBgwFoAUk+FDY1w8ndYn81LsF7Kpryz3dvgwHQYDVR0O
-BBYEFJPhQ2NcPJ3WJ/NS7Beyqa8s93b4MA4GA1UdDwEB/wQEAwIBBjAKBggqhkjO
-PQQDAwNoADBlAjAdfKR7w4l1M+E7qUW/Runpod3JIha3RxEL2Jq68cgLcFBTApFw
-hVmpHqTm6iMxoAACMQD94vizrxa5HnPEluPBMBnYfubDl94cT7iJLzPrSA8Z94dG
-XSaQpYXFuXqUPoeovQA=
------END CERTIFICATE-----
-
 ### GUANG DONG CERTIFICATE AUTHORITY CO.,LTD.
 
 === /C=CN/O=GUANG DONG CERTIFICATE AUTHORITY CO.,LTD./CN=GDCA TrustAUTH R5 ROOT
@@ -3340,57 +2621,6 @@ Z6tGn6D/Qqc6f1zLXbBwHSs09dR2CQzreExZBfMzQsNhFRAbd03OIozUhfJFfbdT
 2tIMPNuzjsmhDYAPexZ3FL//2wmUspO8IFgV6dtxQ/PeEMMA3KgqlbbC1j+Qa3bb
 bP6MvPJwNQzcmRk13NfIRmPVNnGuV/u3gm3c
 -----END CERTIFICATE-----
-=== /C=US/O=Google Trust Services LLC/CN=GTS Root R2
-Certificate:
-    Data:
-        Version: 3 (0x2)
-        Serial Number:
-            02:03:e5:ae:c5:8d:04:25:1a:ab:11:25:aa
-    Signature Algorithm: sha384WithRSAEncryption
-        Validity
-            Not Before: Jun 22 00:00:00 2016 GMT
-            Not After : Jun 22 00:00:00 2036 GMT
-        Subject: C=US, O=Google Trust Services LLC, CN=GTS Root R2
-        X509v3 extensions:
-            X509v3 Key Usage: critical
-                Digital Signature, Certificate Sign, CRL Sign
-            X509v3 Basic Constraints: critical
-                CA:TRUE
-            X509v3 Subject Key Identifier:
-                BB:FF:CA:8E:23:9F:4F:99:CA:DB:E2:68:A6:A5:15:27:17:1E:D9:0E
-SHA1 Fingerprint=9A:44:49:76:32:DB:DE:FA:D0:BC:FB:5A:7B:17:BD:9E:56:09:24:94
-SHA256 Fingerprint=8D:25:CD:97:22:9D:BF:70:35:6B:DA:4E:B3:CC:73:40:31:E2:4C:F0:0F:AF:CF:D3:2D:C7:6E:B5:84:1C:7E:A8
------BEGIN CERTIFICATE-----
-MIIFVzCCAz+gAwIBAgINAgPlrsWNBCUaqxElqjANBgkqhkiG9w0BAQwFADBHMQsw
-CQYDVQQGEwJVUzEiMCAGA1UEChMZR29vZ2xlIFRydXN0IFNlcnZpY2VzIExMQzEU
-MBIGA1UEAxMLR1RTIFJvb3QgUjIwHhcNMTYwNjIyMDAwMDAwWhcNMzYwNjIyMDAw
-MDAwWjBHMQswCQYDVQQGEwJVUzEiMCAGA1UEChMZR29vZ2xlIFRydXN0IFNlcnZp
-Y2VzIExMQzEUMBIGA1UEAxMLR1RTIFJvb3QgUjIwggIiMA0GCSqGSIb3DQEBAQUA
-A4ICDwAwggIKAoICAQDO3v2m++zsFDQ8BwZabFn3GTXd98GdVarTzTukk3LvCvpt
-nfbwhYBboUhSnznFt+4orO/LdmgUud+tAWyZH8QiHZ/+cnfgLFuv5AS/T3KgGjSY
-6Dlo7JUle3ah5mm5hRm9iYz+re026nO8/4Piy33B0s5Ks40FnotJk9/BW9BuXvAu
-MC6C/Pq8tBcKSOWIm8Wba96wyrQD8Nr0kLhlZPdcTK3ofmZemde4wj7I0BOdre7k
-RXuJVfeKH2JShBKzwkCX44ofR5GmdFrS+LFjKBC4swm4VndAoiaYecb+3yXuPuWg
-f9RhD1FLPD+M2uFwdNjCaKH5wQzpoeJ/u1U8dgbuak7MkogwTZq9TwtImoS1mKPV
-+3PBV2HdKFZ1E66HjucMUQkQdYhMvI35ezzUIkgfKtzra7tEscszcTJGr61K8Yzo
-dDqs5xoic4DSMPclQsciOzsSrZYuxsN2B6ogtzVJV+mSSeh2FnIxZyuWfoqjx5RW
-Ir9qS34BIbIjMt/kmkRtWVtd9QCgHJvGeJeNkP+byKq0rxFROV7Z+2et1VsRnTKa
-G73VululycslaVNVJ1zgyjbLiGH7HrfQy+4W+9OmTN6SpdTi3/UGVN4unUu0kzCq
-gc7dGtxRcw1PcOnlthYhGXmy5okLdWTK1au8CcEYof/UVKGFPP0UJAOyh9OktwID
-AQABo0IwQDAOBgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4E
-FgQUu//KjiOfT5nK2+JopqUVJxce2Q4wDQYJKoZIhvcNAQEMBQADggIBAB/Kzt3H
-vqGf2SdMC9wXmBFqiN495nFWcrKeGk6c1SuYJF2ba3uwM4IJvd8lRuqYnrYb/oM8
-0mJhwQTtzuDFycgTE1XnqGOtjHsB/ncw4c5omwX4Eu55MaBBRTUoCnGkJE+M3DyC
-B19m3H0Q/gxhswWV7uGugQ+o+MePTagjAiZrHYNSVc61LwDKgEDg4XSsYPWHgJ2u
-NmSRXbBoGOqKYcl3qJfEycel/FVL8/B/uWU9J2jQzGv6U53hkRrJXRqWbTKH7QMg
-yALOWr7Z6v2yTcQvG99fevX4i8buMTolUVVnjWQye+mew4K6Ki3pHrTgSAai/Gev
-HyICc/sgCq+dVEuhzf9gR7A/Xe8bVr2XIZYtCtFenTgCR2y59PYjJbigapordwj6
-xLEokCZYCDzifqrXPW+6MYgKBesntaFJ7qBFVHvmJ2WZICGoo7z7GJa7Um8M7YNR
-TOlZ4iBgxcJlkoKM8xAfDoqXvneCbT+PHV28SSe9zE8P4c52hgQjxcCMElv924Sg
-JPFI/2R80L5cFtHvma3AH/vLrrw4IgYmZNralw4/KBVEqE8AyvCazM90arQ+POuV
-7LXTWtiBmelDGDfrs7vRWGJB82bSj6p4lVQgw1oudCvV0b4YacCs1aTPObpRhANl
-6WLAYv7YTVWW4tAR+kg0Eeye7QUd5MjWHYbL
------END CERTIFICATE-----
 === /C=US/O=Google Trust Services LLC/CN=GTS Root R3
 Certificate:
     Data:
@@ -4474,63 +3704,6 @@ ZgKAvQU6O0ec7AAmTPWIUb+oI38YB7AL7YsmoWTTYUrrXJ/es69nA7Mf3W1daWhp
 q1467HxpvMc7hU6eFbm0FU/DlXpY18ls6Wy58yljXrQs8C097Vpl4KlbQMJImYFt
 nh8GKjwStIsPm6Ik8KaN1nrgS7ZklmOVhMJKzRwuJIczYOXD
 -----END CERTIFICATE-----
-=== /C=BM/O=QuoVadis Limited/CN=QuoVadis Root CA 2
-Certificate:
-    Data:
-        Version: 3 (0x2)
-        Serial Number: 1289 (0x509)
-    Signature Algorithm: sha1WithRSAEncryption
-        Validity
-            Not Before: Nov 24 18:27:00 2006 GMT
-            Not After : Nov 24 18:23:33 2031 GMT
-        Subject: C=BM, O=QuoVadis Limited, CN=QuoVadis Root CA 2
-        X509v3 extensions:
-            X509v3 Basic Constraints: critical
-                CA:TRUE
-            X509v3 Key Usage:
-                Certificate Sign, CRL Sign
-            X509v3 Subject Key Identifier:
-                1A:84:62:BC:48:4C:33:25:04:D4:EE:D0:F6:03:C4:19:46:D1:94:6B
-            X509v3 Authority Key Identifier:
-                keyid:1A:84:62:BC:48:4C:33:25:04:D4:EE:D0:F6:03:C4:19:46:D1:94:6B
-                DirName:/C=BM/O=QuoVadis Limited/CN=QuoVadis Root CA 2
-                serial:05:09
-
-SHA1 Fingerprint=CA:3A:FB:CF:12:40:36:4B:44:B2:16:20:88:80:48:39:19:93:7C:F7
-SHA256 Fingerprint=85:A0:DD:7D:D7:20:AD:B7:FF:05:F8:3D:54:2B:20:9D:C7:FF:45:28:F7:D6:77:B1:83:89:FE:A5:E5:C4:9E:86
------BEGIN CERTIFICATE-----
-MIIFtzCCA5+gAwIBAgICBQkwDQYJKoZIhvcNAQEFBQAwRTELMAkGA1UEBhMCQk0x
-GTAXBgNVBAoTEFF1b1ZhZGlzIExpbWl0ZWQxGzAZBgNVBAMTElF1b1ZhZGlzIFJv
-b3QgQ0EgMjAeFw0wNjExMjQxODI3MDBaFw0zMTExMjQxODIzMzNaMEUxCzAJBgNV
-BAYTAkJNMRkwFwYDVQQKExBRdW9WYWRpcyBMaW1pdGVkMRswGQYDVQQDExJRdW9W
-YWRpcyBSb290IENBIDIwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCa
-GMpLlA0ALa8DKYrwD4HIrkwZhR0In6spRIXzL4GtMh6QRr+jhiYaHv5+HBg6XJxg
-Fyo6dIMzMH1hVBHL7avg5tKifvVrbxi3Cgst/ek+7wrGsxDp3MJGF/hd/aTa/55J
-WpzmM+Yklvc/ulsrHHo1wtZn/qtmUIttKGAr79dgw8eTvI02kfN/+NsRE8Scd3bB
-rrcCaoF6qUWD4gXmuVbBlDePSHFjIuwXZQeVikvfj8ZaCuWw419eaxGrDPmF60Tp
-+ARz8un+XJiM9XOva7R+zdRcAitMOeGylZUtQofX1bOQQ7dsE/He3fbE+Ik/0XX1
-ksOR1YqI0JDs3G3eicJlcZaLDQP9nL9bFqyS2+r+eXyt66/3FsvbzSUr5R/7mp/i
-Ucw6UwxI5g69ybR2BlLmEROFcmMDBOAENisgGQLodKcftslWZvB1JdxnwQ5hYIiz
-PtGo/KPaHbDRsSNU30R2be1B2MGyIrZTHN81Hdyhdyox5C315eXbyOD/5YDXC2Og
-/zOhD7osFRXql7PSorW+8oyWHhqPHWykYTe5hnMz15eWniN9gqRMgeKh0bpnX5UH
-oycR7hYQe7xFSkyyBNKr79X9DFHOUGoIMfmR2gyPZFwDwzqLID9ujWc9Otb+fVuI
-yV77zGHcizN300QyNQliBJIWENieJ0f7OyHj+OsdWwIDAQABo4GwMIGtMA8GA1Ud
-EwEB/wQFMAMBAf8wCwYDVR0PBAQDAgEGMB0GA1UdDgQWBBQahGK8SEwzJQTU7tD2
-A8QZRtGUazBuBgNVHSMEZzBlgBQahGK8SEwzJQTU7tD2A8QZRtGUa6FJpEcwRTEL
-MAkGA1UEBhMCQk0xGTAXBgNVBAoTEFF1b1ZhZGlzIExpbWl0ZWQxGzAZBgNVBAMT
-ElF1b1ZhZGlzIFJvb3QgQ0EgMoICBQkwDQYJKoZIhvcNAQEFBQADggIBAD4KFk2f
-BluornFdLwUvZ+YTRYPENvbzwCYMDbVHZF34tHLJRqUDGCdViXh9duqWNIAXINzn
-g/iN/Ae42l9NLmeyhP3ZRPx3UIHmfLTJDQtyU/h2BwdBR5YM++CCJpNVjP4iH2Bl
-fF/nJrP3MpCYUNQ3cVX2kiF495V5+vgtJodmVjB3pjd4M1IQWK4/YY7yarHvGH5K
-WWPKjaJW1acvvFYfzznB4vsKqBUsfU16Y8Zsl0Q80m/DShcK+JDSV6IZUaUtl0Ha
-B0+pUNqQjZRG4T7wlP0QADj1O+hA4bRuVhogzG9Yje0uRY/W6ZM/57Es3zrWIozc
-hLsib9D45MY56QSIPMO661V6bYCZJPVsAfv4l7CUW+v90m/xd2gNNWQjrLhVoQPR
-TUIZ3Ph1WVaj+ahJefivDrkRoHy3au000LYmYjgahwz46P0u05B/B5EqHdZ+XIWD
-mbA4CD/pXvk1B+TJYm5Xf6dQlfe6yJvmjqIBxdZmv3lh8zwc4bmCXF2gw+nYSL0Z
-ohEUGW6yhhtoPkg3Goi3XZZenMfvJ2II4pEZXNLxId26F0KCl3GBUzGpn/Z9Yr9y
-4aOTHcyKJloJONDO1w2AFrR4pTqHTI2KpdVGl/IsELm8VCLAAVBpQ570su9t+Oza
-8eOx79+Rj1QqCyXBJhnEUhAFZdWCEOrCMc0u
------END CERTIFICATE-----
 === /C=BM/O=QuoVadis Limited/CN=QuoVadis Root CA 2 G3
 Certificate:
     Data:
@@ -4582,74 +3755,6 @@ KCLjsZWDzYWm3S8P52dSbrsvhXz1SnPnxT7AvSESBT/8twNJAlvIJebiVDj1eYeM
 HVOyToV7BjjHLPj4sHKNJeV3UvQDHEimUF+IIDBu8oJDqz2XhOdT+yHBTw8imoa4
 WSr2Rz0ZiC3oheGe7IUIarFsNMkd7EgrO3jtZsSOeWmD3n+M
 -----END CERTIFICATE-----
-=== /C=BM/O=QuoVadis Limited/CN=QuoVadis Root CA 3
-Certificate:
-    Data:
-        Version: 3 (0x2)
-        Serial Number: 1478 (0x5c6)
-    Signature Algorithm: sha1WithRSAEncryption
-        Validity
-            Not Before: Nov 24 19:11:23 2006 GMT
-            Not After : Nov 24 19:06:44 2031 GMT
-        Subject: C=BM, O=QuoVadis Limited, CN=QuoVadis Root CA 3
-        X509v3 extensions:
-            X509v3 Basic Constraints: critical
-                CA:TRUE
-            X509v3 Certificate Policies:
-                Policy: 1.3.6.1.4.1.8024.0.3
-                  User Notice:
-                    Explicit Text: Any use of this Certificate constitutes acceptance of the QuoVadis Root CA 3 Certificate Policy / Certification Practice Statement.
-                  CPS: http://www.quovadisglobal.com/cps
-
-            X509v3 Key Usage:
-                Certificate Sign, CRL Sign
-            X509v3 Subject Key Identifier:
-                F2:C0:13:E0:82:43:3E:FB:EE:2F:67:32:96:35:5C:DB:B8:CB:02:D0
-            X509v3 Authority Key Identifier:
-                keyid:F2:C0:13:E0:82:43:3E:FB:EE:2F:67:32:96:35:5C:DB:B8:CB:02:D0
-                DirName:/C=BM/O=QuoVadis Limited/CN=QuoVadis Root CA 3
-                serial:05:C6
-
-SHA1 Fingerprint=1F:49:14:F7:D8:74:95:1D:DD:AE:02:C0:BE:FD:3A:2D:82:75:51:85
-SHA256 Fingerprint=18:F1:FC:7F:20:5D:F8:AD:DD:EB:7F:E0:07:DD:57:E3:AF:37:5A:9C:4D:8D:73:54:6B:F4:F1:FE:D1:E1:8D:35
------BEGIN CERTIFICATE-----
-MIIGnTCCBIWgAwIBAgICBcYwDQYJKoZIhvcNAQEFBQAwRTELMAkGA1UEBhMCQk0x
-GTAXBgNVBAoTEFF1b1ZhZGlzIExpbWl0ZWQxGzAZBgNVBAMTElF1b1ZhZGlzIFJv
-b3QgQ0EgMzAeFw0wNjExMjQxOTExMjNaFw0zMTExMjQxOTA2NDRaMEUxCzAJBgNV
-BAYTAkJNMRkwFwYDVQQKExBRdW9WYWRpcyBMaW1pdGVkMRswGQYDVQQDExJRdW9W
-YWRpcyBSb290IENBIDMwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDM
-V0IWVJzmmNPTTe7+7cefQzlKZbPoFog02w1ZkXTPkrgEQK0CSzGrvI2RaNggDhoB
-4hp7Thdd4oq3P5kazethq8Jlph+3t723j/z9cI8LoGe+AaJZz3HmDyl2/7FWeUUr
-H556VOijKTVopAFPD6QuN+8bv+OPEKhyq1hX51SGyMnzW9os2l2ObjyjPtr7guXd
-8lyyBTNvijbO0BNO/79KDDRMpsMhvVAEVeuxu537RR5kFd5VAYwCdrXLoT9Cabwv
-vWhDFlaJKjdhkf2mrk7AyxRllDdLkgbvBNDInIjbC3uBr7E9KsRlOni27tyAsdLT
-mZw67mtaa7ONt9XOnMK+pUsvFrGeaDsGb659n/je7Mwpp5ijJUMv7/FfJuGITfhe
-btfZFG4ZM2mnO4SJk8RTVROhUXhA+LjJou57ulJCg54U7QVSWllWp5f8nT8KKdjc
-T5EOE7zelaTfi5m+rJsziO+1ga8bxiJTyPbH7pcUsMV8eFLI8M5ud2CEpukqdiDt
-WAEXMJPpGovgc2PZapKUSU60rUqFxKMiMPwJ7Wgic6aIDFUhWMXhOp8q3crhkODZ
-c6tsgLjoC2SToJyMGf+z0gzskSaHirOi4XCPLArlzW1oUevaPwV/izLmE1xr/l9A
-4iLItLRkT9a6fUg+qGkM17uGcclzuD87nSVL2v9A6wIDAQABo4IBlTCCAZEwDwYD
-VR0TAQH/BAUwAwEB/zCB4QYDVR0gBIHZMIHWMIHTBgkrBgEEAb5YAAMwgcUwgZMG
-CCsGAQUFBwICMIGGGoGDQW55IHVzZSBvZiB0aGlzIENlcnRpZmljYXRlIGNvbnN0
-aXR1dGVzIGFjY2VwdGFuY2Ugb2YgdGhlIFF1b1ZhZGlzIFJvb3QgQ0EgMyBDZXJ0
-aWZpY2F0ZSBQb2xpY3kgLyBDZXJ0aWZpY2F0aW9uIFByYWN0aWNlIFN0YXRlbWVu
-dC4wLQYIKwYBBQUHAgEWIWh0dHA6Ly93d3cucXVvdmFkaXNnbG9iYWwuY29tL2Nw
-czALBgNVHQ8EBAMCAQYwHQYDVR0OBBYEFPLAE+CCQz777i9nMpY1XNu4ywLQMG4G
-A1UdIwRnMGWAFPLAE+CCQz777i9nMpY1XNu4ywLQoUmkRzBFMQswCQYDVQQGEwJC
-TTEZMBcGA1UEChMQUXVvVmFkaXMgTGltaXRlZDEbMBkGA1UEAxMSUXVvVmFkaXMg
-Um9vdCBDQSAzggIFxjANBgkqhkiG9w0BAQUFAAOCAgEAT62gLEz6wPJv92ZVqyM0
-7ucp2sNbtrCD2dDQ4iH782CnO11gUyeim/YIIirnv6By5ZwkajGxkHon24QRiSem
-d1o417+shvzuXYO8BsbRd2sPbSQvS3pspweWyuOEn62Iix2rFo1bZhfZFvSLgNLd
-+LJ2w/w4E6oM3kJpK27zPOuAJ9v1pkQNn1pVWQvVDVJIxa6f8i+AxeoyUDUSly7B
-4f/xI4hROJ/yZlZ25w9Rl6VSDE1JUZU2Pb+iSwwQHYaZTKrzchGT5Or2m9qoXadN
-t54CrnMAyNojA+j56hl0YgCUyyIgvpSnWbWCar6ZeXqp8kokUvd0/bpO5qgdAm6x
-DYBEwa7TIzdfu4V8K5Iu6H6li92Z4b8nby1dqnuH/grdS/yO9SbkbnBCbjPsMZ57
-k8HkyWkaPcBrTiJt7qtYTcbQQcEr6k8Sh17rRdhs9ZgC06DYVYoGmRmioHfRMJ6s
-zHXug/WwYjnPbFfiTNKRCw51KBuav/0aQ/HKd/s7j2G4aSgWQgRecCocIdiP4b0j
-Wy10QJLZYxkNc91pvGJHvOB0K7Lrfb5BG7XARsWhIstfTsEokt4YutUqKLsRixeT
-mJlglFwjz1onl14LBQaTNx47aTbrqZ5hHY8y2o4M1nQ+ewkk2gF3R8Q7zTSMmfXK
-4SVhM7JZG+Ju1zdXtg2pEto=
------END CERTIFICATE-----
 === /C=BM/O=QuoVadis Limited/CN=QuoVadis Root CA 3 G3
 Certificate:
     Data:
@@ -4779,6 +3884,102 @@ t/2jioSgrGK+KwmHNPBqAbubKVY8/gA3zyNs8U6qtnRGEmyR7jTV7JqR50S+kDFy
 SjnRBUkLp7Y3gaVdjKozXoEofKd9J+sAro03
 -----END CERTIFICATE-----
 
+### SECOM Trust Systems Co., Ltd.
+
+=== /C=JP/O=SECOM Trust Systems Co., Ltd./CN=SECOM TLS ECC Root CA 2024
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            81:7a:2c:ef:8f:23:7a:44
+    Signature Algorithm: ecdsa-with-SHA384
+        Validity
+            Not Before: Jan 31 05:52:34 2024 GMT
+            Not After : Jan 14 05:52:34 2049 GMT
+        Subject: C=JP, O=SECOM Trust Systems Co., Ltd., CN=SECOM TLS ECC Root CA 2024
+        X509v3 extensions:
+            X509v3 Subject Key Identifier:
+                3B:76:11:7B:29:74:E2:4E:06:4C:56:82:40:D0:21:2F:7A:B3:C9:D5
+            X509v3 Authority Key Identifier:
+                keyid:3B:76:11:7B:29:74:E2:4E:06:4C:56:82:40:D0:21:2F:7A:B3:C9:D5
+
+            X509v3 Key Usage: critical
+                Certificate Sign, CRL Sign
+            X509v3 Basic Constraints: critical
+                CA:TRUE
+SHA1 Fingerprint=7A:1F:22:2D:72:B2:C3:19:87:44:DB:61:69:E8:A6:4B:D7:0D:44:0E
+SHA256 Fingerprint=6A:B2:AB:75:F5:1C:B4:F4:F0:15:62:03:FB:F6:F6:46:23:2F:51:4B:E0:59:F6:28:33:30:8B:82:B4:D7:2D:B1
+-----BEGIN CERTIFICATE-----
+MIICTDCCAdGgAwIBAgIJAIF6LO+PI3pEMAoGCCqGSM49BAMDMFoxCzAJBgNVBAYT
+AkpQMSYwJAYDVQQKEx1TRUNPTSBUcnVzdCBTeXN0ZW1zIENvLiwgTHRkLjEjMCEG
+A1UEAxMaU0VDT00gVExTIEVDQyBSb290IENBIDIwMjQwHhcNMjQwMTMxMDU1MjM0
+WhcNNDkwMTE0MDU1MjM0WjBaMQswCQYDVQQGEwJKUDEmMCQGA1UEChMdU0VDT00g
+VHJ1c3QgU3lzdGVtcyBDby4sIEx0ZC4xIzAhBgNVBAMTGlNFQ09NIFRMUyBFQ0Mg
+Um9vdCBDQSAyMDI0MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAE7NzFMtu9dzQXSNC1
+2fabk0+GlC5finB3R7XaZonRUd20aFiWObtuNBCLUZSfk6QXAE55BjEXsXQ/NG8y
+UqicXjsu9ksDK3JZBgCwLOVh6+nwJXTvso/dEj/GUYH5mBdoo2MwYTAdBgNVHQ4E
+FgQUO3YReyl04k4GTFaCQNAhL3qzydUwHwYDVR0jBBgwFoAUO3YReyl04k4GTFaC
+QNAhL3qzydUwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wCgYIKoZI
+zj0EAwMDaQAwZgIxAN3ib8fi1pMYtAPjMilB5e5/H+t5CL0xPL+cZ5oTTZuSCjpA
+n1v7F/VAr8bFxQXAowIxAKsBVO1ACFp7skwzPvdv1EUY5a897WGLT4lb+bjxFAWy
+l8wDcZJdwGZ/pAHxt1AJ1g==
+-----END CERTIFICATE-----
+=== /C=JP/O=SECOM Trust Systems Co., Ltd./CN=SECOM TLS RSA Root CA 2024
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            ee:89:34:d0:cb:80:e0:b2
+    Signature Algorithm: sha384WithRSAEncryption
+        Validity
+            Not Before: Jan 31 05:11:55 2024 GMT
+            Not After : Jan 14 05:11:55 2049 GMT
+        Subject: C=JP, O=SECOM Trust Systems Co., Ltd., CN=SECOM TLS RSA Root CA 2024
+        X509v3 extensions:
+            X509v3 Subject Key Identifier:
+                2C:EB:72:12:8E:58:77:64:35:15:56:35:01:57:07:A9:7D:0D:36:E6
+            X509v3 Authority Key Identifier:
+                keyid:2C:EB:72:12:8E:58:77:64:35:15:56:35:01:57:07:A9:7D:0D:36:E6
+
+            X509v3 Key Usage: critical
+                Certificate Sign, CRL Sign
+            X509v3 Basic Constraints: critical
+                CA:TRUE
+SHA1 Fingerprint=FB:97:96:7C:EF:8D:98:63:06:C0:3B:B6:11:F8:E0:13:97:A2:98:D3
+SHA256 Fingerprint=14:35:F2:25:C5:D2:52:D7:A2:19:48:CC:3C:E6:2A:EC:FA:88:00:1E:3D:D7:2D:1C:C3:55:51:00:EB:37:2F:93
+-----BEGIN CERTIFICATE-----
+MIIFmjCCA4KgAwIBAgIJAO6JNNDLgOCyMA0GCSqGSIb3DQEBDAUAMFoxCzAJBgNV
+BAYTAkpQMSYwJAYDVQQKEx1TRUNPTSBUcnVzdCBTeXN0ZW1zIENvLiwgTHRkLjEj
+MCEGA1UEAxMaU0VDT00gVExTIFJTQSBSb290IENBIDIwMjQwHhcNMjQwMTMxMDUx
+MTU1WhcNNDkwMTE0MDUxMTU1WjBaMQswCQYDVQQGEwJKUDEmMCQGA1UEChMdU0VD
+T00gVHJ1c3QgU3lzdGVtcyBDby4sIEx0ZC4xIzAhBgNVBAMTGlNFQ09NIFRMUyBS
+U0EgUm9vdCBDQSAyMDI0MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA
+4TjizUwzxbInq8Tx11gaFYNk5fO+34y7TyM4neh0UgL5JIZbJNLTz2x//L/B71+5
+m6X6nGIr7d4lFJBGtjO677hXOz93zkcWaUTm3VbOAjBlt4YWxlcccBHXuZ7o3Q+4
+R+ormrBdHeJ1CTUEG8ttQbKIl3G7OZYbnH8/pP8cjPub/0kDVNuMzp7xsVRROOis
+Qt53fMoJLlYgoebbuMphOqMCtjkJ7R6efEMfLp8UAVi9ZaLRn76ET/CJkk925ndu
+uufC4BatS4mnXFmxN0vUXb0ij9B8O/D8gixQEsVSD4GK8FWRPh3bVd/6bzdkHGJj
+y21XI0yejVomZUbRrOfNuz0boPGV1pt18fFC39IHQEth3OFqb5NDO3L+A9bNqTgA
+yUgRmIn4ucgDc/Ri/Km3V51ueZjy1/yk0qwJVadAVVrCt56iNeXOyEvzJADGgDQ8
+E1Pdaqct8Cynz/47ReQM62vFYO08wcQkrjmX/tesiko1V1yyaf6EfPzUFzmaGy9x
+vkCwdbm15EdTolOjE0H2Vb5/APDOyCFEokiYGmXTLdAUl0wKZ4IyjkHGzy0jhpaX
+EXE/GJcEvI6VzEchjaBL03EJ0h9pG4OqeIOycKvAo3A+TbetyfsrgYyHzU0a7/qU
+jGat1AAq1nVljMpKqpinPTsf/d9H39FTUeJL7TpzzjUCAwEAAaNjMGEwHQYDVR0O
+BBYEFCzrchKOWHdkNRVWNQFXB6l9DTbmMB8GA1UdIwQYMBaAFCzrchKOWHdkNRVW
+NQFXB6l9DTbmMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MA0GCSqG
+SIb3DQEBDAUAA4ICAQAVwsvluSafaez5tFPR/hRTBzRxEyMMQF3XJXCVi3yegZyK
+oec7hmE6jx2ZM8KgM1kn2yJRwFXHX8zUW9nBLEDWc4wuE8LrlZqhGZM9pJQXGmGz
+ResDJV6JgRBna+j4sA1M7yIdlvL0sAfFXFCTRaWTD4E1V99RLrFzWfTcC+e180hD
+uNMpqOEo46+lMeW/Wvh7ifOQs+kiK0O2gHxQDNxslSavnCs4V7l8HRDJ2La10o70
+Bo7VLzf1W8MBvv0VTnxB+NjT5qTAbhGFh9Gvp4BaJpmdUf0C5CEP6dbQlfgxWfzY
+r69yVT6dPQB+GFEaY03IMY+AcBCs+om1fNxrQXt9zoofMBNFbLhvpNH/JsXWdGUz
+fNbO12uswTa5wah8LB18FTQN2/zPHYmvBEoLuyUgZ09VNLJo5YA0kXItVYkLjMe2
+SixzK4scUHv81IK99I91DWx7FwMVKw2xgFp+ZLYB2dnpQQrqwlW64glHUcK2N9BD
+snjLSxeZ+UPECh9RxH4WAcKiZW+cqaKMmhP2WBfR4IcR7NOL32ml11ds87hhV1CZ
+WWFCJAcCidYZz6CZa8exzHojP9SB5RH0/v1KdHAisqhSjtJl/UIAHIQ48elOn8wr
+TdFap4Yb5aHglmMeNx+fAIhDluWVfxTO7H4dTPU+SFVRMLAh+wwKZfqb94nMeQ==
+-----END CERTIFICATE-----
+
 ### SSL Corporation
 
 === /C=US/O=SSL Corporation/CN=SSL.com TLS ECC Root CA 2022
@@ -5151,111 +4352,6 @@ LvKRRFHQV80MNNVIIb/bE/FmJUNS0nAiNs2fxBx1IK1jcmMGDw4nztJqDby1ORrp
 QqszKbrAKbkTidOIijlBO8n9pu0f9GBj39ItVQGL
 -----END CERTIFICATE-----
 
-### SecureTrust Corporation
-
-=== /C=US/O=SecureTrust Corporation/CN=Secure Global CA
-Certificate:
-    Data:
-        Version: 3 (0x2)
-        Serial Number:
-            07:56:22:a4:e8:d4:8a:89:4d:f4:13:c8:f0:f8:ea:a5
-    Signature Algorithm: sha1WithRSAEncryption
-        Validity
-            Not Before: Nov  7 19:42:28 2006 GMT
-            Not After : Dec 31 19:52:06 2029 GMT
-        Subject: C=US, O=SecureTrust Corporation, CN=Secure Global CA
-        X509v3 extensions:
-            1.3.6.1.4.1.311.20.2:
-                ...C.A
-            X509v3 Key Usage:
-                Digital Signature, Certificate Sign, CRL Sign
-            X509v3 Basic Constraints: critical
-                CA:TRUE
-            X509v3 Subject Key Identifier:
-                AF:44:04:C2:41:7E:48:83:DB:4E:39:02:EC:EC:84:7A:E6:CE:C9:A4
-            X509v3 CRL Distribution Points:
-
-                Full Name:
-                  URI:http://crl.securetrust.com/SGCA.crl
-
-            1.3.6.1.4.1.311.21.1:
-                ...
-SHA1 Fingerprint=3A:44:73:5A:E5:81:90:1F:24:86:61:46:1E:3B:9C:C4:5F:F5:3A:1B
-SHA256 Fingerprint=42:00:F5:04:3A:C8:59:0E:BB:52:7D:20:9E:D1:50:30:29:FB:CB:D4:1C:A1:B5:06:EC:27:F1:5A:DE:7D:AC:69
------BEGIN CERTIFICATE-----
-MIIDvDCCAqSgAwIBAgIQB1YipOjUiolN9BPI8PjqpTANBgkqhkiG9w0BAQUFADBK
-MQswCQYDVQQGEwJVUzEgMB4GA1UEChMXU2VjdXJlVHJ1c3QgQ29ycG9yYXRpb24x
-GTAXBgNVBAMTEFNlY3VyZSBHbG9iYWwgQ0EwHhcNMDYxMTA3MTk0MjI4WhcNMjkx
-MjMxMTk1MjA2WjBKMQswCQYDVQQGEwJVUzEgMB4GA1UEChMXU2VjdXJlVHJ1c3Qg
-Q29ycG9yYXRpb24xGTAXBgNVBAMTEFNlY3VyZSBHbG9iYWwgQ0EwggEiMA0GCSqG
-SIb3DQEBAQUAA4IBDwAwggEKAoIBAQCvNS7YrGxVaQZx5RNoJLNP2MwhR/jxYDiJ
-iQPpvepeRlMJ3Fz1Wuj3RSoC6zFh1ykzTM7HfAo3fg+6MpjhHZevj8fcyTiW89sa
-/FHtaMbQbqR8JNGuQsiWUGMu4P51/pinX0kuleM5M2SOHqRfkNJnPLLZ/kG5VacJ
-jnIFHovdRIWCQtBJwB1g8NEXLJXr9qXBkqPFwqcIYA1gBBCWeZ4WNOaptvolRTnI
-HmX5k/Wq8VLcmZg9pYYaDDUz+kulBAYVHDGA76oYa8J719rO+TMg1fW9ajMtgQT7
-sFzUnKPiXB3jqUJ1XnvUd+85VLrJChgbEplJL4hL/VBi0XPnj3pDAgMBAAGjgZ0w
-gZowEwYJKwYBBAGCNxQCBAYeBABDAEEwCwYDVR0PBAQDAgGGMA8GA1UdEwEB/wQF
-MAMBAf8wHQYDVR0OBBYEFK9EBMJBfkiD2045AuzshHrmzsmkMDQGA1UdHwQtMCsw
-KaAnoCWGI2h0dHA6Ly9jcmwuc2VjdXJldHJ1c3QuY29tL1NHQ0EuY3JsMBAGCSsG
-AQQBgjcVAQQDAgEAMA0GCSqGSIb3DQEBBQUAA4IBAQBjGghAfaReUw132HquHw0L
-URYD7xh8yOOvaliTFGCRsoTciE6+OYo68+aCiV0BN7OrJKQVDpI1WkpEXk5X+nXO
-H0jOZvQ8QCaSmGwb7iRGDBezUqXbpZGRzzfTb+cnCDpOGR86p1hcF895P4vkp9Mm
-I50mD1hp/Ed+stCNi5O/KU9DaXR2Z0vPB4zmAve14bRDtUstFJ/53CYNv6ZHdAbY
-iNE6KTCEztI5gGIbqMdXSbxqVVFnFUq+NQfk1XWYN3kwFNspnWzFacxHVaIw98xc
-f8LDmBxrThaA63p4ZUWiABqvDA1VZDRIuJK58bRQKfJPIx/abKwfROHdI3hRW8cW
------END CERTIFICATE-----
-=== /C=US/O=SecureTrust Corporation/CN=SecureTrust CA
-Certificate:
-    Data:
-        Version: 3 (0x2)
-        Serial Number:
-            0c:f0:8e:5c:08:16:a5:ad:42:7f:f0:eb:27:18:59:d0
-    Signature Algorithm: sha1WithRSAEncryption
-        Validity
-            Not Before: Nov  7 19:31:18 2006 GMT
-            Not After : Dec 31 19:40:55 2029 GMT
-        Subject: C=US, O=SecureTrust Corporation, CN=SecureTrust CA
-        X509v3 extensions:
-            1.3.6.1.4.1.311.20.2:
-                ...C.A
-            X509v3 Key Usage:
-                Digital Signature, Certificate Sign, CRL Sign
-            X509v3 Basic Constraints: critical
-                CA:TRUE
-            X509v3 Subject Key Identifier:
-                42:32:B6:16:FA:04:FD:FE:5D:4B:7A:C3:FD:F7:4C:40:1D:5A:43:AF
-            X509v3 CRL Distribution Points:
-
-                Full Name:
-                  URI:http://crl.securetrust.com/STCA.crl
-
-            1.3.6.1.4.1.311.21.1:
-                ...
-SHA1 Fingerprint=87:82:C6:C3:04:35:3B:CF:D2:96:92:D2:59:3E:7D:44:D9:34:FF:11
-SHA256 Fingerprint=F1:C1:B5:0A:E5:A2:0D:D8:03:0E:C9:F6:BC:24:82:3D:D3:67:B5:25:57:59:B4:E7:1B:61:FC:E9:F7:37:5D:73
------BEGIN CERTIFICATE-----
-MIIDuDCCAqCgAwIBAgIQDPCOXAgWpa1Cf/DrJxhZ0DANBgkqhkiG9w0BAQUFADBI
-MQswCQYDVQQGEwJVUzEgMB4GA1UEChMXU2VjdXJlVHJ1c3QgQ29ycG9yYXRpb24x
-FzAVBgNVBAMTDlNlY3VyZVRydXN0IENBMB4XDTA2MTEwNzE5MzExOFoXDTI5MTIz
-MTE5NDA1NVowSDELMAkGA1UEBhMCVVMxIDAeBgNVBAoTF1NlY3VyZVRydXN0IENv
-cnBvcmF0aW9uMRcwFQYDVQQDEw5TZWN1cmVUcnVzdCBDQTCCASIwDQYJKoZIhvcN
-AQEBBQADggEPADCCAQoCggEBAKukgeWVzfX2FI7CT8rU4niVWJxB4Q2ZQCQXOZEz
-Zum+4YOvYlyJ0fwkW2Gz4BERQRwdbvC4u/jep4G6pkjGnx29vo6pQT64lO0pGtSO
-0gMdA+9tDWccV9cGrcrI9f4Or2YlSASWC12juhbDCE/RRvgUXPLIXgGZbf2IzIao
-wW8xQmxSPmjL8xk037uHGFaAJsTQ3MBv396gwpEWoGQRS0S8Hvbn+mPeZqx2pHGj
-7DaUaHp3pLHnDi+BeuK1cobvomuL8A/b01k/unK8RCSc43Oz969XL0Imnal0ugBS
-8kvNU3xHCzaFDmapCJcWNFfBZveA4+1wVMeT4C4oFVmHursCAwEAAaOBnTCBmjAT
-BgkrBgEEAYI3FAIEBh4EAEMAQTALBgNVHQ8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB
-/zAdBgNVHQ4EFgQUQjK2FvoE/f5dS3rD/fdMQB1aQ68wNAYDVR0fBC0wKzApoCeg
-JYYjaHR0cDovL2NybC5zZWN1cmV0cnVzdC5jb20vU1RDQS5jcmwwEAYJKwYBBAGC
-NxUBBAMCAQAwDQYJKoZIhvcNAQEFBQADggEBADDtT0rhWDpSclu1pqNlGKa7UTt3
-6Z3q059c4EVlew3KW+JwULKUBRSuSceNQQcSc5R+DCMh/bwQf2AQWnL1mA6s7Ll/
-3XpvXdMc9P+IBWlCqQVxyLesJugutIxq/3HcuLHfmbx8IVQr5Fiiu1cprp6poxkm
-D5kuCLDv/WnPmRoJjeOnnyvJNjR7JLN4TJUXpAYmHrZkUjZfYGfZnMUFdAvnZyPS
-CPyI6a6Lf+Ew9Dd+/cYy2i2eRDAwbO4H3tI0/NL/QPZL9GZGBlSm8jIKYyYwa5vR
-3ItHuuG51WLQoqD0ZwV4KWMabwTW+MZMo5qxN7SN5ShLHZ4swrhovO0C7jE=
------END CERTIFICATE-----
-
 ### Starfield Technologies, Inc.
 
 === /C=US/ST=Arizona/L=Scottsdale/O=Starfield Technologies, Inc./CN=Starfield Root Certificate Authority - G2
@@ -5346,66 +4442,6 @@ sSi6
 
 ### SwissSign AG
 
-=== /C=CH/O=SwissSign AG/CN=SwissSign Gold CA - G2
-Certificate:
-    Data:
-        Version: 3 (0x2)
-        Serial Number:
-            bb:40:1c:43:f5:5e:4f:b0
-    Signature Algorithm: sha1WithRSAEncryption
-        Validity
-            Not Before: Oct 25 08:30:35 2006 GMT
-            Not After : Oct 25 08:30:35 2036 GMT
-        Subject: C=CH, O=SwissSign AG, CN=SwissSign Gold CA - G2
-        X509v3 extensions:
-            X509v3 Key Usage: critical
-                Certificate Sign, CRL Sign
-            X509v3 Basic Constraints: critical
-                CA:TRUE
-            X509v3 Subject Key Identifier:
-                5B:25:7B:96:A4:65:51:7E:B8:39:F3:C0:78:66:5E:E8:3A:E7:F0:EE
-            X509v3 Authority Key Identifier:
-                keyid:5B:25:7B:96:A4:65:51:7E:B8:39:F3:C0:78:66:5E:E8:3A:E7:F0:EE
-
-            X509v3 Certificate Policies:
-                Policy: 2.16.756.1.89.1.2.1.1
-                  CPS: http://repository.swisssign.com/
-
-SHA1 Fingerprint=D8:C5:38:8A:B7:30:1B:1B:6E:D4:7A:E6:45:25:3A:6F:9F:1A:27:61
-SHA256 Fingerprint=62:DD:0B:E9:B9:F5:0A:16:3E:A0:F8:E7:5C:05:3B:1E:CA:57:EA:55:C8:68:8F:64:7C:68:81:F2:C8:35:7B:95
------BEGIN CERTIFICATE-----
-MIIFujCCA6KgAwIBAgIJALtAHEP1Xk+wMA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNV
-BAYTAkNIMRUwEwYDVQQKEwxTd2lzc1NpZ24gQUcxHzAdBgNVBAMTFlN3aXNzU2ln
-biBHb2xkIENBIC0gRzIwHhcNMDYxMDI1MDgzMDM1WhcNMzYxMDI1MDgzMDM1WjBF
-MQswCQYDVQQGEwJDSDEVMBMGA1UEChMMU3dpc3NTaWduIEFHMR8wHQYDVQQDExZT
-d2lzc1NpZ24gR29sZCBDQSAtIEcyMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIIC
-CgKCAgEAr+TufoskDhJuqVAtFkQ7kpJcyrhdhJJCEyq8ZVeCQD5XJM1QiyUqt2/8
-76LQwB8CJEoTlo8jE+YoWACjR8cGp4QjK7u9lit/VcyLwVcfDmJlD909Vopz2q5+
-bbqBHH5CjCA12UNNhPqE21Is8w4ndwtrvxEvcnifLtg+5hg3Wipy+dpikJKVyh+c
-6bM8K8vzARO/Ws/BtQpgvd21mWRTuKCWs2/iJneRjOBiEAKfNA+k1ZIzUd6+jbqE
-emA8atufK+ze3gE/bk3lUIbLtK/tREDFylqM2tIrfKjuvqblCqoOpd8FUrdVxyJd
-MmqXl2MT28nbeTZ7hTpKxVKJ+STnnXepgv9VHKVxaSvRAiTysybUa9oEVeXBCsdt
-MDeQKuSeFDNeFhdVxVu1yzSJkvGdJo+hB9TGsnhQ2wwMC3wLjEHXuendjIj3o02y
-MszYF9rNt85mndT9Xv+9lz4pded+p2JYryU0pUHHPbwNUMoDAw8IWh+Vc3hiv69y
-FGkOpeUDDniOJihC8AcLYiAQZzlG+qkDzAQ4embvIIO1jEpWjpEA/I5cgt6IoMPi
-aG59je883WX0XaxR7ySArqpWl2/5rX3aYT+YdzylkbYcjCbaZaIJbcHiVOO5ykxM
-gI93e2CaHt+28kgeDrpOVG2Y4OGiGqJ3UM/EY5LsRxmd6+ZrzsECAwEAAaOBrDCB
-qTAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUWyV7
-lqRlUX64OfPAeGZe6Drn8O4wHwYDVR0jBBgwFoAUWyV7lqRlUX64OfPAeGZe6Drn
-8O4wRgYDVR0gBD8wPTA7BglghXQBWQECAQEwLjAsBggrBgEFBQcCARYgaHR0cDov
-L3JlcG9zaXRvcnkuc3dpc3NzaWduLmNvbS8wDQYJKoZIhvcNAQEFBQADggIBACe6
-45R88a7A3hfm5djV9VSwg/S7zV4Fe0+fdWavPOhWfvxyeDgD2StiGwC5+OlgzczO
-UYrHUDFu4Up+GC9pWbY9ZIEr44OE5iKHjn3g7gKZYbge9LgriBIWhMIxkziWMaa5
-O1M/wySTVltpkuzFwbs4AOPsF6m43Md8AYOfMke6UiI0HTJ6CVanfCU2qT1L2sCC
-bwq7EsiHSycR+R4tx5M/nttfJmtS2S6K8RTGRI0Vqbe/vd6mGu6uLftIdxf+u+yv
-GPUqUfA5hJeVbG4bwyvEdGB5JbAKJ9/fXtI5z0V9QkvfsywexcZdylU6oJxpmo/a
-77KwPJ+HbBIrZXAVUjEaJM9vMSNQH4xPjyPDdEFjHFWoFN0+4FFQz/EbMFYOkrCC
-hdiDyyJkvC24JdVUorgG6q2SpCSgwYa1ShNqR88uC1aVVMvOmttqtKay20EIhid3
-92qgQmwLOM7XdVAyksLfKzAiSNDVQTglXaTpXZ/GlHXQRf0wl0OPkKsKx4ZzYEpp
-Ld6leNcG2mqeSz53OiATIgHQv2ieY2BrNU0LbbqhPcCT4H8js1WtciVORvnSFu+w
-ZMEBnunKoGqYDs/YYPIvSbjkQuE4NRb0yG5P94FW6LqjviOvrv1vA+ACOzB2+htt
-Qc8Bsem4yWb02ybzOqR08kkkW8mw0FfB+j564ZfJ
------END CERTIFICATE-----
 === /C=CH/O=SwissSign AG/CN=SwissSign RSA TLS Root CA 2022 - 1
 Certificate:
     Data:
@@ -5695,6 +4731,101 @@ aspHYcN6+NOSBB+4IIThNlQWx0DeO4pz3N/GCUzf7Nr/1FNCocnyYh0igzyXxfkZ
 YiesZSLX0zzG5Y6yU8xJzrww/nsOM5D77dIUkR8Hrw==
 -----END CERTIFICATE-----
 
+### Telia Company AB
+
+=== /C=SE/O=Telia Company AB/CN=Telia EC TLS Root CA v3
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            01:8b:d2:22:54:63:4d:04:8b:6c:e5:47:1f:d2:b5
+    Signature Algorithm: ecdsa-with-SHA384
+        Validity
+            Not Before: Nov 15 08:55:26 2023 GMT
+            Not After : May 23 11:00:00 2048 GMT
+        Subject: C=SE, O=Telia Company AB, CN=Telia EC TLS Root CA v3
+        X509v3 extensions:
+            X509v3 Authority Key Identifier:
+                keyid:D4:64:E8:43:88:3A:73:2F:D0:1A:71:82:36:0B:5E:85:DE:C7:DE:43
+
+            X509v3 Subject Key Identifier:
+                D4:64:E8:43:88:3A:73:2F:D0:1A:71:82:36:0B:5E:85:DE:C7:DE:43
+            X509v3 Key Usage: critical
+                Certificate Sign, CRL Sign
+            X509v3 Basic Constraints: critical
+                CA:TRUE
+SHA1 Fingerprint=B4:D6:07:C2:A5:95:BC:5B:F4:67:4D:C9:DC:6F:6F:0A:00:7A:A5:35
+SHA256 Fingerprint=09:8E:08:A9:1D:BB:F7:74:78:B9:6C:CE:B8:9B:14:13:A5:DA:37:B7:C8:62:60:6A:95:5D:EB:07:17:9F:43:26
+-----BEGIN CERTIFICATE-----
+MIICMjCCAbegAwIBAgIPAYvSIlRjTQSLbOVHH9K1MAoGCCqGSM49BAMDMEoxCzAJ
+BgNVBAYTAlNFMRkwFwYDVQQKDBBUZWxpYSBDb21wYW55IEFCMSAwHgYDVQQDDBdU
+ZWxpYSBFQyBUTFMgUm9vdCBDQSB2MzAeFw0yMzExMTUwODU1MjZaFw00ODA1MjMx
+MTAwMDBaMEoxCzAJBgNVBAYTAlNFMRkwFwYDVQQKDBBUZWxpYSBDb21wYW55IEFC
+MSAwHgYDVQQDDBdUZWxpYSBFQyBUTFMgUm9vdCBDQSB2MzB2MBAGByqGSM49AgEG
+BSuBBAAiA2IABMHIlhVDLbmFKUpW0iK4dpryT6emYOeS31JPwWnWPmkWRrAkTbPX
+40sQfHI9mpR7Rbktu3ngg6W+BBSXSechtMCnBmWXj/EaVlmV5cY1jD2HoTfhBQ3A
+acpCNMLJK4NpZaNjMGEwHwYDVR0jBBgwFoAU1GToQ4g6cy/QGnGCNgtehd7H3kMw
+HQYDVR0OBBYEFNRk6EOIOnMv0BpxgjYLXoXex95DMA4GA1UdDwEB/wQEAwIBBjAP
+BgNVHRMBAf8EBTADAQH/MAoGCCqGSM49BAMDA2kAMGYCMQCXAUdS/9bbJ8A1JYaG
+f/bWt/s7Ta0ot5Ulno8OjSNYRWQIlS4tVWldvTAVA7heOFgCMQCvKr8+Z2Rn+OBr
+5UHzlgBObpad1LuwNTRcdNgUJxIWadcki+UBLEi1/AURKV5md2M=
+-----END CERTIFICATE-----
+=== /C=SE/O=Telia Company AB/CN=Telia RSA TLS Root CA v3
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            01:8b:d2:50:ab:42:55:2c:47:5a:bd:a1:dc:1a:c5
+    Signature Algorithm: sha384WithRSAEncryption
+        Validity
+            Not Before: Nov 15 09:47:42 2023 GMT
+            Not After : May 23 11:00:00 2048 GMT
+        Subject: C=SE, O=Telia Company AB, CN=Telia RSA TLS Root CA v3
+        X509v3 extensions:
+            X509v3 Authority Key Identifier:
+                keyid:B0:C7:A9:D2:DD:B2:28:56:73:04:94:8C:14:5C:48:6F:37:52:92:A8
+
+            X509v3 Subject Key Identifier:
+                B0:C7:A9:D2:DD:B2:28:56:73:04:94:8C:14:5C:48:6F:37:52:92:A8
+            X509v3 Key Usage: critical
+                Certificate Sign, CRL Sign
+            X509v3 Basic Constraints: critical
+                CA:TRUE
+SHA1 Fingerprint=B5:2E:88:4E:40:C1:11:FB:50:C7:E2:4F:AC:18:2B:BD:68:15:D2:34
+SHA256 Fingerprint=D1:3D:B1:29:4C:45:EB:C6:FC:86:C6:BB:F6:9F:A2:9B:DF:E6:92:DF:F7:C7:13:C2:43:C7:A9:56:C6:A2:28:4C
+-----BEGIN CERTIFICATE-----
+MIIFgjCCA2qgAwIBAgIPAYvSUKtCVSxHWr2h3BrFMA0GCSqGSIb3DQEBDAUAMEsx
+CzAJBgNVBAYTAlNFMRkwFwYDVQQKDBBUZWxpYSBDb21wYW55IEFCMSEwHwYDVQQD
+DBhUZWxpYSBSU0EgVExTIFJvb3QgQ0EgdjMwHhcNMjMxMTE1MDk0NzQyWhcNNDgw
+NTIzMTEwMDAwWjBLMQswCQYDVQQGEwJTRTEZMBcGA1UECgwQVGVsaWEgQ29tcGFu
+eSBBQjEhMB8GA1UEAwwYVGVsaWEgUlNBIFRMUyBSb290IENBIHYzMIICIjANBgkq
+hkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAsV89KG19hCf4S1Fvk8D3TyDERhmcvx8F
+7Kmb4WATx3ije1id3KHxRE0TKmcNCbAQ57bvHFEYa4hR2l20VjVadExqOW+2ld99
+MbEiO+jRVOz+BbxLxJnmGwCqI+BfuTjjVReDxsxjQvjgBsClaO/sm5i70nlZcWGR
+tIkvWDK3NNkT5RtwXc/O8NTFVpbUqT6cRjIj3olAblR+lRf4Ffy5o+Q9fabjYn9Z
+9S4itruElcEFf9Ljk7fwdTycT/rvJW9w/B3G2a3r0f/zXNOVruIBcqE6pkSospAC
+U2bG42fYKrbM/GWnp7u+p9Frz4jaNwpb4YHuEeS8BratNcP8X62jXIvvKHxlsMDJ
+Cnb4U8JzFOLsU6mohVY58BdZrvi0Gk9UOuqmgoG6dskHoksjZTlK61D/InzmEoA1
+yAYJFDVysjRxDUOu9cAwANbqmq77WIFL6BpnZgVqPtMfG6wN8BrTKdapvilVsYR5
+9BFgIsAVBMxrGh+W+QcvmJafUpASvlArKvVG2FI4i6PiLjSBT0+6F6EQLrYqefOQ
+F/fBNEXb+njUQ0SUVrAqtH4Y+OjCI/a4/JJQppxeemZcQ0SUShgiI5AM5xHO5iya
+UrTjYH4zxUz9j+1FEbDH/xpstr1gXBykspup+hRTaJcbA+UbpJqtWZndAPddJmt6
+YJQ+dU3pDu8CAwEAAaNjMGEwHwYDVR0jBBgwFoAUsMep0t2yKFZzBJSMFFxIbzdS
+kqgwHQYDVR0OBBYEFLDHqdLdsihWcwSUjBRcSG83UpKoMA4GA1UdDwEB/wQEAwIB
+BjAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDAUAA4ICAQBdYzFsNGDRk7bR
+/AgRKq+5637YuOW+w6uhpoS0VnKMUpyHCwku86hEvqivakPtfmlm4bFwt++sb/8O
+XsWBqtfbXMaBNDTZl8XRMJuLWOW2JrbKkRzgG0eBUcvsadG1rrhbmZqYvFXaAZO7
+o4TdOZzxhBB5GOAWWXB3IeraNP4J63zyo9n8Gqw3sJBG44em5hoYjBffP+npibys
+lnslRi4L6xHsCYj/Pab+OlqbMCB6v+sTCLeEIukRVzoR9aQ45pEK7Z1QBnSsbAKQ
+tss0JKD9d/mX143H1xePjPhTXlv5JCkhrcj+SShz0P9+EHoWe6m9lyUEOIVn0rp+
+yVJWNbmyDv3VkwFxHC1ApSQsgSimjGQ4wtr6cSmordYxkV+Ro8lOIIhRksXPyDk2
+7gW6IjUXCkZKpxFjkL3jiBSc8SkxnwCWtXg8xwNwdFVNBGLCCuJnsneYXjJNqzRq
+UcoGwzsvF3Qi/ZnHUNvISdevlgIAXL4Wvrxaqvoa01wB+GCfs57RTGE4TvAGhKNK
+us8K3hRT1BSpigzMIRzSxtAOrqPN6j//QSmW9f8Jcncri4j2ihSpVrFU0NdNkMhZ
+eAKidTFPsxCVFuW4Aniz7jqiw5sWtjbQrlW035izIEU4sYwQoC1Nx0Svy+mMTRai
+50LqFQ+A1/Hq6xHHDNx7CI83d23Erw==
+-----END CERTIFICATE-----
+
 ### Telia Finland Oyj
 
 === /C=FI/O=Telia Finland Oyj/CN=Telia Root CA v2
@@ -5753,59 +4884,6 @@ ysUsWNc8e89ihmpQfTU2Zqf7N+cox9jQraVplI/owd8k+BsHMYeB2F326CjYSlKA
 rBPuUBQemMc=
 -----END CERTIFICATE-----
 
-### TeliaSonera
-
-=== /O=TeliaSonera/CN=TeliaSonera Root CA v1
-Certificate:
-    Data:
-        Version: 3 (0x2)
-        Serial Number:
-            95:be:16:a0:f7:2e:46:f1:7b:39:82:72:fa:8b:cd:96
-    Signature Algorithm: sha1WithRSAEncryption
-        Validity
-            Not Before: Oct 18 12:00:50 2007 GMT
-            Not After : Oct 18 12:00:50 2032 GMT
-        Subject: O=TeliaSonera, CN=TeliaSonera Root CA v1
-        X509v3 extensions:
-            X509v3 Basic Constraints: critical
-                CA:TRUE
-            X509v3 Key Usage:
-                Certificate Sign, CRL Sign
-            X509v3 Subject Key Identifier:
-                F0:8F:59:38:00:B3:F5:8F:9A:96:0C:D5:EB:FA:7B:AA:17:E8:13:12
-SHA1 Fingerprint=43:13:BB:96:F1:D5:86:9B:C1:4E:6A:92:F6:CF:F6:34:69:87:82:37
-SHA256 Fingerprint=DD:69:36:FE:21:F8:F0:77:C1:23:A1:A5:21:C1:22:24:F7:22:55:B7:3E:03:A7:26:06:93:E8:A2:4B:0F:A3:89
------BEGIN CERTIFICATE-----
-MIIFODCCAyCgAwIBAgIRAJW+FqD3LkbxezmCcvqLzZYwDQYJKoZIhvcNAQEFBQAw
-NzEUMBIGA1UECgwLVGVsaWFTb25lcmExHzAdBgNVBAMMFlRlbGlhU29uZXJhIFJv
-b3QgQ0EgdjEwHhcNMDcxMDE4MTIwMDUwWhcNMzIxMDE4MTIwMDUwWjA3MRQwEgYD
-VQQKDAtUZWxpYVNvbmVyYTEfMB0GA1UEAwwWVGVsaWFTb25lcmEgUm9vdCBDQSB2
-MTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAMK+6yfwIaPzaSZVfp3F
-VRaRXP3vIb9TgHot0pGMYzHw7CTww6XScnwQbfQ3t+XmfHnqjLWCi65ItqwA3GV1
-7CpNX8GH9SBlK4GoRz6JI5UwFpB/6FcHSOcZrr9FZ7E3GwYq/t75rH2D+1665I+X
-Z75Ljo1kB1c4VWk0Nj0TSO9P4tNmHqTPGrdeNjPUtAa9GAH9d4RQAEX1jF3oI7x+
-/jXh7VB7qTCNGdMJjmhnXb88lxhTuylixcpecsHHltTbLaC0H2kD7OriUPEMPPCs
-81Mt8Bz17Ww5OXOAFshSsCPN4D7c3TxHoLs1iuKYaIu+5b9y7tL6pe0S7fyYGKkm
-dtwoSxAgHNN/Fnct7W+A90m7UwW7XWjH1Mh1Fj+JWov3F0fUTPHSiXk+TT2YqGHe
-Oh7S+F4D4MHJHIzTjU3TlTazN19jY5szFPAtJmtTfImMMsJu7D0hADnJoWjiUIMu
-sDor8zagrC/kb2HCUQk5PotTubtn2txTuXZZNp1D5SDgPTJghSJRt8czu90VL6R4
-pgd7gUY2BIbdeTXHlSw7sKMXNeVzH7RcWe/a6hBle3rQf5+ztCo3O3CLm1u5K7fs
-slESl1MpWtTwEhDcTwK7EpIvYtQ/aUN8Ddb8WHUBiJ1YFkveupD/RwGJBmr2X7KQ
-arMCpgKIv7NHfirZ1fpoeDVNAgMBAAGjPzA9MA8GA1UdEwEB/wQFMAMBAf8wCwYD
-VR0PBAQDAgEGMB0GA1UdDgQWBBTwj1k4ALP1j5qWDNXr+nuqF+gTEjANBgkqhkiG
-9w0BAQUFAAOCAgEAvuRcYk4k9AwI//DTDGjkk0kiP0Qnb7tt3oNmzqjMDfz1mgbl
-dxSR651Be5kqhOX//CHBXfDkH1e3damhXwIm/9fH907eT/j3HEbAek9ALCI18Bmx
-0GtnLLCo4MBANzX2hFxc469CeP6nyQ1Q6g2EdvZR74NTxnr/DlZJLo961gzmJ1Tj
-TQpgcmLNkQfWpb/ImWvtxBnmq0wROMVvMeJuScg/doAmAyYp4Db29iBT4xdwNBed
-Y2gea+zDTYa4EzAvXUYNR0PVG6pZDrlcjQZIrXSHX8f8MVRBE+LHIQ6e4B4N4cB7
-Q4WQxYpYxmUKeFfyxiMPAdkgS94P+5KFdSpcc41teyWRyu5FrgZLAMzTsVlQ2jqI
-OylDRl6XK1TOU2+NSueW+r9xDkKLfP0ooNBIytrEgUy7onOTJsjrDNYmiLbAJM+7
-vVvrdX3pCI6GMyx5dwlppYn8s3CQh3aP0yK7Qs69cwsgJirQmz1wHiRszYd2qReW
-t88NkvuOGKmYSdGe/mBEciG5Ge3C9THxOUiIkCR1VBatzvT4aRRkOfujuLpwQMcn
-HL/EVlP6Y2XQ8xwOFvVrhlhNGNTkDY6lnVuR3HYkUD/GKvvZt5y11ubQ2egZixVx
-SK236thZiNSQvxaz2emsWWFUyBy6ysHK4bkgTI86k4mloMy/0/Z1pHWWbVY=
------END CERTIFICATE-----
-
 ### The USERTRUST Network
 
 === /C=US/ST=New Jersey/L=Jersey City/O=The USERTRUST Network/CN=USERTrust ECC Certification Authority
@@ -6082,135 +5160,6 @@ ly4wBOeY99sLAZDBHwo/+ML+TvrbmnNzFrwFuHnYWa8G5z9nODmxfKuU4CkUpijy
 323imttUQ/hHWKNddBWcwauwxzQ=
 -----END CERTIFICATE-----
 
-### Trustwave Holdings, Inc.
-
-=== /C=US/ST=Illinois/L=Chicago/O=Trustwave Holdings, Inc./CN=Trustwave Global Certification Authority
-Certificate:
-    Data:
-        Version: 3 (0x2)
-        Serial Number:
-            05:f7:0e:86:da:49:f3:46:35:2e:ba:b2
-    Signature Algorithm: sha256WithRSAEncryption
-        Validity
-            Not Before: Aug 23 19:34:12 2017 GMT
-            Not After : Aug 23 19:34:12 2042 GMT
-        Subject: C=US, ST=Illinois, L=Chicago, O=Trustwave Holdings, Inc., CN=Trustwave Global Certification Authority
-        X509v3 extensions:
-            X509v3 Basic Constraints: critical
-                CA:TRUE
-            X509v3 Subject Key Identifier:
-                99:E0:19:67:0D:62:DB:76:B3:DA:3D:B8:5B:E8:FD:42:D2:31:0E:87
-            X509v3 Key Usage: critical
-                Certificate Sign, CRL Sign
-SHA1 Fingerprint=2F:8F:36:4F:E1:58:97:44:21:59:87:A5:2A:9A:D0:69:95:26:7F:B5
-SHA256 Fingerprint=97:55:20:15:F5:DD:FC:3C:87:88:C0:06:94:45:55:40:88:94:45:00:84:F1:00:86:70:86:BC:1A:2B:B5:8D:C8
------BEGIN CERTIFICATE-----
-MIIF2jCCA8KgAwIBAgIMBfcOhtpJ80Y1LrqyMA0GCSqGSIb3DQEBCwUAMIGIMQsw
-CQYDVQQGEwJVUzERMA8GA1UECAwISWxsaW5vaXMxEDAOBgNVBAcMB0NoaWNhZ28x
-ITAfBgNVBAoMGFRydXN0d2F2ZSBIb2xkaW5ncywgSW5jLjExMC8GA1UEAwwoVHJ1
-c3R3YXZlIEdsb2JhbCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0xNzA4MjMx
-OTM0MTJaFw00MjA4MjMxOTM0MTJaMIGIMQswCQYDVQQGEwJVUzERMA8GA1UECAwI
-SWxsaW5vaXMxEDAOBgNVBAcMB0NoaWNhZ28xITAfBgNVBAoMGFRydXN0d2F2ZSBI
-b2xkaW5ncywgSW5jLjExMC8GA1UEAwwoVHJ1c3R3YXZlIEdsb2JhbCBDZXJ0aWZp
-Y2F0aW9uIEF1dGhvcml0eTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIB
-ALldUShLPDeS0YLOvR29zd24q88KPuFd5dyqCblXAj7mY2Hf8g+CY66j96xz0Xzn
-swuvCAAJWX/NKSqIk4cXGIDtiLK0thAfLdZfVaITXdHG6wZWiYj+rDKd/VzDBcdu
-7oaJuogDnXIhhpCujwOl3J+IKMujkkkP7NAP4m1ET4BqstTnoApTAbqOl5F2brz8
-1Ws25kCI1nsvXwXoLG0R8+eyvpJETNKXpP7ScoFDB5zpET71ixpZfR9oWN0EACyW
-80OzfpgZdNmcc9kYvkHHNHnZ9GLCQ7mzJ7Aiy/k9UscwR7PJPrhq4ufogXBeQotP
-JqX+OsIgbrv4Fo7NDKm0G2x2EOFYeUY+VM6AqFcJNykbmROPDMjWLBz7BegIlT1l
-RtzuzWniTY+HKE40Cz7PFNm73bZQmq131BnW2hqIyE4bJ3XYsgjxroMwuREOzYfw
-hI0Vcnyh78zyiGG69Gm7DIwLdVcEuE4qFC49DxweMqZiNu5m4iK4BUBjECLzMx10
-coos9TkpoNPnG4CELcU9402x/RpvumUHO1jsQkUm+9jaJXLE9gCxInm943xZYkqc
-BW89zubWR2OZxiRvchLIrH+QtAuRcOi35hYQcRfO3gZPSEF9NUqjifLJS3tBEW1n
-twiYTOURGa5CgNz7kAXU+FDKvuStx8KU1xad5hePrzb7AgMBAAGjQjBAMA8GA1Ud
-EwEB/wQFMAMBAf8wHQYDVR0OBBYEFJngGWcNYtt2s9o9uFvo/ULSMQ6HMA4GA1Ud
-DwEB/wQEAwIBBjANBgkqhkiG9w0BAQsFAAOCAgEAmHNw4rDT7TnsTGDZqRKGFx6W
-0OhUKDtkLSGm+J1WE2pIPU/HPinbbViDVD2HfSMF1OQc3Og4ZYbFdada2zUFvXfe
-uyk3QAUHw5RSn8pk3fEbK9xGChACMf1KaA0HZJDmHvUqoai7PF35owgLEQzxPy0Q
-lG/+4jSHg9bP5Rs1bdID4bANqKCqRieCNqcVtgimQlRXtpla4gt5kNdXElE1GYhB
-aCXUNxeEFfsBctyV3lImIJgm4nb1J2/6ADtKYdkNy1GTKv0WBpanI5ojSP5RvbbE
-sLFUzt5sQa0WZ37b/TjNuThOssFgy50X31ieemKyJo90lZvkWx3SD92YHJtZuSPT
-MaCm/zjdzyBP6VhWOmfD0faZmZ26NraAL4hHT4a/RDqA5Dccprrql5gR0IRiR2Qe
-qu5AvzSxnI9O4fKSTx+O856X3vOmeWqJcU9LJxdI/uz0UA9PSX3MReO9ekDFQdxh
-VicGaeVyQYHTtgGJoC86cnn+OjC/QezHYj6RS8fZMXZC+fc8Y+wmjHMMfRod6qh8
-h6jCJ3zhM0EPz8/8AKAigJ5Kp28AsEFFtyLKaEjFQqKu3R3y4G5OBVixwJAWKqQ9
-EEC+j2Jjg6mcgn0tAumDMHzLJ8n9HmYAsC7TIS+OMxZsmO0QqAfWzJPP29FpHOTK
-yeC2nOnOcXHebD8WpHk=
------END CERTIFICATE-----
-=== /C=US/ST=Illinois/L=Chicago/O=Trustwave Holdings, Inc./CN=Trustwave Global ECC P256 Certification Authority
-Certificate:
-    Data:
-        Version: 3 (0x2)
-        Serial Number:
-            0d:6a:5f:08:3f:28:5c:3e:51:95:df:5d
-    Signature Algorithm: ecdsa-with-SHA256
-        Validity
-            Not Before: Aug 23 19:35:10 2017 GMT
-            Not After : Aug 23 19:35:10 2042 GMT
-        Subject: C=US, ST=Illinois, L=Chicago, O=Trustwave Holdings, Inc., CN=Trustwave Global ECC P256 Certification Authority
-        X509v3 extensions:
-            X509v3 Basic Constraints: critical
-                CA:TRUE
-            X509v3 Key Usage: critical
-                Certificate Sign, CRL Sign
-            X509v3 Subject Key Identifier:
-                A3:41:06:AC:90:6D:D1:4A:EB:75:A5:4A:10:99:B3:B1:A1:8B:4A:F7
-SHA1 Fingerprint=B4:90:82:DD:45:0C:BE:8B:5B:B1:66:D3:E2:A4:08:26:CD:ED:42:CF
-SHA256 Fingerprint=94:5B:BC:82:5E:A5:54:F4:89:D1:FD:51:A7:3D:DF:2E:A6:24:AC:70:19:A0:52:05:22:5C:22:A7:8C:CF:A8:B4
------BEGIN CERTIFICATE-----
-MIICYDCCAgegAwIBAgIMDWpfCD8oXD5Rld9dMAoGCCqGSM49BAMCMIGRMQswCQYD
-VQQGEwJVUzERMA8GA1UECBMISWxsaW5vaXMxEDAOBgNVBAcTB0NoaWNhZ28xITAf
-BgNVBAoTGFRydXN0d2F2ZSBIb2xkaW5ncywgSW5jLjE6MDgGA1UEAxMxVHJ1c3R3
-YXZlIEdsb2JhbCBFQ0MgUDI1NiBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0x
-NzA4MjMxOTM1MTBaFw00MjA4MjMxOTM1MTBaMIGRMQswCQYDVQQGEwJVUzERMA8G
-A1UECBMISWxsaW5vaXMxEDAOBgNVBAcTB0NoaWNhZ28xITAfBgNVBAoTGFRydXN0
-d2F2ZSBIb2xkaW5ncywgSW5jLjE6MDgGA1UEAxMxVHJ1c3R3YXZlIEdsb2JhbCBF
-Q0MgUDI1NiBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTBZMBMGByqGSM49AgEGCCqG
-SM49AwEHA0IABH77bOYj43MyCMpg5lOcunSNGLB4kFKA3TjASh3RqMyTpJcGOMoN
-FWLGjgEqZZ2q3zSRLoHB5DOSMcT9CTqmP62jQzBBMA8GA1UdEwEB/wQFMAMBAf8w
-DwYDVR0PAQH/BAUDAwcGADAdBgNVHQ4EFgQUo0EGrJBt0UrrdaVKEJmzsaGLSvcw
-CgYIKoZIzj0EAwIDRwAwRAIgB+ZU2g6gWrKuEZ+Hxbb/ad4lvvigtwjzRM4q3wgh
-DDcCIC0mA6AFvWvR9lz4ZcyGbbOcNEhjhAnFjXca4syc4XR7
------END CERTIFICATE-----
-=== /C=US/ST=Illinois/L=Chicago/O=Trustwave Holdings, Inc./CN=Trustwave Global ECC P384 Certification Authority
-Certificate:
-    Data:
-        Version: 3 (0x2)
-        Serial Number:
-            08:bd:85:97:6c:99:27:a4:80:68:47:3b
-    Signature Algorithm: ecdsa-with-SHA384
-        Validity
-            Not Before: Aug 23 19:36:43 2017 GMT
-            Not After : Aug 23 19:36:43 2042 GMT
-        Subject: C=US, ST=Illinois, L=Chicago, O=Trustwave Holdings, Inc., CN=Trustwave Global ECC P384 Certification Authority
-        X509v3 extensions:
-            X509v3 Basic Constraints: critical
-                CA:TRUE
-            X509v3 Key Usage: critical
-                Certificate Sign, CRL Sign
-            X509v3 Subject Key Identifier:
-                55:A9:84:89:D2:C1:32:BD:18:CB:6C:A6:07:4E:C8:E7:9D:BE:82:90
-SHA1 Fingerprint=E7:F3:A3:C8:CF:6F:C3:04:2E:6D:0E:67:32:C5:9E:68:95:0D:5E:D2
-SHA256 Fingerprint=55:90:38:59:C8:C0:C3:EB:B8:75:9E:CE:4E:25:57:22:5F:F5:75:8B:BD:38:EB:D4:82:76:60:1E:1B:D5:80:97
------BEGIN CERTIFICATE-----
-MIICnTCCAiSgAwIBAgIMCL2Fl2yZJ6SAaEc7MAoGCCqGSM49BAMDMIGRMQswCQYD
-VQQGEwJVUzERMA8GA1UECBMISWxsaW5vaXMxEDAOBgNVBAcTB0NoaWNhZ28xITAf
-BgNVBAoTGFRydXN0d2F2ZSBIb2xkaW5ncywgSW5jLjE6MDgGA1UEAxMxVHJ1c3R3
-YXZlIEdsb2JhbCBFQ0MgUDM4NCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0x
-NzA4MjMxOTM2NDNaFw00MjA4MjMxOTM2NDNaMIGRMQswCQYDVQQGEwJVUzERMA8G
-A1UECBMISWxsaW5vaXMxEDAOBgNVBAcTB0NoaWNhZ28xITAfBgNVBAoTGFRydXN0
-d2F2ZSBIb2xkaW5ncywgSW5jLjE6MDgGA1UEAxMxVHJ1c3R3YXZlIEdsb2JhbCBF
-Q0MgUDM4NCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTB2MBAGByqGSM49AgEGBSuB
-BAAiA2IABGvaDXU1CDFHBa5FmVXxERMuSvgQMSOjfoPTfygIOiYaOs+Xgh+AtycJ
-j9GOMMQKmw6sWASr9zZ9lCOkmwqKi6vr/TklZvFe/oyujUF5nQlgziip04pt89ZF
-1PKYhDhloKNDMEEwDwYDVR0TAQH/BAUwAwEB/zAPBgNVHQ8BAf8EBQMDBwYAMB0G
-A1UdDgQWBBRVqYSJ0sEyvRjLbKYHTsjnnb6CkDAKBggqhkjOPQQDAwNnADBkAjA3
-AZKXRRJ+oPM+rRk6ct30UJMDEr5E0k9BpIycnR+j9sKS50gU/k6bpZFXrsY3crsC
-MGclCrEMXu6pY5Jv5ZAL/mYiykf9ijH3g/56vxC+GCsej/YpHpRZ744hN8tRmKVu
-Sw==
------END CERTIFICATE-----
-
 ### Turkiye Bilimsel ve Teknolojik Arastirma Kurumu - TUBITAK
 
 === /C=TR/L=Gebze - Kocaeli/O=Turkiye Bilimsel ve Teknolojik Arastirma Kurumu - TUBITAK/OU=Kamu Sertifikasyon Merkezi - Kamu SM/CN=TUBITAK Kamu SM SSL Kok Sertifikasi - Surum 1
@@ -6492,106 +5441,6 @@ rYy0UGYwEAYJKwYBBAGCNxUBBAMCAQAwCgYIKoZIzj0EAwMDaAAwZQIwJsdpW9zV
 Mgj/mkkCtojeFK9dbJlxjRo/i9fgojaGHAeCOnZT/cKi7e97sIBPWA9LUzm9
 -----END CERTIFICATE-----
 
-### certSIGN
-
-=== /C=RO/O=certSIGN/OU=certSIGN ROOT CA
-Certificate:
-    Data:
-        Version: 3 (0x2)
-        Serial Number: 35210227249154 (0x200605167002)
-    Signature Algorithm: sha1WithRSAEncryption
-        Validity
-            Not Before: Jul  4 17:20:04 2006 GMT
-            Not After : Jul  4 17:20:04 2031 GMT
-        Subject: C=RO, O=certSIGN, OU=certSIGN ROOT CA
-        X509v3 extensions:
-            X509v3 Basic Constraints: critical
-                CA:TRUE
-            X509v3 Key Usage: critical
-                Digital Signature, Non Repudiation, Certificate Sign, CRL Sign
-            X509v3 Subject Key Identifier:
-                E0:8C:9B:DB:25:49:B3:F1:7C:86:D6:B2:42:87:0B:D0:6B:A0:D9:E4
-SHA1 Fingerprint=FA:B7:EE:36:97:26:62:FB:2D:B0:2A:F6:BF:03:FD:E8:7C:4B:2F:9B
-SHA256 Fingerprint=EA:A9:62:C4:FA:4A:6B:AF:EB:E4:15:19:6D:35:1C:CD:88:8D:4F:53:F3:FA:8A:E6:D7:C4:66:A9:4E:60:42:BB
------BEGIN CERTIFICATE-----
-MIIDODCCAiCgAwIBAgIGIAYFFnACMA0GCSqGSIb3DQEBBQUAMDsxCzAJBgNVBAYT
-AlJPMREwDwYDVQQKEwhjZXJ0U0lHTjEZMBcGA1UECxMQY2VydFNJR04gUk9PVCBD
-QTAeFw0wNjA3MDQxNzIwMDRaFw0zMTA3MDQxNzIwMDRaMDsxCzAJBgNVBAYTAlJP
-MREwDwYDVQQKEwhjZXJ0U0lHTjEZMBcGA1UECxMQY2VydFNJR04gUk9PVCBDQTCC
-ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALczuX7IJUqOtdu0KBuqV5Do
-0SLTZLrTk+jUrIZhQGpgV2hUhE28alQCBf/fm5oqrl0Hj0rDKH/v+yv6efHHrfAQ
-UySQi2bJqIirr1qjAOm+ukbuW3N7LBeCgV5iLKECZbO9xSsAfsT8AzNXDe3i+s5d
-RdY4zTW2ssHQnIFKquSyAVwdj1+ZxLGt24gh65AIgoDzMKND5pCCrlUoSe1b16kQ
-OA7+j0xbm0bqQfWwCHTD0IgztnzXdN/chNFDDnU5oSVAKOp4yw4sLjmdjItuFhwv
-JoIQ4uNllAoEwF73XVv4EOLQunpL+943AAAaWyjj0pxzPjKHmKHJUS/X3qwzs08C
-AwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAcYwHQYDVR0O
-BBYEFOCMm9slSbPxfIbWskKHC9BroNnkMA0GCSqGSIb3DQEBBQUAA4IBAQA+0hyJ
-LjX8+HXd5n9liPRyTMks1zJO890ZeUe9jjtbkw9QSSQTaxQGcu8J06Gh40CEyecY
-MnQ8SG4Pn0vU9x7Tk4ZkVJdjclDVVc/6IJMCopvDI5NOFlV2oHB5bc0hH88vLbwZ
-44gx+FkagQnIl6Z0x2DEW8xXjrJ1/RsCCdtZb3KTafcxQdaIOL+Hsr0Wefmq5L6I
-Jd1hJyMctTEHBDa0GpC9oHRxUIltvBTjD4au8as+x6AJzKNI0eDbZOeStc+vckNw
-i/nDhDwTqn6Sm1dTk/pwwpEOMfmbZ13pljheX7NzTogVZ96edhBiIL5VaZVDADlN
-9u6wWk5JRFRYX0KD
------END CERTIFICATE-----
-
-### e-commerce monitoring GmbH
-
-=== /C=AT/O=e-commerce monitoring GmbH/CN=GLOBALTRUST 2020
-Certificate:
-    Data:
-        Version: 3 (0x2)
-        Serial Number:
-            5a:4b:bd:5a:fb:4f:8a:5b:fa:65:e5
-    Signature Algorithm: sha256WithRSAEncryption
-        Validity
-            Not Before: Feb 10 00:00:00 2020 GMT
-            Not After : Jun 10 00:00:00 2040 GMT
-        Subject: C=AT, O=e-commerce monitoring GmbH, CN=GLOBALTRUST 2020
-        X509v3 extensions:
-            X509v3 Basic Constraints: critical
-                CA:TRUE
-            X509v3 Key Usage: critical
-                Certificate Sign, CRL Sign
-            X509v3 Subject Key Identifier:
-                DC:2E:1F:D1:61:37:79:E4:AB:D5:D5:B3:12:71:68:3D:6A:68:9C:22
-            X509v3 Authority Key Identifier:
-                keyid:DC:2E:1F:D1:61:37:79:E4:AB:D5:D5:B3:12:71:68:3D:6A:68:9C:22
-
-SHA1 Fingerprint=D0:67:C1:13:51:01:0C:AA:D0:C7:6A:65:37:31:16:26:4F:53:71:A2
-SHA256 Fingerprint=9A:29:6A:51:82:D1:D4:51:A2:E3:7F:43:9B:74:DA:AF:A2:67:52:33:29:F9:0F:9A:0D:20:07:C3:34:E2:3C:9A
------BEGIN CERTIFICATE-----
-MIIFgjCCA2qgAwIBAgILWku9WvtPilv6ZeUwDQYJKoZIhvcNAQELBQAwTTELMAkG
-A1UEBhMCQVQxIzAhBgNVBAoTGmUtY29tbWVyY2UgbW9uaXRvcmluZyBHbWJIMRkw
-FwYDVQQDExBHTE9CQUxUUlVTVCAyMDIwMB4XDTIwMDIxMDAwMDAwMFoXDTQwMDYx
-MDAwMDAwMFowTTELMAkGA1UEBhMCQVQxIzAhBgNVBAoTGmUtY29tbWVyY2UgbW9u
-aXRvcmluZyBHbWJIMRkwFwYDVQQDExBHTE9CQUxUUlVTVCAyMDIwMIICIjANBgkq
-hkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAri5WrRsc7/aVj6B3GyvTY4+ETUWiD59b
-RatZe1E0+eyLinjF3WuvvcTfk0Uev5E4C64OFudBc/jbu9G4UeDLgztzOG53ig9Z
-YybNpyrOVPu44sB8R85gfD+yc/LAGbaKkoc1DZAoouQVBGM+uq/ufF7MpotQsjj3
-QWPKzv9pj2gOlTblzLmMCcpL3TGQlsjMH/1WljTbjhzqLL6FLmPdqqmV0/0plRPw
-yJiT2S0WR5ARg6I6IqIoV6Lr/sCMKKCmfecqQjuCgGOlYx8ZzHyyZqjC0203b+J+
-BlHZRYQfEs4kUmSFC0iAToexIiIwquuuvuAC4EDosEKAA1GqtH6qRNdDYfOiaxaJ
-SaSjpCuKAsR49GiKweR6NrFvG5Ybd0mN1MkGco/PU+PcF4UgStyYJ9ORJitHHmkH
-r96i5OTUawuzXnzUJIBHKWk7buis/UDr2O1xcSvy6Fgd60GXIsUf1DnQJ4+H4xj0
-4KlGDfV0OoIu0G4skaMxXDtG6nsEEFZegB31pWXogvziB4xiRfUg3kZwhqG8k9Me
-dKZssCz3AwyIDMvUclOGvGBG85hqwvG/Q/lwIHfKN0F5VVJjjVsSn8VoxIidrPIw
-q7ejMZdnrY8XD2zHc+0klGvIg5rQmjdJBKuxFshsSUktq6HQjJLyQUp5ISXbY9e2
-nKd+Qmn7OmMCAwEAAaNjMGEwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMC
-AQYwHQYDVR0OBBYEFNwuH9FhN3nkq9XVsxJxaD1qaJwiMB8GA1UdIwQYMBaAFNwu
-H9FhN3nkq9XVsxJxaD1qaJwiMA0GCSqGSIb3DQEBCwUAA4ICAQCR8EICaEDuw2jA
-VC/f7GLDw56KoDEoqoOOpFaWEhCGVrqXctJUMHytGdUdaG/7FELYjQ7ztdGl4wJC
-XtzoRlgHNQIw4Lx0SsFDKv/bGtCwr2zD/cuz9X9tAy5ZVp0tLTWMstZDFyySCstd
-6IwPS3BD0IL/qMy/pJTAvoe9iuOTe8aPmxadJ2W8esVCgmxcB9CpwYhgROmYhRZf
-+I/KARDOJcP5YBugxZfD0yyIMaK9MOzQ0MAS8cE54+X1+NZK3TTN+2/BT+MAi1bi
-kvcoskJ3ciNnxz8RFbLEAwW+uxF7Cr+obuf/WEPPm2eggAe2HcqtbepBEX4tdJP7
-wry+UUTF72glJ4DjyKDUEuzZpTcdN3y0kcra1LGWge9oXHYQSa9+pTeAsRxSvTOB
-TI/53WXZFM2KJVj04sWDpQmQ1GwUY7VA3+vA/MRYfg0UFodUJ25W5HCEuGwyEn6C
-MUO+1918oa2u1qsgEu8KwxCMSZY13At1XrFP1U80DhEgB3VDRemjEdqso5nCtnkn
-4rnvyOL2NSl6dPrFf4IFYqYK6miyeUcGbvJXqBUzxvd4Sj1Ce2t+/vdG6tHrju+I
-aFvowdlxfv1k7/9nR4hYJS8+hge9+6jlgqispdNpQ80xiEmEU5LAsTkbOYMBMMTy
-qfrQA71yN2BWHzZ8vTmR9W0Nv3vXkg==
------END CERTIFICATE-----
-
 ### eMudhra Inc
 
 === /C=US/OU=emSign PKI/O=eMudhra Inc/CN=emSign ECC Root CA - C3
diff --git a/src/lib/libcrypto/cms/cms_kari.c b/src/lib/libcrypto/cms/cms_kari.c
index c23da18058..a16f51a569 100644
--- a/src/lib/libcrypto/cms/cms_kari.c
+++ b/src/lib/libcrypto/cms/cms_kari.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: cms_kari.c,v 1.18 2025/05/10 05:54:38 tb Exp $ */
+/* $OpenBSD: cms_kari.c,v 1.19 2026/08/27 07:13:34 tb Exp $ */
 /*
  * Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project.
@@ -250,6 +250,7 @@ cms_kek_cipher(unsigned char **pout, size_t *poutlen, const unsigned char *in,
         size_t keklen;
         int rv = 0;
         unsigned char *out = NULL;
+        size_t outsize = 0;
         int outlen;
 
         keklen = EVP_CIPHER_CTX_key_length(kari->ctx);
@@ -264,7 +265,11 @@ cms_kek_cipher(unsigned char **pout, size_t *poutlen, const unsigned char *in,
         /* obtain output length of ciphered key */
         if (!EVP_CipherUpdate(kari->ctx, NULL, &outlen, in, inlen))
                 goto err;
-        out = malloc(outlen);
+
+        outsize = outlen;
+        if (outsize < inlen)
+                outsize = inlen;
+        out = malloc(outsize);
         if (out == NULL)
                 goto err;
         if (!EVP_CipherUpdate(kari->ctx, out, &outlen, in, inlen))
@@ -276,7 +281,7 @@ cms_kek_cipher(unsigned char **pout, size_t *poutlen, const unsigned char *in,
  err:
         explicit_bzero(kek, keklen);
         if (!rv)
-                free(out);
+                freezero(out, outsize);
         (void)EVP_CIPHER_CTX_reset(kari->ctx);
         /* FIXME: WHY IS kari->pctx freed here?  /RL */
         EVP_PKEY_CTX_free(kari->pctx);
diff --git a/src/lib/libcrypto/cms/cms_pwri.c b/src/lib/libcrypto/cms/cms_pwri.c
index f64f4ab68c..36a53568d1 100644
--- a/src/lib/libcrypto/cms/cms_pwri.c
+++ b/src/lib/libcrypto/cms/cms_pwri.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: cms_pwri.c,v 1.35 2025/09/30 12:51:16 tb Exp $ */
+/* $OpenBSD: cms_pwri.c,v 1.37 2026/06/09 12:20:34 tb Exp $ */
 /*
  * Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project.
@@ -232,6 +232,10 @@ kek_unwrap_key(unsigned char *out, size_t *outlen, const unsigned char *in,
         unsigned char *tmp;
         int outl, rv = 0;
 
+        /* Ensure inlen is large enough that tmp[6] is in bounds. */
+        if (blocklen < 4)
+                return 0;
+
         if (inlen < 2 * blocklen) {
                 /* too small */
                 return 0;
@@ -386,6 +390,10 @@ cms_RecipientInfo_pwri_crypt(CMS_ContentInfo *cms, CMS_RecipientInfo *ri,
         }
 
         algtmp = pwri->keyDerivationAlgorithm;
+        if (algtmp == NULL) {
+                CMSerror(CMS_R_INVALID_KEY_ENCRYPTION_PARAMETER);
+                goto err;
+        }
 
         /* Finish password based key derivation to setup key in "ctx" */
 
diff --git a/src/lib/libcrypto/conf/conf_api.c b/src/lib/libcrypto/conf/conf_api.c
index 0d5a67d9a5..f04243d36c 100644
--- a/src/lib/libcrypto/conf/conf_api.c
+++ b/src/lib/libcrypto/conf/conf_api.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: conf_api.c,v 1.29 2025/12/21 07:31:22 tb Exp $ */
+/* $OpenBSD: conf_api.c,v 1.30 2026/06/22 08:45:55 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -76,12 +76,13 @@ _CONF_get_section(const CONF *conf, const char *section)
 {
         CONF_VALUE *v, vv;
 
-        if ((conf == NULL) || (section == NULL))
-                return (NULL);
+        if (conf == NULL || section == NULL)
+                return NULL;
         vv.name = NULL;
         vv.section = (char *)section;
         v = lh_CONF_VALUE_retrieve(conf->data, &vv);
-        return (v);
+
+        return v;
 }
 
 int
@@ -113,24 +114,24 @@ _CONF_get_string(const CONF *conf, const char *section, const char *name)
         CONF_VALUE *v, vv;
 
         if (name == NULL)
-                return (NULL);
+                return NULL;
         if (conf != NULL) {
                 if (section != NULL) {
                         vv.name = (char *)name;
                         vv.section = (char *)section;
                         v = lh_CONF_VALUE_retrieve(conf->data, &vv);
                         if (v != NULL)
-                                return (v->value);
+                                return v->value;
                 }
                 vv.section = "default";
                 vv.name = (char *)name;
                 v = lh_CONF_VALUE_retrieve(conf->data, &vv);
                 if (v != NULL)
-                        return (v->value);
+                        return v->value;
                 else
-                        return (NULL);
+                        return NULL;
         } else
-                return (NULL);
+                return NULL;
 }
 
 static unsigned long
@@ -149,15 +150,15 @@ conf_value_cmp(const CONF_VALUE *a, const CONF_VALUE *b)
         if (a->section != b->section) {
                 i = strcmp(a->section, b->section);
                 if (i)
-                        return (i);
+                        return i;
         }
         if ((a->name != NULL) && (b->name != NULL)) {
                 i = strcmp(a->name, b->name);
-                return (i);
+                return i;
         } else if (a->name == b->name)
-                return (0);
+                return 0;
         else
-                return ((a->name == NULL)?-1 : 1);
+                return a->name == NULL ? -1 : 1;
 }
 
 static IMPLEMENT_LHASH_COMP_FN(conf_value, CONF_VALUE)
diff --git a/src/lib/libcrypto/conf/conf_mod.c b/src/lib/libcrypto/conf/conf_mod.c
index 6e697cc478..f90cf0f729 100644
--- a/src/lib/libcrypto/conf/conf_mod.c
+++ b/src/lib/libcrypto/conf/conf_mod.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: conf_mod.c,v 1.41 2025/05/10 05:54:38 tb Exp $ */
+/* $OpenBSD: conf_mod.c,v 1.42 2026/07/31 00:50:52 kenjiro Exp $ */
 /* Written by Stephen Henson (steve@openssl.org) for the OpenSSL
  * project 2001.
  */
@@ -65,6 +65,7 @@
 #include <openssl/crypto.h>
 #include <openssl/x509.h>
 
+#include "conf_local.h"
 #include "err_local.h"
 
 /* This structure contains data about supported modules. */
diff --git a/src/lib/libcrypto/conf/ssleay.cnf b/src/lib/libcrypto/conf/ssleay.cnf
deleted file mode 100644
index ed33af601e..0000000000
--- a/src/lib/libcrypto/conf/ssleay.cnf
+++ /dev/null
@@ -1,78 +0,0 @@
-#
-# This is a test configuration file for use in SSLeay etc...
-#
-
-init = 5
-in\#it1 =10
-init2='10'
-init3='10\''
-init4="10'"
-init5='='10\'' again'
-
-SSLeay::version = 0.5.0
-
-[genrsa]
-default_bits    = 512
-SSLEAY::version = 0.5.0
-
-[gendh]
-default_bits    = 512
-def_generator   = 2
-
-[s_client]
-cipher1         = DES_CBC_MD5:DES_CBC_SHA:DES_EDE_SHA:RC4_MD5\
-cipher2         = 'DES_CBC_MD5 DES_CBC_SHA DES_EDE_SHA RC4_MD5'
-cipher3         = "DES_CBC_MD5 DES_CBC_SHA DES_EDE_SHA RC4_MD5"
-cipher4         = DES_CBC_MD5 DES_CBC_SHA DES_EDE_SHA RC4_MD5
-
-[ default ]
-cert_dir        = $ENV::HOME/.ca_certs
-
-HOME            = /tmp/eay
-
-tmp_cert_dir    = $HOME/.ca_certs
-tmp2_cert_dir   = thisis$(HOME)stuff
-
-LOGNAME = Eric Young (home=$HOME)
-
-[ special ]
-
-H=$HOME
-H=$default::HOME
-H=$ENV::HOME
-#
-# SSLeay example configuration file.
-# This is mostly being used for generation of certificate requests.
-#
-
-RANDFILE                = $HOME/.rand
-
-[ req ]
-default_bits            = 512
-default_keyfile         = privkey.pem
-
-Attribute_type_1        = countryName
-Attribute_text_1        = Country Name (2 letter code)
-Attribute_default_1     = AU
-
-Attribute_type_2        = stateOrProvinceName
-Attribute_text_2        = State or Province Name (full name)
-Attribute_default_2     = Queensland
-
-Attribute_type_3        = localityName
-Attribute_text_3        = Locality Name (eg, city)
-
-Attribute_type_4        = organizationName
-Attribute_text_4        = Organization Name (eg, company)
-Attribute_default_4     = Mincom Pty Ltd
-
-Attribute_type_5        = organizationalUnitName
-Attribute_text_5        = Organizational Unit Name (eg, section)
-Attribute_default_5     = TR
-
-Attribute_type_6        = commonName
-Attribute_text_6        = Common Name (eg, YOUR name)
-
-Attribute_type_7        = emailAddress
-Attribute_text_7        = Email Address
-
diff --git a/src/lib/libcrypto/crypto.h b/src/lib/libcrypto/crypto.h
index 9fcf868403..2a121dda85 100644
--- a/src/lib/libcrypto/crypto.h
+++ b/src/lib/libcrypto/crypto.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: crypto.h,v 1.80 2025/09/28 07:52:53 tb Exp $ */
+/* $OpenBSD: crypto.h,v 1.81 2026/08/30 12:19:37 kenjiro Exp $ */
 /* ====================================================================
  * Copyright (c) 1998-2006 The OpenSSL Project.  All rights reserved.
  *
@@ -305,8 +305,7 @@ void CRYPTO_free_ex_data(int class_index, void *obj, CRYPTO_EX_DATA *ad);
  * (relative to the class type involved) */
 int CRYPTO_set_ex_data(CRYPTO_EX_DATA *ad, int idx, void *val);
 void *CRYPTO_get_ex_data(const CRYPTO_EX_DATA *ad, int idx);
-/* This function cleans up all "ex_data" state. It mustn't be called under
- * potential race-conditions. */
+/* Deprecated no-op retained for compatibility. */
 void CRYPTO_cleanup_all_ex_data(void);
 
 void CRYPTO_lock(int mode, int type, const char *file, int line);
diff --git a/src/lib/libcrypto/crypto_assembly.h b/src/lib/libcrypto/crypto_assembly.h
index 0ae78a81ab..e42ed947dd 100644
--- a/src/lib/libcrypto/crypto_assembly.h
+++ b/src/lib/libcrypto/crypto_assembly.h
@@ -1,4 +1,4 @@
-/*      $OpenBSD: crypto_assembly.h,v 1.1 2026/03/28 13:09:55 jsing Exp $ */
+/*      $OpenBSD: crypto_assembly.h,v 1.5 2026/05/07 15:50:47 jsing Exp $ */
 /*
  * Copyright (c) 2026 Joel Sing <jsing@openbsd.org>
  *
@@ -27,4 +27,47 @@
 #endif
 #endif
 
+#if defined(__APPLE__) && defined(__aarch64__)
+#define CRYPTO_ASSEMBLY_SEPARATOR               %%
+#else
+#define CRYPTO_ASSEMBLY_SEPARATOR               ;
+#endif
+
+#if defined(__APPLE__)
+#define CRYPTO_ASSEMBLY_SECTION_TEXT            __TEXT,__text
+#define CRYPTO_ASSEMBLY_SECTION_RODATA          __DATA,__const
+
+#define CRYPTO_ASSEMBLY_SYMBOL_NAME(name)       _name
+#define CRYPTO_ASSEMBLY_TYPE_FUNCTION(name)
+#define CRYPTO_ASSEMBLY_TYPE_OBJECT(name)
+#define CRYPTO_ASSEMBLY_OBJECT_SIZE(name)
+
+#define CRYPTO_ASSEMBLY_AARCH64_SYM_HI(name)    name@PAGE
+#define CRYPTO_ASSEMBLY_AARCH64_SYM_LO(name)    name@PAGEOFF
+
+#else
+#define CRYPTO_ASSEMBLY_SECTION_TEXT            .text
+#define CRYPTO_ASSEMBLY_SECTION_RODATA          .rodata
+
+#define CRYPTO_ASSEMBLY_SYMBOL_NAME(name)       name
+#define CRYPTO_ASSEMBLY_TYPE_FUNCTION(name)     .type   name,@function
+#define CRYPTO_ASSEMBLY_TYPE_OBJECT(name)       .type   name,@object
+#define CRYPTO_ASSEMBLY_OBJECT_SIZE(name)       .size   name,.-name
+
+#define CRYPTO_ASSEMBLY_AARCH64_SYM_HI(name)    name
+#define CRYPTO_ASSEMBLY_AARCH64_SYM_LO(name)    :lo12:name
+#endif
+
+#define CRYPTO_ASSEMBLY_GLOBAL_FUNCTION(name) \
+        .global CRYPTO_ASSEMBLY_SYMBOL_NAME(name) CRYPTO_ASSEMBLY_SEPARATOR     \
+        CRYPTO_ASSEMBLY_TYPE_FUNCTION(name) CRYPTO_ASSEMBLY_SEPARATOR           \
+        CRYPTO_ASSEMBLY_SYMBOL_NAME(name)
+
+#define CRYPTO_ASSEMBLY_OBJECT_START(name) \
+        CRYPTO_ASSEMBLY_TYPE_OBJECT(name) CRYPTO_ASSEMBLY_SEPARATOR \
+        name
+
+#define CRYPTO_ASSEMBLY_OBJECT_END(name) \
+        CRYPTO_ASSEMBLY_OBJECT_SIZE(name)
+
 #endif
diff --git a/src/lib/libcrypto/crypto_ex_data.c b/src/lib/libcrypto/crypto_ex_data.c
index 233905f888..2066098653 100644
--- a/src/lib/libcrypto/crypto_ex_data.c
+++ b/src/lib/libcrypto/crypto_ex_data.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: crypto_ex_data.c,v 1.6 2025/06/15 15:58:56 tb Exp $ */
+/* $OpenBSD: crypto_ex_data.c,v 1.7 2026/08/30 12:19:37 kenjiro Exp $ */
 /*
  * Copyright (c) 2023 Joel Sing <jsing@openbsd.org>
  *
@@ -19,6 +19,8 @@
 
 #include <openssl/crypto.h>
 
+#include "crypto_internal.h"
+
 #define CRYPTO_EX_DATA_MAX_INDEX 32
 
 struct crypto_ex_data {
@@ -151,6 +153,16 @@ LCRYPTO_ALIAS(CRYPTO_get_ex_new_index);
 void
 CRYPTO_cleanup_all_ex_data(void)
 {
+}
+LCRYPTO_ALIAS(CRYPTO_cleanup_all_ex_data);
+
+/*
+ * Free process-wide ex_data state during OPENSSL_cleanup(). The caller must
+ * ensure that no other thread is using libcrypto.
+ */
+void
+crypto_ex_data_cleanup(void)
+{
         struct crypto_ex_data_class *class;
         int i, j;
 
@@ -173,7 +185,6 @@ CRYPTO_cleanup_all_ex_data(void)
         free(classes);
         classes = NULL;
 }
-LCRYPTO_ALIAS(CRYPTO_cleanup_all_ex_data);
 
 static void
 crypto_ex_data_clear(CRYPTO_EX_DATA *exdata)
diff --git a/src/lib/libcrypto/crypto_init.c b/src/lib/libcrypto/crypto_init.c
index ae4914e358..5b7ce3d4fa 100644
--- a/src/lib/libcrypto/crypto_init.c
+++ b/src/lib/libcrypto/crypto_init.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: crypto_init.c,v 1.26 2025/06/11 07:41:12 tb Exp $ */
+/*      $OpenBSD: crypto_init.c,v 1.27 2026/08/30 12:19:37 kenjiro Exp $ */
 /*
  * Copyright (c) 2018 Bob Beck <beck@openbsd.org>
  *
@@ -107,7 +107,7 @@ OPENSSL_cleanup(void)
         /* This currently calls init... */
         ERR_free_strings();
 
-        CRYPTO_cleanup_all_ex_data();
+        crypto_ex_data_cleanup();
         EVP_cleanup();
 
         X509_VERIFY_PARAM_table_cleanup();
diff --git a/src/lib/libcrypto/crypto_internal.h b/src/lib/libcrypto/crypto_internal.h
index 058245e95e..2dce750724 100644
--- a/src/lib/libcrypto/crypto_internal.h
+++ b/src/lib/libcrypto/crypto_internal.h
@@ -1,4 +1,4 @@
-/*      $OpenBSD: crypto_internal.h,v 1.16 2025/07/22 09:18:02 jsing Exp $ */
+/*      $OpenBSD: crypto_internal.h,v 1.17 2026/08/30 12:19:37 kenjiro Exp $ */
 /*
  * Copyright (c) 2023 Joel Sing <jsing@openbsd.org>
  *
@@ -299,5 +299,6 @@ crypto_ror_u64(uint64_t v, size_t shift)
 #endif
 
 void crypto_cpu_caps_init(void);
+void crypto_ex_data_cleanup(void);
 
 #endif
diff --git a/src/lib/libcrypto/ct/ct_x509v3.c b/src/lib/libcrypto/ct/ct_x509v3.c
index b14ffc9532..c4cf9b823d 100644
--- a/src/lib/libcrypto/ct/ct_x509v3.c
+++ b/src/lib/libcrypto/ct/ct_x509v3.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: ct_x509v3.c,v 1.7 2024/07/13 15:08:58 tb Exp $ */
+/*      $OpenBSD: ct_x509v3.c,v 1.8 2026/07/31 00:50:52 kenjiro Exp $ */
 /*
  * Written by Rob Stradling (rob@comodo.com) and Stephen Henson
  * (steve@openssl.org) for the OpenSSL project 2014.
@@ -64,6 +64,7 @@
 #include <string.h>
 
 #include "ct_local.h"
+#include "x509_local.h"
 
 static char *
 i2s_poison(const X509V3_EXT_METHOD *method, void *val)
diff --git a/src/lib/libcrypto/ec/ec_ameth.c b/src/lib/libcrypto/ec/ec_ameth.c
index ddc8adea1e..d1654d4041 100644
--- a/src/lib/libcrypto/ec/ec_ameth.c
+++ b/src/lib/libcrypto/ec/ec_ameth.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ec_ameth.c,v 1.74 2025/05/10 05:54:38 tb Exp $ */
+/* $OpenBSD: ec_ameth.c,v 1.75 2026/07/31 00:50:52 kenjiro Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 2006.
  */
@@ -73,6 +73,7 @@
 
 #include "asn1_local.h"
 #include "bn_local.h"
+#include "ec_local.h"
 #include "err_local.h"
 #include "evp_local.h"
 #include "x509_local.h"
diff --git a/src/lib/libcrypto/ec/ec_convert.c b/src/lib/libcrypto/ec/ec_convert.c
index 3b88bd20ba..ca79a898db 100644
--- a/src/lib/libcrypto/ec/ec_convert.c
+++ b/src/lib/libcrypto/ec/ec_convert.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ec_convert.c,v 1.16 2025/12/26 18:44:19 tb Exp $ */
+/* $OpenBSD: ec_convert.c,v 1.17 2026/06/07 11:17:15 tb Exp $ */
 /*
  * Originally written by Bodo Moeller for the OpenSSL project.
  */
@@ -78,8 +78,8 @@
  * at infinity. In compressed and hybrid form bit 1 indicates if the even
  * or the odd solution of the quadratic equation for y should be used.
  *
- * The public point_conversion_t enum lacks the point at infinity, so we
- * ignore it except at the API boundary.
+ * The public point_conversion_form_t enum lacks the point at infinity,
+ * so we ignore it except at the API boundary.
  */
 
 #define EC_POINT_YBIT                   0x01
diff --git a/src/lib/libcrypto/ec/ec_lib.c b/src/lib/libcrypto/ec/ec_lib.c
index 30b2cf95b8..fc66d29a9f 100644
--- a/src/lib/libcrypto/ec/ec_lib.c
+++ b/src/lib/libcrypto/ec/ec_lib.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ec_lib.c,v 1.131 2025/12/26 18:49:13 tb Exp $ */
+/* $OpenBSD: ec_lib.c,v 1.132 2026/06/09 05:23:30 tb Exp $ */
 /*
  * Originally written by Bodo Moeller for the OpenSSL project.
  */
@@ -972,7 +972,7 @@ EC_POINT_get_affine_coordinates(const EC_GROUP *group, const EC_POINT *point,
         BN_CTX *ctx = NULL;
         int ret = 0;
 
-        if (EC_POINT_is_at_infinity(group, point) > 0) {
+        if (EC_POINT_is_at_infinity(group, point)) {
                 ECerror(EC_R_POINT_AT_INFINITY);
                 goto err;
         }
diff --git a/src/lib/libcrypto/ecdh/ecdh.c b/src/lib/libcrypto/ecdh/ecdh.c
index f970db7750..218c584558 100644
--- a/src/lib/libcrypto/ecdh/ecdh.c
+++ b/src/lib/libcrypto/ecdh/ecdh.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ecdh.c,v 1.13 2026/03/18 08:02:40 tb Exp $ */
+/* $OpenBSD: ecdh.c,v 1.15 2026/06/09 05:24:47 tb Exp $ */
 /* ====================================================================
  * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
  *
@@ -169,8 +169,15 @@ ec_key_ecdh_compute_key(unsigned char **out, size_t *out_len,
         if ((group = EC_KEY_get0_group(ecdh)) == NULL)
                 goto err;
 
-        if (EC_POINT_is_on_curve(group, pub_key, ctx) <= 0)
+        if (EC_POINT_is_at_infinity(group, pub_key)) {
+                ECerror(EC_R_POINT_AT_INFINITY);
                 goto err;
+        }
+
+        if (EC_POINT_is_on_curve(group, pub_key, ctx) <= 0) {
+                ECerror(EC_R_POINT_IS_NOT_ON_CURVE);
+                goto err;
+        }
 
         if ((point = EC_POINT_new(group)) == NULL) {
                 ECerror(ERR_R_MALLOC_FAILURE);
diff --git a/src/lib/libcrypto/err/err.c b/src/lib/libcrypto/err/err.c
index a60769fc2a..5bfdf66aee 100644
--- a/src/lib/libcrypto/err/err.c
+++ b/src/lib/libcrypto/err/err.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: err.c,v 1.78 2025/06/10 08:53:37 tb Exp $ */
+/* $OpenBSD: err.c,v 1.79 2026/07/31 00:50:52 kenjiro Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -122,6 +122,9 @@
 #include <openssl/err.h>
 #include <openssl/lhash.h>
 
+#include "constant_time.h"
+#include "err_local.h"
+
 DECLARE_LHASH_OF(ERR_STRING_DATA);
 DECLARE_LHASH_OF(ERR_STATE);
 
diff --git a/src/lib/libcrypto/evp/bio_b64.c b/src/lib/libcrypto/evp/bio_b64.c
index 32cd1f06df..61a26df868 100644
--- a/src/lib/libcrypto/evp/bio_b64.c
+++ b/src/lib/libcrypto/evp/bio_b64.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: bio_b64.c,v 1.29 2024/04/09 13:52:41 beck Exp $ */
+/* $OpenBSD: bio_b64.c,v 1.30 2026/07/17 12:41:52 kenjiro Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -380,7 +380,6 @@ b64_write(BIO *b, const char *in, int inl)
                         BIO_copy_next_retry(b);
                         return (i);
                 }
-                OPENSSL_assert(i <= n);
                 ctx->buf_off += i;
                 OPENSSL_assert(ctx->buf_off <= (int)sizeof(ctx->buf));
                 OPENSSL_assert(ctx->buf_len >= ctx->buf_off);
@@ -453,7 +452,6 @@ b64_write(BIO *b, const char *in, int inl)
                                 BIO_copy_next_retry(b);
                                 return ((ret == 0) ? i : ret);
                         }
-                        OPENSSL_assert(i <= n);
                         n -= i;
                         ctx->buf_off += i;
                         OPENSSL_assert(ctx->buf_off <= (int)sizeof(ctx->buf));
diff --git a/src/lib/libcrypto/man/ASN1_STRING_length.3 b/src/lib/libcrypto/man/ASN1_STRING_length.3
index 922ae89ac6..96eb50e193 100644
--- a/src/lib/libcrypto/man/ASN1_STRING_length.3
+++ b/src/lib/libcrypto/man/ASN1_STRING_length.3
@@ -1,4 +1,4 @@
-.\" $OpenBSD: ASN1_STRING_length.3,v 1.31 2025/06/08 22:37:23 schwarze Exp $
+.\" $OpenBSD: ASN1_STRING_length.3,v 1.32 2026/08/23 05:10:18 tb Exp $
 .\" full merge up to: OpenSSL 24a535ea Sep 22 13:14:20 2020 +0100
 .\"
 .\" This file is a derived work.
@@ -66,13 +66,12 @@
 .\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 .\" OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd $Mdocdate: June 8 2025 $
+.Dd $Mdocdate: August 23 2026 $
 .Dt ASN1_STRING_LENGTH 3
 .Os
 .Sh NAME
 .Nm ASN1_STRING_cmp ,
 .Nm ASN1_OCTET_STRING_cmp ,
-.Nm ASN1_STRING_data ,
 .Nm ASN1_STRING_dup ,
 .Nm ASN1_OCTET_STRING_dup ,
 .Nm ASN1_STRING_get0_data ,
@@ -83,7 +82,8 @@
 .Nm ASN1_OCTET_STRING_set ,
 .Nm ASN1_STRING_copy ,
 .Nm ASN1_STRING_to_UTF8 ,
-.Nm ASN1_STRING_type
+.Nm ASN1_STRING_type ,
+.Nm ASN1_STRING_data
 .Nd ASN1_STRING utility functions
 .Sh SYNOPSIS
 .Lb libcrypto
@@ -98,10 +98,6 @@
 .Fa "const ASN1_OCTET_STRING *a"
 .Fa "const ASN1_OCTET_STRING *b"
 .Fc
-.Ft unsigned char *
-.Fo ASN1_STRING_data
-.Fa "ASN1_STRING *x"
-.Fc
 .Ft ASN1_STRING *
 .Fo ASN1_STRING_dup
 .Fa "const ASN1_STRING *a"
@@ -155,6 +151,13 @@
 .Fo ASN1_STRING_type
 .Fa "const ASN1_STRING *x"
 .Fc
+.Pp
+Deprecated:
+.Pp
+.Ft unsigned char *
+.Fo ASN1_STRING_data
+.Fa "ASN1_STRING *x"
+.Fc
 .Sh DESCRIPTION
 These functions manipulate
 .Vt ASN1_STRING
@@ -171,15 +174,6 @@ does exactly the same as
 .Fn ASN1_STRING_cmp
 without providing any type safety.
 .Pp
-.Fn ASN1_STRING_data
-is similar to
-.Fn ASN1_STRING_get0_data
-except that the returned value is not constant.
-This function is deprecated.
-Applications should use
-.Fn ASN1_STRING_get0_data
-instead.
-.Pp
 .Fn ASN1_STRING_dup
 allocates a new
 .Vt ASN1_STRING
@@ -283,6 +277,15 @@ is set in the return value,
 .Fa x
 is an ASN.1 INTEGER or ENUMERATED object with a negative value.
 .Pp
+.Fn ASN1_STRING_data
+is similar to
+.Fn ASN1_STRING_get0_data
+except that the returned value is not constant.
+This function is deprecated.
+Applications should use
+.Fn ASN1_STRING_get0_data
+instead.
+.Pp
 Almost all ASN.1 types are represented as
 .Vt ASN1_STRING
 structures.
@@ -341,9 +344,9 @@ In contrast to
 .Xr strcmp 3 ,
 the sign of the return value does not indicate lexicographical ordering.
 .Pp
-.Fn ASN1_STRING_data
-and
 .Fn ASN1_STRING_get0_data
+and
+.Fn ASN1_STRING_data
 return an internal pointer to the data of
 .Fa x .
 .Pp
diff --git a/src/lib/libcrypto/man/ASN1_parse_dump.3 b/src/lib/libcrypto/man/ASN1_parse_dump.3
index 45aa673d4c..809bf01337 100644
--- a/src/lib/libcrypto/man/ASN1_parse_dump.3
+++ b/src/lib/libcrypto/man/ASN1_parse_dump.3
@@ -1,4 +1,4 @@
-.\" $OpenBSD: ASN1_parse_dump.3,v 1.4 2025/06/08 22:40:29 schwarze Exp $
+.\" $OpenBSD: ASN1_parse_dump.3,v 1.5 2026/05/16 06:17:05 tb Exp $
 .\"
 .\" Copyright (c) 2021 Ingo Schwarze <schwarze@openbsd.org>
 .\"
@@ -14,7 +14,7 @@
 .\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 .\"
-.Dd $Mdocdate: June 8 2025 $
+.Dd $Mdocdate: May 16 2026 $
 .Dt ASN1_PARSE_DUMP 3
 .Os
 .Sh NAME
@@ -180,7 +180,11 @@ with 0 passed as the
 .Fa dump
 argument.
 .Sh RETURN VALUES
-These functions return 1 for success or 0 for failure.
+These functions normally return 1 for success or 0 for failure;
+when printing indefinite-length encoded BER with a tag of class
+.Dv V_ASN1_UNIVERSAL ,
+the return value 2 indicates that the printing stopped
+when reaching the end-of-content marker.
 .Pp
 In particular, they print an error message to
 .Fa bio ,
diff --git a/src/lib/libcrypto/man/BIO_dump.3 b/src/lib/libcrypto/man/BIO_dump.3
index 2c06c8cc9c..30020dfd26 100644
--- a/src/lib/libcrypto/man/BIO_dump.3
+++ b/src/lib/libcrypto/man/BIO_dump.3
@@ -1,4 +1,4 @@
-.\" $OpenBSD: BIO_dump.3,v 1.6 2025/06/08 22:40:29 schwarze Exp $
+.\" $OpenBSD: BIO_dump.3,v 1.7 2026/05/16 06:15:22 tb Exp $
 .\"
 .\" Copyright (c) 2021 Ingo Schwarze <schwarze@openbsd.org>
 .\"
@@ -14,7 +14,7 @@
 .\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 .\"
-.Dd $Mdocdate: June 8 2025 $
+.Dd $Mdocdate: May 16 2026 $
 .Dt BIO_DUMP 3
 .Os
 .Sh NAME
@@ -77,16 +77,14 @@ is 7 or more, the number of data columns is reduced such that the
 total width of the output does not exceed 79 characters per line.
 .Sh RETURN VALUES
 On success these functions return the total number of bytes written by
-.Xr BIO_write 3
-or
-.Xr fwrite 3 .
+.Xr BIO_printf 3 .
 If a failure occurs at any point when writing, these
 functions will stop after having potentially written out partial results,
 and return -1.
 .Sh SEE ALSO
 .Xr hexdump 1 ,
 .Xr BIO_new 3 ,
-.Xr BIO_write 3
+.Xr BIO_printf 3
 .Sh HISTORY
 .Fn BIO_dump
 first appeared in SSLeay 0.6.5 and has been available since
diff --git a/src/lib/libcrypto/man/BN_generate_prime.3 b/src/lib/libcrypto/man/BN_generate_prime.3
index 55eed14e75..417d974f12 100644
--- a/src/lib/libcrypto/man/BN_generate_prime.3
+++ b/src/lib/libcrypto/man/BN_generate_prime.3
@@ -1,4 +1,4 @@
-.\" $OpenBSD: BN_generate_prime.3,v 1.26 2025/06/08 22:40:29 schwarze Exp $
+.\" $OpenBSD: BN_generate_prime.3,v 1.27 2026/09/01 05:51:25 jsg Exp $
 .\" full merge up to: OpenSSL f987a4dd Jun 27 10:12:08 2019 +0200
 .\"
 .\" This file is a derived work.
@@ -67,7 +67,7 @@
 .\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 .\" OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd $Mdocdate: June 8 2025 $
+.Dd $Mdocdate: September 1 2026 $
 .Dt BN_GENERATE_PRIME 3
 .Os
 .Sh NAME
@@ -181,7 +181,7 @@ If
 .Dv NULL
 is passed for the
 .Fa ctx
-argument, these function allocate a
+argument, these functions allocate a
 .Vt BN_CTX
 object internally when they need one and free it before returning.
 Alternatively, to save the overhead of allocating and freeing
diff --git a/src/lib/libcrypto/man/CRYPTO_set_ex_data.3 b/src/lib/libcrypto/man/CRYPTO_set_ex_data.3
index 57cdbfb4ca..00b5785533 100644
--- a/src/lib/libcrypto/man/CRYPTO_set_ex_data.3
+++ b/src/lib/libcrypto/man/CRYPTO_set_ex_data.3
@@ -1,4 +1,4 @@
-.\" $OpenBSD: CRYPTO_set_ex_data.3,v 1.16 2025/06/08 22:40:29 schwarze Exp $
+.\" $OpenBSD: CRYPTO_set_ex_data.3,v 1.18 2026/08/30 12:19:37 kenjiro Exp $
 .\"
 .\" Copyright (c) 2023 Ingo Schwarze <schwarze@openbsd.org>
 .\"
@@ -14,7 +14,7 @@
 .\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 .\"
-.Dd $Mdocdate: June 8 2025 $
+.Dd $Mdocdate: August 30 2026 $
 .Dt CRYPTO_SET_EX_DATA 3
 .Os
 .Sh NAME
@@ -25,7 +25,8 @@
 .Nm CRYPTO_new_ex_data ,
 .Nm CRYPTO_set_ex_data ,
 .Nm CRYPTO_get_ex_data ,
-.Nm CRYPTO_free_ex_data
+.Nm CRYPTO_free_ex_data ,
+.Nm CRYPTO_cleanup_all_ex_data
 .Nd low-level functions for application specific data
 .Sh SYNOPSIS
 .Lb libcrypto
@@ -89,6 +90,8 @@
 .Fa "void *parent"
 .Fa "CRYPTO_EX_DATA *ad"
 .Fc
+.Ft void
+.Fn CRYPTO_cleanup_all_ex_data void
 .Sh DESCRIPTION
 The library implements the functions documented in the
 .Xr RSA_get_ex_new_index 3
@@ -342,6 +345,20 @@ Despite its name,
 does not free
 .Fa ad
 itself.
+.Pp
+.Fn CRYPTO_cleanup_all_ex_data
+is deprecated and has no effect.
+It is retained for source and binary compatibility only.
+Application programs should not call it after individual operations,
+from individual library components, or during process shutdown.
+No replacement call is needed.
+.Pp
+In particular,
+.Xr OPENSSL_cleanup 3
+is not a replacement for
+.Fn CRYPTO_cleanup_all_ex_data .
+It tears down process-wide library state and is only intended for final
+shutdown after all threads using libcrypto have stopped.
 .Sh RETURN VALUES
 .Fn CRYPTO_get_ex_new_index
 returns a new index equal to or greater than 1
@@ -425,8 +442,12 @@ and
 .Fn CRYPTO_EX_dup
 first appeared in OpenSSL 0.9.5 and have been available since
 .Ox 2.7 .
+.Pp
+.Fn CRYPTO_cleanup_all_ex_data
+first appeared in OpenSSL 0.9.7 and has been available since
+.Ox 3.2 .
 .Sh CAVEATS
-If an program installs callback functions, the last call to
+If a program installs callback functions, the last call to
 .Fn CRYPTO_get_ex_new_index
 installing a function of a certain type for a certain
 .Fa class_index
diff --git a/src/lib/libcrypto/man/EC_GROUP_check.3 b/src/lib/libcrypto/man/EC_GROUP_check.3
index 146c3d255d..2c45033834 100644
--- a/src/lib/libcrypto/man/EC_GROUP_check.3
+++ b/src/lib/libcrypto/man/EC_GROUP_check.3
@@ -1,4 +1,4 @@
-.\" $OpenBSD: EC_GROUP_check.3,v 1.6 2025/07/04 05:16:56 jsg Exp $
+.\" $OpenBSD: EC_GROUP_check.3,v 1.7 2026/08/26 09:03:57 jsg Exp $
 .\"
 .\" Copyright (c) 2025 Theo Buehler <tb@openbsd.org>
 .\"
@@ -14,7 +14,7 @@
 .\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 .\"
-.Dd $Mdocdate: July 4 2025 $
+.Dd $Mdocdate: August 26 2026 $
 .Dt EC_GROUP_CHECK 3
 .Os
 .Sh NAME
@@ -75,7 +75,7 @@ is a point on the curve whose order divides
 It checks with
 .Fn EC_GROUP_check_discriminant
 that the discriminant is non-zero
-and then verifies that that
+and then verifies that the
 .Fa order
 is non-zero and that the product
 .Fa generator No * Fa order
diff --git a/src/lib/libcrypto/man/MD5.3 b/src/lib/libcrypto/man/MD5.3
index c9c89c33af..c36318994d 100644
--- a/src/lib/libcrypto/man/MD5.3
+++ b/src/lib/libcrypto/man/MD5.3
@@ -1,4 +1,4 @@
-.\"     $OpenBSD: MD5.3,v 1.10 2025/06/08 22:40:30 schwarze Exp $
+.\"     $OpenBSD: MD5.3,v 1.11 2026/08/25 00:08:28 jsg Exp $
 .\"     OpenSSL 99d63d46 Oct 26 13:56:48 2016 -0400
 .\"
 .\" This file was written by Ulf Moeller <ulf@openssl.org> and
@@ -49,7 +49,7 @@
 .\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 .\" OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd $Mdocdate: June 8 2025 $
+.Dd $Mdocdate: August 25 2026 $
 .Dt MD5 3
 .Os
 .Sh NAME
@@ -129,7 +129,7 @@ The following functions may be used if the message is not completely
 stored in memory:
 .Pp
 .Fn MD5_Init
-initializes a
+initializes an
 .Vt MD5_CTX
 structure.
 .Pp
diff --git a/src/lib/libcrypto/man/OBJ_create.3 b/src/lib/libcrypto/man/OBJ_create.3
index 75d51f4bb8..e3ec7f01f3 100644
--- a/src/lib/libcrypto/man/OBJ_create.3
+++ b/src/lib/libcrypto/man/OBJ_create.3
@@ -1,4 +1,4 @@
-.\" $OpenBSD: OBJ_create.3,v 1.11 2025/06/08 22:37:23 schwarze Exp $
+.\" $OpenBSD: OBJ_create.3,v 1.13 2026/08/05 08:45:43 tb Exp $
 .\" full merge up to:
 .\" OpenSSL OBJ_nid2obj.pod 9b86974e Aug 17 15:21:33 2015 -0400
 .\" selective merge up to:
@@ -69,12 +69,11 @@
 .\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 .\" OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd $Mdocdate: June 8 2025 $
+.Dd $Mdocdate: August 5 2026 $
 .Dt OBJ_CREATE 3
 .Os
 .Sh NAME
 .Nm OBJ_new_nid ,
-.Nm OBJ_add_object ,
 .Nm OBJ_create ,
 .Nm OBJ_create_objects ,
 .Nm OBJ_cleanup
@@ -85,8 +84,6 @@
 .Ft int
 .Fn OBJ_new_nid "int increment"
 .Ft int
-.Fn OBJ_add_object "const ASN1_OBJECT *object"
-.Ft int
 .Fo OBJ_create
 .Fa "const char *oid"
 .Fa "const char *sn"
@@ -106,19 +103,14 @@ Passing an argument of 1 is usually recommended.
 The return value can be assigned to a new object by passing it as the
 .Fa nid
 argument to
-.Xr ASN1_OBJECT_create 3
-and by passing the resulting object to
-.Fn OBJ_add_object .
+.Xr ASN1_OBJECT_create 3 .
 .Pp
-.Fn OBJ_add_object
-adds a copy of the
-.Fa object
+.Fn OBJ_create
+adds an
+.Vt ASN1_OBJECT
 to the internal table of ASN.1 object identifiers for use by
 .Xr OBJ_nid2obj 3
 and related functions.
-.Pp
-.Fn OBJ_create
-provides a simpler way to add a new object to the internal table.
 .Fa oid
 is the numerical form of the object,
 .Fa sn
@@ -141,8 +133,11 @@ for every line read.
 The three fields of the input lines
 are separated by one or more whitespace characters.
 .Pp
-For all three functions, the objects added to the internal table and
-all the data contained in them is marked as not dynamically allocated.
+For the objects added to the internal table by
+.Fn OBJ_create
+and
+.Fn OBJ_create_objects ,
+all the data contained is marked as not dynamically allocated.
 Consequently, retrieving them with
 .Xr OBJ_nid2obj 3
 or a similar function and then calling
@@ -152,7 +147,6 @@ on the returned pointer will have no effect.
 .Fn OBJ_cleanup
 resets the internal object table to its default state,
 removing and freeing all objects that were added with
-.Fn OBJ_add_object ,
 .Fn OBJ_create ,
 or
 .Fn OBJ_create_objects .
@@ -160,17 +154,6 @@ or
 .Fn OBJ_new_nid
 returns the new NID.
 .Pp
-.Fn OBJ_add_object
-returns the NID of the added
-.Fa object
-or
-.Dv NID_undef
-if no object was added because the
-.Fa object
-argument was
-.Dv NULL ,
-did not contain an NID, or memory allocation failed.
-.Pp
 .Fn OBJ_create
 returns the new NID or
 .Dv NID_undef
@@ -183,8 +166,7 @@ or if memory allocation fails.
 returns the number of objects added.
 .Pp
 In some cases of failure of
-.Fn OBJ_add_object ,
-.Fn OBJ_create ,
+.Fn OBJ_create
 and
 .Fn OBJ_create_objects ,
 the reason can be determined with
@@ -203,7 +185,6 @@ obj = OBJ_nid2obj(new_nid);
 .Xr OBJ_nid2obj 3
 .Sh HISTORY
 .Fn OBJ_new_nid ,
-.Fn OBJ_add_object ,
 and
 .Fn OBJ_cleanup
 first appeared in SSLeay 0.8.0 and
@@ -212,12 +193,6 @@ in SSLeay 0.9.0.
 These functions have been available since
 .Ox 2.4 .
 .Sh CAVEATS
-.Fn OBJ_add_object
-indicates success even after adding an incomplete object that was created with
-.Xr ASN1_OBJECT_create 3
-but lacks a short name, a long name, or an OID.
-.Pp
-Even
 .Fn OBJ_create
 tolerates
 .Dv NULL
@@ -229,11 +204,11 @@ arguments, in which case
 .Xr OBJ_nid2sn 3
 and
 .Xr OBJ_sn2nid 3
-or
+and/or
 .Xr OBJ_nid2ln 3
 and
 .Xr OBJ_ln2nid 3
-will not work on the added object, respectively.
+will not work on the added object.
 .Sh BUGS
 .Fn OBJ_new_nid
 does not reserve any return value to indicate an error.
diff --git a/src/lib/libcrypto/man/OPENSSL_init_crypto.3 b/src/lib/libcrypto/man/OPENSSL_init_crypto.3
index 5c29d55aa9..24756bc396 100644
--- a/src/lib/libcrypto/man/OPENSSL_init_crypto.3
+++ b/src/lib/libcrypto/man/OPENSSL_init_crypto.3
@@ -1,4 +1,4 @@
-.\" $OpenBSD: OPENSSL_init_crypto.3,v 1.7 2025/06/09 12:43:53 schwarze Exp $
+.\" $OpenBSD: OPENSSL_init_crypto.3,v 1.8 2026/08/30 12:19:37 kenjiro Exp $
 .\" Copyright (c) 2018, 2020 Ingo Schwarze <schwarze@openbsd.org>
 .\"
 .\" Permission to use, copy, modify, and distribute this software for any
@@ -13,13 +13,14 @@
 .\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 .\"
-.Dd $Mdocdate: June 9 2025 $
+.Dd $Mdocdate: August 30 2026 $
 .Dt OPENSSL_INIT_CRYPTO 3
 .Os
 .Sh NAME
 .Nm OPENSSL_init_crypto ,
-.Nm OPENSSL_init
-.Nd initialise the crypto library
+.Nm OPENSSL_init ,
+.Nm OPENSSL_cleanup
+.Nd initialise and shut down the crypto library
 .Sh SYNOPSIS
 .Lb libcrypto
 .In openssl/crypto.h
@@ -30,8 +31,13 @@
 .Fc
 .Ft void
 .Fn OPENSSL_init void
+.Ft void
+.Fn OPENSSL_cleanup void
 .Sh DESCRIPTION
-These functions are deprecated.
+.Fn OPENSSL_init_crypto
+and
+.Fn OPENSSL_init
+are deprecated.
 It is never useful for an application program
 to call either of them explicitly.
 .Pp
@@ -84,6 +90,21 @@ the first one have any effect.
 .Pp
 .Fn OPENSSL_init
 has no effect at all.
+.Pp
+.Fn OPENSSL_cleanup
+frees process-wide resources allocated by libcrypto.
+It is intended exclusively for the final shutdown of libcrypto in a process.
+Before calling it, the application has to ensure that all other threads
+that may use libcrypto have stopped and that no library component will use
+libcrypto again.
+After it returns, libcrypto cannot be reinitialized and no libcrypto or
+libssl function may be called.
+.Pp
+.Fn OPENSSL_cleanup
+is not a replacement for deprecated cleanup functions such as
+.Xr CRYPTO_cleanup_all_ex_data 3
+and must not be called after individual cryptographic operations or when an
+individual library component is finished with libcrypto.
 .Sh RETURN VALUES
 .Fn OPENSSL_init_crypto
 is intended to return 1 on success or 0 on error.
@@ -101,6 +122,10 @@ It stopped having any effect in OpenSSL 1.1.1 and in
 .Fn OPENSSL_init_crypto
 first appeared in OpenSSL 1.1.0 and has been available since
 .Ox 6.3 .
+.Pp
+.Fn OPENSSL_cleanup
+first appeared in OpenSSL 1.1.0 and has been available since
+.Ox 7.2 .
 .Sh BUGS
 .Fn OPENSSL_init_crypto
 silently ignores almost all kinds of errors.
diff --git a/src/lib/libcrypto/man/X509_STORE_CTX_get_error.3 b/src/lib/libcrypto/man/X509_STORE_CTX_get_error.3
index 5eb2bfe8cb..ab7909a24d 100644
--- a/src/lib/libcrypto/man/X509_STORE_CTX_get_error.3
+++ b/src/lib/libcrypto/man/X509_STORE_CTX_get_error.3
@@ -1,4 +1,4 @@
-.\" $OpenBSD: X509_STORE_CTX_get_error.3,v 1.29 2025/06/08 22:40:30 schwarze Exp $
+.\" $OpenBSD: X509_STORE_CTX_get_error.3,v 1.31 2026/08/29 05:53:59 tb Exp $
 .\" full merge up to:
 .\" OpenSSL man3/X509_STORE_CTX_get_error 24a535ea Sep 22 13:14:20 2020 +0100
 .\" OpenSSL man3/X509_STORE_CTX_new 24a535ea Sep 22 13:14:20 2020 +0100
@@ -68,7 +68,7 @@
 .\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 .\" OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd $Mdocdate: June 8 2025 $
+.Dd $Mdocdate: August 29 2026 $
 .Dt X509_STORE_CTX_GET_ERROR 3
 .Os
 .Sh NAME
@@ -241,7 +241,7 @@ validation of a related CRL issuer certificate, and if the latter,
 what the target certificate is.
 .Pp
 .Fn X509_STORE_CTX_get0_chain
-returns an internal pointer to a complete validate chain
+returns an internal pointer to a complete validated chain of certificates
 if a previous call to
 .Xr X509_verify_cert 3
 was successful.
@@ -259,7 +259,7 @@ When it is no longer needed, it should be freed using
 .Fn sk_X509_pop_free chain X509_free .
 .Pp
 .Fn X509_STORE_CTX_set0_verified_chain
-frees the validate chain generated by if a previous call to
+frees the validated chain generated by a previous call to
 .Xr X509_verify_cert 3 ,
 if any, and replaces it with the given
 .Fa chain .
diff --git a/src/lib/libcrypto/man/X509v3_addr_add_inherit.3 b/src/lib/libcrypto/man/X509v3_addr_add_inherit.3
index d33de1f6a8..70d5ec2563 100644
--- a/src/lib/libcrypto/man/X509v3_addr_add_inherit.3
+++ b/src/lib/libcrypto/man/X509v3_addr_add_inherit.3
@@ -1,4 +1,4 @@
-.\" $OpenBSD: X509v3_addr_add_inherit.3,v 1.12 2025/06/08 22:40:30 schwarze Exp $
+.\" $OpenBSD: X509v3_addr_add_inherit.3,v 1.13 2026/05/10 10:35:20 tb Exp $
 .\"
 .\" Copyright (c) 2023 Theo Buehler <tb@openbsd.org>
 .\"
@@ -14,7 +14,7 @@
 .\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 .\"
-.Dd $Mdocdate: June 8 2025 $
+.Dd $Mdocdate: May 10 2026 $
 .Dt X509V3_ADDR_ADD_INHERIT 3
 .Os
 .Sh NAME
@@ -467,6 +467,7 @@ dereference.
 The code only supports the IPv4 and IPv6 AFIs.
 This is not consistently enforced across implementations.
 .Pp
+In some implementations
 .Fn X509v3_addr_add_range
 fails to clear the unused bits set to 1 in the last octet of
 the
diff --git a/src/lib/libcrypto/man/d2i_X509_SIG.3 b/src/lib/libcrypto/man/d2i_X509_SIG.3
index 1700b2d728..6a446c0874 100644
--- a/src/lib/libcrypto/man/d2i_X509_SIG.3
+++ b/src/lib/libcrypto/man/d2i_X509_SIG.3
@@ -1,4 +1,4 @@
-.\"     $OpenBSD: d2i_X509_SIG.3,v 1.11 2025/06/08 22:40:30 schwarze Exp $
+.\"     $OpenBSD: d2i_X509_SIG.3,v 1.12 2026/08/25 00:08:28 jsg Exp $
 .\"     OpenSSL 9b86974e Aug 17 15:21:33 2015 -0400
 .\"
 .\" Copyright (c) 2016 Ingo Schwarze <schwarze@openbsd.org>
@@ -15,7 +15,7 @@
 .\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 .\"
-.Dd $Mdocdate: June 8 2025 $
+.Dd $Mdocdate: August 25 2026 $
 .Dt D2I_X509_SIG 3
 .Os
 .Sh NAME
@@ -99,7 +99,7 @@ pointer.
 .Fn d2i_PKCS8_bio ,
 and
 .Fn d2i_PKCS8_fp
-return a
+return an
 .Vt X509_SIG
 object or
 .Dv NULL
diff --git a/src/lib/libcrypto/man/s2i_ASN1_INTEGER.3 b/src/lib/libcrypto/man/s2i_ASN1_INTEGER.3
index 16646c69d1..f7ab217d48 100644
--- a/src/lib/libcrypto/man/s2i_ASN1_INTEGER.3
+++ b/src/lib/libcrypto/man/s2i_ASN1_INTEGER.3
@@ -1,4 +1,4 @@
-.\" $OpenBSD: s2i_ASN1_INTEGER.3,v 1.11 2025/06/13 18:34:00 schwarze Exp $
+.\" $OpenBSD: s2i_ASN1_INTEGER.3,v 1.12 2026/08/18 11:27:46 tb Exp $
 .\"
 .\" Copyright (c) 2023 Theo Buehler <tb@openbsd.org>
 .\"
@@ -14,7 +14,7 @@
 .\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 .\"
-.Dd $Mdocdate: June 13 2025 $
+.Dd $Mdocdate: August 18 2026 $
 .Dt S2I_ASN1_INTEGER 3
 .Os
 .Sh NAME
@@ -162,7 +162,9 @@ The default
 .Fa methods
 corresponding to the following
 .Fa nid
-arguments have strings configured in their usr_data field:
+arguments have strings configured in their
+.Fa usr_data
+field:
 .Pp
 .Bl -column NID_netscape_cert_type "Netscape certificate type (obsolete)" -compact
 .It Dv NID_crl_reason           Ta reason codes, RFC 5280, 5.3.1
diff --git a/src/lib/libcrypto/md5/md5_amd64_generic.S b/src/lib/libcrypto/md5/md5_amd64_generic.S
index 35e6fcdada..02f6ebdbcc 100644
--- a/src/lib/libcrypto/md5/md5_amd64_generic.S
+++ b/src/lib/libcrypto/md5/md5_amd64_generic.S
@@ -1,4 +1,4 @@
-/*      $OpenBSD: md5_amd64_generic.S,v 1.2 2026/03/28 13:11:28 jsing Exp $ */
+/*      $OpenBSD: md5_amd64_generic.S,v 1.3 2026/05/12 15:07:30 jsing Exp $ */
 /*
  * Copyright (c) 2025 Joel Sing <jsing@openbsd.org>
  *
@@ -231,3 +231,7 @@ md5_block_data_order:
         popq    %rbx
 
         ret
+
+#if defined(__linux__) && defined(__ELF__)
+.section .note.GNU-stack,"",%progbits
+#endif
diff --git a/src/lib/libcrypto/mlkem/mlkem_internal.c b/src/lib/libcrypto/mlkem/mlkem_internal.c
index 12b1c3e235..2e707704a4 100644
--- a/src/lib/libcrypto/mlkem/mlkem_internal.c
+++ b/src/lib/libcrypto/mlkem/mlkem_internal.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: mlkem_internal.c,v 1.8 2026/03/29 06:31:07 tb Exp $ */
+/* $OpenBSD: mlkem_internal.c,v 1.9 2026/05/04 20:44:36 tb Exp $ */
 /*
  * Copyright (c) 2024, Google Inc.
  * Copyright (c) 2024, 2025 Bob Beck <beck@obtuse.com>
@@ -1137,6 +1137,7 @@ mlkem_decap(const MLKEM_private_key *private_key, const uint8_t *ciphertext,
  err:
         freezero(expected_ciphertext, expected_ciphertext_length);
         explicit_bzero(key_and_randomness, sizeof(key_and_randomness));
+        explicit_bzero(failure_key, sizeof(failure_key));
         explicit_bzero(decrypted, sizeof(decrypted));
 
         return ret;
diff --git a/src/lib/libcrypto/objects/obj_mac.num b/src/lib/libcrypto/objects/obj_mac.num
index 2f93e12b82..938ed866e7 100644
--- a/src/lib/libcrypto/objects/obj_mac.num
+++ b/src/lib/libcrypto/objects/obj_mac.num
@@ -1054,3 +1054,8 @@ acmeIdentifier	1053
 id_ct_rpkiSignedPrefixList      1054
 tls1_prf        1055
 X25519MLKEM768  1056
+id_ct_rpkiCanonicalCacheRepresentation  1057
+id_ct_rpkiErikIndex     1058
+id_ct_rpkiErikPartition 1059
+id_ct_CDR       1060
+communityDefinition     1061
diff --git a/src/lib/libcrypto/objects/objects.txt b/src/lib/libcrypto/objects/objects.txt
index 933fa51f71..4bafd9da7c 100644
--- a/src/lib/libcrypto/objects/objects.txt
+++ b/src/lib/libcrypto/objects/objects.txt
@@ -269,6 +269,10 @@ id-smime-ct 48		: id-ct-signedChecklist
 id-smime-ct 49          : id-ct-ASPA
 id-smime-ct 50          : id-ct-signedTAL
 id-smime-ct 51          : id-ct-rpkiSignedPrefixList
+id-smime-ct 54          : id-ct-rpkiCanonicalCacheRepresentation
+id-smime-ct 55          : id-ct-rpkiErikIndex
+id-smime-ct 56          : id-ct-rpkiErikPartition
+id-smime-ct 58          : id-ct-CDR
 
 # S/MIME Attributes
 id-smime-aa 1           : id-smime-aa-receiptRequest
@@ -632,6 +636,7 @@ id-ad 5			: caRepository		: CA Repository
 id-ad 10                : rpkiManifest          : RPKI Manifest
 id-ad 11                : signedObject          : Signed Object
 id-ad 13                : rpkiNotify            : RPKI Notify
+id-ad 15                : communityDefinition   : Community Definition Reference
 
 !Alias id-pkix-OCSP ad-OCSP
 !module id-pkix-OCSP
diff --git a/src/lib/libcrypto/pem/pem_info.c b/src/lib/libcrypto/pem/pem_info.c
index 26061f6f08..24f0ddb011 100644
--- a/src/lib/libcrypto/pem/pem_info.c
+++ b/src/lib/libcrypto/pem/pem_info.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: pem_info.c,v 1.33 2025/07/16 15:59:26 tb Exp $ */
+/* $OpenBSD: pem_info.c,v 1.34 2026/07/31 03:59:50 kenjiro Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -77,7 +77,7 @@
 #include "err_local.h"
 #include "evp_local.h"
 
-X509_PKEY *
+static X509_PKEY *
 X509_PKEY_new(void)
 {
         X509_PKEY *x_pkey;
@@ -90,7 +90,7 @@ X509_PKEY_new(void)
         return x_pkey;
 }
 
-void
+static void
 X509_PKEY_free(X509_PKEY *x_pkey)
 {
         if (x_pkey == NULL)
diff --git a/src/lib/libcrypto/pkcs12/p12_decr.c b/src/lib/libcrypto/pkcs12/p12_decr.c
index 3090781eba..b4d8c4e7f8 100644
--- a/src/lib/libcrypto/pkcs12/p12_decr.c
+++ b/src/lib/libcrypto/pkcs12/p12_decr.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: p12_decr.c,v 1.28 2026/01/27 14:03:01 tb Exp $ */
+/* $OpenBSD: p12_decr.c,v 1.29 2026/07/31 00:50:52 kenjiro Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 1999.
  */
@@ -63,6 +63,7 @@
 
 #include "err_local.h"
 #include "evp_local.h"
+#include "pkcs12_local.h"
 
 /* Encrypt/Decrypt a buffer based on password and algor, result in a
  * malloc'ed buffer
diff --git a/src/lib/libcrypto/pkcs12/p12_npas.c b/src/lib/libcrypto/pkcs12/p12_npas.c
index c78deb9182..cf5d1ef9e0 100644
--- a/src/lib/libcrypto/pkcs12/p12_npas.c
+++ b/src/lib/libcrypto/pkcs12/p12_npas.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: p12_npas.c,v 1.28 2025/05/10 05:54:38 tb Exp $ */
+/* $OpenBSD: p12_npas.c,v 1.29 2026/05/09 10:52:02 tb Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 1999.
  */
@@ -276,11 +276,11 @@ PKCS12_newpass(PKCS12 *pkcs12, const char *oldpass, const char *newpass)
 
                 switch (OBJ_obj2nid(pkcs7->type)) {
                 case NID_pkcs7_data:
-                        if (pkcs7_repack_data(pkcs7, safes, oldpass, newpass))
+                        if (!pkcs7_repack_data(pkcs7, safes, oldpass, newpass))
                                 goto err;
                         break;
                 case NID_pkcs7_encrypted:
-                        if (pkcs7_repack_encdata(pkcs7, safes, oldpass, newpass))
+                        if (!pkcs7_repack_encdata(pkcs7, safes, oldpass, newpass))
                                 goto err;
                         break;
                 }
diff --git a/src/lib/libcrypto/pkcs12/pkcs12_local.h b/src/lib/libcrypto/pkcs12/pkcs12_local.h
index 4a3ce4b3f0..b076784d89 100644
--- a/src/lib/libcrypto/pkcs12/pkcs12_local.h
+++ b/src/lib/libcrypto/pkcs12/pkcs12_local.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: pkcs12_local.h,v 1.6 2025/03/09 15:45:52 tb Exp $ */
+/* $OpenBSD: pkcs12_local.h,v 1.7 2026/07/31 00:50:52 kenjiro Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 1999.
  */
@@ -59,6 +59,8 @@
 #ifndef HEADER_PKCS12_LOCAL_H
 #define HEADER_PKCS12_LOCAL_H
 
+#include <openssl/pkcs12.h>
+
 __BEGIN_HIDDEN_DECLS
 
 struct PKCS12_MAC_DATA_st {
diff --git a/src/lib/libcrypto/pkcs7/pk7_doit.c b/src/lib/libcrypto/pkcs7/pk7_doit.c
index 2e0b0a4f2a..0377c33cde 100644
--- a/src/lib/libcrypto/pkcs7/pk7_doit.c
+++ b/src/lib/libcrypto/pkcs7/pk7_doit.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: pk7_doit.c,v 1.62 2026/04/24 15:10:20 tb Exp $ */
+/* $OpenBSD: pk7_doit.c,v 1.69 2026/07/31 00:50:52 kenjiro Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -66,30 +66,24 @@
 
 #include "err_local.h"
 #include "evp_local.h"
+/* XXX - for PKCS7_get_octet_string(), which belongs in pkcs7_local.h. */
+#include "pkcs12_local.h"
 #include "x509_local.h"
 
 static int
 PKCS7_type_is_other(PKCS7* p7)
 {
-        int isOther = 1;
-
-        int nid = OBJ_obj2nid(p7->type);
-
-        switch (nid ) {
+        switch (OBJ_obj2nid(p7->type)) {
         case NID_pkcs7_data:
         case NID_pkcs7_signed:
         case NID_pkcs7_enveloped:
         case NID_pkcs7_signedAndEnveloped:
         case NID_pkcs7_digest:
         case NID_pkcs7_encrypted:
-                isOther = 0;
-                break;
-        default:
-                isOther = 1;
+                return 0;
         }
 
-        return isOther;
-
+        return 1;
 }
 
 ASN1_OCTET_STRING *
@@ -284,10 +278,9 @@ PKCS7_dataInit(PKCS7 *p7, BIO *bio)
                 return NULL;
         }
 
-        i = OBJ_obj2nid(p7->type);
         p7->state = PKCS7_S_HEADER;
 
-        switch (i) {
+        switch (OBJ_obj2nid(p7->type)) {
         case NID_pkcs7_signed:
                 md_sk = p7->d.sign->md_algs;
                 os = PKCS7_get_octet_string(p7->d.sign->contents);
@@ -424,7 +417,6 @@ pkcs7_cmp_ri(PKCS7_RECIP_INFO *ri, X509 *pcert)
 BIO *
 PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert)
 {
-        int i, j;
         BIO *out = NULL, *btmp = NULL, *etmp = NULL, *bio = NULL;
         X509_ALGOR *xa;
         ASN1_OCTET_STRING *data_body = NULL;
@@ -437,6 +429,7 @@ PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert)
         PKCS7_RECIP_INFO *ri = NULL;
         unsigned char *ek = NULL, *tkey = NULL;
         int eklen = 0, tkeylen = 0;
+        int i;
 
         if (p7 == NULL) {
                 PKCS7error(PKCS7_R_INVALID_NULL_POINTER);
@@ -448,10 +441,9 @@ PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert)
                 return NULL;
         }
 
-        i = OBJ_obj2nid(p7->type);
         p7->state = PKCS7_S_HEADER;
 
-        switch (i) {
+        switch (OBJ_obj2nid(p7->type)) {
         case NID_pkcs7_signed:
                 data_body = PKCS7_get_octet_string(p7->d.sign->contents);
                 md_sk = p7->d.sign->md_algs;
@@ -491,8 +483,7 @@ PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert)
                                 goto err;
                         }
 
-                        j = OBJ_obj2nid(xa->algorithm);
-                        evp_md = EVP_get_digestbynid(j);
+                        evp_md = EVP_get_digestbynid(OBJ_obj2nid(xa->algorithm));
                         if (evp_md == NULL) {
                                 PKCS7error(PKCS7_R_UNKNOWN_DIGEST_TYPE);
                                 goto err;
@@ -692,14 +683,14 @@ do_pkcs7_signed_attrib(PKCS7_SIGNER_INFO *si, EVP_MD_CTX *mctx)
 int
 PKCS7_dataFinal(PKCS7 *p7, BIO *bio)
 {
-        int ret = 0;
-        int i, j;
         BIO *btmp;
         PKCS7_SIGNER_INFO *si;
         EVP_MD_CTX *mdc, ctx_tmp;
         STACK_OF(X509_ATTRIBUTE) *sk;
         STACK_OF(PKCS7_SIGNER_INFO) *si_sk = NULL;
         ASN1_OCTET_STRING *os = NULL;
+        int i, nid;
+        int ret = 0;
 
         if (p7 == NULL) {
                 PKCS7error(PKCS7_R_INVALID_NULL_POINTER);
@@ -712,10 +703,9 @@ PKCS7_dataFinal(PKCS7 *p7, BIO *bio)
         }
 
         EVP_MD_CTX_legacy_clear(&ctx_tmp);
-        i = OBJ_obj2nid(p7->type);
         p7->state = PKCS7_S_HEADER;
 
-        switch (i) {
+        switch (nid = OBJ_obj2nid(p7->type)) {
         case NID_pkcs7_data:
                 os = p7->d.data;
                 break;
@@ -785,9 +775,8 @@ PKCS7_dataFinal(PKCS7 *p7, BIO *bio)
                         if (si->pkey == NULL)
                                 continue;
 
-                        j = OBJ_obj2nid(si->digest_alg->algorithm);
-
-                        if ((btmp = PKCS7_find_digest(&mdc, bio, j)) == NULL)
+                        nid = OBJ_obj2nid(si->digest_alg->algorithm);
+                        if ((btmp = PKCS7_find_digest(&mdc, bio, nid)) == NULL)
                                 goto err;
 
                         /* We now have the EVP_MD_CTX, lets do the
@@ -819,7 +808,7 @@ PKCS7_dataFinal(PKCS7 *p7, BIO *bio)
                                 ASN1_STRING_set0(si->enc_digest, abuf, abuflen);
                         }
                 }
-        } else if (i == NID_pkcs7_digest) {
+        } else if (nid == NID_pkcs7_digest) {
                 unsigned char md_data[EVP_MAX_MD_SIZE];
                 unsigned int md_len;
 
@@ -930,9 +919,9 @@ PKCS7_dataVerify(X509_STORE *cert_store, X509_STORE_CTX *ctx, BIO *bio,
     PKCS7 *p7, PKCS7_SIGNER_INFO *si)
 {
         PKCS7_ISSUER_AND_SERIAL *ias;
-        int ret = 0, i;
         STACK_OF(X509) *cert;
         X509 *x509;
+        int ret = 0;
 
         if (p7 == NULL) {
                 PKCS7error(PKCS7_R_INVALID_NULL_POINTER);
@@ -972,8 +961,7 @@ PKCS7_dataVerify(X509_STORE *cert_store, X509_STORE_CTX *ctx, BIO *bio,
                 X509_STORE_CTX_cleanup(ctx);
                 goto err;
         }
-        i = X509_verify_cert(ctx);
-        if (i <= 0) {
+        if (X509_verify_cert(ctx) <= 0) {
                 PKCS7error(ERR_R_X509_LIB);
                 X509_STORE_CTX_cleanup(ctx);
                 goto err;
@@ -1161,24 +1149,42 @@ PKCS7_digest_from_attributes(STACK_OF(X509_ATTRIBUTE) *sk)
 }
 LCRYPTO_ALIAS(PKCS7_digest_from_attributes);
 
-int
-PKCS7_set_signed_attributes(PKCS7_SIGNER_INFO *p7si,
-    STACK_OF(X509_ATTRIBUTE) *sk)
+static STACK_OF(X509_ATTRIBUTE) *
+sk_X509_ATTRIBUTE_deep_copy(const STACK_OF(X509_ATTRIBUTE) *in_attrs)
 {
+        STACK_OF(X509_ATTRIBUTE) *attrs = NULL;
+        X509_ATTRIBUTE *attr = NULL;
         int i;
 
-        if (p7si->auth_attr != NULL)
-                sk_X509_ATTRIBUTE_pop_free(p7si->auth_attr,
-                    X509_ATTRIBUTE_free);
-        p7si->auth_attr = sk_X509_ATTRIBUTE_dup(sk);
-        if (p7si->auth_attr == NULL)
-                return 0;
-        for (i = 0; i < sk_X509_ATTRIBUTE_num(sk); i++) {
-                if ((sk_X509_ATTRIBUTE_set(p7si->auth_attr, i,
-                    X509_ATTRIBUTE_dup(sk_X509_ATTRIBUTE_value(sk, i))))
-                    == NULL)
-                        return 0;
+        if ((attrs = sk_X509_ATTRIBUTE_new_null()) == NULL) {
+                X509error(ERR_R_MALLOC_FAILURE);
+                goto err;
         }
+
+        for (i = 0; i < sk_X509_ATTRIBUTE_num(in_attrs); i++) {
+                attr = X509_ATTRIBUTE_dup(sk_X509_ATTRIBUTE_value(in_attrs, i));
+                if (attr == NULL)
+                        goto err;
+                if (!sk_X509_ATTRIBUTE_push(attrs, attr))
+                        goto err;
+                attr = NULL;
+        }
+
+        return attrs;
+
+ err:
+        X509_ATTRIBUTE_free(attr);
+        sk_X509_ATTRIBUTE_pop_free(attrs, X509_ATTRIBUTE_free);
+
+        return NULL;
+}
+
+int
+PKCS7_set_signed_attributes(PKCS7_SIGNER_INFO *p7si, STACK_OF(X509_ATTRIBUTE) *sk)
+{
+        sk_X509_ATTRIBUTE_pop_free(p7si->auth_attr, X509_ATTRIBUTE_free);
+        if ((p7si->auth_attr = sk_X509_ATTRIBUTE_deep_copy(sk)) == NULL)
+                return 0;
         return 1;
 }
 LCRYPTO_ALIAS(PKCS7_set_signed_attributes);
@@ -1186,20 +1192,9 @@ LCRYPTO_ALIAS(PKCS7_set_signed_attributes);
 int
 PKCS7_set_attributes(PKCS7_SIGNER_INFO *p7si, STACK_OF(X509_ATTRIBUTE) *sk)
 {
-        int i;
-
-        if (p7si->unauth_attr != NULL)
-                sk_X509_ATTRIBUTE_pop_free(p7si->unauth_attr,
-                    X509_ATTRIBUTE_free);
-        p7si->unauth_attr = sk_X509_ATTRIBUTE_dup(sk);
-        if (p7si->unauth_attr == NULL)
+        sk_X509_ATTRIBUTE_pop_free(p7si->unauth_attr, X509_ATTRIBUTE_free);
+        if ((p7si->unauth_attr = sk_X509_ATTRIBUTE_deep_copy(sk)) == NULL)
                 return 0;
-        for (i = 0; i < sk_X509_ATTRIBUTE_num(sk); i++) {
-                if ((sk_X509_ATTRIBUTE_set(p7si->unauth_attr, i,
-                    X509_ATTRIBUTE_dup(sk_X509_ATTRIBUTE_value(sk, i))))
-                    == NULL)
-                        return 0;
-        }
         return 1;
 }
 LCRYPTO_ALIAS(PKCS7_set_attributes);
diff --git a/src/lib/libcrypto/pkcs7/pk7_lib.c b/src/lib/libcrypto/pkcs7/pk7_lib.c
index 8712a2ecc1..58e5c88a5e 100644
--- a/src/lib/libcrypto/pkcs7/pk7_lib.c
+++ b/src/lib/libcrypto/pkcs7/pk7_lib.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: pk7_lib.c,v 1.31 2025/05/10 05:54:38 tb Exp $ */
+/* $OpenBSD: pk7_lib.c,v 1.33 2026/08/30 16:56:45 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -650,6 +650,11 @@ PKCS7_stream(unsigned char ***boundary, PKCS7 *p7)
                 break;
 
         case NID_pkcs7_signedAndEnveloped:
+                if (p7->d.signed_and_enveloped == NULL ||
+                    p7->d.signed_and_enveloped->enc_data == NULL) {
+                        PKCS7error(PKCS7_R_NO_CONTENT);
+                        break;
+                }
                 os = p7->d.signed_and_enveloped->enc_data->enc_data;
                 if (os == NULL) {
                         os = ASN1_OCTET_STRING_new();
@@ -658,6 +663,11 @@ PKCS7_stream(unsigned char ***boundary, PKCS7 *p7)
                 break;
 
         case NID_pkcs7_enveloped:
+                if (p7->d.enveloped == NULL ||
+                    p7->d.enveloped->enc_data == NULL) {
+                        PKCS7error(PKCS7_R_NO_CONTENT);
+                        break;
+                }
                 os = p7->d.enveloped->enc_data->enc_data;
                 if (os == NULL) {
                         os = ASN1_OCTET_STRING_new();
@@ -666,6 +676,14 @@ PKCS7_stream(unsigned char ***boundary, PKCS7 *p7)
                 break;
 
         case NID_pkcs7_signed:
+                if (p7->d.sign == NULL || p7->d.sign->contents == NULL) {
+                        PKCS7error(PKCS7_R_NO_CONTENT);
+                        break;
+                }
+                if (!PKCS7_type_is_data(p7->d.sign->contents)) {
+                        PKCS7error(PKCS7_R_UNSUPPORTED_CONTENT_TYPE);
+                        break;
+                }
                 os = p7->d.sign->contents->d.data;
                 break;
 
diff --git a/src/lib/libcrypto/pkcs7/pk7_smime.c b/src/lib/libcrypto/pkcs7/pk7_smime.c
index 9baff7f525..3806d17082 100644
--- a/src/lib/libcrypto/pkcs7/pk7_smime.c
+++ b/src/lib/libcrypto/pkcs7/pk7_smime.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: pk7_smime.c,v 1.29 2025/12/20 07:22:43 tb Exp $ */
+/* $OpenBSD: pk7_smime.c,v 1.30 2026/06/09 12:34:08 tb Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project.
  */
@@ -259,7 +259,7 @@ PKCS7_verify(PKCS7 *p7, STACK_OF(X509) *certs, X509_STORE *store, BIO *indata,
         char buf[4096];
         int i, j = 0, k, ret = 0;
         BIO *p7bio;
-        BIO *tmpin, *tmpout;
+        BIO *next, *tmpin, *tmpout;
 
         if (!p7) {
                 PKCS7error(PKCS7_R_INVALID_NULL_POINTER);
@@ -409,12 +409,12 @@ PKCS7_verify(PKCS7 *p7, STACK_OF(X509) *certs, X509_STORE *store, BIO *indata,
 
         ret = 1;
 
-err:
-        if (tmpin == indata) {
-                if (indata)
-                        BIO_pop(p7bio);
+ err:
+        while (p7bio != NULL && p7bio != indata) {
+                next = BIO_pop(p7bio);
+                BIO_free(p7bio);
+                p7bio = next;
         }
-        BIO_free_all(p7bio);
         sk_X509_free(signers);
 
         return ret;
diff --git a/src/lib/libcrypto/ripemd/ripemd.h b/src/lib/libcrypto/ripemd/ripemd.h
index c7b1bd79b9..7866626ffc 100644
--- a/src/lib/libcrypto/ripemd/ripemd.h
+++ b/src/lib/libcrypto/ripemd/ripemd.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: ripemd.h,v 1.20 2025/01/25 17:59:44 tb Exp $ */
+/* $OpenBSD: ripemd.h,v 1.21 2026/05/08 05:15:20 jsg Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -71,14 +71,7 @@
 extern "C" {
 #endif
 
-#if defined(__LP32__)
-#define RIPEMD160_LONG unsigned long
-#elif defined(__ILP64__)
-#define RIPEMD160_LONG unsigned long
-#define RIPEMD160_LONG_LOG2 3
-#else
 #define RIPEMD160_LONG unsigned int
-#endif
 
 #define RIPEMD160_CBLOCK        64
 #define RIPEMD160_LBLOCK        (RIPEMD160_CBLOCK/4)
diff --git a/src/lib/libcrypto/rsa/rsa_ameth.c b/src/lib/libcrypto/rsa/rsa_ameth.c
index aca00a9ec8..9d8e2d2789 100644
--- a/src/lib/libcrypto/rsa/rsa_ameth.c
+++ b/src/lib/libcrypto/rsa/rsa_ameth.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: rsa_ameth.c,v 1.65 2026/04/07 13:16:41 tb Exp $ */
+/* $OpenBSD: rsa_ameth.c,v 1.66 2026/08/21 17:15:22 tb Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 2006.
  */
@@ -879,7 +879,7 @@ rsa_pss_signature_info(const X509_ALGOR *alg, int *out_md_nid,
                 goto err;
 
         /*
-         * RFC 8446, section 4.2.3 - restricts the digest algorithm:
+         * RFC 9846, section 4.3.3 - restricts the digest algorithm:
          * - it must be one of SHA256, SHA384, and SHA512;
          * - the same digest must be used in the mask generation function;
          * - the salt length must match the output length of the digest.
diff --git a/src/lib/libcrypto/rsa/rsa_eay.c b/src/lib/libcrypto/rsa/rsa_eay.c
index 65ccfc35e1..0a88c812be 100644
--- a/src/lib/libcrypto/rsa/rsa_eay.c
+++ b/src/lib/libcrypto/rsa/rsa_eay.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: rsa_eay.c,v 1.66 2025/05/10 05:54:38 tb Exp $ */
+/* $OpenBSD: rsa_eay.c,v 1.67 2026/08/27 07:18:40 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -126,7 +126,7 @@ rsa_public_encrypt(int flen, const unsigned char *from, unsigned char *to,
     RSA *rsa, int padding)
 {
         BIGNUM *f, *ret;
-        int i, j, k, num = 0, r = -1;
+        int i, num = 0, r = -1;
         unsigned char *buf = NULL;
         BN_CTX *ctx = NULL;
 
@@ -200,15 +200,9 @@ rsa_public_encrypt(int flen, const unsigned char *from, unsigned char *to,
             rsa->_method_mod_n))
                 goto err;
 
-        /* put in leading 0 bytes if the number is less than the
-         * length of the modulus */
-        j = BN_num_bytes(ret);
-        i = BN_bn2bin(ret, &(to[num - j]));
-        for (k = 0; k < num - i; k++)
-                to[k] = 0;
+        r = BN_bn2binpad(ret, to, num);
 
-        r = num;
-err:
+ err:
         if (ctx != NULL) {
                 BN_CTX_end(ctx);
                 BN_CTX_free(ctx);
@@ -306,7 +300,7 @@ rsa_private_encrypt(int flen, const unsigned char *from, unsigned char *to,
     RSA *rsa, int padding)
 {
         BIGNUM *f, *ret, *res;
-        int i, j, k, num = 0, r = -1;
+        int i, num = 0, r = -1;
         unsigned char *buf = NULL;
         BN_CTX *ctx = NULL;
         int local_blinding = 0;
@@ -412,15 +406,9 @@ rsa_private_encrypt(int flen, const unsigned char *from, unsigned char *to,
         } else
                 res = ret;
 
-        /* put in leading 0 bytes if the number is less than the
-         * length of the modulus */
-        j = BN_num_bytes(res);
-        i = BN_bn2bin(res, &(to[num - j]));
-        for (k = 0; k < num - i; k++)
-                to[k] = 0;
+        r = BN_bn2binpad(res, to, num);
 
-        r = num;
-err:
+ err:
         if (ctx != NULL) {
                 BN_CTX_end(ctx);
                 BN_CTX_free(ctx);
diff --git a/src/lib/libcrypto/rsa/rsa_x931.c b/src/lib/libcrypto/rsa/rsa_x931.c
index 8a0190d7fe..c4b4179f7b 100644
--- a/src/lib/libcrypto/rsa/rsa_x931.c
+++ b/src/lib/libcrypto/rsa/rsa_x931.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: rsa_x931.c,v 1.13 2025/05/10 05:54:38 tb Exp $ */
+/* $OpenBSD: rsa_x931.c,v 1.14 2026/07/31 00:50:52 kenjiro Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 2005.
  */
@@ -64,6 +64,7 @@
 #include <openssl/rsa.h>
 
 #include "err_local.h"
+#include "rsa_local.h"
 
 int
 RSA_padding_add_X931(unsigned char *to, int tlen, const unsigned char *from,
diff --git a/src/lib/libcrypto/sha/sha1_aarch64.c b/src/lib/libcrypto/sha/sha1_aarch64.c
index 04c87761e0..a9fb8235c6 100644
--- a/src/lib/libcrypto/sha/sha1_aarch64.c
+++ b/src/lib/libcrypto/sha/sha1_aarch64.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sha1_aarch64.c,v 1.1 2025/06/28 12:51:08 jsing Exp $ */
+/* $OpenBSD: sha1_aarch64.c,v 1.2 2026/05/09 07:03:49 jsing Exp $ */
 /*
  * Copyright (c) 2025 Joel Sing <jsing@openbsd.org>
  *
@@ -19,11 +19,11 @@
 
 #include "crypto_arch.h"
 
-void sha1_block_ce(SHA256_CTX *ctx, const void *in, size_t num);
-void sha1_block_generic(SHA256_CTX *ctx, const void *in, size_t num);
+void sha1_block_ce(SHA_CTX *ctx, const void *in, size_t num);
+void sha1_block_generic(SHA_CTX *ctx, const void *in, size_t num);
 
 void
-sha1_block_data_order(SHA256_CTX *ctx, const void *in, size_t num)
+sha1_block_data_order(SHA_CTX *ctx, const void *in, size_t num)
 {
         if ((crypto_cpu_caps_aarch64 & CRYPTO_CPU_CAPS_AARCH64_SHA1) != 0) {
                 sha1_block_ce(ctx, in, num);
diff --git a/src/lib/libcrypto/sha/sha1_aarch64_ce.S b/src/lib/libcrypto/sha/sha1_aarch64_ce.S
index 641500a1e5..913a7b8fc1 100644
--- a/src/lib/libcrypto/sha/sha1_aarch64_ce.S
+++ b/src/lib/libcrypto/sha/sha1_aarch64_ce.S
@@ -1,4 +1,4 @@
-/* $OpenBSD: sha1_aarch64_ce.S,v 1.5 2026/01/25 08:22:17 jsing Exp $ */
+/* $OpenBSD: sha1_aarch64_ce.S,v 1.10 2026/05/12 15:07:30 jsing Exp $ */
 /*
  * Copyright (c) 2023,2025 Joel Sing <jsing@openbsd.org>
  *
@@ -15,6 +15,10 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
+#include "crypto_assembly.h"
+
+#define _SEP    CRYPTO_ASSEMBLY_SEPARATOR
+
 /*
  * SHA-1 implementation using the ARM Cryptographic Extension (CE).
  *
@@ -65,7 +69,7 @@
  * W0 = W8 ^ W2 ^ W0, while sha1su1 computes rol(W0 ^ W13, 1).
  */
 #define sha1_message_schedule_update(m0, m1, m2, m3) \
-        sha1su0 m0.4s, m1.4s, m2.4s;                                    \
+        sha1su0 m0.4s, m1.4s, m2.4s                                     _SEP \
         sha1su1 m0.4s, m3.4s
 
 /*
@@ -75,41 +79,39 @@
  */
 
 #define sha1_round1(h0, h1, w, k) \
-        add     tmp0.4s, w.4s, k.4s;            /* Tt = Wt + Kt */      \
-        mov     tmp1, h0.s[0];                                          \
-        sha1c   h0##q, h1##s, tmp0.4s;                                  \
+        add     tmp0.4s, w.4s, k.4s             /* Tt = Wt + Kt */      _SEP \
+        mov     tmp1, h0.s[0]                                           _SEP \
+        sha1c   h0##q, h1##s, tmp0.4s                                   _SEP \
         sha1h   h1##s, tmp1
 
 #define sha1_round2(h0, h1, w, k) \
-        add     tmp0.4s, w.4s, k.4s;            /* Tt = Wt + Kt */      \
-        mov     tmp1, h0.s[0];                                          \
-        sha1p   h0##q, h1##s, tmp0.4s;                                  \
+        add     tmp0.4s, w.4s, k.4s             /* Tt = Wt + Kt */      _SEP \
+        mov     tmp1, h0.s[0]                                           _SEP \
+        sha1p   h0##q, h1##s, tmp0.4s                                   _SEP \
         sha1h   h1##s, tmp1
 
 #define sha1_round3(h0, h1, w, k) \
-        add     tmp0.4s, w.4s, k.4s;            /* Tt = Wt + Kt */      \
-        mov     tmp1, h0.s[0];                                          \
-        sha1m   h0##q, h1##s, tmp0.4s;                                  \
+        add     tmp0.4s, w.4s, k.4s             /* Tt = Wt + Kt */      _SEP \
+        mov     tmp1, h0.s[0]                                           _SEP \
+        sha1m   h0##q, h1##s, tmp0.4s                                   _SEP \
         sha1h   h1##s, tmp1
 
 #define sha1_round4(h0, h1, w, k) \
-        add     tmp0.4s, w.4s, k.4s;            /* Tt = Wt + Kt */      \
-        mov     tmp1, h0.s[0];                                          \
-        sha1p   h0##q, h1##s, tmp0.4s;                                  \
+        add     tmp0.4s, w.4s, k.4s             /* Tt = Wt + Kt */      _SEP \
+        mov     tmp1, h0.s[0]                                           _SEP \
+        sha1p   h0##q, h1##s, tmp0.4s                                   _SEP \
         sha1h   h1##s, tmp1
 
 .arch   armv8-a+sha2
 
-.section .text
+.section CRYPTO_ASSEMBLY_SECTION_TEXT
 
 /*
- * void sha1_block_ce(SHA256_CTX *ctx, const void *in, size_t num);
+ * void sha1_block_ce(SHA_CTX *ctx, const void *in, size_t num);
  *
  * Standard ARM ABI: x0 = ctx, x1 = in, x2 = num
  */
-.globl  sha1_block_ce
-.type   sha1_block_ce,@function
-sha1_block_ce:
+CRYPTO_ASSEMBLY_GLOBAL_FUNCTION(sha1_block_ce):
 
         /*
          * Load SHA-1 round constants.
@@ -213,3 +215,7 @@ sha1_block_ce:
         str     hc1s, [ctx, #(4*4)]
 
         ret
+
+#if defined(__linux__) && defined(__ELF__)
+.section .note.GNU-stack,"",%progbits
+#endif
diff --git a/src/lib/libcrypto/sha/sha1_amd64_generic.S b/src/lib/libcrypto/sha/sha1_amd64_generic.S
index 57709c0a1f..c890d0d7fe 100644
--- a/src/lib/libcrypto/sha/sha1_amd64_generic.S
+++ b/src/lib/libcrypto/sha/sha1_amd64_generic.S
@@ -1,4 +1,4 @@
-/* $OpenBSD: sha1_amd64_generic.S,v 1.5 2026/03/28 13:11:28 jsing Exp $ */
+/* $OpenBSD: sha1_amd64_generic.S,v 1.8 2026/05/12 15:07:30 jsing Exp $ */
 /*
  * Copyright (c) 2024 Joel Sing <jsing@openbsd.org>
  *
@@ -17,6 +17,8 @@
 
 #include "crypto_assembly.h"
 
+#define _SEP    CRYPTO_ASSEMBLY_SEPARATOR
+
 #define ctx             %rdi
 #define in              %rsi
 #define num             %rdx
@@ -40,8 +42,8 @@
  *  Wt = Mt
  */
 #define sha1_message_schedule_load(idx, m, w, wt) \
-        movl    ((idx&0xf)*4)(m), wt;                           \
-        bswapl  wt;                                             \
+        movl    ((idx&0xf)*4)(m), wt                            _SEP \
+        bswapl  wt                                              _SEP \
         movl    wt, ((idx&0xf)*4)(w)
 
 /*
@@ -50,11 +52,11 @@
  *  W0 = rol(W13 ^ W8 ^ W2 ^ W0, 1)
  */
 #define sha1_message_schedule_update(idx, w, wt) \
-        movl    (((idx-3)&0xf)*4)(w), wt;       /* W13 */       \
-        xorl    (((idx-8)&0xf)*4)(w), wt;       /* W8 */        \
-        xorl    (((idx-14)&0xf)*4)(w), wt;      /* W2 */        \
-        xorl    (((idx)&0xf)*4)(w), wt;         /* W0 */        \
-        roll    $1, wt;                                         \
+        movl    (((idx-3)&0xf)*4)(w), wt        /* W13 */       _SEP \
+        xorl    (((idx-8)&0xf)*4)(w), wt        /* W8 */        _SEP \
+        xorl    (((idx-14)&0xf)*4)(w), wt       /* W2 */        _SEP \
+        xorl    (((idx)&0xf)*4)(w), wt          /* W0 */        _SEP \
+        roll    $1, wt                                          _SEP \
         \
         movl    wt, ((idx&0xf)*4)(w)
 
@@ -69,13 +71,13 @@
  * Upon completion b = rol(b, 30), e = T, pending rotation.
  */
 #define sha1_round(a, b, c, d, e, kt, wt) \
-        leal    kt(wt, e, 1), e;                /* Kt + Wt */   \
+        leal    kt(wt, e, 1), e                 /* Kt + Wt */   _SEP \
         \
-        movl    a, tmp1;                        /* rol(a, 5) */ \
-        roll    $5, tmp1;                                       \
-        addl    tmp1, e;                                        \
+        movl    a, tmp1                         /* rol(a, 5) */ _SEP \
+        roll    $5, tmp1                                        _SEP \
+        addl    tmp1, e                                         _SEP \
         \
-        roll    $30, b;                         /* rol(b, 30) */
+        roll    $30, b                          /* rol(b, 30) */
 
 /*
  * Compute a SHA-1 round with Ch:
@@ -87,11 +89,11 @@
  * Upon completion b = rol(b, 30), e = T, pending rotation.
  */
 #define sha1_round_ch(a, b, c, d, e, kt, wt) \
-        movl    c, tmp2;                        /* Ch */        \
-        xorl    d, tmp2;                        /* Ch */        \
-        andl    b, tmp2;                        /* Ch */        \
-        xorl    d, tmp2;                        /* Ch */        \
-        addl    tmp2, e;                        /* Ch */        \
+        movl    c, tmp2                         /* Ch */        _SEP \
+        xorl    d, tmp2                         /* Ch */        _SEP \
+        andl    b, tmp2                         /* Ch */        _SEP \
+        xorl    d, tmp2                         /* Ch */        _SEP \
+        addl    tmp2, e                         /* Ch */        _SEP \
         \
         sha1_round(a, b, c, d, e, kt, wt)
 
@@ -105,10 +107,10 @@
  * Upon completion b = rol(b, 30), e = T, pending rotation.
  */
 #define sha1_round_parity(a, b, c, d, e, kt, wt) \
-        movl    b, tmp2;                        /* Parity */    \
-        xorl    c, tmp2;                        /* Parity */    \
-        xorl    d, tmp2;                        /* Parity */    \
-        addl    tmp2, e;                        /* Parity */    \
+        movl    b, tmp2                         /* Parity */    _SEP \
+        xorl    c, tmp2                         /* Parity */    _SEP \
+        xorl    d, tmp2                         /* Parity */    _SEP \
+        addl    tmp2, e                         /* Parity */    _SEP \
         \
         sha1_round(a, b, c, d, e, kt, wt)
 
@@ -122,34 +124,34 @@
  * Upon completion b = rol(b, 30), e = T, pending rotation.
  */
 #define sha1_round_maj(a, b, c, d, e, kt, wt) \
-        movl    c, tmp2;                        /* Maj */       \
-        xorl    d, tmp2;                        /* Maj */       \
-        andl    b, tmp2;                        /* Maj */       \
-        movl    c, tmp3;                        /* Maj */       \
-        andl    d, tmp3;                        /* Maj */       \
-        xorl    tmp2, tmp3;                     /* Maj */       \
-        addl    tmp3, e;                        /* Maj */       \
+        movl    c, tmp2                         /* Maj */       _SEP \
+        xorl    d, tmp2                         /* Maj */       _SEP \
+        andl    b, tmp2                         /* Maj */       _SEP \
+        movl    c, tmp3                         /* Maj */       _SEP \
+        andl    d, tmp3                         /* Maj */       _SEP \
+        xorl    tmp2, tmp3                      /* Maj */       _SEP \
+        addl    tmp3, e                         /* Maj */       _SEP \
         \
         sha1_round(a, b, c, d, e, kt, wt)
 
 #define sha1_round1_load(idx, a, b, c, d, e) \
-        sha1_message_schedule_load(idx, in, %rsp, tmp0); \
+        sha1_message_schedule_load(idx, in, %rsp, tmp0)         _SEP \
         sha1_round_ch(a, b, c, d, e, 0x5a827999, tmp0)
 
 #define sha1_round1_update(idx, a, b, c, d, e) \
-        sha1_message_schedule_update(idx, %rsp, tmp0); \
+        sha1_message_schedule_update(idx, %rsp, tmp0)           _SEP \
         sha1_round_ch(a, b, c, d, e, 0x5a827999, tmp0)
 
 #define sha1_round2_update(idx, a, b, c, d, e) \
-        sha1_message_schedule_update(idx, %rsp, tmp0); \
+        sha1_message_schedule_update(idx, %rsp, tmp0)           _SEP \
         sha1_round_parity(a, b, c, d, e, 0x6ed9eba1, tmp0)
 
 #define sha1_round3_update(idx, a, b, c, d, e) \
-        sha1_message_schedule_update(idx, %rsp, tmp0); \
+        sha1_message_schedule_update(idx, %rsp, tmp0)           _SEP \
         sha1_round_maj(a, b, c, d, e, 0x8f1bbcdc, tmp0)
 
 #define sha1_round4_update(idx, a, b, c, d, e) \
-        sha1_message_schedule_update(idx, %rsp, tmp0); \
+        sha1_message_schedule_update(idx, %rsp, tmp0)           _SEP \
         sha1_round_parity(a, b, c, d, e, 0xca62c1d6, tmp0)
 
 .section .text
@@ -160,9 +162,7 @@
  * Standard x86-64 ABI: rdi = ctx, rsi = in, rdx = num
  */
 .align 16
-.globl  sha1_block_generic
-.type   sha1_block_generic,@function
-sha1_block_generic:
+CRYPTO_ASSEMBLY_GLOBAL_FUNCTION(sha1_block_generic):
         _CET_ENDBR
 
         /* Save callee save registers. */
@@ -308,3 +308,7 @@ sha1_block_generic:
         popq    %rbx
 
         ret
+
+#if defined(__linux__) && defined(__ELF__)
+.section .note.GNU-stack,"",%progbits
+#endif
diff --git a/src/lib/libcrypto/sha/sha1_amd64_shani.S b/src/lib/libcrypto/sha/sha1_amd64_shani.S
index 7fc5168907..afba0b9f14 100644
--- a/src/lib/libcrypto/sha/sha1_amd64_shani.S
+++ b/src/lib/libcrypto/sha/sha1_amd64_shani.S
@@ -1,4 +1,4 @@
-/* $OpenBSD: sha1_amd64_shani.S,v 1.4 2026/03/28 13:11:28 jsing Exp $ */
+/* $OpenBSD: sha1_amd64_shani.S,v 1.9 2026/05/12 15:07:30 jsing Exp $ */
 /*
  * Copyright (c) 2024 Joel Sing <jsing@openbsd.org>
  *
@@ -17,6 +17,8 @@
 
 #include "crypto_assembly.h"
 
+#define _SEP    CRYPTO_ASSEMBLY_SEPARATOR
+
 /*
  * SHA-1 implementation using the Intel SHA extensions:
  *
@@ -45,39 +47,37 @@
 
 
 #define sha1_message_schedule_load(idx, m, xmsg) \
-        movdqu  (idx*16)(m), xmsg;                                      \
+        movdqu  (idx*16)(m), xmsg                                       _SEP \
         pshufb  xshufmask, xmsg
 
 #define sha1_message_schedule_update(xm0, xm1, xm2, xm3) \
-        sha1msg1 xm1, xm0;                                              \
-        pxor    xm2, xm0;                                               \
+        sha1msg1 xm1, xm0                                               _SEP \
+        pxor    xm2, xm0                                                _SEP \
         sha1msg2 xm3, xm0
 
 #define sha1_shani_round(fn, xmsg, xe, xe_next) \
-        sha1nexte xmsg, xe;                                             \
-        movdqa  xabcd, xe_next;                                         \
+        sha1nexte xmsg, xe                                              _SEP \
+        movdqa  xabcd, xe_next                                          _SEP \
         sha1rnds4 fn, xe, xabcd
 
 #define sha1_shani_round_load(fn, idx, m, xmsg, xe, xe_next) \
-        sha1_message_schedule_load(idx, m, xmsg);                       \
+        sha1_message_schedule_load(idx, m, xmsg)                        _SEP \
         sha1_shani_round(fn, xmsg, xe, xe_next)
 
 #define sha1_shani_round_update(fn, xm0, xm1, xm2, xm3, xe, xe_next) \
-        sha1_message_schedule_update(xm0, xm1, xm2, xm3);               \
+        sha1_message_schedule_update(xm0, xm1, xm2, xm3)                _SEP \
         sha1_shani_round(fn, xm0, xe, xe_next)
 
 
-.section .text
+.section CRYPTO_ASSEMBLY_SECTION_TEXT
 
 /*
- * void sha1_block_shani(SHA256_CTX *ctx, const void *in, size_t num);
+ * void sha1_block_shani(SHA_CTX *ctx, const void *in, size_t num);
  *
  * Standard x86-64 ABI: rdi = ctx, rsi = in, rdx = num
  */
 .align 16
-.globl  sha1_block_shani
-.type   sha1_block_shani,@function
-sha1_block_shani:
+CRYPTO_ASSEMBLY_GLOBAL_FUNCTION(sha1_block_shani):
         _CET_ENDBR
 
         /* Save callee save registers. */
@@ -153,14 +153,17 @@ sha1_block_shani:
 
         ret
 
-.section .rodata
+.section CRYPTO_ASSEMBLY_SECTION_RODATA
 
 /*
  * Shuffle mask - byte reversal for little endian to big endian word conversion,
  * and reordering to abcd.
  */
 .align  16
-.type   shufmask,@object
-shufmask:
+CRYPTO_ASSEMBLY_OBJECT_START(shufmask):
 .octa   0x000102030405060708090a0b0c0d0e0f
-.size   shufmask,.-shufmask
+CRYPTO_ASSEMBLY_OBJECT_END(shufmask)
+
+#if defined(__linux__) && defined(__ELF__)
+.section .note.GNU-stack,"",%progbits
+#endif
diff --git a/src/lib/libcrypto/sha/sha256.c b/src/lib/libcrypto/sha/sha256.c
index 5d002ca62c..de7904293e 100644
--- a/src/lib/libcrypto/sha/sha256.c
+++ b/src/lib/libcrypto/sha/sha256.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sha256.c,v 1.33 2025/02/14 12:01:58 jsing Exp $ */
+/* $OpenBSD: sha256.c,v 1.38 2026/05/09 07:14:42 jsing Exp $ */
 /* ====================================================================
  * Copyright (c) 1998-2011 The OpenSSL Project.  All rights reserved.
  *
@@ -72,7 +72,10 @@ void sha256_block_data_order(SHA256_CTX *ctx, const void *_in, size_t num);
 void sha256_block_generic(SHA256_CTX *ctx, const void *_in, size_t num);
 
 #ifndef HAVE_SHA256_BLOCK_GENERIC
-static const SHA_LONG K256[64] = {
+/*
+ * SHA-256 constants - see FIPS 180-4 section 4.2.2.
+ */
+static const uint32_t K256[64] = {
         0x428a2f98UL, 0x71374491UL, 0xb5c0fbcfUL, 0xe9b5dba5UL,
         0x3956c25bUL, 0x59f111f1UL, 0x923f82a4UL, 0xab1c5ed5UL,
         0xd807aa98UL, 0x12835b01UL, 0x243185beUL, 0x550c7dc3UL,
@@ -91,55 +94,55 @@ static const SHA_LONG K256[64] = {
         0x90befffaUL, 0xa4506cebUL, 0xbef9a3f7UL, 0xc67178f2UL,
 };
 
-static inline SHA_LONG
-Sigma0(SHA_LONG x)
+static inline uint32_t
+Sigma0(uint32_t x)
 {
         return crypto_ror_u32(x, 2) ^ crypto_ror_u32(x, 13) ^
             crypto_ror_u32(x, 22);
 }
 
-static inline SHA_LONG
-Sigma1(SHA_LONG x)
+static inline uint32_t
+Sigma1(uint32_t x)
 {
         return crypto_ror_u32(x, 6) ^ crypto_ror_u32(x, 11) ^
             crypto_ror_u32(x, 25);
 }
 
-static inline SHA_LONG
-sigma0(SHA_LONG x)
+static inline uint32_t
+sigma0(uint32_t x)
 {
         return crypto_ror_u32(x, 7) ^ crypto_ror_u32(x, 18) ^ (x >> 3);
 }
 
-static inline SHA_LONG
-sigma1(SHA_LONG x)
+static inline uint32_t
+sigma1(uint32_t x)
 {
         return crypto_ror_u32(x, 17) ^ crypto_ror_u32(x, 19) ^ (x >> 10);
 }
 
-static inline SHA_LONG
-Ch(SHA_LONG x, SHA_LONG y, SHA_LONG z)
+static inline uint32_t
+Ch(uint32_t x, uint32_t y, uint32_t z)
 {
         return (x & y) ^ (~x & z);
 }
 
-static inline SHA_LONG
-Maj(SHA_LONG x, SHA_LONG y, SHA_LONG z)
+static inline uint32_t
+Maj(uint32_t x, uint32_t y, uint32_t z)
 {
         return (x & y) ^ (x & z) ^ (y & z);
 }
 
 static inline void
-sha256_msg_schedule_update(SHA_LONG *W0, SHA_LONG W1, SHA_LONG W9, SHA_LONG W14)
+sha256_msg_schedule_update(uint32_t *W0, uint32_t W1, uint32_t W9, uint32_t W14)
 {
         *W0 = sigma1(W14) + W9 + sigma0(W1) + *W0;
 }
 
 static inline void
-sha256_round(SHA_LONG *a, SHA_LONG *b, SHA_LONG *c, SHA_LONG *d, SHA_LONG *e,
-    SHA_LONG *f, SHA_LONG *g, SHA_LONG *h, SHA_LONG Kt, SHA_LONG Wt)
+sha256_round(uint32_t *a, uint32_t *b, uint32_t *c, uint32_t *d, uint32_t *e,
+    uint32_t *f, uint32_t *g, uint32_t *h, uint32_t Kt, uint32_t Wt)
 {
-        SHA_LONG T1, T2;
+        uint32_t T1, T2;
 
         T1 = *h + Sigma1(*e) + Ch(*e, *f, *g) + Kt + Wt;
         T2 = Sigma0(*a) + Maj(*a, *b, *c);
@@ -158,9 +161,9 @@ void
 sha256_block_generic(SHA256_CTX *ctx, const void *_in, size_t num)
 {
         const uint8_t *in = _in;
-        const SHA_LONG *in32;
-        SHA_LONG a, b, c, d, e, f, g, h;
-        SHA_LONG X[16];
+        const uint32_t *in32;
+        uint32_t a, b, c, d, e, f, g, h;
+        uint32_t W[16];
         int i;
 
         while (num--) {
@@ -175,95 +178,95 @@ sha256_block_generic(SHA256_CTX *ctx, const void *_in, size_t num)
 
                 if ((size_t)in % 4 == 0) {
                         /* Input is 32 bit aligned. */
-                        in32 = (const SHA_LONG *)in;
-                        X[0] = be32toh(in32[0]);
-                        X[1] = be32toh(in32[1]);
-                        X[2] = be32toh(in32[2]);
-                        X[3] = be32toh(in32[3]);
-                        X[4] = be32toh(in32[4]);
-                        X[5] = be32toh(in32[5]);
-                        X[6] = be32toh(in32[6]);
-                        X[7] = be32toh(in32[7]);
-                        X[8] = be32toh(in32[8]);
-                        X[9] = be32toh(in32[9]);
-                        X[10] = be32toh(in32[10]);
-                        X[11] = be32toh(in32[11]);
-                        X[12] = be32toh(in32[12]);
-                        X[13] = be32toh(in32[13]);
-                        X[14] = be32toh(in32[14]);
-                        X[15] = be32toh(in32[15]);
+                        in32 = (const uint32_t *)in;
+                        W[0] = be32toh(in32[0]);
+                        W[1] = be32toh(in32[1]);
+                        W[2] = be32toh(in32[2]);
+                        W[3] = be32toh(in32[3]);
+                        W[4] = be32toh(in32[4]);
+                        W[5] = be32toh(in32[5]);
+                        W[6] = be32toh(in32[6]);
+                        W[7] = be32toh(in32[7]);
+                        W[8] = be32toh(in32[8]);
+                        W[9] = be32toh(in32[9]);
+                        W[10] = be32toh(in32[10]);
+                        W[11] = be32toh(in32[11]);
+                        W[12] = be32toh(in32[12]);
+                        W[13] = be32toh(in32[13]);
+                        W[14] = be32toh(in32[14]);
+                        W[15] = be32toh(in32[15]);
                 } else {
                         /* Input is not 32 bit aligned. */
-                        X[0] = crypto_load_be32toh(&in[0 * 4]);
-                        X[1] = crypto_load_be32toh(&in[1 * 4]);
-                        X[2] = crypto_load_be32toh(&in[2 * 4]);
-                        X[3] = crypto_load_be32toh(&in[3 * 4]);
-                        X[4] = crypto_load_be32toh(&in[4 * 4]);
-                        X[5] = crypto_load_be32toh(&in[5 * 4]);
-                        X[6] = crypto_load_be32toh(&in[6 * 4]);
-                        X[7] = crypto_load_be32toh(&in[7 * 4]);
-                        X[8] = crypto_load_be32toh(&in[8 * 4]);
-                        X[9] = crypto_load_be32toh(&in[9 * 4]);
-                        X[10] = crypto_load_be32toh(&in[10 * 4]);
-                        X[11] = crypto_load_be32toh(&in[11 * 4]);
-                        X[12] = crypto_load_be32toh(&in[12 * 4]);
-                        X[13] = crypto_load_be32toh(&in[13 * 4]);
-                        X[14] = crypto_load_be32toh(&in[14 * 4]);
-                        X[15] = crypto_load_be32toh(&in[15 * 4]);
+                        W[0] = crypto_load_be32toh(&in[0 * 4]);
+                        W[1] = crypto_load_be32toh(&in[1 * 4]);
+                        W[2] = crypto_load_be32toh(&in[2 * 4]);
+                        W[3] = crypto_load_be32toh(&in[3 * 4]);
+                        W[4] = crypto_load_be32toh(&in[4 * 4]);
+                        W[5] = crypto_load_be32toh(&in[5 * 4]);
+                        W[6] = crypto_load_be32toh(&in[6 * 4]);
+                        W[7] = crypto_load_be32toh(&in[7 * 4]);
+                        W[8] = crypto_load_be32toh(&in[8 * 4]);
+                        W[9] = crypto_load_be32toh(&in[9 * 4]);
+                        W[10] = crypto_load_be32toh(&in[10 * 4]);
+                        W[11] = crypto_load_be32toh(&in[11 * 4]);
+                        W[12] = crypto_load_be32toh(&in[12 * 4]);
+                        W[13] = crypto_load_be32toh(&in[13 * 4]);
+                        W[14] = crypto_load_be32toh(&in[14 * 4]);
+                        W[15] = crypto_load_be32toh(&in[15 * 4]);
                 }
                 in += SHA256_CBLOCK;
 
-                sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[0], X[0]);
-                sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[1], X[1]);
-                sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[2], X[2]);
-                sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[3], X[3]);
-                sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[4], X[4]);
-                sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[5], X[5]);
-                sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[6], X[6]);
-                sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[7], X[7]);
-                sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[8], X[8]);
-                sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[9], X[9]);
-                sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[10], X[10]);
-                sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[11], X[11]);
-                sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[12], X[12]);
-                sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[13], X[13]);
-                sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[14], X[14]);
-                sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[15], X[15]);
+                sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[0], W[0]);
+                sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[1], W[1]);
+                sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[2], W[2]);
+                sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[3], W[3]);
+                sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[4], W[4]);
+                sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[5], W[5]);
+                sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[6], W[6]);
+                sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[7], W[7]);
+                sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[8], W[8]);
+                sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[9], W[9]);
+                sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[10], W[10]);
+                sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[11], W[11]);
+                sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[12], W[12]);
+                sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[13], W[13]);
+                sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[14], W[14]);
+                sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[15], W[15]);
 
                 for (i = 16; i < 64; i += 16) {
-                        sha256_msg_schedule_update(&X[0], X[1], X[9], X[14]);
-                        sha256_msg_schedule_update(&X[1], X[2], X[10], X[15]);
-                        sha256_msg_schedule_update(&X[2], X[3], X[11], X[0]);
-                        sha256_msg_schedule_update(&X[3], X[4], X[12], X[1]);
-                        sha256_msg_schedule_update(&X[4], X[5], X[13], X[2]);
-                        sha256_msg_schedule_update(&X[5], X[6], X[14], X[3]);
-                        sha256_msg_schedule_update(&X[6], X[7], X[15], X[4]);
-                        sha256_msg_schedule_update(&X[7], X[8], X[0], X[5]);
-                        sha256_msg_schedule_update(&X[8], X[9], X[1], X[6]);
-                        sha256_msg_schedule_update(&X[9], X[10], X[2], X[7]);
-                        sha256_msg_schedule_update(&X[10], X[11], X[3], X[8]);
-                        sha256_msg_schedule_update(&X[11], X[12], X[4], X[9]);
-                        sha256_msg_schedule_update(&X[12], X[13], X[5], X[10]);
-                        sha256_msg_schedule_update(&X[13], X[14], X[6], X[11]);
-                        sha256_msg_schedule_update(&X[14], X[15], X[7], X[12]);
-                        sha256_msg_schedule_update(&X[15], X[0], X[8], X[13]);
-
-                        sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[i + 0], X[0]);
-                        sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[i + 1], X[1]);
-                        sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[i + 2], X[2]);
-                        sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[i + 3], X[3]);
-                        sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[i + 4], X[4]);
-                        sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[i + 5], X[5]);
-                        sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[i + 6], X[6]);
-                        sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[i + 7], X[7]);
-                        sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[i + 8], X[8]);
-                        sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[i + 9], X[9]);
-                        sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[i + 10], X[10]);
-                        sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[i + 11], X[11]);
-                        sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[i + 12], X[12]);
-                        sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[i + 13], X[13]);
-                        sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[i + 14], X[14]);
-                        sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[i + 15], X[15]);
+                        sha256_msg_schedule_update(&W[0], W[1], W[9], W[14]);
+                        sha256_msg_schedule_update(&W[1], W[2], W[10], W[15]);
+                        sha256_msg_schedule_update(&W[2], W[3], W[11], W[0]);
+                        sha256_msg_schedule_update(&W[3], W[4], W[12], W[1]);
+                        sha256_msg_schedule_update(&W[4], W[5], W[13], W[2]);
+                        sha256_msg_schedule_update(&W[5], W[6], W[14], W[3]);
+                        sha256_msg_schedule_update(&W[6], W[7], W[15], W[4]);
+                        sha256_msg_schedule_update(&W[7], W[8], W[0], W[5]);
+                        sha256_msg_schedule_update(&W[8], W[9], W[1], W[6]);
+                        sha256_msg_schedule_update(&W[9], W[10], W[2], W[7]);
+                        sha256_msg_schedule_update(&W[10], W[11], W[3], W[8]);
+                        sha256_msg_schedule_update(&W[11], W[12], W[4], W[9]);
+                        sha256_msg_schedule_update(&W[12], W[13], W[5], W[10]);
+                        sha256_msg_schedule_update(&W[13], W[14], W[6], W[11]);
+                        sha256_msg_schedule_update(&W[14], W[15], W[7], W[12]);
+                        sha256_msg_schedule_update(&W[15], W[0], W[8], W[13]);
+
+                        sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[i + 0], W[0]);
+                        sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[i + 1], W[1]);
+                        sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[i + 2], W[2]);
+                        sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[i + 3], W[3]);
+                        sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[i + 4], W[4]);
+                        sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[i + 5], W[5]);
+                        sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[i + 6], W[6]);
+                        sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[i + 7], W[7]);
+                        sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[i + 8], W[8]);
+                        sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[i + 9], W[9]);
+                        sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[i + 10], W[10]);
+                        sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[i + 11], W[11]);
+                        sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[i + 12], W[12]);
+                        sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[i + 13], W[13]);
+                        sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[i + 14], W[14]);
+                        sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[i + 15], W[15]);
                 }
 
                 ctx->h[0] += a;
@@ -287,123 +290,119 @@ sha256_block_data_order(SHA256_CTX *ctx, const void *_in, size_t num)
 #endif
 
 int
-SHA224_Init(SHA256_CTX *c)
+SHA224_Init(SHA256_CTX *ctx)
 {
-        memset(c, 0, sizeof(*c));
+        memset(ctx, 0, sizeof(*ctx));
 
-        c->h[0] = 0xc1059ed8UL;
-        c->h[1] = 0x367cd507UL;
-        c->h[2] = 0x3070dd17UL;
-        c->h[3] = 0xf70e5939UL;
-        c->h[4] = 0xffc00b31UL;
-        c->h[5] = 0x68581511UL;
-        c->h[6] = 0x64f98fa7UL;
-        c->h[7] = 0xbefa4fa4UL;
+        /* FIPS 180-4 section 5.3.2. */
+        ctx->h[0] = 0xc1059ed8UL;
+        ctx->h[1] = 0x367cd507UL;
+        ctx->h[2] = 0x3070dd17UL;
+        ctx->h[3] = 0xf70e5939UL;
+        ctx->h[4] = 0xffc00b31UL;
+        ctx->h[5] = 0x68581511UL;
+        ctx->h[6] = 0x64f98fa7UL;
+        ctx->h[7] = 0xbefa4fa4UL;
 
-        c->md_len = SHA224_DIGEST_LENGTH;
+        ctx->md_len = SHA224_DIGEST_LENGTH;
 
         return 1;
 }
 LCRYPTO_ALIAS(SHA224_Init);
 
 int
-SHA224_Update(SHA256_CTX *c, const void *data, size_t len)
+SHA224_Update(SHA256_CTX *ctx, const void *data, size_t len)
 {
-        return SHA256_Update(c, data, len);
+        return SHA256_Update(ctx, data, len);
 }
 LCRYPTO_ALIAS(SHA224_Update);
 
 int
-SHA224_Final(unsigned char *md, SHA256_CTX *c)
+SHA224_Final(unsigned char *md, SHA256_CTX *ctx)
 {
-        return SHA256_Final(md, c);
+        return SHA256_Final(md, ctx);
 }
 LCRYPTO_ALIAS(SHA224_Final);
 
 unsigned char *
-SHA224(const unsigned char *d, size_t n, unsigned char *md)
+SHA224(const unsigned char *data, size_t len, unsigned char *md)
 {
-        SHA256_CTX c;
+        SHA256_CTX ctx;
 
-        SHA224_Init(&c);
-        SHA256_Update(&c, d, n);
-        SHA256_Final(md, &c);
+        SHA224_Init(&ctx);
+        SHA256_Update(&ctx, data, len);
+        SHA256_Final(md, &ctx);
 
-        explicit_bzero(&c, sizeof(c));
+        explicit_bzero(&ctx, sizeof(ctx));
 
         return (md);
 }
 LCRYPTO_ALIAS(SHA224);
 
 int
-SHA256_Init(SHA256_CTX *c)
+SHA256_Init(SHA256_CTX *ctx)
 {
-        memset(c, 0, sizeof(*c));
+        memset(ctx, 0, sizeof(*ctx));
 
-        c->h[0] = 0x6a09e667UL;
-        c->h[1] = 0xbb67ae85UL;
-        c->h[2] = 0x3c6ef372UL;
-        c->h[3] = 0xa54ff53aUL;
-        c->h[4] = 0x510e527fUL;
-        c->h[5] = 0x9b05688cUL;
-        c->h[6] = 0x1f83d9abUL;
-        c->h[7] = 0x5be0cd19UL;
+        /* FIPS 180-4 section 5.3.3. */
+        ctx->h[0] = 0x6a09e667UL;
+        ctx->h[1] = 0xbb67ae85UL;
+        ctx->h[2] = 0x3c6ef372UL;
+        ctx->h[3] = 0xa54ff53aUL;
+        ctx->h[4] = 0x510e527fUL;
+        ctx->h[5] = 0x9b05688cUL;
+        ctx->h[6] = 0x1f83d9abUL;
+        ctx->h[7] = 0x5be0cd19UL;
 
-        c->md_len = SHA256_DIGEST_LENGTH;
+        ctx->md_len = SHA256_DIGEST_LENGTH;
 
         return 1;
 }
 LCRYPTO_ALIAS(SHA256_Init);
 
 int
-SHA256_Update(SHA256_CTX *c, const void *data_, size_t len)
+SHA256_Update(SHA256_CTX *ctx, const void *data_, size_t len)
 {
         const unsigned char *data = data_;
         unsigned char *p;
-        SHA_LONG l;
         size_t n;
 
         if (len == 0)
                 return 1;
 
-        l = (c->Nl + (((SHA_LONG)len) << 3)) & 0xffffffffUL;
-        /* 95-05-24 eay Fixed a bug with the overflow handling, thanks to
-         * Wei Dai <weidai@eskimo.com> for pointing it out. */
-        if (l < c->Nl) /* overflow */
-                c->Nh++;
-        c->Nh += (SHA_LONG)(len >> 29); /* might cause compiler warning on 16-bit */
-        c->Nl = l;
+        /* Update message bit counter. */
+        crypto_add_u32dw_u64(&ctx->Nh, &ctx->Nl, (uint64_t)len << 3);
 
-        n = c->num;
+        n = ctx->num;
         if (n != 0) {
-                p = (unsigned char *)c->data;
+                p = (unsigned char *)ctx->data;
 
                 if (len >= SHA_CBLOCK || len + n >= SHA_CBLOCK) {
                         memcpy(p + n, data, SHA_CBLOCK - n);
-                        sha256_block_data_order(c, p, 1);
+                        sha256_block_data_order(ctx, p, 1);
                         n = SHA_CBLOCK - n;
                         data += n;
                         len -= n;
-                        c->num = 0;
+                        ctx->num = 0;
                         memset(p, 0, SHA_CBLOCK);       /* keep it zeroed */
                 } else {
                         memcpy(p + n, data, len);
-                        c->num += (unsigned int)len;
+                        ctx->num += (unsigned int)len;
                         return 1;
                 }
         }
 
         n = len/SHA_CBLOCK;
         if (n > 0) {
-                sha256_block_data_order(c, data, n);
+                sha256_block_data_order(ctx, data, n);
                 n *= SHA_CBLOCK;
                 data += n;
                 len -= n;
         }
 
         if (len != 0) {
-                p = (unsigned char *)c->data;
-                c->num = (unsigned int)len;
+                p = (unsigned char *)ctx->data;
+                ctx->num = (unsigned int)len;
                 memcpy(p, data, len);
         }
         return 1;
@@ -411,17 +410,17 @@ SHA256_Update(SHA256_CTX *c, const void *data_, size_t len)
 LCRYPTO_ALIAS(SHA256_Update);
 
 void
-SHA256_Transform(SHA256_CTX *c, const unsigned char *data)
+SHA256_Transform(SHA256_CTX *ctx, const unsigned char *data)
 {
-        sha256_block_data_order(c, data, 1);
+        sha256_block_data_order(ctx, data, 1);
 }
 LCRYPTO_ALIAS(SHA256_Transform);
 
 int
-SHA256_Final(unsigned char *md, SHA256_CTX *c)
+SHA256_Final(unsigned char *md, SHA256_CTX *ctx)
 {
-        unsigned char *p = (unsigned char *)c->data;
-        size_t n = c->num;
+        unsigned char *p = (unsigned char *)ctx->data;
+        size_t n = ctx->num;
         unsigned int nn;
 
         p[n] = 0x80; /* there is always room for one */
@@ -430,15 +429,15 @@ SHA256_Final(unsigned char *md, SHA256_CTX *c)
         if (n > (SHA_CBLOCK - 8)) {
                 memset(p + n, 0, SHA_CBLOCK - n);
                 n = 0;
-                sha256_block_data_order(c, p, 1);
+                sha256_block_data_order(ctx, p, 1);
         }
 
         memset(p + n, 0, SHA_CBLOCK - 8 - n);
-        c->data[SHA_LBLOCK - 2] = htobe32(c->Nh);
-        c->data[SHA_LBLOCK - 1] = htobe32(c->Nl);
+        ctx->data[SHA_LBLOCK - 2] = htobe32(ctx->Nh);
+        ctx->data[SHA_LBLOCK - 1] = htobe32(ctx->Nl);
 
-        sha256_block_data_order(c, p, 1);
-        c->num = 0;
+        sha256_block_data_order(ctx, p, 1);
+        ctx->num = 0;
         memset(p, 0, SHA_CBLOCK);
 
         /*
@@ -449,26 +448,26 @@ SHA256_Final(unsigned char *md, SHA256_CTX *c)
          * Idea behind separate cases for pre-defined lengths is to let the
          * compiler decide if it's appropriate to unroll small loops.
          */
-        switch (c->md_len) {
+        switch (ctx->md_len) {
         case SHA224_DIGEST_LENGTH:
                 for (nn = 0; nn < SHA224_DIGEST_LENGTH / 4; nn++) {
-                        crypto_store_htobe32(md, c->h[nn]);
+                        crypto_store_htobe32(md, ctx->h[nn]);
                         md += 4;
                 }
                 break;
 
         case SHA256_DIGEST_LENGTH:
                 for (nn = 0; nn < SHA256_DIGEST_LENGTH / 4; nn++) {
-                        crypto_store_htobe32(md, c->h[nn]);
+                        crypto_store_htobe32(md, ctx->h[nn]);
                         md += 4;
                 }
                 break;
 
         default:
-                if (c->md_len > SHA256_DIGEST_LENGTH)
+                if (ctx->md_len > SHA256_DIGEST_LENGTH)
                         return 0;
-                for (nn = 0; nn < c->md_len / 4; nn++) {
-                        crypto_store_htobe32(md, c->h[nn]);
+                for (nn = 0; nn < ctx->md_len / 4; nn++) {
+                        crypto_store_htobe32(md, ctx->h[nn]);
                         md += 4;
                 }
                 break;
@@ -479,15 +478,15 @@ SHA256_Final(unsigned char *md, SHA256_CTX *c)
 LCRYPTO_ALIAS(SHA256_Final);
 
 unsigned char *
-SHA256(const unsigned char *d, size_t n, unsigned char *md)
+SHA256(const unsigned char *data, size_t len, unsigned char *md)
 {
-        SHA256_CTX c;
+        SHA256_CTX ctx;
 
-        SHA256_Init(&c);
-        SHA256_Update(&c, d, n);
-        SHA256_Final(md, &c);
+        SHA256_Init(&ctx);
+        SHA256_Update(&ctx, data, len);
+        SHA256_Final(md, &ctx);
 
-        explicit_bzero(&c, sizeof(c));
+        explicit_bzero(&ctx, sizeof(ctx));
 
         return (md);
 }
diff --git a/src/lib/libcrypto/sha/sha256_aarch64_ce.S b/src/lib/libcrypto/sha/sha256_aarch64_ce.S
index 8a26f91b06..75352b4f7a 100644
--- a/src/lib/libcrypto/sha/sha256_aarch64_ce.S
+++ b/src/lib/libcrypto/sha/sha256_aarch64_ce.S
@@ -1,4 +1,4 @@
-/* $OpenBSD: sha256_aarch64_ce.S,v 1.6 2026/01/25 08:22:17 jsing Exp $ */
+/* $OpenBSD: sha256_aarch64_ce.S,v 1.11 2026/05/12 15:07:30 jsing Exp $ */
 /*
  * Copyright (c) 2023,2025 Joel Sing <jsing@openbsd.org>
  *
@@ -15,6 +15,10 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
+#include "crypto_assembly.h"
+
+#define _SEP    CRYPTO_ASSEMBLY_SEPARATOR
+
 /*
  * SHA-256 implementation using the ARM Cryptographic Extension (CE).
  *
@@ -68,7 +72,7 @@
  *   W0:W1:W2:W3 = sigma1(W14:W15:W0:W1) + W9:W10:W12:W13 + W0:W1:W2:W3
  */
 #define sha256_message_schedule_update(m0, m1, m2, m3) \
-        sha256su0 m0.4s, m1.4s;                                         \
+        sha256su0 m0.4s, m1.4s                                          _SEP \
         sha256su1 m0.4s, m2.4s, m3.4s
 
 /*
@@ -77,34 +81,32 @@
  * sha256h/sha256h2.
  */
 #define sha256_round(h0, h1, w, k) \
-        add     tmp0.4s, w.4s, k.4s;            /* Tt = Wt + Kt */      \
-        mov     tmp1.16b, h0.16b;                                       \
-        sha256h h0##q, h1##q, tmp0.4s;                                  \
+        add     tmp0.4s, w.4s, k.4s             /* Tt = Wt + Kt */      _SEP \
+        mov     tmp1.16b, h0.16b                                        _SEP \
+        sha256h h0##q, h1##q, tmp0.4s                                   _SEP \
         sha256h2 h1##q, tmp1##q, tmp0.4s
 
 #define sha256_round_initial(h0, h1, w, k) \
         sha256_round(h0, h1, w, k)
 
 #define sha256_round_update(h0, h1, m0, m1, m2, m3, k) \
-        sha256_message_schedule_update(m0, m1, m2, m3);                 \
+        sha256_message_schedule_update(m0, m1, m2, m3)                  _SEP \
         sha256_round(h0, h1, m0, k)
 
 .arch   armv8-a+sha2
 
-.section .text
+.section CRYPTO_ASSEMBLY_SECTION_TEXT
 
 /*
  * void sha256_block_ce(SHA256_CTX *ctx, const void *in, size_t num);
  *
  * Standard ARM ABI: x0 = ctx, x1 = in, x2 = num
  */
-.globl  sha256_block_ce
-.type   sha256_block_ce,@function
-sha256_block_ce:
+CRYPTO_ASSEMBLY_GLOBAL_FUNCTION(sha256_block_ce):
 
         /* Address of SHA-256 constants. */
-        adrp    k256_base, K256
-        add     k256_base, k256_base, :lo12:K256
+        adrp    k256_base, CRYPTO_ASSEMBLY_AARCH64_SYM_HI(K256)
+        add     k256_base, k256_base, CRYPTO_ASSEMBLY_AARCH64_SYM_LO(K256)
 
         /*
          * Load current hash state from context.
@@ -170,14 +172,13 @@ sha256_block_ce:
 
         ret
 
-.section .rodata
+.section CRYPTO_ASSEMBLY_SECTION_RODATA
 
 /*
  * SHA-256 constants - see FIPS 180-4 section 4.2.3.
  */
 .align  4
-.type   K256,@object
-K256:
+CRYPTO_ASSEMBLY_OBJECT_START(K256):
 .long   0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5
 .long   0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5
 .long   0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3
@@ -194,4 +195,8 @@ K256:
 .long   0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3
 .long   0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208
 .long   0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2
-.size   K256,.-K256
+CRYPTO_ASSEMBLY_OBJECT_END(K256)
+
+#if defined(__linux__) && defined(__ELF__)
+.section .note.GNU-stack,"",%progbits
+#endif
diff --git a/src/lib/libcrypto/sha/sha256_amd64_generic.S b/src/lib/libcrypto/sha/sha256_amd64_generic.S
index 52ad974eab..0d18e95d04 100644
--- a/src/lib/libcrypto/sha/sha256_amd64_generic.S
+++ b/src/lib/libcrypto/sha/sha256_amd64_generic.S
@@ -1,4 +1,4 @@
-/* $OpenBSD: sha256_amd64_generic.S,v 1.6 2026/03/28 13:11:28 jsing Exp $ */
+/* $OpenBSD: sha256_amd64_generic.S,v 1.10 2026/05/12 15:07:30 jsing Exp $ */
 /*
  * Copyright (c) 2024 Joel Sing <jsing@openbsd.org>
  *
@@ -17,6 +17,8 @@
 
 #include "crypto_assembly.h"
 
+#define _SEP    CRYPTO_ASSEMBLY_SEPARATOR
+
 #define ctx             %rdi
 #define in              %rsi
 #define num             %rdx
@@ -45,8 +47,8 @@
  *  Wt = Mt
  */
 #define sha256_message_schedule_load(idx, m, w, wt) \
-        movl    (m, round, 4), wt;                              \
-        bswapl  wt;                                             \
+        movl    (m, round, 4), wt                               _SEP \
+        bswapl  wt                                              _SEP \
         movl    wt, ((idx&0xf)*4)(w)
 
 /*
@@ -58,25 +60,25 @@
  *  sigma1(x) = ror(x, 17) ^ ror(x, 19) ^ (x >> 10)
  */
 #define sha256_message_schedule_update(idx, w, wt) \
-        movl    (((idx-2)&0xf)*4)(w), wt;       /* sigma1 */    \
-        movl    wt, tmp1;                       /* sigma1 */    \
-        rorl    $(19-17), tmp1;                 /* sigma1 */    \
-        xorl    wt, tmp1;                       /* sigma1 */    \
-        rorl    $17, tmp1;                      /* sigma1 */    \
-        shrl    $10, wt;                        /* sigma1 */    \
-        xorl    tmp1, wt;                       /* sigma1 */    \
+        movl    (((idx-2)&0xf)*4)(w), wt        /* sigma1 */    _SEP \
+        movl    wt, tmp1                        /* sigma1 */    _SEP \
+        rorl    $(19-17), tmp1                  /* sigma1 */    _SEP \
+        xorl    wt, tmp1                        /* sigma1 */    _SEP \
+        rorl    $17, tmp1                       /* sigma1 */    _SEP \
+        shrl    $10, wt                         /* sigma1 */    _SEP \
+        xorl    tmp1, wt                        /* sigma1 */    _SEP \
         \
-        addl    (((idx-7)&0xf)*4)(w), wt;       /* Wt-7 */      \
-        addl    (((idx-16)&0xf)*4)(w), wt;      /* Wt-16 */     \
+        addl    (((idx-7)&0xf)*4)(w), wt        /* Wt-7 */      _SEP \
+        addl    (((idx-16)&0xf)*4)(w), wt       /* Wt-16 */     _SEP \
         \
-        movl    (((idx-15)&0xf)*4)(w), tmp2;    /* sigma0 */    \
-        movl    tmp2, tmp3;                     /* sigma0 */    \
-        rorl    $(18-7), tmp2;                  /* sigma0 */    \
-        xorl    tmp3, tmp2;                     /* sigma0 */    \
-        rorl    $7, tmp2;                       /* sigma0 */    \
-        shrl    $3, tmp3;                       /* sigma0 */    \
-        xorl    tmp3, tmp2;                     /* sigma0 */    \
-        addl    tmp2, wt;                       /* sigma0 */    \
+        movl    (((idx-15)&0xf)*4)(w), tmp2     /* sigma0 */    _SEP \
+        movl    tmp2, tmp3                      /* sigma0 */    _SEP \
+        rorl    $(18-7), tmp2                   /* sigma0 */    _SEP \
+        xorl    tmp3, tmp2                      /* sigma0 */    _SEP \
+        rorl    $7, tmp2                        /* sigma0 */    _SEP \
+        shrl    $3, tmp3                        /* sigma0 */    _SEP \
+        xorl    tmp3, tmp2                      /* sigma0 */    _SEP \
+        addl    tmp2, wt                        /* sigma0 */    _SEP \
         \
         movl    wt, ((idx&0xf)*4)(w)
 
@@ -94,52 +96,52 @@
  * Upon completion d = d + T1, h = T1 + T2, pending rotation.
  */
 #define sha256_round(idx, a, b, c, d, e, f, g, h, k, w, wt) \
-        addl    wt, h;                          /* T1 Wt */     \
-        addl    (k256, round, 4), h;            /* T1 Kt */     \
+        addl    wt, h                           /* T1 Wt */     _SEP \
+        addl    (k256, round, 4), h             /* T1 Kt */     _SEP \
         \
-        movl    e, tmp1;                        /* T1 Sigma1 */ \
-        rorl    $(25-11), tmp1;                 /* T1 Sigma1 */ \
-        xorl    e, tmp1;                        /* T1 Sigma1 */ \
-        rorl    $(11-6), tmp1;                  /* T1 Sigma1 */ \
-        xorl    e, tmp1;                        /* T1 Sigma1 */ \
-        rorl    $6, tmp1;                       /* T1 Sigma1 */ \
-        addl    tmp1, h;                        /* T1 Sigma1 */ \
+        movl    e, tmp1                         /* T1 Sigma1 */ _SEP \
+        rorl    $(25-11), tmp1                  /* T1 Sigma1 */ _SEP \
+        xorl    e, tmp1                         /* T1 Sigma1 */ _SEP \
+        rorl    $(11-6), tmp1                   /* T1 Sigma1 */ _SEP \
+        xorl    e, tmp1                         /* T1 Sigma1 */ _SEP \
+        rorl    $6, tmp1                        /* T1 Sigma1 */ _SEP \
+        addl    tmp1, h                         /* T1 Sigma1 */ _SEP \
         \
-        movl    f, tmp2;                        /* T1 Ch */     \
-        xorl    g, tmp2;                        /* T1 Ch */     \
-        andl    e, tmp2;                        /* T1 Ch */     \
-        xorl    g, tmp2;                        /* T1 Ch */     \
-        addl    tmp2, h;                        /* T1 Ch */     \
+        movl    f, tmp2                         /* T1 Ch */     _SEP \
+        xorl    g, tmp2                         /* T1 Ch */     _SEP \
+        andl    e, tmp2                         /* T1 Ch */     _SEP \
+        xorl    g, tmp2                         /* T1 Ch */     _SEP \
+        addl    tmp2, h                         /* T1 Ch */     _SEP \
         \
-        addl    h, d;                           /* d += T1 */   \
+        addl    h, d                            /* d += T1 */   _SEP \
         \
-        movl    a, tmp1;                        /* T2 Sigma0 */ \
-        rorl    $(22-13), tmp1;                 /* T2 Sigma0 */ \
-        xorl    a, tmp1;                        /* T2 Sigma0 */ \
-        rorl    $(13-2), tmp1;                  /* T2 Sigma0 */ \
-        xorl    a, tmp1;                        /* T2 Sigma0 */ \
-        rorl    $2, tmp1;                       /* T2 Sigma0 */ \
-        addl    tmp1, h;                        /* T2 Sigma0 */ \
+        movl    a, tmp1                         /* T2 Sigma0 */ _SEP \
+        rorl    $(22-13), tmp1                  /* T2 Sigma0 */ _SEP \
+        xorl    a, tmp1                         /* T2 Sigma0 */ _SEP \
+        rorl    $(13-2), tmp1                   /* T2 Sigma0 */ _SEP \
+        xorl    a, tmp1                         /* T2 Sigma0 */ _SEP \
+        rorl    $2, tmp1                        /* T2 Sigma0 */ _SEP \
+        addl    tmp1, h                         /* T2 Sigma0 */ _SEP \
         \
-        movl    b, tmp2;                        /* T2 Maj */    \
-        xorl    c, tmp2;                        /* T2 Maj */    \
-        andl    a, tmp2;                        /* T2 Maj */    \
-        movl    b, tmp3;                        /* T2 Maj */    \
-        andl    c, tmp3;                        /* T2 Maj */    \
-        xorl    tmp2, tmp3;                     /* T2 Maj */    \
-        addl    tmp3, h;                        /* T2 Maj */    \
+        movl    b, tmp2                         /* T2 Maj */    _SEP \
+        xorl    c, tmp2                         /* T2 Maj */    _SEP \
+        andl    a, tmp2                         /* T2 Maj */    _SEP \
+        movl    b, tmp3                         /* T2 Maj */    _SEP \
+        andl    c, tmp3                         /* T2 Maj */    _SEP \
+        xorl    tmp2, tmp3                      /* T2 Maj */    _SEP \
+        addl    tmp3, h                         /* T2 Maj */    _SEP \
         \
         addq    $1, round
 
 #define sha256_round_load(idx, a, b, c, d, e, f, g, h) \
-        sha256_message_schedule_load(idx, in, %rsp, tmp0); \
+        sha256_message_schedule_load(idx, in, %rsp, tmp0)       _SEP \
         sha256_round(idx, a, b, c, d, e, f, g, h, k256, %rsp, tmp0)
 
 #define sha256_round_update(idx, a, b, c, d, e, f, g, h) \
-        sha256_message_schedule_update(idx, %rsp, tmp0); \
+        sha256_message_schedule_update(idx, %rsp, tmp0)         _SEP \
         sha256_round(idx, a, b, c, d, e, f, g, h, k256, %rsp, tmp0)
 
-.section .text
+.section CRYPTO_ASSEMBLY_SECTION_TEXT
 
 /*
  * void sha256_block_generic(SHA256_CTX *ctx, const void *in, size_t num);
@@ -147,9 +149,7 @@
  * Standard x86-64 ABI: rdi = ctx, rsi = in, rdx = num
  */
 .align 16
-.globl  sha256_block_generic
-.type   sha256_block_generic,@function
-sha256_block_generic:
+CRYPTO_ASSEMBLY_GLOBAL_FUNCTION(sha256_block_generic):
         _CET_ENDBR
 
         /* Save callee save registers. */
@@ -272,14 +272,13 @@ sha256_block_generic:
 
         ret
 
-.section .rodata
+.section CRYPTO_ASSEMBLY_SECTION_RODATA
 
 /*
  * SHA-256 constants - see FIPS 180-4 section 4.2.2.
  */
 .align  64
-.type   K256,@object
-K256:
+CRYPTO_ASSEMBLY_OBJECT_START(K256):
 .long   0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5
 .long   0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5
 .long   0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3
@@ -296,4 +295,8 @@ K256:
 .long   0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3
 .long   0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208
 .long   0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2
-.size   K256,.-K256
+CRYPTO_ASSEMBLY_OBJECT_END(K256)
+
+#if defined(__linux__) && defined(__ELF__)
+.section .note.GNU-stack,"",%progbits
+#endif
diff --git a/src/lib/libcrypto/sha/sha256_amd64_shani.S b/src/lib/libcrypto/sha/sha256_amd64_shani.S
index d86be5be68..e51a168062 100644
--- a/src/lib/libcrypto/sha/sha256_amd64_shani.S
+++ b/src/lib/libcrypto/sha/sha256_amd64_shani.S
@@ -1,4 +1,4 @@
-/* $OpenBSD: sha256_amd64_shani.S,v 1.4 2026/03/28 13:11:28 jsing Exp $ */
+/* $OpenBSD: sha256_amd64_shani.S,v 1.8 2026/05/12 15:07:30 jsing Exp $ */
 /*
  * Copyright (c) 2024 Joel Sing <jsing@openbsd.org>
  *
@@ -17,6 +17,8 @@
 
 #include "crypto_assembly.h"
 
+#define _SEP    CRYPTO_ASSEMBLY_SEPARATOR
+
 /*
  * SHA-256 implementation using the Intel SHA extensions:
  *
@@ -50,33 +52,33 @@
 #define xtmp0           %xmm12
 
 #define sha256_message_schedule_load(idx, m, xmsgtmp) \
-        movdqu  (idx*16)(m), xmsg;                                      \
-        pshufb  xshufmask, xmsg;                                        \
+        movdqu  (idx*16)(m), xmsg                                       _SEP \
+        pshufb  xshufmask, xmsg                                         _SEP \
         movdqa  xmsg, xmsgtmp
 
 #define sha256_message_schedule_update(xmt0, xmt1, xmt2, xmt3) \
-        sha256msg1 xmt1, xmt0;                                          \
-        movdqa  xmt3, xmsgtmp4;                                         \
-        palignr $4, xmt2, xmsgtmp4;                                     \
-        paddd   xmsgtmp4, xmt0;                                         \
+        sha256msg1 xmt1, xmt0                                           _SEP \
+        movdqa  xmt3, xmsgtmp4                                          _SEP \
+        palignr $4, xmt2, xmsgtmp4                                      _SEP \
+        paddd   xmsgtmp4, xmt0                                          _SEP \
         sha256msg2 xmt3, xmt0
 
 #define sha256_shani_round(idx) \
-        paddd   (idx*16)(k256), xmsg;                                   \
-        sha256rnds2 xmsg, xhs0, xhs1;                                   \
-        pshufd  $0x0e, xmsg, xmsg;                                      \
+        paddd   (idx*16)(k256), xmsg                                    _SEP \
+        sha256rnds2 xmsg, xhs0, xhs1                                    _SEP \
+        pshufd  $0x0e, xmsg, xmsg                                       _SEP \
         sha256rnds2 xmsg, xhs1, xhs0
 
 #define sha256_shani_round_load(idx, m, xmsgtmp) \
-        sha256_message_schedule_load(idx, m, xmsgtmp);                  \
+        sha256_message_schedule_load(idx, m, xmsgtmp)                   _SEP \
         sha256_shani_round(idx)
 
 #define sha256_shani_round_update(idx, xmt0, xmt1, xmt2, xmt3) \
-        sha256_message_schedule_update(xmt0, xmt1, xmt2, xmt3);         \
-        movdqa  xmt0, xmsg;                                             \
+        sha256_message_schedule_update(xmt0, xmt1, xmt2, xmt3)          _SEP \
+        movdqa  xmt0, xmsg                                              _SEP \
         sha256_shani_round(idx)
 
-.section .text
+.section CRYPTO_ASSEMBLY_SECTION_TEXT
 
 /*
  * void sha256_block_shani(SHA256_CTX *ctx, const void *in, size_t num);
@@ -84,9 +86,7 @@
  * Standard x86-64 ABI: rdi = ctx, rsi = in, rdx = num
  */
 .align 16
-.globl  sha256_block_shani
-.type   sha256_block_shani,@function
-sha256_block_shani:
+CRYPTO_ASSEMBLY_GLOBAL_FUNCTION(sha256_block_shani):
         _CET_ENDBR
 
         /* Save callee save registers. */
@@ -169,23 +169,21 @@ sha256_block_shani:
 
         ret
 
-.section .rodata
+.section CRYPTO_ASSEMBLY_SECTION_RODATA
 
 /*
  * Shuffle mask - little endian to big endian word conversion.
  */
 .align  16
-.type   shufmask,@object
-shufmask:
+CRYPTO_ASSEMBLY_OBJECT_START(shufmask):
 .octa   0x0c0d0e0f08090a0b0405060700010203
-.size   shufmask,.-shufmask
+CRYPTO_ASSEMBLY_OBJECT_END(shufmask)
 
 /*
  * SHA-256 constants - see FIPS 180-4 section 4.2.2.
  */
 .align  64
-.type   K256,@object
-K256:
+CRYPTO_ASSEMBLY_OBJECT_START(K256):
 .long   0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5
 .long   0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5
 .long   0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3
@@ -202,4 +200,8 @@ K256:
 .long   0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3
 .long   0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208
 .long   0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2
-.size   K256,.-K256
+CRYPTO_ASSEMBLY_OBJECT_END(K256)
+
+#if defined(__linux__) && defined(__ELF__)
+.section .note.GNU-stack,"",%progbits
+#endif
diff --git a/src/lib/libcrypto/sha/sha3.c b/src/lib/libcrypto/sha/sha3.c
index fde0da94ff..bfbbe10303 100644
--- a/src/lib/libcrypto/sha/sha3.c
+++ b/src/lib/libcrypto/sha/sha3.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: sha3.c,v 1.20 2025/04/18 07:36:11 jsing Exp $ */
+/*      $OpenBSD: sha3.c,v 1.21 2026/07/22 14:34:38 jsing Exp $ */
 /*
  * The MIT License (MIT)
  *
@@ -41,55 +41,299 @@ static const uint64_t sha3_keccakf_rndc[24] = {
         0x000000000000800a, 0x800000008000000a, 0x8000000080008081,
         0x8000000000008080, 0x0000000080000001, 0x8000000080008008
 };
-static const int sha3_keccakf_rotc[24] = {
-        1,  3,  6,  10, 15, 21, 28, 36, 45, 55, 2,  14,
-        27, 41, 56, 8,  25, 43, 62, 18, 39, 61, 20, 44
-};
-static const int sha3_keccakf_piln[24] = {
-        10, 7,  11, 17, 18, 3, 5,  16, 8,  21, 24, 4,
-        15, 23, 19, 13, 12, 2, 20, 14, 22, 9,  6,  1
-};
 
 static void
 sha3_keccakf(uint64_t st[25])
 {
-        uint64_t t0, t1, bc[5];
-        int i, j, r;
+        uint64_t bc0, bc1, bc2, bc3, bc4;
+        uint64_t d0, d1, d2, d3, d4;
+        int i, r;
 
         for (i = 0; i < 25; i++)
                 st[i] = le64toh(st[i]);
 
-        for (r = 0; r < KECCAKF_ROUNDS; r++) {
+        /*
+         * Optimized Keccak algorithm from
+         * KeccakReferenceAndOptimized/Sources/Keccak-inplace.c contained in
+         * https://keccak.team/obsolete/KeccakReferenceAndOptimized-3.2.zip
+         */
 
-                /* Theta */
-                for (i = 0; i < 5; i++)
-                        bc[i] = st[i] ^ st[i + 5] ^ st[i + 10] ^ st[i + 15] ^ st[i + 20];
+        for (r = 0; r < KECCAKF_ROUNDS; r += 4) {
+                /*
+                 * Round 1
+                 */
+                bc0 = st[0] ^ st[5] ^ st[10] ^ st[15] ^ st[20];
+                bc1 = st[1] ^ st[6] ^ st[11] ^ st[16] ^ st[21];
+                bc2 = st[2] ^ st[7] ^ st[12] ^ st[17] ^ st[22];
+                bc3 = st[3] ^ st[8] ^ st[13] ^ st[18] ^ st[23];
+                bc4 = st[4] ^ st[9] ^ st[14] ^ st[19] ^ st[24];
+                d0 = bc4 ^ crypto_rol_u64(bc1, 1);
+                d1 = bc0 ^ crypto_rol_u64(bc2, 1);
+                d2 = bc1 ^ crypto_rol_u64(bc3, 1);
+                d3 = bc2 ^ crypto_rol_u64(bc4, 1);
+                d4 = bc3 ^ crypto_rol_u64(bc0, 1);
 
-                for (i = 0; i < 5; i++) {
-                        t0 = bc[(i + 4) % 5] ^ crypto_rol_u64(bc[(i + 1) % 5], 1);
-                        for (j = 0; j < 25; j += 5)
-                                st[j + i] ^= t0;
-                }
+                bc0 = st[0] ^ d0;
+                bc1 = crypto_rol_u64(st[6] ^ d1, 44);
+                bc2 = crypto_rol_u64(st[12] ^ d2, 43);
+                bc3 = crypto_rol_u64(st[18] ^ d3, 21);
+                bc4 = crypto_rol_u64(st[24] ^ d4, 14);
+                st[0] = bc0 ^ (~bc1 & bc2) ^ sha3_keccakf_rndc[r + 0];
+                st[6] = bc1 ^ (~bc2 & bc3);
+                st[12] = bc2 ^ (~bc3 & bc4);
+                st[18] = bc3 ^ (~bc4 & bc0);
+                st[24] = bc4 ^ (~bc0 & bc1);
 
-                /* Rho Pi */
-                t0 = st[1];
-                for (i = 0; i < 24; i++) {
-                        j = sha3_keccakf_piln[i];
-                        t1 = st[j];
-                        st[j] = crypto_rol_u64(t0, sha3_keccakf_rotc[i]);
-                        t0 = t1;
-                }
+                bc2 = crypto_rol_u64(st[10] ^ d0, 3);
+                bc3 = crypto_rol_u64(st[16] ^ d1, 45);
+                bc4 = crypto_rol_u64(st[22] ^ d2, 61);
+                bc0 = crypto_rol_u64(st[3] ^ d3, 28);
+                bc1 = crypto_rol_u64(st[9] ^ d4, 20);
+                st[10] = bc0 ^ (~bc1 & bc2);
+                st[16] = bc1 ^ (~bc2 & bc3);
+                st[22] = bc2 ^ (~bc3 & bc4);
+                st[3] = bc3 ^ (~bc4 & bc0);
+                st[9] = bc4 ^ (~bc0 & bc1);
 
-                /* Chi */
-                for (j = 0; j < 25; j += 5) {
-                        for (i = 0; i < 5; i++)
-                                bc[i] = st[j + i];
-                        for (i = 0; i < 5; i++)
-                                st[j + i] ^= (~bc[(i + 1) % 5]) & bc[(i + 2) % 5];
-                }
+                bc4 = crypto_rol_u64(st[20] ^ d0, 18);
+                bc0 = crypto_rol_u64(st[1] ^ d1, 1);
+                bc1 = crypto_rol_u64(st[7] ^ d2, 6);
+                bc2 = crypto_rol_u64(st[13] ^ d3, 25);
+                bc3 = crypto_rol_u64(st[19] ^ d4, 8);
+                st[20] = bc0 ^ (~bc1 & bc2);
+                st[1] = bc1 ^ (~bc2 & bc3);
+                st[7] = bc2 ^ (~bc3 & bc4);
+                st[13] = bc3 ^ (~bc4 & bc0);
+                st[19] = bc4 ^ (~bc0 & bc1);
+
+                bc1 = crypto_rol_u64(st[5] ^ d0, 36);
+                bc2 = crypto_rol_u64(st[11] ^ d1, 10);
+                bc3 = crypto_rol_u64(st[17] ^ d2, 15);
+                bc4 = crypto_rol_u64(st[23] ^ d3, 56);
+                bc0 = crypto_rol_u64(st[4] ^ d4, 27);
+                st[5] = bc0 ^ (~bc1 & bc2);
+                st[11] = bc1 ^ (~bc2 & bc3);
+                st[17] = bc2 ^ (~bc3 & bc4);
+                st[23] = bc3 ^ (~bc4 & bc0);
+                st[4] = bc4 ^ (~bc0 & bc1);
+
+                bc3 = crypto_rol_u64(st[15] ^ d0, 41);
+                bc4 = crypto_rol_u64(st[21] ^ d1, 2);
+                bc0 = crypto_rol_u64(st[2] ^ d2, 62);
+                bc1 = crypto_rol_u64(st[8] ^ d3, 55);
+                bc2 = crypto_rol_u64(st[14] ^ d4, 39);
+                st[15] = bc0 ^ (~bc1 & bc2);
+                st[21] = bc1 ^ (~bc2 & bc3);
+                st[2] = bc2 ^ (~bc3 & bc4);
+                st[8] = bc3 ^ (~bc4 & bc0);
+                st[14] = bc4 ^ (~bc0 & bc1);
+
+                /*
+                 * Round 2
+                 */
+                bc0 = st[0] ^ st[5] ^ st[10] ^ st[15] ^ st[20];
+                bc1 = st[1] ^ st[6] ^ st[11] ^ st[16] ^ st[21];
+                bc2 = st[2] ^ st[7] ^ st[12] ^ st[17] ^ st[22];
+                bc3 = st[3] ^ st[8] ^ st[13] ^ st[18] ^ st[23];
+                bc4 = st[4] ^ st[9] ^ st[14] ^ st[19] ^ st[24];
+                d0 = bc4 ^ crypto_rol_u64(bc1, 1);
+                d1 = bc0 ^ crypto_rol_u64(bc2, 1);
+                d2 = bc1 ^ crypto_rol_u64(bc3, 1);
+                d3 = bc2 ^ crypto_rol_u64(bc4, 1);
+                d4 = bc3 ^ crypto_rol_u64(bc0, 1);
+
+                bc0 = st[0] ^ d0;
+                bc1 = crypto_rol_u64(st[16] ^ d1, 44);
+                bc2 = crypto_rol_u64(st[7] ^ d2, 43);
+                bc3 = crypto_rol_u64(st[23] ^ d3, 21);
+                bc4 = crypto_rol_u64(st[14] ^ d4, 14);
+                st[0] = bc0 ^ (~bc1 & bc2) ^ sha3_keccakf_rndc[r + 1];
+                st[16] = bc1 ^ (~bc2 & bc3);
+                st[7] = bc2 ^ (~bc3 & bc4);
+                st[23] = bc3 ^ (~bc4 & bc0);
+                st[14] = bc4 ^ (~bc0 & bc1);
+
+                bc2 = crypto_rol_u64(st[20] ^ d0, 3);
+                bc3 = crypto_rol_u64(st[11] ^ d1, 45);
+                bc4 = crypto_rol_u64(st[2] ^ d2, 61);
+                bc0 = crypto_rol_u64(st[18] ^ d3, 28);
+                bc1 = crypto_rol_u64(st[9] ^ d4, 20);
+                st[20] = bc0 ^ (~bc1 & bc2);
+                st[11] = bc1 ^ (~bc2 & bc3);
+                st[2] = bc2 ^ (~bc3 & bc4);
+                st[18] = bc3 ^ (~bc4 & bc0);
+                st[9] = bc4 ^ (~bc0 & bc1);
+
+                bc4 = crypto_rol_u64(st[15] ^ d0, 18);
+                bc0 = crypto_rol_u64(st[6] ^ d1, 1);
+                bc1 = crypto_rol_u64(st[22] ^ d2, 6);
+                bc2 = crypto_rol_u64(st[13] ^ d3, 25);
+                bc3 = crypto_rol_u64(st[4] ^ d4, 8);
+                st[15] = bc0 ^ (~bc1 & bc2);
+                st[6] = bc1 ^ (~bc2 & bc3);
+                st[22] = bc2 ^ (~bc3 & bc4);
+                st[13] = bc3 ^ (~bc4 & bc0);
+                st[4] = bc4 ^ (~bc0 & bc1);
+
+                bc1 = crypto_rol_u64(st[10] ^ d0, 36);
+                bc2 = crypto_rol_u64(st[1] ^ d1, 10);
+                bc3 = crypto_rol_u64(st[17] ^ d2, 15);
+                bc4 = crypto_rol_u64(st[8] ^ d3, 56);
+                bc0 = crypto_rol_u64(st[24] ^ d4, 27);
+                st[10] = bc0 ^ (~bc1 & bc2);
+                st[1] = bc1 ^ (~bc2 & bc3);
+                st[17] = bc2 ^ (~bc3 & bc4);
+                st[8] = bc3 ^ (~bc4 & bc0);
+                st[24] = bc4 ^ (~bc0 & bc1);
+
+                bc3 = crypto_rol_u64(st[5] ^ d0, 41);
+                bc4 = crypto_rol_u64(st[21] ^ d1, 2);
+                bc0 = crypto_rol_u64(st[12] ^ d2, 62);
+                bc1 = crypto_rol_u64(st[3] ^ d3, 55);
+                bc2 = crypto_rol_u64(st[19] ^ d4, 39);
+                st[5] = bc0 ^ (~bc1 & bc2);
+                st[21] = bc1 ^ (~bc2 & bc3);
+                st[12] = bc2 ^ (~bc3 & bc4);
+                st[3] = bc3 ^ (~bc4 & bc0);
+                st[19] = bc4 ^ (~bc0 & bc1);
+
+                /*
+                 * Round 3
+                 */
+                bc0 = st[0] ^ st[5] ^ st[10] ^ st[15] ^ st[20];
+                bc1 = st[1] ^ st[6] ^ st[11] ^ st[16] ^ st[21];
+                bc2 = st[2] ^ st[7] ^ st[12] ^ st[17] ^ st[22];
+                bc3 = st[3] ^ st[8] ^ st[13] ^ st[18] ^ st[23];
+                bc4 = st[4] ^ st[9] ^ st[14] ^ st[19] ^ st[24];
+                d0 = bc4 ^ crypto_rol_u64(bc1, 1);
+                d1 = bc0 ^ crypto_rol_u64(bc2, 1);
+                d2 = bc1 ^ crypto_rol_u64(bc3, 1);
+                d3 = bc2 ^ crypto_rol_u64(bc4, 1);
+                d4 = bc3 ^ crypto_rol_u64(bc0, 1);
+
+                bc0 = st[0] ^ d0;
+                bc1 = crypto_rol_u64(st[11] ^ d1, 44);
+                bc2 = crypto_rol_u64(st[22] ^ d2, 43);
+                bc3 = crypto_rol_u64(st[8] ^ d3, 21);
+                bc4 = crypto_rol_u64(st[19] ^ d4, 14);
+                st[0] = bc0 ^ (~bc1 & bc2) ^ sha3_keccakf_rndc[r + 2];
+                st[11] = bc1 ^ (~bc2 & bc3);
+                st[22] = bc2 ^ (~bc3 & bc4);
+                st[8] = bc3 ^ (~bc4 & bc0);
+                st[19] = bc4 ^ (~bc0 & bc1);
+
+                bc2 = crypto_rol_u64(st[15] ^ d0, 3);
+                bc3 = crypto_rol_u64(st[1] ^ d1, 45);
+                bc4 = crypto_rol_u64(st[12] ^ d2, 61);
+                bc0 = crypto_rol_u64(st[23] ^ d3, 28);
+                bc1 = crypto_rol_u64(st[9] ^ d4, 20);
+                st[15] = bc0 ^ (~bc1 & bc2);
+                st[1] = bc1 ^ (~bc2 & bc3);
+                st[12] = bc2 ^ (~bc3 & bc4);
+                st[23] = bc3 ^ (~bc4 & bc0);
+                st[9] = bc4 ^ (~bc0 & bc1);
+
+                bc4 = crypto_rol_u64(st[5] ^ d0, 18);
+                bc0 = crypto_rol_u64(st[16] ^ d1, 1);
+                bc1 = crypto_rol_u64(st[2] ^ d2, 6);
+                bc2 = crypto_rol_u64(st[13] ^ d3, 25);
+                bc3 = crypto_rol_u64(st[24] ^ d4, 8);
+                st[5] = bc0 ^ (~bc1 & bc2);
+                st[16] = bc1 ^ (~bc2 & bc3);
+                st[2] = bc2 ^ (~bc3 & bc4);
+                st[13] = bc3 ^ (~bc4 & bc0);
+                st[24] = bc4 ^ (~bc0 & bc1);
+
+                bc1 = crypto_rol_u64(st[20] ^ d0, 36);
+                bc2 = crypto_rol_u64(st[6] ^ d1, 10);
+                bc3 = crypto_rol_u64(st[17] ^ d2, 15);
+                bc4 = crypto_rol_u64(st[3] ^ d3, 56);
+                bc0 = crypto_rol_u64(st[14] ^ d4, 27);
+                st[20] = bc0 ^ (~bc1 & bc2);
+                st[6] = bc1 ^ (~bc2 & bc3);
+                st[17] = bc2 ^ (~bc3 & bc4);
+                st[3] = bc3 ^ (~bc4 & bc0);
+                st[14] = bc4 ^ (~bc0 & bc1);
+
+                bc3 = crypto_rol_u64(st[10] ^ d0, 41);
+                bc4 = crypto_rol_u64(st[21] ^ d1, 2);
+                bc0 = crypto_rol_u64(st[7] ^ d2, 62);
+                bc1 = crypto_rol_u64(st[18] ^ d3, 55);
+                bc2 = crypto_rol_u64(st[4] ^ d4, 39);
+                st[10] = bc0 ^ (~bc1 & bc2);
+                st[21] = bc1 ^ (~bc2 & bc3);
+                st[7] = bc2 ^ (~bc3 & bc4);
+                st[18] = bc3 ^ (~bc4 & bc0);
+                st[4] = bc4 ^ (~bc0 & bc1);
+
+                /*
+                 * Round 4
+                 */
+                bc0 = st[0] ^ st[5] ^ st[10] ^ st[15] ^ st[20];
+                bc1 = st[1] ^ st[6] ^ st[11] ^ st[16] ^ st[21];
+                bc2 = st[2] ^ st[7] ^ st[12] ^ st[17] ^ st[22];
+                bc3 = st[3] ^ st[8] ^ st[13] ^ st[18] ^ st[23];
+                bc4 = st[4] ^ st[9] ^ st[14] ^ st[19] ^ st[24];
+                d0 = bc4 ^ crypto_rol_u64(bc1, 1);
+                d1 = bc0 ^ crypto_rol_u64(bc2, 1);
+                d2 = bc1 ^ crypto_rol_u64(bc3, 1);
+                d3 = bc2 ^ crypto_rol_u64(bc4, 1);
+                d4 = bc3 ^ crypto_rol_u64(bc0, 1);
+
+                bc0 = st[0] ^ d0;
+                bc1 = crypto_rol_u64(st[1] ^ d1, 44);
+                bc2 = crypto_rol_u64(st[2] ^ d2, 43);
+                bc3 = crypto_rol_u64(st[3] ^ d3, 21);
+                bc4 = crypto_rol_u64(st[4] ^ d4, 14);
+                st[0] = bc0 ^ (~bc1 & bc2) ^ sha3_keccakf_rndc[r + 3];
+                st[1] = bc1 ^ (~bc2 & bc3);
+                st[2] = bc2 ^ (~bc3 & bc4);
+                st[3] = bc3 ^ (~bc4 & bc0);
+                st[4] = bc4 ^ (~bc0 & bc1);
+
+                bc2 = crypto_rol_u64(st[5] ^ d0, 3);
+                bc3 = crypto_rol_u64(st[6] ^ d1, 45);
+                bc4 = crypto_rol_u64(st[7] ^ d2, 61);
+                bc0 = crypto_rol_u64(st[8] ^ d3, 28);
+                bc1 = crypto_rol_u64(st[9] ^ d4, 20);
+                st[5] = bc0 ^ (~bc1 & bc2);
+                st[6] = bc1 ^ (~bc2 & bc3);
+                st[7] = bc2 ^ (~bc3 & bc4);
+                st[8] = bc3 ^ (~bc4 & bc0);
+                st[9] = bc4 ^ (~bc0 & bc1);
+
+                bc4 = crypto_rol_u64(st[10] ^ d0, 18);
+                bc0 = crypto_rol_u64(st[11] ^ d1, 1);
+                bc1 = crypto_rol_u64(st[12] ^ d2, 6);
+                bc2 = crypto_rol_u64(st[13] ^ d3, 25);
+                bc3 = crypto_rol_u64(st[14] ^ d4, 8);
+                st[10] = bc0 ^ (~bc1 & bc2);
+                st[11] = bc1 ^ (~bc2 & bc3);
+                st[12] = bc2 ^ (~bc3 & bc4);
+                st[13] = bc3 ^ (~bc4 & bc0);
+                st[14] = bc4 ^ (~bc0 & bc1);
+
+                bc1 = crypto_rol_u64(st[15] ^ d0, 36);
+                bc2 = crypto_rol_u64(st[16] ^ d1, 10);
+                bc3 = crypto_rol_u64(st[17] ^ d2, 15);
+                bc4 = crypto_rol_u64(st[18] ^ d3, 56);
+                bc0 = crypto_rol_u64(st[19] ^ d4, 27);
+                st[15] = bc0 ^ (~bc1 & bc2);
+                st[16] = bc1 ^ (~bc2 & bc3);
+                st[17] = bc2 ^ (~bc3 & bc4);
+                st[18] = bc3 ^ (~bc4 & bc0);
+                st[19] = bc4 ^ (~bc0 & bc1);
 
-                /* Iota */
-                st[0] ^= sha3_keccakf_rndc[r];
+                bc3 = crypto_rol_u64(st[20] ^ d0, 41);
+                bc4 = crypto_rol_u64(st[21] ^ d1, 2);
+                bc0 = crypto_rol_u64(st[22] ^ d2, 62);
+                bc1 = crypto_rol_u64(st[23] ^ d3, 55);
+                bc2 = crypto_rol_u64(st[24] ^ d4, 39);
+                st[20] = bc0 ^ (~bc1 & bc2);
+                st[21] = bc1 ^ (~bc2 & bc3);
+                st[22] = bc2 ^ (~bc3 & bc4);
+                st[23] = bc3 ^ (~bc4 & bc0);
+                st[24] = bc4 ^ (~bc0 & bc1);
         }
 
         for (i = 0; i < 25; i++)
diff --git a/src/lib/libcrypto/sha/sha512_aarch64_ce.S b/src/lib/libcrypto/sha/sha512_aarch64_ce.S
index 6efe775ff5..8c88696e4a 100644
--- a/src/lib/libcrypto/sha/sha512_aarch64_ce.S
+++ b/src/lib/libcrypto/sha/sha512_aarch64_ce.S
@@ -1,4 +1,4 @@
-/* $OpenBSD: sha512_aarch64_ce.S,v 1.4 2026/01/25 08:22:17 jsing Exp $ */
+/* $OpenBSD: sha512_aarch64_ce.S,v 1.9 2026/05/12 15:07:30 jsing Exp $ */
 /*
  * Copyright (c) 2023,2025 Joel Sing <jsing@openbsd.org>
  *
@@ -15,6 +15,10 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
+#include "crypto_assembly.h"
+
+#define _SEP    CRYPTO_ASSEMBLY_SEPARATOR
+
 /*
  * SHA-512 implementation using the ARM Cryptographic Extension (CE).
  *
@@ -103,9 +107,9 @@
  *   W0 = sigma1(W14) + W9 + sigma0(W1) + W0
  */
 #define sha512_message_schedule_update(m0, m1, m4, m5, m7) \
-        sha512su0 m0.2d, m1.2d;                 /* W0 += sigma0(W1) */  \
-        ext     tmp2.16b, m4.16b, m5.16b, #8;   /* W9:W10 */            \
-        sha512su1 m0.2d, m7.2d, tmp2.2d;        /* W0 += sigma1(W14) + W9 */
+        sha512su0 m0.2d, m1.2d                  /* W0 += sigma0(W1) */  _SEP \
+        ext     tmp2.16b, m4.16b, m5.16b, #8    /* W9:W10 */            _SEP \
+        sha512su1 m0.2d, m7.2d, tmp2.2d         /* W0 += sigma1(W14) + W9 */
 
 /*
  * Compute two SHA-512 rounds by adding W0:W1 + K0:K1, then computing T1 for two
@@ -142,33 +146,32 @@
  * These values are then rotated by the caller to perform the next two rounds.
  */
 #define sha512_round(h0, h1, h2, h3, h4, h5, w, k) \
-        add     h4.2d, w.2d, k.2d;                      /* W0:W1 += K0:K1 */    \
-        ext     h4.16b, h4.16b, h4.16b, #8;             /* W1:W0 (swap) */      \
-        add     h4.2d, h4.2d, h3.2d;                    /* W1:W0 += g:h */      \
-        ext     tmp0.16b, h2.16b, h3.16b, #8;           /* f:g */               \
-        ext     tmp1.16b, h1.16b, h2.16b, #8;           /* d:e */               \
-        sha512h h4##q, tmp0##q, tmp1.2d;                /* T1 */                \
-        add     h5.2d, h1.2d, h4.2d;                    /* c:d + T1 */          \
-        sha512h2 h4##q, h1##q, h0.2d;                   /* T1 + T2 */
+        add     h4.2d, w.2d, k.2d                       /* W0:W1 += K0:K1 */    _SEP \
+        ext     h4.16b, h4.16b, h4.16b, #8              /* W1:W0 (swap) */      _SEP \
+        add     h4.2d, h4.2d, h3.2d                     /* W1:W0 += g:h */      _SEP \
+        ext     tmp0.16b, h2.16b, h3.16b, #8            /* f:g */               _SEP \
+        ext     tmp1.16b, h1.16b, h2.16b, #8            /* d:e */               _SEP \
+        sha512h h4##q, tmp0##q, tmp1.2d                 /* T1 */                _SEP \
+        add     h5.2d, h1.2d, h4.2d                     /* c:d + T1 */          _SEP \
+        sha512h2 h4##q, h1##q, h0.2d                    /* T1 + T2 */
 
 #define sha512_round_initial(h0, h1, h2, h3, h4, h5, w, k) \
         sha512_round(h0, h1, h2, h3, h4, h5, w, k)
 
 #define sha512_round_update(h0, h1, h2, h3, h4, h5, m0, m1, m2, m3, m4, k) \
-        sha512_message_schedule_update(m0, m1, m2, m3, m4) \
+        sha512_message_schedule_update(m0, m1, m2, m3, m4)                      _SEP \
         sha512_round(h0, h1, h2, h3, h4, h5, m0, k)
 
 .arch   armv8-a+sha3
 
-.section .text
+.section CRYPTO_ASSEMBLY_SECTION_TEXT
 
 /*
  * void sha512_block_ce(SHA512_CTX *ctx, const void *in, size_t num);
  *
  * Standard ARM ABI: x0 = ctx, x1 = in, x2 = num
  */
-.globl  sha512_block_ce
-sha512_block_ce:
+CRYPTO_ASSEMBLY_GLOBAL_FUNCTION(sha512_block_ce):
 
         /* Save low 64 bits of v8 through v15 to the stack. */
         sub     sp, sp, #32
@@ -177,8 +180,8 @@ sha512_block_ce:
         st4     {v12.d, v13.d, v14.d, v15.d}[0], [sp]
 
         /* Address of SHA-512 constants. */
-        adrp    k512_base, K512
-        add     k512_base, k512_base, :lo12:K512
+        adrp    k512_base, CRYPTO_ASSEMBLY_AARCH64_SYM_HI(K512)
+        add     k512_base, k512_base, CRYPTO_ASSEMBLY_AARCH64_SYM_LO(K512)
 
         /*
          * Load current hash state from context.
@@ -291,14 +294,13 @@ sha512_block_ce:
 
         ret
 
-.section .rodata
+.section CRYPTO_ASSEMBLY_SECTION_RODATA
 
 /*
  * SHA-512 constants - see FIPS 180-4 section 4.2.3.
  */
 .align  4
-.type   K512,@object
-K512:
+CRYPTO_ASSEMBLY_OBJECT_START(K512):
 .quad   0x428a2f98d728ae22, 0x7137449123ef65cd, 0xb5c0fbcfec4d3b2f, 0xe9b5dba58189dbbc
 .quad   0x3956c25bf348b538, 0x59f111f1b605d019, 0x923f82a4af194f9b, 0xab1c5ed5da6d8118
 .quad   0xd807aa98a3030242, 0x12835b0145706fbe, 0x243185be4ee4b28c, 0x550c7dc3d5ffb4e2
@@ -319,4 +321,8 @@ K512:
 .quad   0x06f067aa72176fba, 0x0a637dc5a2c898a6, 0x113f9804bef90dae, 0x1b710b35131c471b
 .quad   0x28db77f523047d84, 0x32caab7b40c72493, 0x3c9ebe0a15c9bebc, 0x431d67c49c100d4c
 .quad   0x4cc5d4becb3e42b6, 0x597f299cfc657e2a, 0x5fcb6fab3ad6faec, 0x6c44198c4a475817
-.size   K512,.-K512
+CRYPTO_ASSEMBLY_OBJECT_END(K512)
+
+#if defined(__linux__) && defined(__ELF__)
+.section .note.GNU-stack,"",%progbits
+#endif
diff --git a/src/lib/libcrypto/sha/sha512_amd64_generic.S b/src/lib/libcrypto/sha/sha512_amd64_generic.S
index de759875f4..2e862df5ef 100644
--- a/src/lib/libcrypto/sha/sha512_amd64_generic.S
+++ b/src/lib/libcrypto/sha/sha512_amd64_generic.S
@@ -1,4 +1,4 @@
-/* $OpenBSD: sha512_amd64_generic.S,v 1.4 2026/03/28 13:11:28 jsing Exp $ */
+/* $OpenBSD: sha512_amd64_generic.S,v 1.8 2026/05/12 15:07:30 jsing Exp $ */
 /*
  * Copyright (c) 2024 Joel Sing <jsing@openbsd.org>
  *
@@ -17,6 +17,8 @@
 
 #include "crypto_assembly.h"
 
+#define _SEP    CRYPTO_ASSEMBLY_SEPARATOR
+
 #define ctx             %rdi
 #define in              %rsi
 #define num             %rdx
@@ -45,8 +47,8 @@
  *  Wt = Mt
  */
 #define sha512_message_schedule_load(idx, m, w, wt) \
-        movq    (m, round, 8), wt;                              \
-        bswapq  wt;                                             \
+        movq    (m, round, 8), wt                               _SEP \
+        bswapq  wt                                              _SEP \
         movq    wt, ((idx&0xf)*8)(w)
 
 /*
@@ -59,25 +61,25 @@
  *
  */
 #define sha512_message_schedule_update(idx, w, wt) \
-        movq    (((idx-2)&0xf)*8)(w), wt;       /* sigma1 */    \
-        movq    wt, tmp1;                       /* sigma1 */    \
-        rorq    $(61-19), tmp1;                 /* sigma1 */    \
-        xorq    wt, tmp1;                       /* sigma1 */    \
-        rorq    $19, tmp1;                      /* sigma1 */    \
-        shrq    $6, wt;                         /* sigma1 */    \
-        xorq    tmp1, wt;                       /* sigma1 */    \
+        movq    (((idx-2)&0xf)*8)(w), wt        /* sigma1 */    _SEP \
+        movq    wt, tmp1                        /* sigma1 */    _SEP \
+        rorq    $(61-19), tmp1                  /* sigma1 */    _SEP \
+        xorq    wt, tmp1                        /* sigma1 */    _SEP \
+        rorq    $19, tmp1                       /* sigma1 */    _SEP \
+        shrq    $6, wt                          /* sigma1 */    _SEP \
+        xorq    tmp1, wt                        /* sigma1 */    _SEP \
         \
-        addq    (((idx-7)&0xf)*8)(w), wt;       /* Wt-7 */      \
-        addq    (((idx-16)&0xf)*8)(w), wt;      /* Wt-16 */     \
+        addq    (((idx-7)&0xf)*8)(w), wt        /* Wt-7 */      _SEP \
+        addq    (((idx-16)&0xf)*8)(w), wt       /* Wt-16 */     _SEP \
         \
-        movq    (((idx-15)&0xf)*8)(w), tmp2;    /* sigma0 */    \
-        movq    tmp2, tmp3;                     /* sigma0 */    \
-        rorq    $(8-1), tmp2;                   /* sigma0 */    \
-        xorq    tmp3, tmp2;                     /* sigma0 */    \
-        rorq    $1, tmp2;                       /* sigma0 */    \
-        shrq    $7, tmp3;                       /* sigma0 */    \
-        xorq    tmp3, tmp2;                     /* sigma0 */    \
-        addq    tmp2, wt;                       /* sigma0 */    \
+        movq    (((idx-15)&0xf)*8)(w), tmp2     /* sigma0 */    _SEP \
+        movq    tmp2, tmp3                      /* sigma0 */    _SEP \
+        rorq    $(8-1), tmp2                    /* sigma0 */    _SEP \
+        xorq    tmp3, tmp2                      /* sigma0 */    _SEP \
+        rorq    $1, tmp2                        /* sigma0 */    _SEP \
+        shrq    $7, tmp3                        /* sigma0 */    _SEP \
+        xorq    tmp3, tmp2                      /* sigma0 */    _SEP \
+        addq    tmp2, wt                        /* sigma0 */    _SEP \
         \
         movq    wt, ((idx&0xf)*8)(w)
 
@@ -95,52 +97,52 @@
  * Upon completion d = d + T1, h = T1 + T2, pending rotation.
  */
 #define sha512_round(idx, a, b, c, d, e, f, g, h, k, w, wt) \
-        addq    wt, h;                          /* T1 Wt */     \
-        addq    (k512, round, 8), h;            /* T1 Kt */     \
+        addq    wt, h                           /* T1 Wt */     _SEP \
+        addq    (k512, round, 8), h             /* T1 Kt */     _SEP \
         \
-        movq    e, tmp1;                        /* T1 Sigma1 */ \
-        rorq    $(41-18), tmp1;                 /* T1 Sigma1 */ \
-        xorq    e, tmp1;                        /* T1 Sigma1 */ \
-        rorq    $(18-14), tmp1;                 /* T1 Sigma1 */ \
-        xorq    e, tmp1;                        /* T1 Sigma1 */ \
-        rorq    $14, tmp1;                      /* T1 Sigma1 */ \
-        addq    tmp1, h;                        /* T1 Sigma1 */ \
+        movq    e, tmp1                         /* T1 Sigma1 */ _SEP \
+        rorq    $(41-18), tmp1                  /* T1 Sigma1 */ _SEP \
+        xorq    e, tmp1                         /* T1 Sigma1 */ _SEP \
+        rorq    $(18-14), tmp1                  /* T1 Sigma1 */ _SEP \
+        xorq    e, tmp1                         /* T1 Sigma1 */ _SEP \
+        rorq    $14, tmp1                       /* T1 Sigma1 */ _SEP \
+        addq    tmp1, h                         /* T1 Sigma1 */ _SEP \
         \
-        movq    f, tmp2;                        /* T1 Ch */     \
-        xorq    g, tmp2;                        /* T1 Ch */     \
-        andq    e, tmp2;                        /* T1 Ch */     \
-        xorq    g, tmp2;                        /* T1 Ch */     \
-        addq    tmp2, h;                        /* T1 Ch */     \
+        movq    f, tmp2                         /* T1 Ch */     _SEP \
+        xorq    g, tmp2                         /* T1 Ch */     _SEP \
+        andq    e, tmp2                         /* T1 Ch */     _SEP \
+        xorq    g, tmp2                         /* T1 Ch */     _SEP \
+        addq    tmp2, h                         /* T1 Ch */     _SEP \
         \
-        addq    h, d;                           /* d += T1 */   \
+        addq    h, d                            /* d += T1 */   _SEP \
         \
-        movq    a, tmp1;                        /* T2 Sigma0 */ \
-        rorq    $(39-34), tmp1;                 /* T2 Sigma0 */ \
-        xorq    a, tmp1;                        /* T2 Sigma0 */ \
-        rorq    $(34-28), tmp1;                 /* T2 Sigma0 */ \
-        xorq    a, tmp1;                        /* T2 Sigma0 */ \
-        rorq    $28, tmp1;                      /* T2 Sigma0 */ \
-        addq    tmp1, h;                        /* T2 Sigma0 */ \
+        movq    a, tmp1                         /* T2 Sigma0 */ _SEP \
+        rorq    $(39-34), tmp1                  /* T2 Sigma0 */ _SEP \
+        xorq    a, tmp1                         /* T2 Sigma0 */ _SEP \
+        rorq    $(34-28), tmp1                  /* T2 Sigma0 */ _SEP \
+        xorq    a, tmp1                         /* T2 Sigma0 */ _SEP \
+        rorq    $28, tmp1                       /* T2 Sigma0 */ _SEP \
+        addq    tmp1, h                         /* T2 Sigma0 */ _SEP \
         \
-        movq    b, tmp2;                        /* T2 Maj */    \
-        xorq    c, tmp2;                        /* T2 Maj */    \
-        andq    a, tmp2;                        /* T2 Maj */    \
-        movq    b, tmp3;                        /* T2 Maj */    \
-        andq    c, tmp3;                        /* T2 Maj */    \
-        xorq    tmp2, tmp3;                     /* T2 Maj */    \
-        addq    tmp3, h;                        /* T2 Maj */    \
+        movq    b, tmp2                         /* T2 Maj */    _SEP \
+        xorq    c, tmp2                         /* T2 Maj */    _SEP \
+        andq    a, tmp2                         /* T2 Maj */    _SEP \
+        movq    b, tmp3                         /* T2 Maj */    _SEP \
+        andq    c, tmp3                         /* T2 Maj */    _SEP \
+        xorq    tmp2, tmp3                      /* T2 Maj */    _SEP \
+        addq    tmp3, h                         /* T2 Maj */    _SEP \
         \
         addq    $1, round
 
 #define sha512_round_load(idx, a, b, c, d, e, f, g, h) \
-        sha512_message_schedule_load(idx, in, %rsp, tmp0); \
+        sha512_message_schedule_load(idx, in, %rsp, tmp0)       _SEP \
         sha512_round(idx, a, b, c, d, e, f, g, h, k512, %rsp, tmp0)
 
 #define sha512_round_update(idx, a, b, c, d, e, f, g, h) \
-        sha512_message_schedule_update(idx, %rsp, tmp0); \
+        sha512_message_schedule_update(idx, %rsp, tmp0)         _SEP \
         sha512_round(idx, a, b, c, d, e, f, g, h, k512, %rsp, tmp0)
 
-.section .text
+.section CRYPTO_ASSEMBLY_SECTION_TEXT
 
 /*
  * void sha512_block_generic(SHA512_CTX *ctx, const void *in, size_t num);
@@ -148,9 +150,7 @@
  * Standard x86-64 ABI: rdi = ctx, rsi = in, rdx = num
  */
 .align 16
-.globl  sha512_block_generic
-.type   sha512_block_generic,@function
-sha512_block_generic:
+CRYPTO_ASSEMBLY_GLOBAL_FUNCTION(sha512_block_generic):
         _CET_ENDBR
 
         /* Save callee save registers. */
@@ -273,14 +273,13 @@ sha512_block_generic:
 
         ret
 
-.section .rodata
+.section CRYPTO_ASSEMBLY_SECTION_RODATA
 
 /*
  * SHA-512 constants - see FIPS 180-4 section 4.2.3.
  */
 .align  64
-.type   K512,@object
-K512:
+CRYPTO_ASSEMBLY_OBJECT_START(K512):
 .quad   0x428a2f98d728ae22, 0x7137449123ef65cd, 0xb5c0fbcfec4d3b2f, 0xe9b5dba58189dbbc
 .quad   0x3956c25bf348b538, 0x59f111f1b605d019, 0x923f82a4af194f9b, 0xab1c5ed5da6d8118
 .quad   0xd807aa98a3030242, 0x12835b0145706fbe, 0x243185be4ee4b28c, 0x550c7dc3d5ffb4e2
@@ -301,4 +300,8 @@ K512:
 .quad   0x06f067aa72176fba, 0x0a637dc5a2c898a6, 0x113f9804bef90dae, 0x1b710b35131c471b
 .quad   0x28db77f523047d84, 0x32caab7b40c72493, 0x3c9ebe0a15c9bebc, 0x431d67c49c100d4c
 .quad   0x4cc5d4becb3e42b6, 0x597f299cfc657e2a, 0x5fcb6fab3ad6faec, 0x6c44198c4a475817
-.size   K512,.-K512
+CRYPTO_ASSEMBLY_OBJECT_END(K512)
+
+#if defined(__linux__) && defined(__ELF__)
+.section .note.GNU-stack,"",%progbits
+#endif
diff --git a/src/lib/libcrypto/ui/ui_lib.c b/src/lib/libcrypto/ui/ui_lib.c
index cc9de59c19..4562464cc7 100644
--- a/src/lib/libcrypto/ui/ui_lib.c
+++ b/src/lib/libcrypto/ui/ui_lib.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ui_lib.c,v 1.52 2025/05/10 05:54:39 tb Exp $ */
+/* $OpenBSD: ui_lib.c,v 1.55 2026/07/25 07:33:43 tb Exp $ */
 /* Written by Richard Levitte (richard@levitte.org) for the OpenSSL
  * project 2001.
  */
@@ -68,6 +68,39 @@
 
 static const UI_METHOD *default_UI_meth = NULL;
 
+struct ui_string_st {
+        enum UI_string_types type; /* Input */
+        const char *out_string; /* Input */
+        int input_flags;        /* Flags from the user */
+
+        /* The following parameters are completely irrelevant for UIT_INFO,
+           and can therefore be set to 0 or NULL */
+        char *result_buf;       /* Input and Output: If not NULL, user-defined
+                                   with size in result_maxsize.  Otherwise, it
+                                   may be allocated by the UI routine, meaning
+                                   result_minsize is going to be overwritten.*/
+        union {
+                struct {
+                        int result_minsize;     /* Input: minimum required
+                                                   size of the result.
+                                                */
+                        int result_maxsize;     /* Input: maximum permitted
+                                                   size of the result */
+
+                        const char *test_buf;   /* Input: test string to verify
+                                                   against */
+                } string_data;
+                struct {
+                        const char *action_desc; /* Input */
+                        const char *ok_chars; /* Input */
+                        const char *cancel_chars; /* Input */
+                } boolean_data;
+        } u;
+
+#define OUT_STRING_FREEABLE 0x01
+        int flags;              /* flags for internal use */
+};
+
 UI *
 UI_new(void)
 {
@@ -101,9 +134,9 @@ free_string(UI_STRING *uis)
                 free((char *) uis->out_string);
                 switch (uis->type) {
                 case UIT_BOOLEAN:
-                        free((char *)uis->_.boolean_data.action_desc);
-                        free((char *)uis->_.boolean_data.ok_chars);
-                        free((char *)uis->_.boolean_data.cancel_chars);
+                        free((char *)uis->u.boolean_data.action_desc);
+                        free((char *)uis->u.boolean_data.ok_chars);
+                        free((char *)uis->u.boolean_data.cancel_chars);
                         break;
                 default:
                         break;
@@ -186,9 +219,9 @@ general_allocate_string(UI *ui, const char *prompt, int dup_prompt,
         if ((s = general_allocate_prompt(prompt, dup_prompt, type, input_flags,
             result_buf)) == NULL)
                 goto err;
-        s->_.string_data.result_minsize = minsize;
-        s->_.string_data.result_maxsize = maxsize;
-        s->_.string_data.test_buf = test_buf;
+        s->u.string_data.result_minsize = minsize;
+        s->u.string_data.result_maxsize = maxsize;
+        s->u.string_data.test_buf = test_buf;
 
         if (allocate_string_stack(ui) < 0)
                 goto err;
@@ -225,25 +258,25 @@ general_allocate_boolean(UI *ui, const char *prompt, const char *action_desc,
 
         if (dup_strings) {
                 if (action_desc != NULL) {
-                        if ((s->_.boolean_data.action_desc =
+                        if ((s->u.boolean_data.action_desc =
                             strdup(action_desc)) == NULL) {
                                 UIerror(ERR_R_MALLOC_FAILURE);
                                 goto err;
                         }
                 }
-                if ((s->_.boolean_data.ok_chars = strdup(ok_chars)) == NULL) {
+                if ((s->u.boolean_data.ok_chars = strdup(ok_chars)) == NULL) {
                         UIerror(ERR_R_MALLOC_FAILURE);
                         goto err;
                 }
-                if ((s->_.boolean_data.cancel_chars = strdup(cancel_chars)) ==
+                if ((s->u.boolean_data.cancel_chars = strdup(cancel_chars)) ==
                     NULL) {
                         UIerror(ERR_R_MALLOC_FAILURE);
                         goto err;
                 }
         } else {
-                s->_.boolean_data.action_desc = action_desc;
-                s->_.boolean_data.ok_chars = ok_chars;
-                s->_.boolean_data.cancel_chars = cancel_chars;
+                s->u.boolean_data.action_desc = action_desc;
+                s->u.boolean_data.ok_chars = ok_chars;
+                s->u.boolean_data.cancel_chars = cancel_chars;
         }
 
         if (allocate_string_stack(ui) < 0)
@@ -428,8 +461,10 @@ UI_process(UI *ui)
 {
         int i, ok = 0;
 
-        if (ui->meth->ui_open_session && !ui->meth->ui_open_session(ui))
-                return -1;
+        if (ui->meth->ui_open_session && !ui->meth->ui_open_session(ui)) {
+                ok = -1;
+                goto err;
+        }
 
         if (ui->flags & UI_FLAG_PRINT_ERRORS)
                 ERR_print_errors_cb(print_error, ui);
@@ -772,7 +807,7 @@ UI_get0_action_string(UI_STRING *uis)
         switch (uis->type) {
         case UIT_PROMPT:
         case UIT_BOOLEAN:
-                return uis->_.boolean_data.action_desc;
+                return uis->u.boolean_data.action_desc;
         default:
                 return NULL;
         }
@@ -803,7 +838,7 @@ UI_get0_test_string(UI_STRING *uis)
 
         switch (uis->type) {
         case UIT_VERIFY:
-                return uis->_.string_data.test_buf;
+                return uis->u.string_data.test_buf;
         default:
                 return NULL;
         }
@@ -819,7 +854,7 @@ UI_get_result_minsize(UI_STRING *uis)
         switch (uis->type) {
         case UIT_PROMPT:
         case UIT_VERIFY:
-                return uis->_.string_data.result_minsize;
+                return uis->u.string_data.result_minsize;
         default:
                 return -1;
         }
@@ -835,7 +870,7 @@ UI_get_result_maxsize(UI_STRING *uis)
         switch (uis->type) {
         case UIT_PROMPT:
         case UIT_VERIFY:
-                return uis->_.string_data.result_maxsize;
+                return uis->u.string_data.result_maxsize;
         default:
                 return -1;
         }
@@ -856,22 +891,22 @@ UI_set_result(UI *ui, UI_STRING *uis, const char *result)
         switch (uis->type) {
         case UIT_PROMPT:
         case UIT_VERIFY:
-                if (l < uis->_.string_data.result_minsize) {
+                if (l < uis->u.string_data.result_minsize) {
                         ui->flags |= UI_FLAG_REDOABLE;
                         UIerror(UI_R_RESULT_TOO_SMALL);
                         ERR_asprintf_error_data
                             ("You must type in %d to %d characters",
-                                uis->_.string_data.result_minsize,
-                                uis->_.string_data.result_maxsize);
+                                uis->u.string_data.result_minsize,
+                                uis->u.string_data.result_maxsize);
                         return -1;
                 }
-                if (l > uis->_.string_data.result_maxsize) {
+                if (l > uis->u.string_data.result_maxsize) {
                         ui->flags |= UI_FLAG_REDOABLE;
                         UIerror(UI_R_RESULT_TOO_LARGE);
                         ERR_asprintf_error_data
                             ("You must type in %d to %d characters",
-                                uis->_.string_data.result_minsize,
-                                uis->_.string_data.result_maxsize);
+                                uis->u.string_data.result_minsize,
+                                uis->u.string_data.result_maxsize);
                         return -1;
                 }
                 if (!uis->result_buf) {
@@ -879,7 +914,7 @@ UI_set_result(UI *ui, UI_STRING *uis, const char *result)
                         return -1;
                 }
                 strlcpy(uis->result_buf, result,
-                    uis->_.string_data.result_maxsize + 1);
+                    uis->u.string_data.result_maxsize + 1);
                 break;
         case UIT_BOOLEAN:
                 if (!uis->result_buf) {
@@ -888,14 +923,14 @@ UI_set_result(UI *ui, UI_STRING *uis, const char *result)
                 }
                 uis->result_buf[0] = '\0';
                 for (p = result; *p; p++) {
-                        if (strchr(uis->_.boolean_data.ok_chars, *p)) {
+                        if (strchr(uis->u.boolean_data.ok_chars, *p)) {
                                 uis->result_buf[0] =
-                                    uis->_.boolean_data.ok_chars[0];
+                                    uis->u.boolean_data.ok_chars[0];
                                 break;
                         }
-                        if (strchr(uis->_.boolean_data.cancel_chars, *p)) {
+                        if (strchr(uis->u.boolean_data.cancel_chars, *p)) {
                                 uis->result_buf[0] =
-                                    uis->_.boolean_data.cancel_chars[0];
+                                    uis->u.boolean_data.cancel_chars[0];
                                 break;
                         }
                 }
diff --git a/src/lib/libcrypto/ui/ui_local.h b/src/lib/libcrypto/ui/ui_local.h
index 460b5600bd..f16ea34b29 100644
--- a/src/lib/libcrypto/ui/ui_local.h
+++ b/src/lib/libcrypto/ui/ui_local.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: ui_local.h,v 1.2 2022/11/26 17:23:18 tb Exp $ */
+/* $OpenBSD: ui_local.h,v 1.4 2026/05/19 10:44:42 jsg Exp $ */
 
 /* Written by Richard Levitte (richard@levitte.org) for the OpenSSL
  * project 2001.
@@ -65,10 +65,6 @@
 
 __BEGIN_HIDDEN_DECLS
 
-#ifdef _
-#undef _
-#endif
-
 struct ui_method_st {
         char *name;
 
@@ -101,39 +97,6 @@ struct ui_method_st {
             const char *object_name);
 };
 
-struct ui_string_st {
-        enum UI_string_types type; /* Input */
-        const char *out_string; /* Input */
-        int input_flags;        /* Flags from the user */
-
-        /* The following parameters are completely irrelevant for UIT_INFO,
-           and can therefore be set to 0 or NULL */
-        char *result_buf;       /* Input and Output: If not NULL, user-defined
-                                   with size in result_maxsize.  Otherwise, it
-                                   may be allocated by the UI routine, meaning
-                                   result_minsize is going to be overwritten.*/
-        union {
-                struct {
-                        int result_minsize;     /* Input: minimum required
-                                                   size of the result.
-                                                */
-                        int result_maxsize;     /* Input: maximum permitted
-                                                   size of the result */
-
-                        const char *test_buf;   /* Input: test string to verify
-                                                   against */
-                } string_data;
-                struct {
-                        const char *action_desc; /* Input */
-                        const char *ok_chars; /* Input */
-                        const char *cancel_chars; /* Input */
-                } boolean_data;
-        } _;
-
-#define OUT_STRING_FREEABLE 0x01
-        int flags;              /* flags for internal use */
-};
-
 struct ui_st {
         const UI_METHOD *meth;
         STACK_OF(UI_STRING) *strings; /* We might want to prompt for more
diff --git a/src/lib/libcrypto/x509/x509_addr.c b/src/lib/libcrypto/x509/x509_addr.c
index b4ee92a14b..c48a0ab118 100644
--- a/src/lib/libcrypto/x509/x509_addr.c
+++ b/src/lib/libcrypto/x509/x509_addr.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: x509_addr.c,v 1.94 2025/05/10 05:54:39 tb Exp $ */
+/*      $OpenBSD: x509_addr.c,v 1.96 2026/05/18 04:24:01 tb Exp $ */
 /*
  * Contributed to the OpenSSL Project by the American Registry for
  * Internet Numbers ("ARIN").
@@ -504,10 +504,10 @@ IPAddressFamily_cmp(const IPAddressFamily *const *a_,
         const ASN1_OCTET_STRING *b = (*b_)->addressFamily;
         int len, cmp;
 
-        len = MINIMUM(a->length, b->length);
-
-        if ((cmp = memcmp(a->data, b->data, len)) != 0)
-                return cmp;
+        if ((len = MINIMUM(a->length, b->length)) != 0) {
+                if ((cmp = memcmp(a->data, b->data, len)) != 0)
+                        return cmp;
+        }
 
         return a->length - b->length;
 }
@@ -961,18 +961,22 @@ trim_end_u8(CBS *cbs, uint8_t trim)
  * RFC 3779, 2.1.2.
  */
 static int
-make_addressRange(IPAddressOrRange **out_aor, uint8_t *min, uint8_t *max,
+make_addressRange(IPAddressOrRange **out_aor, uint8_t *min, uint8_t *in_max,
     uint32_t afi, int length)
 {
         IPAddressOrRange *aor = NULL;
         IPAddressRange *range;
         int prefix_len;
         CBS cbs;
+        CBB cbb;
+        uint8_t max[ADDR_RAW_BUF_LEN];
         size_t max_len, min_len;
         uint8_t unused_bits_min, unused_bits_max;
         uint8_t octet;
 
-        if (memcmp(min, max, length) > 0)
+        memset(&cbb, 0, sizeof(cbb));
+
+        if (memcmp(min, in_max, length) > 0)
                 goto err;
 
         /*
@@ -980,7 +984,7 @@ make_addressRange(IPAddressOrRange **out_aor, uint8_t *min, uint8_t *max,
          * must be encoded as a prefix.
          */
 
-        if ((prefix_len = range_should_be_prefix(min, max, length)) >= 0)
+        if ((prefix_len = range_should_be_prefix(min, in_max, length)) >= 0)
                 return make_addressPrefix(out_aor, min, afi, prefix_len);
 
         /*
@@ -1008,19 +1012,31 @@ make_addressRange(IPAddressOrRange **out_aor, uint8_t *min, uint8_t *max,
          * the trailing ones of the last octet.
          */
 
-        CBS_init(&cbs, max, length);
+        CBS_init(&cbs, in_max, length);
+        if (!CBB_init_fixed(&cbb, max, sizeof(max)))
+                goto err;
 
         if (!trim_end_u8(&cbs, 0xff))
                 goto err;
 
         unused_bits_max = 0;
         if ((max_len = CBS_len(&cbs)) > 0) {
-                if (!CBS_peek_last_u8(&cbs, &octet))
+                if (!CBS_get_last_u8(&cbs, &octet))
                         goto err;
 
                 unused_bits_max = count_trailing_zeroes(octet + 1);
+                octet &= 0xff << unused_bits_max;
         }
 
+        if (!CBB_add_bytes(&cbb, CBS_data(&cbs), CBS_len(&cbs)))
+                goto err;
+        if (max_len > 0) {
+                if (!CBB_add_u8(&cbb, octet))
+                        goto err;
+        }
+        if (!CBB_finish(&cbb, NULL, NULL))
+                goto err;
+
         /*
          * Populate IPAddressOrRange.
          */
@@ -1048,6 +1064,7 @@ make_addressRange(IPAddressOrRange **out_aor, uint8_t *min, uint8_t *max,
         return 1;
 
  err:
+        CBB_cleanup(&cbb);
         IPAddressOrRange_free(aor);
         return 0;
 }
diff --git a/src/lib/libcrypto/x509/x509_constraints.c b/src/lib/libcrypto/x509/x509_constraints.c
index c4f32c9cfc..be93f3fd6c 100644
--- a/src/lib/libcrypto/x509/x509_constraints.c
+++ b/src/lib/libcrypto/x509/x509_constraints.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: x509_constraints.c,v 1.33 2026/04/13 17:04:23 beck Exp $ */
+/* $OpenBSD: x509_constraints.c,v 1.35 2026/07/31 03:59:50 kenjiro Exp $ */
 /*
  * Copyright (c) 2020 Bob Beck <beck@openbsd.org>
  *
@@ -38,26 +38,45 @@
 #define MAX_IP_ADDRESS_LENGTH (size_t)46
 
 static int
-cbs_is_ip_address(CBS *cbs, int *is_ip)
+host_is_ip_address(CBS *cbs, int *is_ip)
 {
         struct sockaddr_in6 sin6;
         struct sockaddr_in sin4;
+        uint8_t first, last;
         char *name = NULL;
+        CBS ipv6_cbs;
 
         *is_ip = 0;
+
         if (CBS_len(cbs) > MAX_IP_ADDRESS_LENGTH)
                 return 1;
+
+        /* Must be an IPv6 literal. */
+        CBS_dup(cbs, &ipv6_cbs);
+        if (!CBS_get_u8(&ipv6_cbs, &first))
+                return 1;
+        if (!CBS_get_last_u8(&ipv6_cbs, &last))
+                return 1;
+        if (first == '[' && last == ']') {
+                if (!CBS_strdup(&ipv6_cbs, &name))
+                        return 0;
+                if (inet_pton(AF_INET6, name, &sin6) == 1)
+                        *is_ip = 1;
+                goto done;
+        }
+
+        /* Or an IPv4 address. */
         if (!CBS_strdup(cbs, &name))
                 return 0;
-        if (inet_pton(AF_INET, name, &sin4) == 1 ||
-            inet_pton(AF_INET6, name, &sin6) == 1)
+        if (inet_pton(AF_INET, name, &sin4) == 1)
                 *is_ip = 1;
 
+ done:
         free(name);
         return 1;
 }
 
-struct x509_constraints_name *
+static struct x509_constraints_name *
 x509_constraints_name_new(void)
 {
         return (calloc(1, sizeof(struct x509_constraints_name)));
@@ -81,7 +100,7 @@ x509_constraints_name_free(struct x509_constraints_name *name)
         free(name);
 }
 
-struct x509_constraints_name *
+static struct x509_constraints_name *
 x509_constraints_name_dup(struct x509_constraints_name *name)
 {
         struct x509_constraints_name *new;
@@ -273,13 +292,13 @@ x509_constraints_valid_host(CBS *cbs, int permit_ip)
                 return 0;
         if (first == '.')
                 return 0; /* leading . not allowed in a host name or IP */
-        if (!permit_ip) {
-                if (!cbs_is_ip_address(cbs, &is_ip))
-                        return 0;
-                if (is_ip)
-                        return 0;
+        if (!host_is_ip_address(cbs, &is_ip))
+                return 0;
+        if (is_ip) {
+                if (permit_ip)
+                        return 1;
+                return 0;
         }
-
         return x509_constraints_valid_domain_internal(cbs, 0);
 }
 
@@ -508,10 +527,11 @@ x509_constraints_valid_domain_constraint(CBS *cbs)
 int
 x509_constraints_uri_host(uint8_t *uri, size_t len, char **hostpart)
 {
-        size_t i, hostlen = 0;
         uint8_t *authority = NULL;
-        char *host = NULL;
+        uint8_t *host = NULL;
+        size_t hostlen = 0;
         CBS host_cbs;
+        size_t i;
 
         /*
          * Find first '//'. there must be at least a '//' and
@@ -542,31 +562,55 @@ x509_constraints_uri_host(uint8_t *uri, size_t len, char **hostpart)
         for (i = authority - uri; i < len; i++) {
                 if (!isascii(uri[i]))
                         return 0;
-                /* it has a userinfo part */
-                if (uri[i] == '@') {
-                        hostlen = 0;
-                        /* it can only have one */
-                        if (host != NULL)
-                                break;
-                        /* start after the userinfo part */
-                        host = uri + i + 1;
-                        continue;
-                }
-                /* did we find the end? */
-                if (uri[i] == ':' || uri[i] == '/' || uri[i] == '?' ||
-                    uri[i] == '#')
+                /*
+                 * Per RFC 3986 section 3.2, authority is terminated
+                 * by a slash (/), question mark (?), hash (#) or by
+                 * the end of the URI.
+                 */
+                if (uri[i] == '/' || uri[i] == '?' || uri[i] == '#')
                         break;
+
                 hostlen++;
         }
+
+        host = authority;
+
+        /* Remove any leading userinfo part. */
+        for (i = 0; i < hostlen; i++) {
+                if (authority[i] != '@')
+                        continue;
+
+                /* Only one at-sign (@) is permitted. */
+                if (host != authority)
+                        return 0;
+
+                /* Start after the userinfo part. */
+                host = authority + i + 1;
+        }
+        hostlen = hostlen - (host - authority);
+
+        if (hostlen == 0)
+                return 0;
+
+        /* Remove any port part, respecting IPv6 literals. */
+        for (i = hostlen - 1; i > 0; i--) {
+                if (host[i] == ']')
+                        break;
+                if (host[i] == ':') {
+                        hostlen = i;
+                        break;
+                }
+        }
+
         if (hostlen == 0)
                 return 0;
-        if (host == NULL)
-                host = authority;
+
         CBS_init(&host_cbs, host, hostlen);
         if (!x509_constraints_valid_host(&host_cbs, 1))
                 return 0;
         if (hostpart != NULL && !CBS_strdup(&host_cbs, hostpart))
                 return 0;
+
         return 1;
 }
 
@@ -647,8 +691,7 @@ x509_constraints_domain(char *domain, size_t dlen, char *constraint, size_t len)
 
 int
 x509_constraints_uri(uint8_t *uri, size_t ulen, uint8_t *constraint,
-    size_t len,
-    int *error)
+    size_t len, int *error)
 {
         int ret = 0;
         char *hostpart = NULL;
@@ -681,7 +724,7 @@ x509_constraints_uri(uint8_t *uri, size_t ulen, uint8_t *constraint,
  * respectively for ipv4 addresses and constraints, and a length of
  * 16 and 32 respectively for ipv6 address constraints by the caller.
  */
-int
+static int
 x509_constraints_ipaddr(uint8_t *address, size_t alen, uint8_t *constraint,
     size_t len)
 {
@@ -703,7 +746,7 @@ x509_constraints_ipaddr(uint8_t *address, size_t alen, uint8_t *constraint,
  * Verify a canonicalized der encoded constraint dirname
  * a canonicalized der encoded constraint.
  */
-int
+static int
 x509_constraints_dirname(uint8_t *dirname, size_t dlen,
     uint8_t *constraint, size_t len)
 {
@@ -1151,7 +1194,7 @@ x509_constraints_extract_constraints(X509 *cert,
  * Match a validated name in "name" against a validated constraint in
  * "constraint" return 1 if then name matches, 0 otherwise.
  */
-int
+static int
 x509_constraints_match(struct x509_constraints_name *name,
     struct x509_constraints_name *constraint)
 {
diff --git a/src/lib/libcrypto/x509/x509_ia5.c b/src/lib/libcrypto/x509/x509_ia5.c
index b8886c6cb8..712ce5c702 100644
--- a/src/lib/libcrypto/x509/x509_ia5.c
+++ b/src/lib/libcrypto/x509/x509_ia5.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: x509_ia5.c,v 1.3 2025/05/10 05:54:39 tb Exp $ */
+/* $OpenBSD: x509_ia5.c,v 1.4 2026/07/31 00:50:52 kenjiro Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 1999.
  */
@@ -64,6 +64,7 @@
 #include <openssl/x509v3.h>
 
 #include "err_local.h"
+#include "x509_local.h"
 
 static char *i2s_ASN1_IA5STRING(X509V3_EXT_METHOD *method, ASN1_IA5STRING *ia5);
 static ASN1_IA5STRING *s2i_ASN1_IA5STRING(X509V3_EXT_METHOD *method,
diff --git a/src/lib/libcrypto/x509/x509_info.c b/src/lib/libcrypto/x509/x509_info.c
index c91642a02e..4b2ee10d28 100644
--- a/src/lib/libcrypto/x509/x509_info.c
+++ b/src/lib/libcrypto/x509/x509_info.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: x509_info.c,v 1.6 2025/05/10 05:54:39 tb Exp $ */
+/* $OpenBSD: x509_info.c,v 1.7 2026/07/31 00:50:52 kenjiro Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 1999.
  */
@@ -65,6 +65,7 @@
 #include <openssl/x509v3.h>
 
 #include "err_local.h"
+#include "x509_local.h"
 
 static STACK_OF(CONF_VALUE) *i2v_AUTHORITY_INFO_ACCESS(
     X509V3_EXT_METHOD *method, AUTHORITY_INFO_ACCESS *ainfo,
diff --git a/src/lib/libcrypto/x509/x509_int.c b/src/lib/libcrypto/x509/x509_int.c
index 2236bfe4c4..76979f79b0 100644
--- a/src/lib/libcrypto/x509/x509_int.c
+++ b/src/lib/libcrypto/x509/x509_int.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: x509_int.c,v 1.2 2024/07/13 15:08:58 tb Exp $ */
+/* $OpenBSD: x509_int.c,v 1.3 2026/07/31 00:50:52 kenjiro Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 1999.
  */
@@ -60,6 +60,8 @@
 
 #include <openssl/x509v3.h>
 
+#include "x509_local.h"
+
 static const X509V3_EXT_METHOD x509v3_ext_crl_number = {
         .ext_nid = NID_crl_number,
         .ext_flags = 0,
diff --git a/src/lib/libcrypto/x509/x509_lib.c b/src/lib/libcrypto/x509/x509_lib.c
index 0285ac0d3a..ca9f1550bf 100644
--- a/src/lib/libcrypto/x509/x509_lib.c
+++ b/src/lib/libcrypto/x509/x509_lib.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: x509_lib.c,v 1.25 2025/05/10 05:54:39 tb Exp $ */
+/* $OpenBSD: x509_lib.c,v 1.26 2026/08/07 23:58:20 kenjiro Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 1999.
  */
@@ -108,6 +108,8 @@ X509V3_EXT_get_nid(int nid)
                 return x509v3_ext_method_id_pkix_OCSP_acceptableResponses();
         case NID_id_pkix_OCSP_archiveCutoff:
                 return x509v3_ext_method_id_pkix_OCSP_archiveCutoff();
+        case NID_id_pkix_OCSP_noCheck:
+                return x509v3_ext_method_id_pkix_OCSP_noCheck();
         case NID_id_pkix_OCSP_serviceLocator:
                 return x509v3_ext_method_id_pkix_OCSP_serviceLocator();
 #endif
diff --git a/src/lib/libcrypto/x509/x509_local.h b/src/lib/libcrypto/x509/x509_local.h
index 5b9c1e51f7..e46052b382 100644
--- a/src/lib/libcrypto/x509/x509_local.h
+++ b/src/lib/libcrypto/x509/x509_local.h
@@ -1,4 +1,4 @@
-/*      $OpenBSD: x509_local.h,v 1.39 2025/10/10 11:31:13 tb Exp $ */
+/*      $OpenBSD: x509_local.h,v 1.40 2026/08/07 23:58:20 kenjiro Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 2013.
  */
@@ -472,6 +472,7 @@ const X509V3_EXT_METHOD *x509v3_ext_method_id_pkix_OCSP_CrlID(void);
 const X509V3_EXT_METHOD *x509v3_ext_method_id_pkix_OCSP_Nonce(void);
 const X509V3_EXT_METHOD *x509v3_ext_method_id_pkix_OCSP_acceptableResponses(void);
 const X509V3_EXT_METHOD *x509v3_ext_method_id_pkix_OCSP_archiveCutoff(void);
+const X509V3_EXT_METHOD *x509v3_ext_method_id_pkix_OCSP_noCheck(void);
 const X509V3_EXT_METHOD *x509v3_ext_method_id_pkix_OCSP_serviceLocator(void);
 const X509V3_EXT_METHOD *x509v3_ext_method_info_access(void);
 const X509V3_EXT_METHOD *x509v3_ext_method_inhibit_any_policy(void);
diff --git a/src/lib/libcrypto/x509/x509_ocsp.c b/src/lib/libcrypto/x509/x509_ocsp.c
index d0a0d49890..54a04ea8fa 100644
--- a/src/lib/libcrypto/x509/x509_ocsp.c
+++ b/src/lib/libcrypto/x509/x509_ocsp.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: x509_ocsp.c,v 1.5 2025/05/10 05:54:39 tb Exp $ */
+/* $OpenBSD: x509_ocsp.c,v 1.6 2026/07/31 00:50:52 kenjiro Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 1999.
  */
@@ -70,6 +70,7 @@
 
 #include "err_local.h"
 #include "ocsp_local.h"
+#include "x509_local.h"
 
 /* OCSP extensions and a couple of CRL entry extensions
  */
diff --git a/src/lib/libcrypto/x509/x509_pku.c b/src/lib/libcrypto/x509/x509_pku.c
index 6753f0f733..75cf5e6763 100644
--- a/src/lib/libcrypto/x509/x509_pku.c
+++ b/src/lib/libcrypto/x509/x509_pku.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: x509_pku.c,v 1.5 2024/07/13 15:08:58 tb Exp $ */
+/* $OpenBSD: x509_pku.c,v 1.6 2026/07/31 00:50:52 kenjiro Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 1999.
  */
@@ -62,6 +62,8 @@
 #include <openssl/asn1t.h>
 #include <openssl/x509v3.h>
 
+#include "x509_local.h"
+
 static int i2r_PKEY_USAGE_PERIOD(X509V3_EXT_METHOD *method,
     PKEY_USAGE_PERIOD *usage, BIO *out, int indent);
 
diff --git a/src/lib/libcrypto/x509/x509_policy.c b/src/lib/libcrypto/x509/x509_policy.c
index 2df965aad1..addd4b29ef 100644
--- a/src/lib/libcrypto/x509/x509_policy.c
+++ b/src/lib/libcrypto/x509/x509_policy.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: x509_policy.c,v 1.33 2025/08/10 06:36:45 beck Exp $ */
+/*      $OpenBSD: x509_policy.c,v 1.34 2026/07/31 03:59:50 kenjiro Exp $ */
 /*
  * Copyright (c) 2022, Google Inc.
  *
@@ -158,7 +158,7 @@ DECLARE_STACK_OF(X509_POLICY_LEVEL)
  * this the OpenSSL way either, and we are not using this boringsslism
  * anywhere else. Callers should ensure that the stack in data is sorted.
  */
-void
+static void
 sk_X509_POLICY_NODE_delete_if(STACK_OF(X509_POLICY_NODE) *nodes,
     int (*delete_if)(X509_POLICY_NODE *, void *), void *data)
 {
diff --git a/src/lib/libcrypto/x509/x509_prn.c b/src/lib/libcrypto/x509/x509_prn.c
index 23c649a7b9..5be754a71d 100644
--- a/src/lib/libcrypto/x509/x509_prn.c
+++ b/src/lib/libcrypto/x509/x509_prn.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: x509_prn.c,v 1.7 2025/06/02 12:18:22 jsg Exp $ */
+/* $OpenBSD: x509_prn.c,v 1.11 2026/05/16 07:12:27 tb Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 1999.
  */
@@ -55,7 +55,6 @@
  * Hudson (tjh@cryptsoft.com).
  *
  */
-/* X509 v3 extension utilities */
 
 #include <stdio.h>
 
@@ -64,13 +63,6 @@
 
 #include "x509_local.h"
 
-/* Extension printing routines */
-
-static int unknown_ext_print(BIO *out, X509_EXTENSION *ext, unsigned long flag,
-    int indent, int supported);
-
-/* Print out a name+value stack */
-
 void
 X509V3_EXT_val_prn(BIO *out, STACK_OF(CONF_VALUE) *val, int indent, int ml)
 {
@@ -102,7 +94,29 @@ X509V3_EXT_val_prn(BIO *out, STACK_OF(CONF_VALUE) *val, int indent, int ml)
 }
 LCRYPTO_ALIAS(X509V3_EXT_val_prn);
 
-/* Main routine: print out a general extension */
+static int
+unknown_ext_print(BIO *out, X509_EXTENSION *ext, unsigned long flag,
+    int indent, int supported)
+{
+        switch (flag & X509V3_EXT_UNKNOWN_MASK) {
+        case X509V3_EXT_DEFAULT:
+                return 0;
+        case X509V3_EXT_ERROR_UNKNOWN:
+                if (supported)
+                        BIO_printf(out, "%*s<Parse Error>", indent, "");
+                else
+                        BIO_printf(out, "%*s<Not Supported>", indent, "");
+                return 1;
+        case X509V3_EXT_PARSE_UNKNOWN:
+                return ASN1_parse_dump(out,
+                    ext->value->data, ext->value->length, indent, -1) > 0;
+        case X509V3_EXT_DUMP_UNKNOWN:
+                return BIO_dump_indent(out, (const char *)ext->value->data,
+                    ext->value->length, indent) > 0;
+        default:
+                return 1;
+        }
+}
 
 int
 X509V3_EXT_print(BIO *out, X509_EXTENSION *ext, unsigned long flag, int indent)
@@ -192,31 +206,6 @@ X509V3_extensions_print(BIO *bp, const char *title,
 }
 LCRYPTO_ALIAS(X509V3_extensions_print);
 
-static int
-unknown_ext_print(BIO *out, X509_EXTENSION *ext, unsigned long flag,
-    int indent, int supported)
-{
-        switch (flag & X509V3_EXT_UNKNOWN_MASK) {
-        case X509V3_EXT_DEFAULT:
-                return 0;
-        case X509V3_EXT_ERROR_UNKNOWN:
-                if (supported)
-                        BIO_printf(out, "%*s<Parse Error>", indent, "");
-                else
-                        BIO_printf(out, "%*s<Not Supported>", indent, "");
-                return 1;
-        case X509V3_EXT_PARSE_UNKNOWN:
-                return ASN1_parse_dump(out,
-                    ext->value->data, ext->value->length, indent, -1);
-        case X509V3_EXT_DUMP_UNKNOWN:
-                return BIO_dump_indent(out, (char *)ext->value->data,
-                    ext->value->length, indent);
-        default:
-                return 1;
-        }
-}
-
-
 int
 X509V3_EXT_print_fp(FILE *fp, X509_EXTENSION *ext, int flag, int indent)
 {
diff --git a/src/lib/libcrypto/x509/x509_purp.c b/src/lib/libcrypto/x509/x509_purp.c
index 36dfe6abee..ff6d272d39 100644
--- a/src/lib/libcrypto/x509/x509_purp.c
+++ b/src/lib/libcrypto/x509/x509_purp.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: x509_purp.c,v 1.44 2025/05/10 05:54:39 tb Exp $ */
+/* $OpenBSD: x509_purp.c,v 1.45 2026/05/08 04:28:28 tb Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 2001.
  */
@@ -580,13 +580,17 @@ x509v3_cache_extensions(X509 *x)
         return (x->ex_flags & EXFLAG_INVALID) == 0;
 }
 
-/* CA checks common to all purposes
+/*
+ * CA checks common to all purposes
  * return codes:
  * 0 not a CA
- * 1 is a CA
+ * 1 is a CA per RFC 5280.
  * 2 basicConstraints absent so "maybe" a CA
+ *   "I don't know..." fallback removed in 2004 (OpenSSL commit 8f284faa)
  * 3 basicConstraints absent but self signed V1.
  * 4 basicConstraints absent but keyUsage present and keyCertSign asserted.
+ * 5 basicConstraints absent but outdated Netscape Certificate Type extension
+ *   indicates that it is a CA certificate
  */
 
 static int
diff --git a/src/lib/libcrypto/x509/x509_utl.c b/src/lib/libcrypto/x509/x509_utl.c
index 2e60834edf..20c58dd8c5 100644
--- a/src/lib/libcrypto/x509/x509_utl.c
+++ b/src/lib/libcrypto/x509/x509_utl.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: x509_utl.c,v 1.28 2026/01/12 22:08:34 tb Exp $ */
+/* $OpenBSD: x509_utl.c,v 1.29 2026/07/31 00:50:52 kenjiro Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project.
  */
@@ -69,6 +69,7 @@
 #include "bytestring.h"
 #include "conf_local.h"
 #include "err_local.h"
+#include "x509_local.h"
 
 /*
  * Match reference identifiers starting with "." to any sub-domain. This
diff --git a/src/lib/libcrypto/x509/x509_verify.c b/src/lib/libcrypto/x509/x509_verify.c
index fc3fbc14da..a8fd5a37d3 100644
--- a/src/lib/libcrypto/x509/x509_verify.c
+++ b/src/lib/libcrypto/x509/x509_verify.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: x509_verify.c,v 1.75 2026/04/01 14:38:26 jsing Exp $ */
+/* $OpenBSD: x509_verify.c,v 1.79 2026/08/26 16:25:12 beck Exp $ */
 /*
  * Copyright (c) 2020-2021 Bob Beck <beck@openbsd.org>
  *
@@ -83,7 +83,7 @@ x509_verify_asn1_time_to_time_t(const ASN1_TIME *atime, int notAfter,
         return asn1_time_tm_to_time_t(&tm, out);
 }
 
-struct x509_verify_chain *
+static struct x509_verify_chain *
 x509_verify_chain_new(void)
 {
         struct x509_verify_chain *chain;
@@ -199,7 +199,7 @@ x509_verify_chain_last(struct x509_verify_chain *chain)
         return sk_X509_value(chain->certs, last);
 }
 
-X509 *
+static X509 *
 x509_verify_chain_leaf(struct x509_verify_chain *chain)
 {
         if (chain->certs == NULL)
@@ -668,11 +668,9 @@ x509_verify_build_chains(struct x509_verify_ctx *ctx, X509 *cert,
         depth = sk_X509_num(current_chain->certs);
         if (depth > 0)
                 depth--;
-        if (depth >= ctx->max_depth) {
-                (void)x509_verify_cert_error(ctx, cert, depth,
-                    X509_V_ERR_CERT_CHAIN_TOO_LONG, 0);
+        if (depth >= ctx->max_depth && !x509_verify_cert_error(ctx, cert, depth,
+            X509_V_ERR_CERT_CHAIN_TOO_LONG, 0))
                 return;
-        }
 
         count = ctx->chains_count;
 
@@ -762,8 +760,11 @@ x509_verify_cert_hostname(struct x509_verify_ctx *ctx, X509 *cert, char *name)
                 if (ctx->xsc != NULL) {
                         int ret;
 
-                        if ((ret = x509_vfy_check_id(ctx->xsc)) == 0)
+                        ret = x509_vfy_check_id(ctx->xsc);
+                        if (ctx->xsc->error != X509_V_OK) {
                                 ctx->error = ctx->xsc->error;
+                                ctx->error_depth = ctx->xsc->error_depth;
+                        }
                         return ret;
                 }
                 return 1;
@@ -911,7 +912,8 @@ x509_verify_cert_extensions(struct x509_verify_ctx *ctx, X509 *cert, int need_ca
                 ctx->error = X509_V_ERR_INVALID_CA;
                 return 0;
         }
-        if (ctx->purpose > 0 && X509_check_purpose(cert, ctx->purpose, need_ca)) {
+        if (ctx->purpose > 0 &&
+            X509_check_purpose(cert, ctx->purpose, need_ca) != 1) {
                 ctx->error = X509_V_ERR_INVALID_PURPOSE;
                 return 0;
         }
diff --git a/src/lib/libcrypto/x509/x509_vfy.c b/src/lib/libcrypto/x509/x509_vfy.c
index 776478508e..993d057d10 100644
--- a/src/lib/libcrypto/x509/x509_vfy.c
+++ b/src/lib/libcrypto/x509/x509_vfy.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: x509_vfy.c,v 1.149 2026/04/07 12:48:37 tb Exp $ */
+/* $OpenBSD: x509_vfy.c,v 1.153 2026/06/26 06:03:32 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -1074,26 +1074,35 @@ get_crl_sk(X509_STORE_CTX *ctx, X509_CRL **pcrl, X509_CRL **pdcrl,
                 reasons = *preasons;
                 crl_score = get_crl_score(ctx, &crl_issuer, &reasons, crl, x);
 
-                if (crl_score > best_score) {
-                        best_crl = crl;
-                        best_crl_issuer = crl_issuer;
-                        best_score = crl_score;
-                        best_reasons = reasons;
+                if (crl_score < best_score || crl_score == 0)
+                        continue;
+
+                if (crl_score == best_score && best_crl != NULL) {
+                        int day, sec;
+
+                        if (!ASN1_TIME_diff(&day, &sec, best_crl->crl->lastUpdate,
+                            crl->crl->lastUpdate))
+                                continue;
+
+                        if (day <= 0 && sec <= 0)
+                                continue;
                 }
+
+                best_crl = crl;
+                best_crl_issuer = crl_issuer;
+                best_score = crl_score;
+                best_reasons = reasons;
         }
 
-        if (best_crl) {
-                if (*pcrl)
-                        X509_CRL_free(*pcrl);
+        if (best_crl != NULL) {
+                X509_CRL_free(*pcrl);
                 *pcrl = best_crl;
                 *pissuer = best_crl_issuer;
                 *pscore = best_score;
                 *preasons = best_reasons;
                 CRYPTO_add(&best_crl->references, 1, CRYPTO_LOCK_X509_CRL);
-                if (*pdcrl) {
-                        X509_CRL_free(*pdcrl);
-                        *pdcrl = NULL;
-                }
+                X509_CRL_free(*pdcrl);
+                *pdcrl = NULL;
                 get_delta_sk(ctx, pdcrl, pscore, best_crl, crls);
         }
 
@@ -2420,9 +2429,9 @@ LCRYPTO_ALIAS(X509_STORE_get_check_issued);
 
 void
 X509_STORE_set_check_issued(X509_STORE *store,
-    X509_STORE_CTX_check_issued_fn check_issued)
+    X509_STORE_CTX_check_issued_fn check_issued_fn)
 {
-        store->check_issued = check_issued;
+        store->check_issued = check_issued_fn;
 }
 LCRYPTO_ALIAS(X509_STORE_set_check_issued);
 
diff --git a/src/lib/libssl/Makefile b/src/lib/libssl/Makefile
index 7e423b0b43..0d5934508a 100644
--- a/src/lib/libssl/Makefile
+++ b/src/lib/libssl/Makefile
@@ -1,4 +1,4 @@
-# $OpenBSD: Makefile,v 1.86 2026/04/03 07:26:20 jsing Exp $
+# $OpenBSD: Makefile,v 1.87 2026/05/16 08:20:41 jsing Exp $
 
 .include <bsd.own.mk>
 .ifndef NOMAN
@@ -43,6 +43,7 @@ SRCS= \
         d1_lib.c \
         d1_pkt.c \
         d1_srtp.c \
+        dtls12_handshake_msg.c \
         pqueue.c \
         s3_cbc.c \
         s3_lib.c \
diff --git a/src/lib/libssl/d1_both.c b/src/lib/libssl/d1_both.c
index e144d8f533..b57c8960c1 100644
--- a/src/lib/libssl/d1_both.c
+++ b/src/lib/libssl/d1_both.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: d1_both.c,v 1.85 2025/03/09 15:12:18 tb Exp $ */
+/* $OpenBSD: d1_both.c,v 1.99 2026/07/16 14:43:22 jsing Exp $ */
 /*
  * DTLS implementation written by Nagendra Modadugu
  * (nagendra@cs.stanford.edu) for the OpenSSL project 2005.
@@ -159,8 +159,6 @@ static const unsigned char bitmask_end_values[] = {
 static const unsigned int g_probable_mtu[] = {1500 - 28, 512 - 28, 256 - 28};
 
 static unsigned int dtls1_guess_mtu(unsigned int curr_mtu);
-static void dtls1_fix_message_header(SSL *s, unsigned long frag_off,
-    unsigned long frag_len);
 static int dtls1_write_message_header(const struct hm_header_st *msg_hdr,
     unsigned long frag_off, unsigned long frag_len, unsigned char *p);
 static long dtls1_get_message_fragment(SSL *s, int st1, int stn, long max,
@@ -206,14 +204,49 @@ dtls1_hm_fragment_free(hm_fragment *frag)
         free(frag);
 }
 
-/* send s->init_buf in records of type 'type' (SSL3_RT_HANDSHAKE or SSL3_RT_CHANGE_CIPHER_SPEC) */
-int
-dtls1_do_write(SSL *s, int type)
+static int
+dtls12_create_handshake_msg(SSL *s)
 {
-        int ret;
-        int curr_mtu;
-        unsigned int len, frag_off;
+        CBB cbb;
+
+        OPENSSL_assert(s->init_off == 0);
+        OPENSSL_assert(s->init_num == (int)s->d1->w_msg_hdr.msg_len +
+            DTLS1_HM_HEADER_LENGTH);
+
+        /* Skip over the existing header. */
+        s->init_off += DTLS1_HM_HEADER_LENGTH;
+        s->init_num -= DTLS1_HM_HEADER_LENGTH;
+
+        if (s->d1->hs_msg != NULL)
+                goto err;
+
+        if ((s->d1->hs_msg = dtls12_handshake_msg_new()) == NULL)
+                goto err;
+        if (!dtls12_handshake_msg_start(s->d1->hs_msg, &cbb,
+            s->d1->w_msg_hdr.type, s->d1->w_msg_hdr.seq))
+                goto err;
+        if (!CBB_add_bytes(&cbb, &s->init_buf->data[s->init_off],
+            s->init_num))
+                goto err;
+        if (!dtls12_handshake_msg_finish(s->d1->hs_msg))
+                goto err;
+
+        return 1;
+
+ err:
+        dtls12_handshake_msg_free(s->d1->hs_msg);
+        s->d1->hs_msg = NULL;
+
+        return 0;
+}
+
+static int
+dtls1_do_write_handshake_message(SSL *s)
+{
+        int curr_mtu, written;
         size_t overhead;
+        CBS cbs;
+        int ret;
 
         /* AHA!  Figure out the MTU, and stick to the right size */
         if (s->d1->mtu < dtls1_min_mtu() &&
@@ -237,15 +270,15 @@ dtls1_do_write(SSL *s, int type)
         OPENSSL_assert(s->d1->mtu >= dtls1_min_mtu());
         /* should have something reasonable now */
 
-        if (s->init_off == 0  && type == SSL3_RT_HANDSHAKE)
-                OPENSSL_assert(s->init_num ==
-                    (int)s->d1->w_msg_hdr.msg_len + DTLS1_HM_HEADER_LENGTH);
+        if (s->d1->hs_msg == NULL) {
+                if (!dtls12_create_handshake_msg(s))
+                        return -1;
+        }
 
         if (!tls12_record_layer_write_overhead(s->rl, &overhead))
                 return -1;
 
-        frag_off = 0;
-        while (s->init_num) {
+        do {
                 curr_mtu = s->d1->mtu - BIO_wpending(SSL_get_wbio(s)) -
                     DTLS1_RT_HEADER_LENGTH - overhead;
 
@@ -258,38 +291,14 @@ dtls1_do_write(SSL *s, int type)
                             overhead;
                 }
 
-                if (s->init_num > curr_mtu)
-                        len = curr_mtu;
-                else
-                        len = s->init_num;
-
-                /* XDTLS: this function is too long.  split out the CCS part */
-                if (type == SSL3_RT_HANDSHAKE) {
-                        if (s->init_off != 0) {
-                                OPENSSL_assert(s->init_off > DTLS1_HM_HEADER_LENGTH);
-                                s->init_off -= DTLS1_HM_HEADER_LENGTH;
-                                s->init_num += DTLS1_HM_HEADER_LENGTH;
-
-                                if (s->init_num > curr_mtu)
-                                        len = curr_mtu;
-                                else
-                                        len = s->init_num;
-                        }
-
-                        dtls1_fix_message_header(s, frag_off,
-                            len - DTLS1_HM_HEADER_LENGTH);
-
-                        if (!dtls1_write_message_header(&s->d1->w_msg_hdr,
-                            s->d1->w_msg_hdr.frag_off, s->d1->w_msg_hdr.frag_len,
-                            (unsigned char *)&s->init_buf->data[s->init_off]))
-                                return -1;
+                OPENSSL_assert(curr_mtu >= DTLS1_HM_HEADER_LENGTH);
 
-                        OPENSSL_assert(len >= DTLS1_HM_HEADER_LENGTH);
-                }
+                if (!dtls12_handshake_msg_fragment_build(s->d1->hs_msg,
+                    curr_mtu - DTLS1_HM_HEADER_LENGTH, &cbs))
+                        return -1;
 
-                ret = dtls1_write_bytes(s, type,
-                    &s->init_buf->data[s->init_off], len);
-                if (ret < 0) {
+                if ((written = dtls1_write_bytes(s, SSL3_RT_HANDSHAKE,
+                    CBS_data(&cbs), CBS_len(&cbs))) < 0) {
                         /*
                          * Might need to update MTU here, but we don't know
                          * which previous packet caused the failure -- so
@@ -298,69 +307,83 @@ dtls1_do_write(SSL *s, int type)
                          * handle the retransmit
                          */
                         if (BIO_ctrl(SSL_get_wbio(s),
-                            BIO_CTRL_DGRAM_MTU_EXCEEDED, 0, NULL) > 0)
-                                s->d1->mtu = BIO_ctrl(SSL_get_wbio(s),
-                                    BIO_CTRL_DGRAM_QUERY_MTU, 0, NULL);
-                        else
-                                return (-1);
-                } else {
+                            BIO_CTRL_DGRAM_MTU_EXCEEDED, 0, NULL) <= 0)
+                                return -1;
 
-                        /*
-                         * Bad if this assert fails, only part of the
-                         * handshake message got sent.  but why would
-                         * this happen?
-                         */
-                        OPENSSL_assert(len == (unsigned int)ret);
-
-                        if (type == SSL3_RT_HANDSHAKE &&
-                            !s->d1->retransmitting) {
-                                /*
-                                 * Should not be done for 'Hello Request's,
-                                 * but in that case we'll ignore the result
-                                 * anyway
-                                 */
-                                unsigned char *p = (unsigned char *)&s->init_buf->data[s->init_off];
-                                const struct hm_header_st *msg_hdr = &s->d1->w_msg_hdr;
-                                int xlen;
-
-                                if (frag_off == 0) {
-                                        /*
-                                         * Reconstruct message header is if it
-                                         * is being sent in single fragment
-                                         */
-                                        if (!dtls1_write_message_header(msg_hdr,
-                                            0, msg_hdr->msg_len, p))
-                                                return (-1);
-                                        xlen = ret;
-                                } else {
-                                        p += DTLS1_HM_HEADER_LENGTH;
-                                        xlen = ret - DTLS1_HM_HEADER_LENGTH;
-                                }
-
-                                tls1_transcript_record(s, p, xlen);
-                        }
-
-                        if (ret == s->init_num) {
-                                if (s->msg_callback)
-                                        s->msg_callback(1, s->version, type,
-                                            s->init_buf->data,
-                                            (size_t)(s->init_off + s->init_num),
-                                            s, s->msg_callback_arg);
-
-                                s->init_off = 0;
-                                /* done writing this message */
-                                s->init_num = 0;
-
-                                return (1);
-                        }
-                        s->init_off += ret;
-                        s->init_num -= ret;
-                        frag_off += (ret -= DTLS1_HM_HEADER_LENGTH);
+                        s->d1->mtu = BIO_ctrl(SSL_get_wbio(s),
+                            BIO_CTRL_DGRAM_QUERY_MTU, 0, NULL);
+
+                        continue;
                 }
+
+                /*
+                 * Bad if this assert fails, only part of the
+                 * handshake message got sent.  but why would
+                 * this happen?
+                 */
+                OPENSSL_assert(CBS_len(&cbs) == (size_t)written);
+
+                if (!dtls12_handshake_msg_fragment_next(s->d1->hs_msg))
+                        return -1;
+
+        } while (dtls12_handshake_msg_fragment_pending(s->d1->hs_msg));
+
+        dtls12_handshake_msg_data(s->d1->hs_msg, &cbs);
+
+        if (!s->d1->retransmitting) {
+                /*
+                 * The TLS transcript is based on each handshake message being
+                 * sent as a single fragment - see RFC 6347 section 4.2.6. This
+                 * should not be called for a HelloRequest, however the result
+                 * will be ignored.
+                 */
+                tls1_transcript_record(s, CBS_data(&cbs), CBS_len(&cbs));
         }
-        return (0);
+
+        ssl_msg_callback(s, 1, SSL3_RT_HANDSHAKE, CBS_data(&cbs), CBS_len(&cbs));
+
+        dtls12_handshake_msg_free(s->d1->hs_msg);
+        s->d1->hs_msg = NULL;
+
+        s->init_off = 0;
+        s->init_num = 0;
+
+        return 1;
 }
 
+static int
+dtls1_do_write_ccs(SSL *s)
+{
+        const uint8_t ccs[] = { SSL3_MT_CCS };
+        int ret;
+
+        OPENSSL_assert(s->d1->mtu >= dtls1_min_mtu());
+
+        if ((ret = dtls1_write_bytes(s, SSL3_RT_CHANGE_CIPHER_SPEC,
+            ccs, sizeof(ccs))) < 0)
+                return -1;
+
+        OPENSSL_assert(sizeof(ccs) == ret);
+
+        ssl_msg_callback(s, 1, SSL3_RT_CHANGE_CIPHER_SPEC,
+            ccs, sizeof(ccs));
+
+        s->init_off = 0;
+        s->init_num = 0;
+
+        return 1;
+}
+
+int
+dtls1_do_write(SSL *s, int msg_type)
+{
+        if (msg_type == SSL3_RT_HANDSHAKE)
+                return dtls1_do_write_handshake_message(s);
+        if (msg_type == SSL3_RT_CHANGE_CIPHER_SPEC)
+                return dtls1_do_write_ccs(s);
+
+        return -1;
+}
 
 /*
  * Obtain handshake message of message type 'mt' (any if mt == -1),
@@ -413,9 +436,8 @@ dtls1_get_message(SSL *s, int st1, int stn, int mt, long max)
         msg_len += DTLS1_HM_HEADER_LENGTH;
 
         tls1_transcript_record(s, p, msg_len);
-        if (s->msg_callback)
-                s->msg_callback(0, s->version, SSL3_RT_HANDSHAKE, p, msg_len,
-                    s, s->msg_callback_arg);
+
+        ssl_msg_callback(s, 0, SSL3_RT_HANDSHAKE, p, msg_len);
 
         memset(msg_hdr, 0, sizeof(struct hm_header_st));
 
@@ -797,11 +819,8 @@ dtls1_get_message_fragment(SSL *s, int st1, int stn, long max, int *ok)
                  * 'Finished' MAC.
                  */
                 if (wire[1] == 0 && wire[2] == 0 && wire[3] == 0) {
-                        if (s->msg_callback)
-                                s->msg_callback(0, s->version,
-                                    SSL3_RT_HANDSHAKE, wire,
-                                    DTLS1_HM_HEADER_LENGTH, s,
-                                    s->msg_callback_arg);
+                        ssl_msg_callback(s, 0, SSL3_RT_HANDSHAKE, wire,
+                            DTLS1_HM_HEADER_LENGTH);
 
                         s->init_num = 0;
                         goto again;
@@ -907,6 +926,46 @@ dtls1_get_queue_priority(unsigned short seq, int is_ccs)
         return seq * 2 - is_ccs;
 }
 
+static int
+dtls1_retransmit_message(SSL *s, hm_fragment *frag)
+{
+        unsigned long header_length;
+        uint16_t epoch;
+        int ret;
+
+        if (frag->msg_header.is_ccs)
+                header_length = DTLS1_CCS_HEADER_LENGTH;
+        else
+                header_length = DTLS1_HM_HEADER_LENGTH;
+
+        memcpy(s->init_buf->data, frag->fragment,
+            frag->msg_header.msg_len + header_length);
+        s->init_num = frag->msg_header.msg_len + header_length;
+
+        dtls1_set_message_header(s, frag->msg_header.type,
+            frag->msg_header.msg_len, frag->msg_header.seq, 0,
+            frag->msg_header.frag_len);
+
+        epoch = tls12_record_layer_write_epoch(s->rl);
+
+        s->d1->retransmitting = 1;
+
+        /* Switch to the epoch that was used to send the message. */
+        if (!tls12_record_layer_use_write_epoch(s->rl, frag->msg_header.epoch))
+                return 0;
+
+        ret = dtls1_do_write(s, frag->msg_header.is_ccs ?
+            SSL3_RT_CHANGE_CIPHER_SPEC : SSL3_RT_HANDSHAKE);
+
+        if (!tls12_record_layer_use_write_epoch(s->rl, epoch))
+                return 0;
+
+        s->d1->retransmitting = 0;
+
+        (void)BIO_flush(SSL_get_wbio(s));
+        return ret;
+}
+
 int
 dtls1_retransmit_buffered_messages(SSL *s)
 {
@@ -914,17 +973,12 @@ dtls1_retransmit_buffered_messages(SSL *s)
         piterator iter;
         pitem *item;
         hm_fragment *frag;
-        int found = 0;
 
         iter = pqueue_iterator(sent);
 
-        for (item = pqueue_next(&iter); item != NULL;
-            item = pqueue_next(&iter)) {
+        for (item = pqueue_next(&iter); item != NULL; item = pqueue_next(&iter)) {
                 frag = (hm_fragment *)item->data;
-                if (dtls1_retransmit_message(s,
-                    (unsigned short)dtls1_get_queue_priority(
-                    frag->msg_header.seq, frag->msg_header.is_ccs), 0,
-                    &found) <= 0 && found) {
+                if (dtls1_retransmit_message(s, frag) <= 0) {
 #ifdef DEBUG
                         fprintf(stderr, "dtls1_retransmit_message() failed\n");
 #endif
@@ -960,6 +1014,7 @@ dtls1_buffer_message(SSL *s, int is_ccs)
             (is_ccs ? DTLS1_CCS_HEADER_LENGTH : DTLS1_HM_HEADER_LENGTH) ==
             (unsigned int)s->init_num);
 
+        frag->msg_header.epoch = tls12_record_layer_write_epoch(s->rl);
         frag->msg_header.msg_len = s->d1->w_msg_hdr.msg_len;
         frag->msg_header.seq = s->d1->w_msg_hdr.seq;
         frag->msg_header.type = s->d1->w_msg_hdr.type;
@@ -967,11 +1022,6 @@ dtls1_buffer_message(SSL *s, int is_ccs)
         frag->msg_header.frag_len = s->d1->w_msg_hdr.msg_len;
         frag->msg_header.is_ccs = is_ccs;
 
-        /* save current state*/
-        frag->msg_header.saved_retransmit_state.session = s->session;
-        frag->msg_header.saved_retransmit_state.epoch =
-            tls12_record_layer_write_epoch(s->rl);
-
         memset(seq64be, 0, sizeof(seq64be));
         seq64be[6] = (unsigned char)(dtls1_get_queue_priority(
             frag->msg_header.seq, frag->msg_header.is_ccs) >> 8);
@@ -988,80 +1038,6 @@ dtls1_buffer_message(SSL *s, int is_ccs)
         return 1;
 }
 
-int
-dtls1_retransmit_message(SSL *s, unsigned short seq, unsigned long frag_off,
-    int *found)
-{
-        int ret;
-        /* XDTLS: for now assuming that read/writes are blocking */
-        pitem *item;
-        hm_fragment *frag;
-        unsigned long header_length;
-        unsigned char seq64be[8];
-        struct dtls1_retransmit_state saved_state;
-
-        /*
-          OPENSSL_assert(s->init_num == 0);
-          OPENSSL_assert(s->init_off == 0);
-         */
-
-        /* XDTLS:  the requested message ought to be found, otherwise error */
-        memset(seq64be, 0, sizeof(seq64be));
-        seq64be[6] = (unsigned char)(seq >> 8);
-        seq64be[7] = (unsigned char)seq;
-
-        item = pqueue_find(s->d1->sent_messages, seq64be);
-        if (item == NULL) {
-#ifdef DEBUG
-                fprintf(stderr, "retransmit:  message %d non-existent\n", seq);
-#endif
-                *found = 0;
-                return 0;
-        }
-
-        *found = 1;
-        frag = (hm_fragment *)item->data;
-
-        if (frag->msg_header.is_ccs)
-                header_length = DTLS1_CCS_HEADER_LENGTH;
-        else
-                header_length = DTLS1_HM_HEADER_LENGTH;
-
-        memcpy(s->init_buf->data, frag->fragment,
-            frag->msg_header.msg_len + header_length);
-        s->init_num = frag->msg_header.msg_len + header_length;
-
-        dtls1_set_message_header_int(s, frag->msg_header.type,
-            frag->msg_header.msg_len, frag->msg_header.seq, 0,
-            frag->msg_header.frag_len);
-
-        /* save current state */
-        saved_state.session = s->session;
-        saved_state.epoch = tls12_record_layer_write_epoch(s->rl);
-
-        s->d1->retransmitting = 1;
-
-        /* restore state in which the message was originally sent */
-        s->session = frag->msg_header.saved_retransmit_state.session;
-        if (!tls12_record_layer_use_write_epoch(s->rl,
-            frag->msg_header.saved_retransmit_state.epoch))
-                return 0;
-
-        ret = dtls1_do_write(s, frag->msg_header.is_ccs ?
-            SSL3_RT_CHANGE_CIPHER_SPEC : SSL3_RT_HANDSHAKE);
-
-        /* restore current state */
-        s->session = saved_state.session;
-        if (!tls12_record_layer_use_write_epoch(s->rl,
-            saved_state.epoch))
-                return 0;
-
-        s->d1->retransmitting = 0;
-
-        (void)BIO_flush(SSL_get_wbio(s));
-        return ret;
-}
-
 /* call this function when the buffered messages are no longer needed */
 void
 dtls1_clear_record_buffer(SSL *s)
@@ -1074,7 +1050,7 @@ dtls1_clear_record_buffer(SSL *s)
                 frag = item->data;
                 if (frag->msg_header.is_ccs)
                         tls12_record_layer_write_epoch_done(s->rl,
-                            frag->msg_header.saved_retransmit_state.epoch);
+                            frag->msg_header.epoch);
                 dtls1_hm_fragment_free(frag);
                 pitem_free(item);
         }
@@ -1082,21 +1058,6 @@ dtls1_clear_record_buffer(SSL *s)
 
 void
 dtls1_set_message_header(SSL *s, unsigned char mt, unsigned long len,
-    unsigned long frag_off, unsigned long frag_len)
-{
-        /* Don't change sequence numbers while listening */
-        if (frag_off == 0 && !s->d1->listen) {
-                s->d1->handshake_write_seq = s->d1->next_handshake_write_seq;
-                s->d1->next_handshake_write_seq++;
-        }
-
-        dtls1_set_message_header_int(s, mt, len, s->d1->handshake_write_seq,
-            frag_off, frag_len);
-}
-
-/* don't actually do the writing, wait till the MTU has been retrieved */
-void
-dtls1_set_message_header_int(SSL *s, unsigned char mt, unsigned long len,
     unsigned short seq_num, unsigned long frag_off, unsigned long frag_len)
 {
         struct hm_header_st *msg_hdr = &s->d1->w_msg_hdr;
@@ -1108,15 +1069,6 @@ dtls1_set_message_header_int(SSL *s, unsigned char mt, unsigned long len,
         msg_hdr->frag_len = frag_len;
 }
 
-static void
-dtls1_fix_message_header(SSL *s, unsigned long frag_off, unsigned long frag_len)
-{
-        struct hm_header_st *msg_hdr = &s->d1->w_msg_hdr;
-
-        msg_hdr->frag_off = frag_off;
-        msg_hdr->frag_len = frag_len;
-}
-
 static int
 dtls1_write_message_header(const struct hm_header_st *msg_hdr,
     unsigned long frag_off, unsigned long frag_len, unsigned char *p)
@@ -1196,3 +1148,47 @@ dtls1_get_message_header(CBS *header, struct hm_header_st *msg_hdr)
 
         return 1;
 }
+
+int
+dtls12_ccs_built(SSL *s)
+{
+        dtls1_set_message_header(s, SSL3_MT_CCS, 0, 0, 0, 0);
+
+        if (!dtls1_buffer_message(s, 1))
+                return 0;
+
+        return 1;
+}
+
+int
+dtls12_handshake_msg_built(SSL *s)
+{
+        unsigned long len;
+        uint8_t msg_type;
+        CBS cbs;
+
+        CBS_init(&cbs, s->init_buf->data, s->init_num);
+        if (!CBS_get_u8(&cbs, &msg_type))
+                return 0;
+
+        if (s->init_off != 0)
+                return 0;
+        if (s->init_num < DTLS1_HM_HEADER_LENGTH)
+                return 0;
+
+        len = s->init_num - DTLS1_HM_HEADER_LENGTH;
+
+        /* Do not change sequence numbers while listening. */
+        if (!s->d1->listen) {
+                s->d1->handshake_write_seq = s->d1->next_handshake_write_seq;
+                s->d1->next_handshake_write_seq++;
+        }
+
+        dtls1_set_message_header(s, msg_type, len, s->d1->handshake_write_seq,
+            0, len);
+
+        if (!dtls1_buffer_message(s, 0))
+                return 0;
+
+        return 1;
+}
diff --git a/src/lib/libssl/d1_lib.c b/src/lib/libssl/d1_lib.c
index 69db8a0df4..7f6dd1d1c5 100644
--- a/src/lib/libssl/d1_lib.c
+++ b/src/lib/libssl/d1_lib.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: d1_lib.c,v 1.65 2024/07/23 14:40:53 jsing Exp $ */
+/* $OpenBSD: d1_lib.c,v 1.67 2026/08/30 12:23:16 kenjiro Exp $ */
 /*
  * DTLS implementation written by Nagendra Modadugu
  * (nagendra@cs.stanford.edu) for the OpenSSL project 2005.
@@ -179,6 +179,8 @@ dtls1_free(SSL *s)
         pqueue_free(s->d1->sent_messages);
         pqueue_free(s->d1->buffered_app_data.q);
 
+        dtls12_handshake_msg_free(s->d1->hs_msg);
+
         freezero(s->d1, sizeof(*s->d1));
         s->d1 = NULL;
 }
@@ -199,6 +201,9 @@ dtls1_clear(SSL *s)
                 buffered_app_data = s->d1->buffered_app_data.q;
                 mtu = s->d1->mtu;
 
+                dtls12_handshake_msg_free(s->d1->hs_msg);
+                s->d1->hs_msg = NULL;
+
                 dtls1_clear_queues(s);
 
                 memset(s->d1, 0, sizeof(*s->d1));
@@ -228,7 +233,7 @@ dtls1_clear(SSL *s)
 long
 dtls1_ctrl(SSL *s, int cmd, long larg, void *parg)
 {
-        int ret = 0;
+        long ret = 0;
 
         switch (cmd) {
         case DTLS_CTRL_GET_TIMEOUT:
diff --git a/src/lib/libssl/dtls12_handshake_msg.c b/src/lib/libssl/dtls12_handshake_msg.c
new file mode 100644
index 0000000000..7874aa8598
--- /dev/null
+++ b/src/lib/libssl/dtls12_handshake_msg.c
@@ -0,0 +1,231 @@
+/* $OpenBSD: dtls12_handshake_msg.c,v 1.1 2026/05/16 08:20:41 jsing Exp $ */
+/*
+ * Copyright (c) 2026 Joel Sing <jsing@openbsd.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <stdint.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include "bytestring.h"
+#include "dtls12_internal.h"
+
+#define DTLS12_HANDSHAKE_MSG_HEADER_LEN                 12
+#define DTLS12_HANDSHAKE_MSG_INITIAL_LEN                256
+
+#define DTLS12_HANDSHAKE_MSG_FRAGMENT_LENGTH_OFFSET     9
+
+struct dtls12_handshake_msg {
+        uint8_t msg_type;
+        uint32_t msg_len;
+        uint16_t msg_seq;
+
+        uint32_t fragment_offset;
+        uint32_t fragment_len;
+        uint8_t *fragment_data;
+        size_t fragment_data_len;
+        int fragment_pending;
+
+        uint8_t *data;
+        size_t data_len;
+
+        CBS cbs;
+        CBB cbb;
+};
+
+struct dtls12_handshake_msg *
+dtls12_handshake_msg_new(void)
+{
+        struct dtls12_handshake_msg *msg = NULL;
+
+        if ((msg = calloc(1, sizeof(struct dtls12_handshake_msg))) == NULL)
+                return NULL;
+
+        return msg;
+}
+
+void
+dtls12_handshake_msg_free(struct dtls12_handshake_msg *msg)
+{
+        if (msg == NULL)
+                return;
+
+        CBB_cleanup(&msg->cbb);
+
+        freezero(msg->data, msg->data_len);
+        freezero(msg->fragment_data, msg->fragment_data_len);
+
+        freezero(msg, sizeof(struct dtls12_handshake_msg));
+}
+
+void
+dtls12_handshake_msg_data(struct dtls12_handshake_msg *msg, CBS *cbs)
+{
+        CBS_init(cbs, msg->data, msg->data_len);
+}
+
+uint8_t
+dtls12_handshake_msg_type(struct dtls12_handshake_msg *msg)
+{
+        return msg->msg_type;
+}
+
+int
+dtls12_handshake_msg_content(struct dtls12_handshake_msg *msg, CBS *cbs)
+{
+        dtls12_handshake_msg_data(msg, cbs);
+
+        return CBS_skip(cbs, DTLS12_HANDSHAKE_MSG_HEADER_LEN);
+}
+
+int
+dtls12_handshake_msg_start(struct dtls12_handshake_msg *msg, CBB *body,
+    uint8_t msg_type, size_t msg_seq)
+{
+        msg->msg_type = msg_type;
+        msg->msg_seq = msg_seq;
+
+        msg->msg_len = 0;
+        msg->fragment_offset = 0;
+
+        if (!CBB_init(&msg->cbb, DTLS12_HANDSHAKE_MSG_INITIAL_LEN))
+                return 0;
+        if (!CBB_add_u8(&msg->cbb, msg->msg_type))
+                return 0;
+        if (!CBB_add_u24(&msg->cbb, msg->msg_len))
+                return 0;
+        if (!CBB_add_u16(&msg->cbb, msg->msg_seq))
+                return 0;
+        if (!CBB_add_u24(&msg->cbb, msg->fragment_offset))
+                return 0;
+        if (!CBB_add_u24_length_prefixed(&msg->cbb, body))
+                return 0;
+
+        return 1;
+}
+
+int
+dtls12_handshake_msg_finish(struct dtls12_handshake_msg *msg)
+{
+        CBS cbs;
+
+        if (!CBB_finish(&msg->cbb, &msg->data, &msg->data_len))
+                return 0;
+
+        /* Update message length to match fragment length. */
+        CBS_init(&cbs, msg->data, msg->data_len);
+        if (!CBS_skip(&cbs, DTLS12_HANDSHAKE_MSG_FRAGMENT_LENGTH_OFFSET))
+                return 0;
+        if (!CBS_get_u24(&cbs, &msg->msg_len))
+                return 0;
+
+        if (!CBB_init_fixed(&msg->cbb, msg->data, msg->data_len))
+                return 0;
+        if (!CBB_add_u8(&msg->cbb, msg->msg_type))
+                return 0;
+        if (!CBB_add_u24(&msg->cbb, msg->msg_len))
+                return 0;
+        if (!CBB_finish(&msg->cbb, NULL, NULL))
+                return 0;
+
+        dtls12_handshake_msg_fragment_reset(msg);
+
+        return 1;
+}
+
+int
+dtls12_handshake_msg_fragment_reset(struct dtls12_handshake_msg *msg)
+{
+        freezero(msg->fragment_data, msg->fragment_data_len);
+        msg->fragment_data = NULL;
+        msg->fragment_data_len = 0;
+
+        msg->fragment_offset = 0;
+        msg->fragment_pending = 1;
+
+        return dtls12_handshake_msg_content(msg, &msg->cbs);
+}
+
+int
+dtls12_handshake_msg_fragment_build(struct dtls12_handshake_msg *msg,
+    size_t max_fragment_len, CBS *cbs)
+{
+        CBB body;
+
+        CBS_init(cbs, NULL, 0);
+
+        if (msg->fragment_offset > msg->msg_len)
+                return 0;
+        if (msg->msg_len - msg->fragment_offset > CBS_len(&msg->cbs))
+                return 0;
+
+        freezero(msg->fragment_data, msg->fragment_data_len);
+        msg->fragment_data = NULL;
+        msg->fragment_data_len = 0;
+
+        if ((msg->fragment_len = CBS_len(&msg->cbs)) > max_fragment_len)
+                msg->fragment_len = max_fragment_len;
+
+        /* Build the fragment. */
+        if (!CBB_init(&msg->cbb, DTLS12_HANDSHAKE_MSG_INITIAL_LEN))
+                goto err;
+        if (!CBB_add_u8(&msg->cbb, msg->msg_type))
+                goto err;
+        if (!CBB_add_u24(&msg->cbb, msg->msg_len))
+                goto err;
+        if (!CBB_add_u16(&msg->cbb, msg->msg_seq))
+                goto err;
+        if (!CBB_add_u24(&msg->cbb, msg->fragment_offset))
+                goto err;
+        if (!CBB_add_u24_length_prefixed(&msg->cbb, &body))
+                goto err;
+        if (!CBB_add_bytes(&body, CBS_data(&msg->cbs), msg->fragment_len))
+                goto err;
+        if (!CBB_finish(&msg->cbb, &msg->fragment_data, &msg->fragment_data_len))
+                goto err;
+
+        CBS_init(cbs, msg->fragment_data, msg->fragment_data_len);
+
+        return 1;
+
+ err:
+        CBB_cleanup(&msg->cbb);
+
+        return 0;
+}
+
+int
+dtls12_handshake_msg_fragment_next(struct dtls12_handshake_msg *msg)
+{
+        if (msg->fragment_offset > msg->msg_len)
+                return 0;
+        if (msg->msg_len - msg->fragment_offset < msg->fragment_len)
+                return 0;
+
+        if (!CBS_skip(&msg->cbs, msg->fragment_len))
+                return 0;
+
+        msg->fragment_offset += msg->fragment_len;
+
+        msg->fragment_pending = (CBS_len(&msg->cbs) > 0);
+
+        return 1;
+}
+
+int
+dtls12_handshake_msg_fragment_pending(struct dtls12_handshake_msg *msg)
+{
+        return msg->fragment_pending;
+}
diff --git a/src/lib/libssl/dtls12_internal.h b/src/lib/libssl/dtls12_internal.h
new file mode 100644
index 0000000000..f3fa9b7490
--- /dev/null
+++ b/src/lib/libssl/dtls12_internal.h
@@ -0,0 +1,46 @@
+/* $OpenBSD: dtls12_internal.h,v 1.1 2026/05/16 08:20:41 jsing Exp $ */
+/*
+ * Copyright (c) 2026 Joel Sing <jsing@openbsd.org>
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef HEADER_DTLS12_INTERNAL_H
+#define HEADER_DTLS12_INTERNAL_H
+
+#include <stddef.h>
+#include <stdint.h>
+
+#include "bytestring.h"
+
+__BEGIN_HIDDEN_DECLS
+
+struct dtls12_handshake_msg;
+
+struct dtls12_handshake_msg *dtls12_handshake_msg_new(void);
+void dtls12_handshake_msg_free(struct dtls12_handshake_msg *msg);
+void dtls12_handshake_msg_data(struct dtls12_handshake_msg *msg, CBS *cbs);
+uint8_t dtls12_handshake_msg_type(struct dtls12_handshake_msg *msg);
+int dtls12_handshake_msg_content(struct dtls12_handshake_msg *msg, CBS *cbs);
+int dtls12_handshake_msg_start(struct dtls12_handshake_msg *msg, CBB *body,
+    uint8_t msg_type, size_t msg_seq);
+int dtls12_handshake_msg_finish(struct dtls12_handshake_msg *msg);
+int dtls12_handshake_msg_fragment_build(struct dtls12_handshake_msg *msg,
+    size_t max_fragment_len, CBS *cbs);
+int dtls12_handshake_msg_fragment_next(struct dtls12_handshake_msg *msg);
+int dtls12_handshake_msg_fragment_pending(struct dtls12_handshake_msg *msg);
+int dtls12_handshake_msg_fragment_reset(struct dtls12_handshake_msg *msg);
+
+__END_HIDDEN_DECLS
+
+#endif
diff --git a/src/lib/libssl/dtls_local.h b/src/lib/libssl/dtls_local.h
index c7c413fef4..c1ac35055a 100644
--- a/src/lib/libssl/dtls_local.h
+++ b/src/lib/libssl/dtls_local.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: dtls_local.h,v 1.2 2022/11/26 17:23:18 tb Exp $ */
+/* $OpenBSD: dtls_local.h,v 1.9 2026/07/16 14:37:21 jsing Exp $ */
 /*
  * DTLS implementation written by Nagendra Modadugu
  * (nagendra@cs.stanford.edu) for the OpenSSL project 2005.
@@ -65,6 +65,7 @@
 #include <openssl/dtls1.h>
 
 #include "ssl_local.h"
+#include "dtls12_internal.h"
 #include "tls_content.h"
 
 __BEGIN_HIDDEN_DECLS
@@ -77,19 +78,14 @@ typedef struct dtls1_bitmap_st {
                                            encoding */
 } DTLS1_BITMAP;
 
-struct dtls1_retransmit_state {
-        SSL_SESSION *session;
-        unsigned short epoch;
-};
-
 struct hm_header_st {
+        uint16_t epoch;
         unsigned char type;
         unsigned long msg_len;
         unsigned short seq;
         unsigned long frag_off;
         unsigned long frag_len;
         unsigned int is_ccs;
-        struct dtls1_retransmit_state saved_retransmit_state;
 };
 
 struct dtls1_timeout_st {
@@ -184,13 +180,13 @@ struct dtls1_state_st {
 
         unsigned int retransmitting;
         unsigned int change_cipher_spec_ok;
+
+        struct dtls12_handshake_msg *hs_msg;
 };
 
 int dtls1_do_write(SSL *s, int type);
 int dtls1_read_bytes(SSL *s, int type, unsigned char *buf, int len, int peek);
-void dtls1_set_message_header(SSL *s, unsigned char mt, unsigned long len,
-    unsigned long frag_off, unsigned long frag_len);
-void dtls1_set_message_header_int(SSL *s, unsigned char mt,
+void dtls1_set_message_header(SSL *s, unsigned char mt,
     unsigned long len, unsigned short seq_num, unsigned long frag_off,
     unsigned long frag_len);
 
@@ -202,8 +198,6 @@ int dtls1_write_bytes(SSL *s, int type, const void *buf, int len);
 
 int dtls1_read_failed(SSL *s, int code);
 int dtls1_buffer_message(SSL *s, int ccs);
-int dtls1_retransmit_message(SSL *s, unsigned short seq,
-    unsigned long frag_off, int *found);
 int dtls1_get_queue_priority(unsigned short seq, int is_ccs);
 int dtls1_retransmit_buffered_messages(SSL *s);
 void dtls1_clear_record_buffer(SSL *s);
@@ -212,7 +206,6 @@ void dtls1_reset_read_seq_numbers(SSL *s);
 struct timeval* dtls1_get_timeout(SSL *s, struct timeval* timeleft);
 int dtls1_check_timeout_num(SSL *s);
 int dtls1_handle_timeout(SSL *s);
-const SSL_CIPHER *dtls1_get_cipher(unsigned int u);
 void dtls1_start_timer(SSL *s);
 void dtls1_stop_timer(SSL *s);
 int dtls1_is_timer_expired(SSL *s);
@@ -227,6 +220,8 @@ long dtls1_ctrl(SSL *s, int cmd, long larg, void *parg);
 int dtls1_get_message(SSL *s, int st1, int stn, int mt, long max);
 int dtls1_get_record(SSL *s);
 
+int dtls12_ccs_built(SSL *s);
+int dtls12_handshake_msg_built(SSL *s);
 __END_HIDDEN_DECLS
 
 #endif /* !HEADER_DTLS_LOCL_H */
diff --git a/src/lib/libssl/man/Makefile b/src/lib/libssl/man/Makefile
index c8f6e28541..fa2935e5da 100644
--- a/src/lib/libssl/man/Makefile
+++ b/src/lib/libssl/man/Makefile
@@ -1,4 +1,4 @@
-# $OpenBSD: Makefile,v 1.77 2022/07/13 20:52:36 schwarze Exp $
+# $OpenBSD: Makefile,v 1.78 2026/09/01 06:48:34 jsg Exp $
 
 .include <bsd.own.mk>
 
@@ -38,6 +38,7 @@ MAN =	BIO_f_ssl.3 \
         SSL_CTX_set_min_proto_version.3 \
         SSL_CTX_set_mode.3 \
         SSL_CTX_set_msg_callback.3 \
+        SSL_CTX_set_num_tickets.3 \
         SSL_CTX_set_options.3 \
         SSL_CTX_set_quiet_shutdown.3 \
         SSL_CTX_set_read_ahead.3 \
diff --git a/src/lib/libssl/man/SSL_CTX_sess_set_get_cb.3 b/src/lib/libssl/man/SSL_CTX_sess_set_get_cb.3
index 62a6698399..164d39bf3d 100644
--- a/src/lib/libssl/man/SSL_CTX_sess_set_get_cb.3
+++ b/src/lib/libssl/man/SSL_CTX_sess_set_get_cb.3
@@ -1,4 +1,4 @@
-.\"     $OpenBSD: SSL_CTX_sess_set_get_cb.3,v 1.8 2025/06/08 22:52:00 schwarze Exp $
+.\"     $OpenBSD: SSL_CTX_sess_set_get_cb.3,v 1.9 2026/08/25 00:08:28 jsg Exp $
 .\"     OpenSSL b97fdb57 Nov 11 09:33:09 2016 +0100
 .\"
 .\" This file was written by Lutz Jaenicke <jaenicke@openssl.org>.
@@ -49,7 +49,7 @@
 .\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 .\" OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd $Mdocdate: June 8 2025 $
+.Dd $Mdocdate: August 25 2026 $
 .Dt SSL_CTX_SESS_SET_GET_CB 3
 .Os
 .Sh NAME
@@ -123,7 +123,7 @@ removed by the SSL engine (because it is considered faulty or the session has
 become obsolete because of exceeding the timeout value).
 .Pp
 .Fn SSL_CTX_sess_set_get_cb
-sets the callback function which is called whenever a SSL/TLS client proposes
+sets the callback function which is called whenever an SSL/TLS client proposes
 to resume a session but the session cannot be found in the internal session
 cache (see
 .Xr SSL_CTX_set_session_cache_mode 3 ) .
diff --git a/src/lib/libssl/man/SSL_CTX_set_cert_verify_callback.3 b/src/lib/libssl/man/SSL_CTX_set_cert_verify_callback.3
index 2e2beac850..e07c71e266 100644
--- a/src/lib/libssl/man/SSL_CTX_set_cert_verify_callback.3
+++ b/src/lib/libssl/man/SSL_CTX_set_cert_verify_callback.3
@@ -1,4 +1,4 @@
-.\"     $OpenBSD: SSL_CTX_set_cert_verify_callback.3,v 1.6 2025/06/08 22:52:00 schwarze Exp $
+.\"     $OpenBSD: SSL_CTX_set_cert_verify_callback.3,v 1.7 2026/08/25 00:08:28 jsg Exp $
 .\"     OpenSSL b97fdb57 Nov 11 09:33:09 2016 +0100
 .\"
 .\" This file was written by Lutz Jaenicke <jaenicke@openssl.org>.
@@ -48,7 +48,7 @@
 .\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 .\" OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd $Mdocdate: June 8 2025 $
+.Dd $Mdocdate: August 25 2026 $
 .Dt SSL_CTX_SET_CERT_VERIFY_CALLBACK 3
 .Os
 .Sh NAME
@@ -74,7 +74,7 @@ inherit the setting valid at the time when
 .Xr SSL_new 3
 is called.
 .Pp
-Whenever a certificate is verified during a SSL/TLS handshake,
+Whenever a certificate is verified during an SSL/TLS handshake,
 a verification function is called.
 If the application does not explicitly specify a verification callback
 function, the built-in verification function is used.
diff --git a/src/lib/libssl/man/SSL_CTX_set_keylog_callback.3 b/src/lib/libssl/man/SSL_CTX_set_keylog_callback.3
index 0cb36b07c6..70ea0ff486 100644
--- a/src/lib/libssl/man/SSL_CTX_set_keylog_callback.3
+++ b/src/lib/libssl/man/SSL_CTX_set_keylog_callback.3
@@ -1,4 +1,4 @@
-.\" $OpenBSD: SSL_CTX_set_keylog_callback.3,v 1.4 2025/06/08 22:52:00 schwarze Exp $
+.\" $OpenBSD: SSL_CTX_set_keylog_callback.3,v 1.5 2026/09/01 05:51:25 jsg Exp $
 .\" OpenSSL pod checked up to: 61f805c1 Jan 16 01:01:46 2018 +0800
 .\"
 .\" Copyright (c) 2021 Bob Beck <beck@openbsd.org>
@@ -15,7 +15,7 @@
 .\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 .\"
-.Dd $Mdocdate: June 8 2025 $
+.Dd $Mdocdate: September 1 2026 $
 .Dt SSL_CTX_SET_KEYLOG_CALLBACK 3
 .Os
 .Sh NAME
@@ -52,6 +52,6 @@ if no callback has been set.
 .Xr ssl 3 ,
 .Xr SSL_CTX_new 3
 .Sh HISTORY
-These function first appeared in OpenSSL 1.1.1
+These functions first appeared in OpenSSL 1.1.1
 and have been available since
 .Ox 7.1 .
diff --git a/src/lib/libssl/man/SSL_CTX_set_num_tickets.3 b/src/lib/libssl/man/SSL_CTX_set_num_tickets.3
index 093387725a..f5b7a9c5b3 100644
--- a/src/lib/libssl/man/SSL_CTX_set_num_tickets.3
+++ b/src/lib/libssl/man/SSL_CTX_set_num_tickets.3
@@ -1,4 +1,4 @@
-.\" $OpenBSD: SSL_CTX_set_num_tickets.3,v 1.3 2025/06/08 22:52:00 schwarze Exp $
+.\" $OpenBSD: SSL_CTX_set_num_tickets.3,v 1.4 2026/09/01 05:51:25 jsg Exp $
 .\" OpenSSL pod checked up to: 5402f96a Sep 11 09:58:52 2021 +0100
 .\"
 .\" Copyright (c) 2021 Bob Beck <beck@openbsd.org>
@@ -15,7 +15,7 @@
 .\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 .\"
-.Dd $Mdocdate: June 8 2025 $
+.Dd $Mdocdate: September 1 2026 $
 .Dt SSL_CTX_SET_NUM_TICKETS 3
 .Os
 .Sh NAME
@@ -59,6 +59,6 @@ return the previously set number of tickets, or 0 if it has not been set.
 .Xr ssl 3 ,
 .Xr SSL_CTX_new 3
 .Sh HISTORY
-These function first appeared in OpenSSL 1.1.1
+These functions first appeared in OpenSSL 1.1.1
 and have been available since
 .Ox 7.1 .
diff --git a/src/lib/libssl/man/SSL_CTX_set_options.3 b/src/lib/libssl/man/SSL_CTX_set_options.3
index 5e81c978bd..4f486b1945 100644
--- a/src/lib/libssl/man/SSL_CTX_set_options.3
+++ b/src/lib/libssl/man/SSL_CTX_set_options.3
@@ -1,4 +1,4 @@
-.\" $OpenBSD: SSL_CTX_set_options.3,v 1.17 2025/06/08 22:52:00 schwarze Exp $
+.\" $OpenBSD: SSL_CTX_set_options.3,v 1.19 2026/07/17 12:34:25 kenjiro Exp $
 .\" full merge up to: OpenSSL 7946ab33 Dec 6 17:56:41 2015 +0100
 .\" selective merge up to: OpenSSL edb79c3a Mar 29 10:07:14 2017 +1000
 .\"
@@ -52,7 +52,7 @@
 .\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 .\" OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd $Mdocdate: June 8 2025 $
+.Dd $Mdocdate: July 17 2026 $
 .Dt SSL_CTX_SET_OPTIONS 3
 .Os
 .Sh NAME
@@ -151,14 +151,8 @@ The following
 .Em bug workaround
 options are available:
 .Bl -tag -width Ds
-.It Dv SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
-Disables a countermeasure against a TLS 1.0 protocol vulnerability
-affecting CBC ciphers, which cannot be handled by some broken SSL
-implementations.
-This option has no effect for connections using other ciphers.
 .It Dv SSL_OP_ALL
-This is currently an alias for
-.Dv SSL_OP_LEGACY_SERVER_CONNECT .
+This currently does nothing.
 .El
 .Pp
 It is usually safe to use
@@ -179,12 +173,8 @@ When set, the server will choose following its own preferences.
 Turn on Cookie Exchange as described in RFC 4347 Section 4.2.1.
 Only affects DTLS connections.
 .It Dv SSL_OP_LEGACY_SERVER_CONNECT
-Allow legacy insecure renegotiation between OpenSSL and unpatched servers
-.Em only :
-this option is currently set by default.
-See the
-.Sx SECURE RENEGOTIATION
-section for more details.
+Allow connections to legacy servers that do not support secure renegotiation.
+This option is not set by default.
 .It Dv SSL_OP_NO_DTLSv1
 Do not use the DTLSv1 protocol.
 Deprecated; use
@@ -229,6 +219,7 @@ instead.
 The following options used to be supported at some point in the past
 and no longer have any effect:
 .Dv SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION ,
+.Dv SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS ,
 .Dv SSL_OP_EPHEMERAL_RSA ,
 .Dv SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER ,
 .Dv SSL_OP_MICROSOFT_SESS_ID_BUG ,
@@ -250,83 +241,6 @@ and no longer have any effect:
 .Dv SSL_OP_TLS_D5_BUG ,
 .Dv SSL_OP_TLS_ROLLBACK_BUG ,
 .Dv SSL_OP_TLSEXT_PADDING .
-.Sh SECURE RENEGOTIATION
-OpenSSL 0.9.8m and later always attempts to use secure renegotiation as
-described in RFC 5746.
-This counters the prefix attack described in CVE-2009-3555 and elsewhere.
-.Pp
-This attack has far-reaching consequences which application writers should be
-aware of.
-In the description below an implementation supporting secure renegotiation is
-referred to as
-.Dq patched .
-A server not supporting secure
-renegotiation is referred to as
-.Dq unpatched .
-.Pp
-The following sections describe the operations permitted by OpenSSL's secure
-renegotiation implementation.
-.Ss Patched client and server
-Connections and renegotiation are always permitted by OpenSSL implementations.
-.Ss Unpatched client and patched OpenSSL server
-The initial connection succeeds but client renegotiation is denied by the
-server with a
-.Em no_renegotiation
-warning alert.
-.Pp
-If the patched OpenSSL server attempts to renegotiate, a fatal
-.Em handshake_failure
-alert is sent.
-This is because the server code may be unaware of the unpatched nature of the
-client.
-.Pp
-Note that a bug in OpenSSL clients earlier than 0.9.8m (all of which
-are unpatched) will result in the connection hanging if it receives a
-.Em no_renegotiation
-alert.
-OpenSSL versions 0.9.8m and later will regard a
-.Em no_renegotiation
-alert as fatal and respond with a fatal
-.Em handshake_failure
-alert.
-This is because the OpenSSL API currently has no provision to indicate to an
-application that a renegotiation attempt was refused.
-.Ss Patched OpenSSL client and unpatched server
-If the option
-.Dv SSL_OP_LEGACY_SERVER_CONNECT
-is set then initial connections and renegotiation between patched OpenSSL
-clients and unpatched servers succeeds.
-If neither option is set then initial connections to unpatched servers will
-fail.
-.Pp
-The option
-.Dv SSL_OP_LEGACY_SERVER_CONNECT
-is currently set by default even though it has security implications:
-otherwise it would be impossible to connect to unpatched servers (i.e., all of
-them initially) and this is clearly not acceptable.
-Renegotiation is permitted because this does not add any additional security
-issues: during an attack clients do not see any renegotiations anyway.
-.Pp
-As more servers become patched, the option
-.Dv SSL_OP_LEGACY_SERVER_CONNECT
-will
-.Em not
-be set by default in a future version of OpenSSL.
-.Pp
-OpenSSL client applications wishing to ensure they can connect to unpatched
-servers should always
-.Em set
-.Dv SSL_OP_LEGACY_SERVER_CONNECT .
-.Pp
-OpenSSL client applications that want to ensure they can
-.Em not
-connect to unpatched servers (and thus avoid any security issues) should always
-.Em clear
-.Dv SSL_OP_LEGACY_SERVER_CONNECT
-using
-.Fn SSL_CTX_clear_options
-or
-.Fn SSL_clear_options .
 .Sh RETURN VALUES
 .Fn SSL_CTX_set_options
 and
diff --git a/src/lib/libssl/man/SSL_CTX_set_quiet_shutdown.3 b/src/lib/libssl/man/SSL_CTX_set_quiet_shutdown.3
index 20b882167b..eafa8fc642 100644
--- a/src/lib/libssl/man/SSL_CTX_set_quiet_shutdown.3
+++ b/src/lib/libssl/man/SSL_CTX_set_quiet_shutdown.3
@@ -1,4 +1,4 @@
-.\"     $OpenBSD: SSL_CTX_set_quiet_shutdown.3,v 1.7 2025/06/08 22:52:00 schwarze Exp $
+.\"     $OpenBSD: SSL_CTX_set_quiet_shutdown.3,v 1.8 2026/08/25 00:08:28 jsg Exp $
 .\"     OpenSSL b97fdb57 Nov 11 09:33:09 2016 +0100
 .\"
 .\" This file was written by Lutz Jaenicke <jaenicke@openssl.org>.
@@ -48,7 +48,7 @@
 .\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 .\" OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd $Mdocdate: June 8 2025 $
+.Dd $Mdocdate: August 25 2026 $
 .Dt SSL_CTX_SET_QUIET_SHUTDOWN 3
 .Os
 .Sh NAME
@@ -119,7 +119,7 @@ returns the
 setting of
 .Fa ssl .
 .Pp
-Normally when a SSL connection is finished, the parties must send out
+Normally when an SSL connection is finished, the parties must send out
 .Dq close notify
 alert messages using
 .Xr SSL_shutdown 3
diff --git a/src/lib/libssl/man/SSL_alert_type_string.3 b/src/lib/libssl/man/SSL_alert_type_string.3
index 0f051cc0a6..9d3c03555c 100644
--- a/src/lib/libssl/man/SSL_alert_type_string.3
+++ b/src/lib/libssl/man/SSL_alert_type_string.3
@@ -1,4 +1,4 @@
-.\"     $OpenBSD: SSL_alert_type_string.3,v 1.8 2025/06/08 22:52:00 schwarze Exp $
+.\"     $OpenBSD: SSL_alert_type_string.3,v 1.9 2026/06/22 14:07:17 tb Exp $
 .\"     OpenSSL b97fdb57 Nov 11 09:33:09 2016 +0100
 .\"
 .\" This file was written by Lutz Jaenicke <jaenicke@openssl.org>.
@@ -48,7 +48,7 @@
 .\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 .\" OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd $Mdocdate: June 8 2025 $
+.Dd $Mdocdate: June 22 2026 $
 .Dt SSL_ALERT_TYPE_STRING 3
 .Os
 .Sh NAME
@@ -78,9 +78,8 @@ returns a string indicating the type of the alert specified by
 .Fa value .
 .Pp
 .Fn SSL_alert_desc_string
-returns a two letter string as a short form describing the reason of the alert
-specified by
-.Fa value .
+always returns the two letter string
+.Qq !! .
 .Pp
 .Fn SSL_alert_desc_string_long
 returns a string describing the reason of the alert specified by
@@ -114,9 +113,9 @@ The following strings can occur for
 or
 .Fn SSL_alert_type_string_long :
 .Bl -tag -width Ds
-.It \(dqW\(dq/\(dqwarning\(dq
-.It \(dqF\(dq/\(dqfatal\(dq
-.It \(dqU\(dq/\(dqunknown\(dq
+.It Qo W Qc Ns / Ns Qq warning
+.It Qo F Qc Ns / Ns Qq fatal
+.It Qo U Qc Ns / Ns Qq unknown
 This indicates that no support is available for this alert type.
 Probably
 .Fa value
@@ -124,102 +123,100 @@ does not contain a correct alert message.
 .El
 .Pp
 The following strings can occur for
-.Fn SSL_alert_desc_string
-or
 .Fn SSL_alert_desc_string_long :
 .Bl -tag -width Ds
-.It \(dqCN\(dq/\(dqclose notify\(dq
+.It Qq close notify
 The connection shall be closed.
 This is a warning alert.
-.It \(dqUM\(dq/\(dqunexpected message\(dq
+.It Qq unexpected message
 An inappropriate message was received.
 This alert is always fatal and should never be observed in communication
 between proper implementations.
-.It \(dqBM\(dq/\(dqbad record mac\(dq
+.It Qq bad record mac
 This alert is returned if a record is received with an incorrect MAC.
 This message is always fatal.
-.It \(dqDF\(dq/\(dqdecompression failure\(dq
+.It Qq decompression failure
 The decompression function received improper input
 (e.g., data that would expand to excessive length).
 This message is always fatal.
-.It \(dqHF\(dq/\(dqhandshake failure\(dq
+.It Qq handshake failure
 Reception of a handshake_failure alert message indicates that the sender was
 unable to negotiate an acceptable set of security parameters given the options
 available.
 This is a fatal error.
-.It \(dqNC\(dq/\(dqno certificate\(dq
+.It Qq no certificate
 A client, that was asked to send a certificate, does not send a certificate
 (SSLv3 only).
-.It \(dqBC\(dq/\(dqbad certificate\(dq
+.It Qq bad certificate
 A certificate was corrupt, contained signatures that did not verify correctly,
 etc.
-.It \(dqUC\(dq/\(dqunsupported certificate\(dq
+.It Qq unsupported certificate
 A certificate was of an unsupported type.
-.It \(dqCR\(dq/\(dqcertificate revoked\(dq
+.It Qq certificate revoked
 A certificate was revoked by its signer.
-.It \(dqCE\(dq/\(dqcertificate expired\(dq
+.It Qq certificate expired
 A certificate has expired or is not currently valid.
-.It \(dqCU\(dq/\(dqcertificate unknown\(dq
+.It Qq certificate unknown
 Some other (unspecified) issue arose in processing the certificate,
 rendering it unacceptable.
-.It \(dqIP\(dq/\(dqillegal parameter\(dq
+.It Qq illegal parameter
 A field in the handshake was out of range or inconsistent with other fields.
 This is always fatal.
-.It \(dqDC\(dq/\(dqdecryption failed\(dq
+.It Qq decryption failed
 A TLSCiphertext decrypted in an invalid way: either it wasn't an even multiple
 of the block length or its padding values, when checked, weren't correct.
 This message is always fatal.
-.It \(dqRO\(dq/\(dqrecord overflow\(dq
+.It Qq record overflow
 A TLSCiphertext record was received which had a length more than
 2^14+2048 bytes, or a record decrypted to a TLSCompressed record with more than
 2^14+1024 bytes.
 This message is always fatal.
-.It \(dqCA\(dq/\(dqunknown CA\(dq
+.It Qq unknown CA
 A valid certificate chain or partial chain was received,
 but the certificate was not accepted because the CA certificate could not be
 located or couldn't be matched with a known, trusted CA.
 This message is always fatal.
-.It \(dqAD\(dq/\(dqaccess denied\(dq
+.It Qq access denied
 A valid certificate was received, but when access control was applied,
 the sender decided not to proceed with negotiation.
 This message is always fatal.
-.It \(dqDE\(dq/\(dqdecode error\(dq
+.It Qq decode error
 A message could not be decoded because some field was out of the specified
 range or the length of the message was incorrect.
 This message is always fatal.
-.It \(dqCY\(dq/\(dqdecrypt error\(dq
+.It Qq decrypt error
 A handshake cryptographic operation failed, including being unable to correctly
 verify a signature, decrypt a key exchange, or validate a finished message.
-.It \(dqER\(dq/\(dqexport restriction\(dq
+.It Qq export restriction
 A negotiation not in compliance with export restrictions was detected;
 for example, attempting to transfer a 1024 bit ephemeral RSA key for the
 RSA_EXPORT handshake method.
 This message is always fatal.
-.It \(dqPV\(dq/\(dqprotocol version\(dq
+.It Qq protocol version
 The protocol version the client has attempted to negotiate is recognized,
 but not supported.
 (For example, old protocol versions might be avoided for security reasons.)
 This message is always fatal.
-.It \(dqIS\(dq/\(dqinsufficient security\(dq
+.It Qq insufficient security
 Returned instead of handshake_failure when a negotiation has failed
 specifically because the server requires ciphers more secure than those
 supported by the client.
 This message is always fatal.
-.It \(dqIE\(dq/\(dqinternal error\(dq
+.It Qq internal error
 An internal error unrelated to the peer or the correctness of the protocol
 makes it impossible to continue (such as a memory allocation failure).
 This message is always fatal.
-.It \(dqIF\(dq/\(dqinappropriate fallback\(dq
+.It Qq inappropriate fallback
 Sent by a server in response to an invalid connection retry attempt from
 a client (see RFC 7507).
-.It \(dqUS\(dq/\(dquser canceled\(dq
+.It Qq user canceled
 This handshake is being canceled for some reason unrelated to a protocol
 failure.
 If the user cancels an operation after the handshake is complete,
 just closing the connection by sending a close_notify is more appropriate.
 This alert should be followed by a close_notify.
 This message is generally a warning.
-.It \(dqNR\(dq/\(dqno renegotiation\(dq
+.It Qq no renegotiation
 Sent by the client in response to a hello request or by the server in response
 to a client hello after initial handshaking.
 Either of these would normally lead to renegotiation; when that is not
@@ -230,16 +227,16 @@ process to satisfy a request; the process might receive security parameters
 (key length, authentication, etc.) at startup and it might be difficult to
 communicate changes to these parameters after that point.
 This message is always a warning.
-.It \(dqUP\(dq/\(dqunknown PSK identity\(dq
+.It Qq unknown PSK identity
 Sent by the server to indicate that it does not recognize a PSK identity or an
 SRP identity.
-.It \(dqCQ\(dq/\(dqcertificate required\(dq
+.It Qq certificate required
 Sent by servers when a client certificate is desired but none was provided
 by the client.
-.It \(dqAP\(dq/\(dqno application protocol\(dq
+.It Qq no application protocol
 Sent by servers when a client ALPN extension advertises only protocols that
 the server does not support (see RFC 7301).
-.It \(dqUK\(dq/\(dqunknown\(dq
+.It Qq unknown
 This indicates that no description is available for this alert type.
 Probably
 .Fa value
diff --git a/src/lib/libssl/man/SSL_do_handshake.3 b/src/lib/libssl/man/SSL_do_handshake.3
index 78b41db2f4..cf104b10aa 100644
--- a/src/lib/libssl/man/SSL_do_handshake.3
+++ b/src/lib/libssl/man/SSL_do_handshake.3
@@ -1,4 +1,4 @@
-.\"     $OpenBSD: SSL_do_handshake.3,v 1.7 2025/06/08 22:52:00 schwarze Exp $
+.\"     $OpenBSD: SSL_do_handshake.3,v 1.8 2026/08/25 00:08:28 jsg Exp $
 .\"     OpenSSL b97fdb57 Nov 11 09:33:09 2016 +0100
 .\"
 .\" This file was written by Martin Sjoegren <martin@strakt.com>.
@@ -48,7 +48,7 @@
 .\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 .\" OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd $Mdocdate: June 8 2025 $
+.Dd $Mdocdate: August 25 2026 $
 .Dt SSL_DO_HANDSHAKE 3
 .Os
 .Sh NAME
@@ -61,7 +61,7 @@
 .Fn SSL_do_handshake "SSL *ssl"
 .Sh DESCRIPTION
 .Fn SSL_do_handshake
-will wait for a SSL/TLS handshake to take place.
+will wait for an SSL/TLS handshake to take place.
 If the connection is in client mode, the handshake will be started.
 The handshake routines may have to be explicitly set in advance using either
 .Xr SSL_set_connect_state 3
diff --git a/src/lib/libssl/man/SSL_get_ex_data_X509_STORE_CTX_idx.3 b/src/lib/libssl/man/SSL_get_ex_data_X509_STORE_CTX_idx.3
index 234034ac2d..1b1656e097 100644
--- a/src/lib/libssl/man/SSL_get_ex_data_X509_STORE_CTX_idx.3
+++ b/src/lib/libssl/man/SSL_get_ex_data_X509_STORE_CTX_idx.3
@@ -1,4 +1,4 @@
-.\"     $OpenBSD: SSL_get_ex_data_X509_STORE_CTX_idx.3,v 1.6 2025/06/08 22:52:00 schwarze Exp $
+.\"     $OpenBSD: SSL_get_ex_data_X509_STORE_CTX_idx.3,v 1.7 2026/08/25 00:08:28 jsg Exp $
 .\"     OpenSSL 9b86974e Aug 17 15:21:33 2015 -0400
 .\"
 .\" This file was written by Lutz Jaenicke <jaenicke@openssl.org>.
@@ -48,7 +48,7 @@
 .\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 .\" OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd $Mdocdate: June 8 2025 $
+.Dd $Mdocdate: August 25 2026 $
 .Dt SSL_GET_EX_DATA_X509_STORE_CTX_IDX 3
 .Os
 .Sh NAME
@@ -67,7 +67,7 @@ object is stored into the
 .Vt X509_STORE_CTX
 object.
 .Pp
-Whenever a
+Whenever an
 .Vt X509_STORE_CTX
 object is created for the verification of the peer's certificate during a
 handshake, a pointer to the
diff --git a/src/lib/libssl/man/SSL_get_finished.3 b/src/lib/libssl/man/SSL_get_finished.3
index e5c8a36cf6..bf3913f7f0 100644
--- a/src/lib/libssl/man/SSL_get_finished.3
+++ b/src/lib/libssl/man/SSL_get_finished.3
@@ -1,4 +1,4 @@
-.\" $OpenBSD: SSL_get_finished.3,v 1.3 2025/06/08 22:52:00 schwarze Exp $
+.\" $OpenBSD: SSL_get_finished.3,v 1.5 2026/08/21 17:15:22 tb Exp $
 .\"
 .\" Copyright (c) 2020 Theo Buehler <tb@openbsd.org>
 .\"
@@ -14,7 +14,7 @@
 .\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 .\"
-.Dd $Mdocdate: June 8 2025 $
+.Dd $Mdocdate: August 21 2026 $
 .Dt SSL_GET_FINISHED 3
 .Os
 .Sh NAME
@@ -49,8 +49,6 @@ i.e., 64 bytes.
 .\" which is currently either 32 bytes for SHA-256 or 48 bytes for SHA-384.
 .\" In TLSv1.2 the length defaults to 12 bytes, but it can explicitly be
 .\" specified by the ciphersuite to be longer.
-.\" In TLS versions 1.1 and 1.0, the finished message has a fixed length
-.\" of 12 bytes.
 .Sh RETURN VALUES
 .Fn SSL_get_finished
 and
@@ -64,8 +62,8 @@ finished message.
 .Xr SSL_get_session 3 ,
 .Xr SSL_set_session 3
 .Sh STANDARDS
-RFC 8446: The Transport Layer Security (TLS) Protocol Version 1.3,
-section 4.4.4: Finished.
+RFC 9846: The Transport Layer Security (TLS) Protocol Version 1.3,
+section 4.5.3: Finished.
 .Pp
 RFC 5246: The Transport Layer Security (TLS) Protocol Version 1.2,
 section 7.4.9: Finished.
diff --git a/src/lib/libssl/man/SSL_read_early_data.3 b/src/lib/libssl/man/SSL_read_early_data.3
index d36b1e49f7..5ad0dc1d9d 100644
--- a/src/lib/libssl/man/SSL_read_early_data.3
+++ b/src/lib/libssl/man/SSL_read_early_data.3
@@ -1,4 +1,4 @@
-.\" $OpenBSD: SSL_read_early_data.3,v 1.5 2025/06/08 22:52:00 schwarze Exp $
+.\" $OpenBSD: SSL_read_early_data.3,v 1.6 2026/08/21 17:15:22 tb Exp $
 .\" content checked up to: OpenSSL 6328d367 Jul 4 21:58:30 2020 +0200
 .\"
 .\" Copyright (c) 2020 Ingo Schwarze <schwarze@openbsd.org>
@@ -15,7 +15,7 @@
 .\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 .\"
-.Dd $Mdocdate: June 8 2025 $
+.Dd $Mdocdate: August 21 2026 $
 .Dt SSL_READ_EARLY_DATA 3
 .Os
 .Sh NAME
@@ -158,15 +158,15 @@ or
 .Xr SSL_read 3 ,
 .Xr SSL_write 3
 .Sh STANDARDS
-RFC 8446: The Transport Layer Security (TLS) Protocol Version 1.3:
-.Bl -tag -width "section 4.2.10" -compact
+RFC 9846: The Transport Layer Security (TLS) Protocol Version 1.3:
+.Bl -tag -width "section 4.3.10" -compact
 .It Section 2.3
 0-RTT data
-.It Section 4.2.10
+.It Section 4.3.10
 Early Data Indication
 .It Section 8
 0-RTT and Anti-Replay
-.It Appendix E.5
+.It Appendix F.5
 Replay Attacks on 0-RTT
 .El
 .Sh HISTORY
diff --git a/src/lib/libssl/s3_lib.c b/src/lib/libssl/s3_lib.c
index bcf26bec40..9a5e8cd2cc 100644
--- a/src/lib/libssl/s3_lib.c
+++ b/src/lib/libssl/s3_lib.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: s3_lib.c,v 1.258 2025/12/04 21:16:17 beck Exp $ */
+/* $OpenBSD: s3_lib.c,v 1.262 2026/08/21 17:15:22 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -722,7 +722,7 @@ const SSL_CIPHER ssl3_ciphers[] = {
 
 #ifdef LIBRESSL_HAS_TLS1_3
         /*
-         * TLSv1.3 cipher suites (RFC 8446).
+         * TLSv1.3 cipher suites (RFC 9846).
          */
         {
                 .value = 0x1301,
@@ -1163,13 +1163,6 @@ ssl3_pending(const SSL *s)
 }
 
 int
-ssl3_handshake_msg_hdr_len(SSL *s)
-{
-        return (SSL_is_dtls(s) ? DTLS1_HM_HEADER_LENGTH :
-            SSL3_HM_HEADER_LENGTH);
-}
-
-int
 ssl3_handshake_msg_start(SSL *s, CBB *handshake, CBB *body, uint8_t msg_type)
 {
         int ret = 0;
@@ -1216,18 +1209,8 @@ ssl3_handshake_msg_finish(SSL *s, CBB *handshake)
         s->init_off = 0;
 
         if (SSL_is_dtls(s)) {
-                unsigned long len;
-                uint8_t msg_type;
-                CBS cbs;
-
-                CBS_init(&cbs, data, outlen);
-                if (!CBS_get_u8(&cbs, &msg_type))
+                if (!dtls12_handshake_msg_built(s))
                         goto err;
-
-                len = outlen - ssl3_handshake_msg_hdr_len(s);
-
-                dtls1_set_message_header(s, msg_type, len, 0, len);
-                dtls1_buffer_message(s, 0);
         }
 
         ret = 1;
@@ -1396,7 +1379,7 @@ ssl3_clear(SSL *s)
         s->s3->hs.state = SSL_ST_BEFORE|((s->server) ? SSL_ST_ACCEPT : SSL_ST_CONNECT);
 }
 
-long
+static long
 _SSL_get_shared_group(SSL *s, long n)
 {
         size_t count;
@@ -1429,7 +1412,7 @@ _SSL_get_shared_group(SSL *s, long n)
         return nid;
 }
 
-long
+static long
 _SSL_get_peer_tmp_key(SSL *s, EVP_PKEY **key)
 {
         EVP_PKEY *pkey = NULL;
diff --git a/src/lib/libssl/ssl.h b/src/lib/libssl/ssl.h
index 4ad73af722..28ee7f56bc 100644
--- a/src/lib/libssl/ssl.h
+++ b/src/lib/libssl/ssl.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl.h,v 1.250 2026/04/03 13:11:00 jsing Exp $ */
+/* $OpenBSD: ssl.h,v 1.251 2026/06/14 14:25:55 jsing Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -402,8 +402,7 @@ typedef int (*tls_session_secret_cb_fn)(SSL *s, void *secret, int *secret_len,
 #define SSL_OP_NO_DTLSv1_2                              0x80000000L
 
 /* SSL_OP_ALL: various bug workarounds that should be rather harmless. */
-#define SSL_OP_ALL \
-    (SSL_OP_LEGACY_SERVER_CONNECT)
+#define SSL_OP_ALL                                      0x0
 
 /* Obsolete flags kept for compatibility. No sane code should use them. */
 #define SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION        0x0
diff --git a/src/lib/libssl/ssl_clnt.c b/src/lib/libssl/ssl_clnt.c
index 6ef81a1706..37684aba91 100644
--- a/src/lib/libssl/ssl_clnt.c
+++ b/src/lib/libssl/ssl_clnt.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl_clnt.c,v 1.171 2026/04/03 12:58:19 jsing Exp $ */
+/* $OpenBSD: ssl_clnt.c,v 1.177 2026/08/29 08:41:17 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -893,7 +893,7 @@ ssl3_get_server_hello(SSL *s)
         if (s->s3->hs.our_max_tls_version >= TLS1_2_VERSION &&
             s->s3->hs.negotiated_tls_version < s->s3->hs.our_max_tls_version) {
                 /*
-                 * RFC 8446 section 4.1.3. We must not downgrade if the server
+                 * RFC 9846 section 4.2.3. We must not downgrade if the server
                  * random value contains the TLS 1.2 or TLS 1.1 magical value.
                  */
                 if (!CBS_skip(&server_random,
@@ -1003,16 +1003,17 @@ ssl3_get_server_hello(SSL *s)
                 goto fatal_err;
         }
 
-        /* TLS v1.2 only ciphersuites require v1.2 or later. */
-        if ((cipher->algorithm_ssl & SSL_TLSV1_2) &&
-            s->s3->hs.negotiated_tls_version < TLS1_2_VERSION) {
+        if (!ssl_cipher_in_list(SSL_get_ciphers(s), cipher)) {
+                /* we did not say we would use this cipher */
                 al = SSL_AD_ILLEGAL_PARAMETER;
                 SSLerror(s, SSL_R_WRONG_CIPHER_RETURNED);
                 goto fatal_err;
         }
 
-        if (!ssl_cipher_in_list(SSL_get_ciphers(s), cipher)) {
-                /* we did not say we would use this cipher */
+        /* Require a ciphersuite that can be used with TLSv1.2. */
+        if (cipher->algorithm_ssl != SSL_SSLV3 &&
+            cipher->algorithm_ssl != SSL_TLSV1 &&
+            cipher->algorithm_ssl != SSL_TLSV1_2) {
                 al = SSL_AD_ILLEGAL_PARAMETER;
                 SSLerror(s, SSL_R_WRONG_CIPHER_RETURNED);
                 goto fatal_err;
@@ -1034,13 +1035,6 @@ ssl3_get_server_hello(SSL *s)
         if (!tls1_transcript_hash_init(s))
                 goto err;
 
-        /*
-         * Don't digest cached records if no sigalgs: we may need them for
-         * client authentication.
-         */
-        if (!SSL_USE_SIGALGS(s))
-                tls1_transcript_free(s);
-
         if (!CBS_get_u8(&cbs, &compression_method))
                 goto decode_err;
 
@@ -1384,10 +1378,9 @@ ssl3_get_server_key_exchange(SSL *s)
                         goto fatal_err;
                 }
 
-                if (SSL_USE_SIGALGS(s)) {
-                        if (!CBS_get_u16(&cbs, &sigalg_value))
-                                goto decode_err;
-                }
+                if (!CBS_get_u16(&cbs, &sigalg_value))
+                        goto decode_err;
+
                 if (!CBS_get_u16_length_prefixed(&cbs, &signature))
                         goto decode_err;
                 if (CBS_len(&signature) > EVP_PKEY_size(pkey)) {
@@ -1448,7 +1441,7 @@ ssl3_get_server_key_exchange(SSL *s)
 static int
 ssl3_get_certificate_request(SSL *s)
 {
-        CBS cert_request, cert_types, rdn_list;
+        CBS cert_request, cert_types, rdn_list, sigalgs;
         X509_NAME *xn = NULL;
         const unsigned char *q;
         STACK_OF(X509_NAME) *ca_sk = NULL;
@@ -1497,27 +1490,23 @@ ssl3_get_certificate_request(SSL *s)
         if (!CBS_get_u8_length_prefixed(&cert_request, &cert_types))
                 goto decode_err;
 
-        if (SSL_USE_SIGALGS(s)) {
-                CBS sigalgs;
-
-                if (CBS_len(&cert_request) < 2) {
-                        SSLerror(s, SSL_R_DATA_LENGTH_TOO_LONG);
-                        goto err;
-                }
-                if (!CBS_get_u16_length_prefixed(&cert_request, &sigalgs)) {
-                        ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR);
-                        SSLerror(s, SSL_R_DATA_LENGTH_TOO_LONG);
-                        goto err;
-                }
-                if (CBS_len(&sigalgs) % 2 != 0 || CBS_len(&sigalgs) > 64) {
-                        ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR);
-                        SSLerror(s, SSL_R_SIGNATURE_ALGORITHMS_ERROR);
-                        goto err;
-                }
-                if (!CBS_stow(&sigalgs, &s->s3->hs.sigalgs,
-                    &s->s3->hs.sigalgs_len))
-                        goto err;
+        if (CBS_len(&cert_request) < 2) {
+                SSLerror(s, SSL_R_DATA_LENGTH_TOO_LONG);
+                goto err;
+        }
+        if (!CBS_get_u16_length_prefixed(&cert_request, &sigalgs)) {
+                ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR);
+                SSLerror(s, SSL_R_DATA_LENGTH_TOO_LONG);
+                goto err;
+        }
+        if (CBS_len(&sigalgs) % 2 != 0 || CBS_len(&sigalgs) > 64) {
+                ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR);
+                SSLerror(s, SSL_R_SIGNATURE_ALGORITHMS_ERROR);
+                goto err;
         }
+        if (!CBS_stow(&sigalgs, &s->s3->hs.sigalgs,
+            &s->s3->hs.sigalgs_len))
+                goto err;
 
         /* get the CA RDNs */
         if (CBS_len(&cert_request) < 2) {
@@ -2035,77 +2024,6 @@ ssl3_send_client_verify_sigalgs(SSL *s, EVP_PKEY *pkey,
 }
 
 static int
-ssl3_send_client_verify_rsa(SSL *s, EVP_PKEY *pkey, CBB *cert_verify)
-{
-        CBB cbb_signature;
-        RSA *rsa;
-        unsigned char data[EVP_MAX_MD_SIZE];
-        unsigned char *signature = NULL;
-        unsigned int signature_len;
-        size_t data_len;
-        int ret = 0;
-
-        if (!tls1_transcript_hash_value(s, data, sizeof(data), &data_len))
-                goto err;
-        if ((signature = calloc(1, EVP_PKEY_size(pkey))) == NULL)
-                goto err;
-        if ((rsa = EVP_PKEY_get0_RSA(pkey)) == NULL)
-                goto err;
-        if (RSA_sign(NID_md5_sha1, data, data_len, signature, &signature_len,
-            rsa) <= 0 ) {
-                SSLerror(s, ERR_R_RSA_LIB);
-                goto err;
-        }
-
-        if (!CBB_add_u16_length_prefixed(cert_verify, &cbb_signature))
-                goto err;
-        if (!CBB_add_bytes(&cbb_signature, signature, signature_len))
-                goto err;
-        if (!CBB_flush(cert_verify))
-                goto err;
-
-        ret = 1;
- err:
-        free(signature);
-        return ret;
-}
-
-static int
-ssl3_send_client_verify_ec(SSL *s, EVP_PKEY *pkey, CBB *cert_verify)
-{
-        CBB cbb_signature;
-        EC_KEY *eckey;
-        unsigned char data[EVP_MAX_MD_SIZE];
-        unsigned char *signature = NULL;
-        unsigned int signature_len;
-        int ret = 0;
-
-        if (!tls1_transcript_hash_value(s, data, sizeof(data), NULL))
-                goto err;
-        if ((signature = calloc(1, EVP_PKEY_size(pkey))) == NULL)
-                goto err;
-        if ((eckey = EVP_PKEY_get0_EC_KEY(pkey)) == NULL)
-                goto err;
-        if (!ECDSA_sign(0, &data[MD5_DIGEST_LENGTH], SHA_DIGEST_LENGTH,
-            signature, &signature_len, eckey)) {
-                SSLerror(s, ERR_R_ECDSA_LIB);
-                goto err;
-        }
-
-        if (!CBB_add_u16_length_prefixed(cert_verify, &cbb_signature))
-                goto err;
-        if (!CBB_add_bytes(&cbb_signature, signature, signature_len))
-                goto err;
-        if (!CBB_flush(cert_verify))
-                goto err;
-
-        ret = 1;
- err:
-        free(signature);
-        return ret;
-}
-
-static int
 ssl3_send_client_verify(SSL *s)
 {
         const struct ssl_sigalg *sigalg;
@@ -2130,20 +2048,9 @@ ssl3_send_client_verify(SSL *s)
                  * For TLS v1.2 send signature algorithm and signature using
                  * agreed digest and cached handshake records.
                  */
-                if (SSL_USE_SIGALGS(s)) {
-                        if (!ssl3_send_client_verify_sigalgs(s, pkey, sigalg,
-                            &cert_verify))
-                                goto err;
-                } else if (EVP_PKEY_id(pkey) == EVP_PKEY_RSA) {
-                        if (!ssl3_send_client_verify_rsa(s, pkey, &cert_verify))
-                                goto err;
-                } else if (EVP_PKEY_id(pkey) == EVP_PKEY_EC) {
-                        if (!ssl3_send_client_verify_ec(s, pkey, &cert_verify))
-                                goto err;
-                } else {
-                        SSLerror(s, ERR_R_INTERNAL_ERROR);
+                if (!ssl3_send_client_verify_sigalgs(s, pkey, sigalg,
+                    &cert_verify))
                         goto err;
-                }
 
                 tls1_transcript_free(s);
 
@@ -2352,11 +2259,8 @@ ssl3_send_client_change_cipher_spec(SSL *s)
                 s->init_off = 0;
 
                 if (SSL_is_dtls(s)) {
-                        s->d1->handshake_write_seq =
-                            s->d1->next_handshake_write_seq;
-                        dtls1_set_message_header_int(s, SSL3_MT_CCS, 0,
-                            s->d1->handshake_write_seq, 0, 0);
-                        dtls1_buffer_message(s, 1);
+                        if (!dtls12_ccs_built(s))
+                                goto err;
                 }
 
                 s->s3->hs.state = SSL3_ST_CW_CHANGE_B;
@@ -2444,7 +2348,8 @@ ssl3_get_server_finished(SSL *s)
                 goto fatal_err;
         }
 
-        if (!CBS_mem_equal(&cbs, s->s3->hs.peer_finished, CBS_len(&cbs))) {
+        if (!CBS_mem_equal(&cbs,
+            s->s3->hs.peer_finished, s->s3->hs.peer_finished_len)) {
                 al = SSL_AD_DECRYPT_ERROR;
                 SSLerror(s, SSL_R_DIGEST_CHECK_FAILED);
                 goto fatal_err;
diff --git a/src/lib/libssl/ssl_kex.c b/src/lib/libssl/ssl_kex.c
index fa420a35a3..a7d02892bc 100644
--- a/src/lib/libssl/ssl_kex.c
+++ b/src/lib/libssl/ssl_kex.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl_kex.c,v 1.12 2023/07/28 16:02:34 tb Exp $ */
+/* $OpenBSD: ssl_kex.c,v 1.15 2026/06/08 11:52:43 tb Exp $ */
 /*
  * Copyright (c) 2020, 2021 Joel Sing <jsing@openbsd.org>
  *
@@ -24,6 +24,7 @@
 #include <openssl/objects.h>
 
 #include "bytestring.h"
+#include "ssl_local.h"
 
 #define DHE_MINIMUM_BITS        1024
 
@@ -354,13 +355,32 @@ ssl_kex_public_ecdhe_ecp(EC_KEY *ecdh, CBB *cbb)
         return ret;
 }
 
+#define EC_POINT_UNCOMPRESSED           0x04
+#define EC_POINT_CONVERSION_MASK        0x06
+
 int
-ssl_kex_peer_public_ecdhe_ecp(EC_KEY *ecdh, int nid, CBS *cbs)
+ssl_kex_peer_public_ecdhe_ecp(EC_KEY *ecdh, int nid, CBS *cbs,
+    int *decode_error)
 {
         EC_GROUP *group = NULL;
         EC_POINT *point = NULL;
+        uint8_t form;
         int ret = 0;
 
+        /*
+         * Check that the peer's public key uses uncompressed encoding.
+         * This ensures that the public key is not the point at infinity
+         * and enforces correct point encoding via EC_POINT_oct2point().
+         */
+        if (!CBS_peek_u8(cbs, &form)) {
+                *decode_error = 1;
+                goto err;
+        }
+        if ((form & EC_POINT_CONVERSION_MASK) != EC_POINT_UNCOMPRESSED) {
+                *decode_error = 1;
+                goto err;
+        }
+
         if ((group = EC_GROUP_new_by_curve_name(nid)) == NULL)
                 goto err;
 
@@ -370,8 +390,10 @@ ssl_kex_peer_public_ecdhe_ecp(EC_KEY *ecdh, int nid, CBS *cbs)
         if ((point = EC_POINT_new(group)) == NULL)
                 goto err;
         if (EC_POINT_oct2point(group, point, CBS_data(cbs), CBS_len(cbs),
-            NULL) == 0)
+            NULL) == 0) {
+                *decode_error = 1;
                 goto err;
+        }
         if (!EC_KEY_set_public_key(ecdh, point))
                 goto err;
 
diff --git a/src/lib/libssl/ssl_lib.c b/src/lib/libssl/ssl_lib.c
index 630724e670..23757caef3 100644
--- a/src/lib/libssl/ssl_lib.c
+++ b/src/lib/libssl/ssl_lib.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl_lib.c,v 1.333 2025/06/09 10:14:38 tb Exp $ */
+/* $OpenBSD: ssl_lib.c,v 1.336 2026/08/14 06:44:53 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -752,7 +752,6 @@ SSL_set_rfd(SSL *s, int fd)
 }
 LSSL_ALIAS(SSL_set_rfd);
 
-
 /* return length of latest Finished message we sent, copy to 'buf' */
 size_t
 SSL_get_finished(const SSL *s, void *buf, size_t count)
@@ -781,7 +780,6 @@ SSL_get_peer_finished(const SSL *s, void *buf, size_t count)
 }
 LSSL_ALIAS(SSL_get_peer_finished);
 
-
 int
 SSL_get_verify_mode(const SSL *s)
 {
@@ -2169,7 +2167,7 @@ SSL_CTX_new(const SSL_METHOD *meth)
 
         ret->max_send_fragment = SSL3_RT_MAX_PLAIN_LENGTH;
 
-        ret->tlsext_servername_callback = 0;
+        ret->tlsext_servername_callback = NULL;
         ret->tlsext_servername_arg = NULL;
 
         /* Setup RFC4507 ticket keys */
@@ -2177,14 +2175,10 @@ SSL_CTX_new(const SSL_METHOD *meth)
         arc4random_buf(ret->tlsext_tick_hmac_key, 16);
         arc4random_buf(ret->tlsext_tick_aes_key, 16);
 
-        ret->tlsext_status_cb = 0;
+        ret->tlsext_status_cb = NULL;
         ret->tlsext_status_arg = NULL;
 
-        /*
-         * Default is to connect to non-RI servers. When RI is more widely
-         * deployed might change this.
-         */
-        ret->options |= SSL_OP_LEGACY_SERVER_CONNECT;
+        ret->options = 0;
 
         return (ret);
  err:
@@ -3498,7 +3492,6 @@ SSL_set_tmp_ecdh_callback(SSL *ssl, EC_KEY *(*ecdh)(SSL *ssl, int is_export,
 }
 LSSL_ALIAS(SSL_set_tmp_ecdh_callback);
 
-
 void
 SSL_CTX_set_msg_callback(SSL_CTX *ctx, void (*cb)(int write_p, int version,
     int content_type, const void *buf, size_t len, SSL *ssl, void *arg))
@@ -3570,6 +3563,7 @@ SSL_set_min_proto_version(SSL *ssl, uint16_t version)
             &ssl->min_proto_version);
 }
 LSSL_ALIAS(SSL_set_min_proto_version);
+
 int
 SSL_get_max_proto_version(SSL *ssl)
 {
diff --git a/src/lib/libssl/ssl_local.h b/src/lib/libssl/ssl_local.h
index 6484c8dea3..67ca4a5511 100644
--- a/src/lib/libssl/ssl_local.h
+++ b/src/lib/libssl/ssl_local.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl_local.h,v 1.37 2026/04/03 13:11:00 jsing Exp $ */
+/* $OpenBSD: ssl_local.h,v 1.43 2026/08/21 17:15:22 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -263,10 +263,6 @@ __BEGIN_HIDDEN_DECLS
  */
 #define SSL_C_PKEYLENGTH(c)     1024
 
-/* See if we use signature algorithms extension. */
-#define SSL_USE_SIGALGS(s) \
-        (s->method->enc_flags & SSL_ENC_FLAG_SIGALGS)
-
 /* Allow TLS 1.2 ciphersuites: applies to DTLS 1.2 as well as TLS 1.2. */
 #define SSL_USE_TLS1_2_CIPHERS(s) \
         (s->method->enc_flags & SSL_ENC_FLAG_TLS1_2_CIPHERS)
@@ -432,7 +428,7 @@ struct ssl_session_st {
 
         char *tlsext_hostname;
 
-        /* Session resumption - RFC 5077 and RFC 8446. */
+        /* Session resumption - RFC 5077 and RFC 9846. */
         unsigned char *tlsext_tick;             /* Session ticket */
         size_t tlsext_ticklen;                  /* Session ticket length */
         uint32_t tlsext_tick_lifetime_hint;     /* Session lifetime hint in seconds */
@@ -1163,9 +1159,6 @@ typedef struct ssl3_state_st {
  * Flag values for enc_flags.
  */
 
-/* Uses signature algorithms extension. */
-#define SSL_ENC_FLAG_SIGALGS            (1 << 1)
-
 /* Allow TLS 1.2 ciphersuites: applies to DTLS 1.2 as well as TLS 1.2. */
 #define SSL_ENC_FLAG_TLS1_2_CIPHERS     (1 << 4)
 
@@ -1174,10 +1167,8 @@ typedef struct ssl3_state_st {
 
 #define TLSV1_ENC_FLAGS         0
 #define TLSV1_1_ENC_FLAGS       0
-#define TLSV1_2_ENC_FLAGS       (SSL_ENC_FLAG_SIGALGS           | \
-                                 SSL_ENC_FLAG_TLS1_2_CIPHERS)
-#define TLSV1_3_ENC_FLAGS       (SSL_ENC_FLAG_SIGALGS           | \
-                                 SSL_ENC_FLAG_TLS1_3_CIPHERS)
+#define TLSV1_2_ENC_FLAGS       SSL_ENC_FLAG_TLS1_2_CIPHERS
+#define TLSV1_3_ENC_FLAGS       SSL_ENC_FLAG_TLS1_3_CIPHERS
 
 extern const SSL_CIPHER ssl3_ciphers[];
 
@@ -1186,15 +1177,17 @@ int ssl_version_set_min(const SSL_METHOD *meth, uint16_t proto_ver,
     uint16_t max_tls_ver, uint16_t *out_tls_ver, uint16_t *out_proto_ver);
 int ssl_version_set_max(const SSL_METHOD *meth, uint16_t proto_ver,
     uint16_t min_tls_ver, uint16_t *out_tls_ver, uint16_t *out_proto_ver);
-int ssl_enabled_tls_version_range(SSL *s, uint16_t *min_ver, uint16_t *max_ver);
-int ssl_supported_tls_version_range(SSL *s, uint16_t *min_ver, uint16_t *max_ver);
+int ssl_enabled_tls_version_range(const SSL *s, uint16_t *min_ver,
+    uint16_t *max_ver);
+int ssl_supported_tls_version_range(const SSL *s, uint16_t *min_ver,
+    uint16_t *max_ver);
 uint16_t ssl_tls_version(uint16_t version);
-uint16_t ssl_effective_tls_version(SSL *s);
-int ssl_max_supported_version(SSL *s, uint16_t *max_ver);
-int ssl_max_legacy_version(SSL *s, uint16_t *max_ver);
-int ssl_max_shared_version(SSL *s, uint16_t peer_ver, uint16_t *max_ver);
-int ssl_check_version_from_server(SSL *s, uint16_t server_version);
-int ssl_legacy_stack_version(SSL *s, uint16_t version);
+uint16_t ssl_effective_tls_version(const SSL *s);
+int ssl_max_supported_version(const SSL *s, uint16_t *max_ver);
+int ssl_max_legacy_version(const SSL *s, uint16_t *max_ver);
+int ssl_max_shared_version(const SSL *s, uint16_t peer_ver, uint16_t *max_ver);
+int ssl_check_version_from_server(const SSL *s, uint16_t server_version);
+int ssl_legacy_stack_version(const SSL *s, uint16_t version);
 int ssl_cipher_in_list(STACK_OF(SSL_CIPHER) *ciphers, const SSL_CIPHER *cipher);
 int ssl_cipher_allowed_in_tls_version_range(const SSL_CIPHER *cipher,
     uint16_t min_ver, uint16_t max_ver);
@@ -1316,7 +1309,6 @@ long	ssl3_callback_ctrl(SSL *s, int cmd, void (*fp)(void));
 long    ssl3_ctx_callback_ctrl(SSL_CTX *s, int cmd, void (*fp)(void));
 int     ssl3_pending(const SSL *s);
 
-int ssl3_handshake_msg_hdr_len(SSL *s);
 int ssl3_handshake_msg_start(SSL *s, CBB *handshake, CBB *body,
     uint8_t msg_type);
 int ssl3_handshake_msg_finish(SSL *s, CBB *handshake);
@@ -1327,7 +1319,6 @@ int ssl3_do_change_cipher_spec(SSL *ssl);
 
 int ssl3_packet_read(SSL *s, int plen);
 int ssl3_packet_extend(SSL *s, int plen);
-int ssl_server_legacy_first_packet(SSL *s);
 int ssl3_write_pending(SSL *s, int type, const unsigned char *buf,
     unsigned int len);
 
@@ -1345,7 +1336,8 @@ int ssl_kex_derive_dhe(DH *dh, DH *dh_peer,
 int ssl_kex_dummy_ecdhe_x25519(EVP_PKEY *pkey);
 int ssl_kex_generate_ecdhe_ecp(EC_KEY *ecdh, int nid);
 int ssl_kex_public_ecdhe_ecp(EC_KEY *ecdh, CBB *cbb);
-int ssl_kex_peer_public_ecdhe_ecp(EC_KEY *ecdh, int nid, CBS *cbs);
+int ssl_kex_peer_public_ecdhe_ecp(EC_KEY *ecdh, int nid, CBS *cbs,
+    int *decode_error);
 int ssl_kex_derive_ecdhe_ecp(EC_KEY *ecdh, EC_KEY *ecdh_peer,
     uint8_t **shared_key, size_t *shared_key_len);
 
diff --git a/src/lib/libssl/ssl_sigalgs.c b/src/lib/libssl/ssl_sigalgs.c
index ee4088f6ab..779d47985a 100644
--- a/src/lib/libssl/ssl_sigalgs.c
+++ b/src/lib/libssl/ssl_sigalgs.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl_sigalgs.c,v 1.53 2026/03/30 06:20:08 tb Exp $ */
+/* $OpenBSD: ssl_sigalgs.c,v 1.54 2026/05/31 14:34:44 jsing Exp $ */
 /*
  * Copyright (c) 2018-2020 Bob Beck <beck@openbsd.org>
  * Copyright (c) 2021 Joel Sing <jsing@openbsd.org>
@@ -134,12 +134,6 @@ const struct ssl_sigalg sigalgs[] = {
                 .security_level = 1,
         },
         {
-                .value = SIGALG_RSA_PKCS1_MD5_SHA1,
-                .key_type = EVP_PKEY_RSA,
-                .md = EVP_md5_sha1,
-                .security_level = 1,
-        },
-        {
                 .value = SIGALG_NONE,
         },
 };
@@ -237,9 +231,6 @@ ssl_sigalgs_build(uint16_t tls_version, CBB *cbb, int security_level)
 
         /* Add values in order as long as they are supported. */
         for (i = 0; i < len; i++) {
-                /* Do not allow the legacy value for < 1.2 to be used. */
-                if (values[i] == SIGALG_RSA_PKCS1_MD5_SHA1)
-                        return 0;
                 if ((sigalg = ssl_sigalg_lookup(values[i])) == NULL)
                         return 0;
                 if (sigalg->security_level < security_level)
@@ -262,8 +253,6 @@ ssl_sigalg_for_legacy(SSL *s, EVP_PKEY *pkey)
         /* Default signature algorithms used for TLSv1.2 and earlier. */
         switch (EVP_PKEY_id(pkey)) {
         case EVP_PKEY_RSA:
-                if (s->s3->hs.negotiated_tls_version < TLS1_2_VERSION)
-                        return ssl_sigalg_lookup(SIGALG_RSA_PKCS1_MD5_SHA1);
                 return ssl_sigalg_lookup(SIGALG_RSA_PKCS1_SHA1);
         case EVP_PKEY_EC:
                 return ssl_sigalg_lookup(SIGALG_ECDSA_SHA1);
@@ -317,9 +306,6 @@ ssl_sigalg_select(SSL *s, EVP_PKEY *pkey)
 {
         CBS cbs;
 
-        if (!SSL_USE_SIGALGS(s))
-                return ssl_sigalg_for_legacy(s, pkey);
-
         /*
          * RFC 5246 allows a TLS 1.2 client to send no sigalgs extension,
          * in which case the server must use the default.
@@ -353,9 +339,6 @@ ssl_sigalg_for_peer(SSL *s, EVP_PKEY *pkey, uint16_t sigalg_value)
 {
         const struct ssl_sigalg *sigalg;
 
-        if (!SSL_USE_SIGALGS(s))
-                return ssl_sigalg_for_legacy(s, pkey);
-
         if ((sigalg = ssl_sigalg_from_value(s, sigalg_value)) == NULL) {
                 SSLerror(s, SSL_R_UNKNOWN_DIGEST);
                 return NULL;
diff --git a/src/lib/libssl/ssl_sigalgs.h b/src/lib/libssl/ssl_sigalgs.h
index 5211ec6b62..e435ccc287 100644
--- a/src/lib/libssl/ssl_sigalgs.h
+++ b/src/lib/libssl/ssl_sigalgs.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl_sigalgs.h,v 1.27 2024/02/03 15:58:34 beck Exp $ */
+/* $OpenBSD: ssl_sigalgs.h,v 1.29 2026/08/21 17:15:22 tb Exp $ */
 /*
  * Copyright (c) 2018-2019 Bob Beck <beck@openbsd.org>
  *
@@ -23,8 +23,8 @@ __BEGIN_HIDDEN_DECLS
 #define SIGALG_NONE                     0x0000
 
 /*
- * RFC 8446 Section 4.2.3
- * RFC 5246 Section 7.4.1.4.1
+ * RFC 9846 section 4.3.3
+ * RFC 5246 section 7.4.1.4.1
  */
 #define SIGALG_RSA_PKCS1_SHA224         0x0301
 #define SIGALG_RSA_PKCS1_SHA256         0x0401
@@ -47,9 +47,6 @@ __BEGIN_HIDDEN_DECLS
 #define SIGALG_PRIVATE_START            0xFE00
 #define SIGALG_PRIVATE_END              0xFFFF
 
-/* Legacy sigalg for < TLSv1.2 same value as BoringSSL uses. */
-#define SIGALG_RSA_PKCS1_MD5_SHA1       0xFF01
-
 #define SIGALG_FLAG_RSA_PSS     0x00000001
 
 struct ssl_sigalg {
diff --git a/src/lib/libssl/ssl_srvr.c b/src/lib/libssl/ssl_srvr.c
index af4b20f6ce..a12f552bea 100644
--- a/src/lib/libssl/ssl_srvr.c
+++ b/src/lib/libssl/ssl_srvr.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl_srvr.c,v 1.168 2026/04/03 12:58:19 jsing Exp $ */
+/* $OpenBSD: ssl_srvr.c,v 1.172 2026/08/29 08:41:17 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -568,33 +568,14 @@ ssl3_accept(SSL *s)
                         }
 
                         alg_k = s->s3->hs.cipher->algorithm_mkey;
-                        if (SSL_USE_SIGALGS(s)) {
-                                s->s3->hs.state = SSL3_ST_SR_CERT_VRFY_A;
-                                s->init_num = 0;
-                                if (!s->session->peer_cert)
-                                        break;
+                        s->s3->hs.state = SSL3_ST_SR_CERT_VRFY_A;
+                        s->init_num = 0;
+                        if (s->session->peer_cert != NULL) {
                                 /*
                                  * Freeze the transcript for use during client
                                  * certificate verification.
                                  */
                                 tls1_transcript_freeze(s);
-                        } else {
-                                s->s3->hs.state = SSL3_ST_SR_CERT_VRFY_A;
-                                s->init_num = 0;
-
-                                tls1_transcript_free(s);
-
-                                /*
-                                 * We need to get hashes here so if there is
-                                 * a client cert, it can be verified.
-                                 */
-                                if (!tls1_transcript_hash_value(s,
-                                    s->s3->hs.tls12.cert_verify,
-                                    sizeof(s->s3->hs.tls12.cert_verify),
-                                    NULL)) {
-                                        ret = -1;
-                                        goto end;
-                                }
                         }
                         break;
 
@@ -1046,7 +1027,7 @@ ssl3_get_client_hello(SSL *s)
         if (s->s3->hs.our_max_tls_version >= TLS1_2_VERSION &&
             s->s3->hs.negotiated_tls_version < s->s3->hs.our_max_tls_version) {
                 /*
-                 * RFC 8446 section 4.1.3. If we are downgrading from TLS 1.3
+                 * RFC 9846 section 4.2.3. If we are downgrading from TLS 1.3
                  * we must set the last 8 bytes of the server random to magical
                  * values to indicate we meant to downgrade.  For TLS 1.2 it is
                  * recommended that we do the same.
@@ -1142,7 +1123,7 @@ ssl3_get_client_hello(SSL *s)
         if (!tls1_transcript_hash_init(s))
                 goto err;
 
-        if (!SSL_USE_SIGALGS(s) || !(s->verify_mode & SSL_VERIFY_PEER))
+        if (!(s->verify_mode & SSL_VERIFY_PEER))
                 tls1_transcript_free(s);
 
         /*
@@ -1501,12 +1482,10 @@ ssl3_send_server_key_exchange(SSL *s)
                         s->s3->hs.our_sigalg = sigalg;
 
                         /* Send signature algorithm. */
-                        if (SSL_USE_SIGALGS(s)) {
-                                if (!CBB_add_u16(&server_kex, sigalg->value)) {
-                                        al = SSL_AD_INTERNAL_ERROR;
-                                        SSLerror(s, ERR_R_INTERNAL_ERROR);
-                                        goto fatal_err;
-                                }
+                        if (!CBB_add_u16(&server_kex, sigalg->value)) {
+                                al = SSL_AD_INTERNAL_ERROR;
+                                SSLerror(s, ERR_R_INTERNAL_ERROR);
+                                goto fatal_err;
                         }
 
                         if (!EVP_DigestSignInit(md_ctx, &pctx, md, NULL, pkey)) {
@@ -1591,14 +1570,11 @@ ssl3_send_certificate_request(SSL *s)
                 if (!ssl3_get_req_cert_types(s, &cert_types))
                         goto err;
 
-                if (SSL_USE_SIGALGS(s)) {
-                        if (!CBB_add_u16_length_prefixed(&cert_request,
-                            &sigalgs))
-                                goto err;
-                        if (!ssl_sigalgs_build(s->s3->hs.negotiated_tls_version,
-                            &sigalgs, SSL_get_security_level(s)))
-                                goto err;
-                }
+                if (!CBB_add_u16_length_prefixed(&cert_request, &sigalgs))
+                        goto err;
+                if (!ssl_sigalgs_build(s->s3->hs.negotiated_tls_version,
+                    &sigalgs, SSL_get_security_level(s)))
+                        goto err;
 
                 if (!CBB_add_u16_length_prefixed(&cert_request, &cert_auth))
                         goto err;
@@ -1879,7 +1855,8 @@ ssl3_get_cert_verify(SSL *s)
         EVP_PKEY *pkey;
         X509 *peer_cert = NULL;
         EVP_MD_CTX *mctx = NULL;
-        int al, verify;
+        EVP_PKEY_CTX *pctx;
+        int al;
         const unsigned char *hdata;
         size_t hdatalen;
         int type = 0;
@@ -1932,10 +1909,9 @@ ssl3_get_cert_verify(SSL *s)
                 goto fatal_err;
         }
 
-        if (SSL_USE_SIGALGS(s)) {
-                if (!CBS_get_u16(&cbs, &sigalg_value))
-                        goto decode_err;
-        }
+        if (!CBS_get_u16(&cbs, &sigalg_value))
+                goto decode_err;
+
         if (!CBS_get_u16_length_prefixed(&cbs, &signature))
                 goto err;
         if (CBS_len(&cbs) != 0) {
@@ -1957,74 +1933,26 @@ ssl3_get_cert_verify(SSL *s)
         }
         s->s3->hs.peer_sigalg = sigalg;
 
-        if (SSL_USE_SIGALGS(s)) {
-                EVP_PKEY_CTX *pctx;
-
-                if (!tls1_transcript_data(s, &hdata, &hdatalen)) {
-                        SSLerror(s, ERR_R_INTERNAL_ERROR);
-                        al = SSL_AD_INTERNAL_ERROR;
-                        goto fatal_err;
-                }
-                if (!EVP_DigestVerifyInit(mctx, &pctx, sigalg->md(),
-                    NULL, pkey)) {
-                        SSLerror(s, ERR_R_EVP_LIB);
-                        al = SSL_AD_INTERNAL_ERROR;
-                        goto fatal_err;
-                }
-                if ((sigalg->flags & SIGALG_FLAG_RSA_PSS) &&
-                    (!EVP_PKEY_CTX_set_rsa_padding(pctx,
-                        RSA_PKCS1_PSS_PADDING) ||
-                    !EVP_PKEY_CTX_set_rsa_pss_saltlen(pctx, -1))) {
-                        al = SSL_AD_INTERNAL_ERROR;
-                        goto fatal_err;
-                }
-                if (EVP_DigestVerify(mctx, CBS_data(&signature),
-                    CBS_len(&signature), hdata, hdatalen) <= 0) {
-                        SSLerror(s, ERR_R_EVP_LIB);
-                        al = SSL_AD_INTERNAL_ERROR;
-                        goto fatal_err;
-                }
-        } else if (EVP_PKEY_id(pkey) == EVP_PKEY_RSA) {
-                RSA *rsa;
-
-                if ((rsa = EVP_PKEY_get0_RSA(pkey)) == NULL) {
-                        al = SSL_AD_INTERNAL_ERROR;
-                        SSLerror(s, ERR_R_EVP_LIB);
-                        goto fatal_err;
-                }
-                verify = RSA_verify(NID_md5_sha1, s->s3->hs.tls12.cert_verify,
-                    MD5_DIGEST_LENGTH + SHA_DIGEST_LENGTH, CBS_data(&signature),
-                    CBS_len(&signature), rsa);
-                if (verify < 0) {
-                        al = SSL_AD_DECRYPT_ERROR;
-                        SSLerror(s, SSL_R_BAD_RSA_DECRYPT);
-                        goto fatal_err;
-                }
-                if (verify == 0) {
-                        al = SSL_AD_DECRYPT_ERROR;
-                        SSLerror(s, SSL_R_BAD_RSA_SIGNATURE);
-                        goto fatal_err;
-                }
-        } else if (EVP_PKEY_id(pkey) == EVP_PKEY_EC) {
-                EC_KEY *eckey;
-
-                if ((eckey = EVP_PKEY_get0_EC_KEY(pkey)) == NULL) {
-                        al = SSL_AD_INTERNAL_ERROR;
-                        SSLerror(s, ERR_R_EVP_LIB);
-                        goto fatal_err;
-                }
-                verify = ECDSA_verify(0,
-                    &(s->s3->hs.tls12.cert_verify[MD5_DIGEST_LENGTH]),
-                    SHA_DIGEST_LENGTH, CBS_data(&signature),
-                    CBS_len(&signature), eckey);
-                if (verify <= 0) {
-                        al = SSL_AD_DECRYPT_ERROR;
-                        SSLerror(s, SSL_R_BAD_ECDSA_SIGNATURE);
-                        goto fatal_err;
-                }
-        } else {
+        if (!tls1_transcript_data(s, &hdata, &hdatalen)) {
                 SSLerror(s, ERR_R_INTERNAL_ERROR);
-                al = SSL_AD_UNSUPPORTED_CERTIFICATE;
+                al = SSL_AD_INTERNAL_ERROR;
+                goto fatal_err;
+        }
+        if (!EVP_DigestVerifyInit(mctx, &pctx, sigalg->md(), NULL, pkey)) {
+                SSLerror(s, ERR_R_EVP_LIB);
+                al = SSL_AD_INTERNAL_ERROR;
+                goto fatal_err;
+        }
+        if ((sigalg->flags & SIGALG_FLAG_RSA_PSS) &&
+            (!EVP_PKEY_CTX_set_rsa_padding(pctx, RSA_PKCS1_PSS_PADDING) ||
+            !EVP_PKEY_CTX_set_rsa_pss_saltlen(pctx, -1))) {
+                al = SSL_AD_INTERNAL_ERROR;
+                goto fatal_err;
+        }
+        if (EVP_DigestVerify(mctx, CBS_data(&signature), CBS_len(&signature),
+            hdata, hdatalen) <= 0) {
+                SSLerror(s, ERR_R_EVP_LIB);
+                al = SSL_AD_INTERNAL_ERROR;
                 goto fatal_err;
         }
 
@@ -2393,11 +2321,8 @@ ssl3_send_server_change_cipher_spec(SSL *s)
                 s->init_off = 0;
 
                 if (SSL_is_dtls(s)) {
-                        s->d1->handshake_write_seq =
-                            s->d1->next_handshake_write_seq;
-                        dtls1_set_message_header_int(s, SSL3_MT_CCS, 0,
-                            s->d1->handshake_write_seq, 0, 0);
-                        dtls1_buffer_message(s, 1);
+                        if (!dtls12_ccs_built(s))
+                                goto err;
                 }
 
                 s->s3->hs.state = SSL3_ST_SW_CHANGE_B;
@@ -2448,7 +2373,8 @@ ssl3_get_client_finished(SSL *s)
                 goto fatal_err;
         }
 
-        if (!CBS_mem_equal(&cbs, s->s3->hs.peer_finished, CBS_len(&cbs))) {
+        if (!CBS_mem_equal(&cbs,
+            s->s3->hs.peer_finished, s->s3->hs.peer_finished_len)) {
                 al = SSL_AD_DECRYPT_ERROR;
                 SSLerror(s, SSL_R_DIGEST_CHECK_FAILED);
                 goto fatal_err;
diff --git a/src/lib/libssl/ssl_tlsext.c b/src/lib/libssl/ssl_tlsext.c
index d879b3304e..e3dbfd82cf 100644
--- a/src/lib/libssl/ssl_tlsext.c
+++ b/src/lib/libssl/ssl_tlsext.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl_tlsext.c,v 1.159 2025/12/04 21:16:17 beck Exp $ */
+/* $OpenBSD: ssl_tlsext.c,v 1.168 2026/08/29 05:12:51 tb Exp $ */
 /*
  * Copyright (c) 2016, 2017, 2019 Joel Sing <jsing@openbsd.org>
  * Copyright (c) 2017 Doug Hogan <doug@openbsd.org>
@@ -163,28 +163,42 @@ tlsext_alpn_server_build(SSL *s, uint16_t msg_type, CBB *cbb)
 static int
 tlsext_alpn_client_process(SSL *s, uint16_t msg_type, CBS *cbs, int *alert)
 {
-        CBS list, proto;
+        CBS server_list, supported_list;
+        CBS selected, proto;
 
         if (s->alpn_client_proto_list == NULL) {
                 *alert = SSL_AD_UNSUPPORTED_EXTENSION;
                 return 0;
         }
 
-        if (!CBS_get_u16_length_prefixed(cbs, &list))
+        if (!CBS_get_u16_length_prefixed(cbs, &server_list))
                 return 0;
-
-        if (!CBS_get_u8_length_prefixed(&list, &proto))
+        if (!CBS_get_u8_length_prefixed(&server_list, &selected))
                 return 0;
 
-        if (CBS_len(&list) != 0)
+        if (CBS_len(&server_list) != 0)
                 return 0;
-        if (CBS_len(&proto) == 0)
+        if (CBS_len(&selected) == 0)
                 return 0;
 
-        if (!CBS_stow(&proto, &s->s3->alpn_selected, &s->s3->alpn_selected_len))
-                return 0;
+        /*
+         * Check the server selected a protocol that we advertised as supported.
+         */
 
-        return 1;
+        CBS_init(&supported_list, s->alpn_client_proto_list,
+            s->alpn_client_proto_list_len);
+
+        while (CBS_len(&supported_list) > 0) {
+                if (!CBS_get_u8_length_prefixed(&supported_list, &proto))
+                        return 0;
+                if (CBS_mem_equal(&selected, CBS_data(&proto), CBS_len(&proto)))
+                        return CBS_stow(&selected,
+                            &s->s3->alpn_selected, &s->s3->alpn_selected_len);
+        }
+
+        *alert = SSL_AD_ILLEGAL_PARAMETER;
+
+        return 0;
 }
 
 /*
@@ -193,6 +207,10 @@ tlsext_alpn_client_process(SSL *s, uint16_t msg_type, CBS *cbs, int *alert)
 static int
 tlsext_supportedgroups_client_needs(SSL *s, uint16_t msg_type)
 {
+        /*
+         * XXX - Don't send an empty named_group_list. For TLSv1.3 we error
+         * earlier; for TLSv1.2 ensure we don't send the extension.
+         */
         return ssl_has_ecc_ciphers(s) ||
             (s->s3->hs.our_max_tls_version >= TLS1_3_VERSION);
 }
@@ -215,7 +233,7 @@ tlsext_supportedgroups_client_build(SSL *s, uint16_t msg_type, CBB *cbb)
                 return 0;
 
         for (i = 0; i < groups_len; i++) {
-                if (!ssl_security_supported_group(s, groups[i]))
+                if (!tls1_check_group(s, groups[i]))
                         continue;
                 if (!CBB_add_u16(&grouplist, groups[i]))
                         return 0;
@@ -277,10 +295,8 @@ tlsext_supportedgroups_server_process(SSL *s, uint16_t msg_type, CBS *cbs,
                 if (!CBS_get_u16(&grouplist, &groups[i]))
                         goto err;
                 /*
-                 * Do not allow duplicate groups to be sent. This is not
-                 * currently specified in RFC 8446 or earlier, but there is no
-                 * legitimate justification for this to occur in TLS 1.2 or TLS
-                 * 1.3.
+                 * RFC 9846 section 4.3.7: The "named_group_list" MUST NOT
+                 * contain any duplicate entries.
                  */
                 for (j = 0; j < i; j++) {
                         if (groups[i] == groups[j]) {
@@ -332,7 +348,7 @@ tlsext_supportedgroups_client_process(SSL *s, uint16_t msg_type, CBS *cbs,
                 return 0;
 
         /*
-         * RFC 8446, section 4.2.7: TLSv1.3 servers can send this extension but
+         * RFC 9846 section 4.3.7: TLSv1.3 servers can send this extension but
          * clients must not act on it during the handshake. This allows servers
          * to advertise their preferences for subsequent handshakes. We ignore
          * this complication.
@@ -382,6 +398,8 @@ tlsext_ecpf_process(SSL *s, uint16_t msg_type, CBS *cbs, int *alert)
         if (CBS_len(&ecpf) == 0)
                 return 0;
 
+        /* XXX - tighten this to reject anything but uncompressed format? */
+
         /* Must contain uncompressed (0) - RFC 8422, section 5.1.2. */
         if (!CBS_contains_zero_byte(&ecpf)) {
                 SSLerror(s, SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST);
@@ -1058,7 +1076,7 @@ tlsext_ocsp_client_process(SSL *s, uint16_t msg_type, CBS *cbs, int *alert)
         if (ssl_effective_tls_version(s) >= TLS1_3_VERSION) {
                 if (msg_type == SSL_TLSEXT_MSG_CR) {
                         /*
-                         * RFC 8446, 4.4.2.1 - the server may request an OCSP
+                         * RFC 9846, 4.5.1.1 - the server may request an OCSP
                          * response with an empty status_request.
                          */
                         if (CBS_len(cbs) == 0)
@@ -1434,7 +1452,7 @@ tlsext_srtp_client_process(SSL *s, uint16_t msg_type, CBS *cbs, int *alert)
 #endif /* OPENSSL_NO_SRTP */
 
 /*
- * TLSv1.3 Key Share - RFC 8446 section 4.2.8.
+ * TLSv1.3 Key Share - RFC 9846 section 4.3.8.
  */
 static int
 tlsext_keyshare_client_needs(SSL *s, uint16_t msg_type)
@@ -1495,14 +1513,14 @@ tlsext_keyshare_server_process(SSL *s, uint16_t msg_type, CBS *cbs, int *alert)
         const uint16_t *client_groups = NULL, *server_groups = NULL;
         size_t client_groups_len = 0, server_groups_len = 0;
         size_t i, j, client_groups_index;
-        int preferred_group_found = 0;
+        int shared_group_found = 0;
         int decode_error;
         uint16_t client_preferred_group = 0;
         uint16_t group;
         CBS client_shares, key_exchange;
 
         /*
-         * RFC 8446 section 4.2.8:
+         * RFC 9846 section 4.3.8:
          *
          * Each KeyShareEntry value MUST correspond to a group offered in the
          * "supported_groups" extension and MUST appear in the same order.
@@ -1511,7 +1529,7 @@ tlsext_keyshare_server_process(SSL *s, uint16_t msg_type, CBS *cbs, int *alert)
          */
 
         if (!tlsext_extension_seen(s, TLSEXT_TYPE_supported_groups)) {
-                *alert = SSL_AD_ILLEGAL_PARAMETER;
+                *alert = SSL_AD_MISSING_EXTENSION;
                 return 0;
         }
         if (!tlsext_extension_processed(s, TLSEXT_TYPE_supported_groups)) {
@@ -1571,21 +1589,32 @@ tlsext_keyshare_server_process(SSL *s, uint16_t msg_type, CBS *cbs, int *alert)
 
         /*
          * Find the group that is most preferred by the client that
-         * we also support.
+         * is also supported by the server.
          */
-        for (i = 0; i < client_groups_len && !preferred_group_found; i++) {
+        for (i = 0; i < client_groups_len && !shared_group_found; i++) {
                 if (!ssl_security_supported_group(s, client_groups[i]))
                         continue;
                 for (j = 0; j < server_groups_len; j++) {
                         if (server_groups[j] == client_groups[i]) {
+                                /* XXX - this should be equivalent to tls1_check_group() */
                                 client_preferred_group = client_groups[i];
                                 s->s3->hs.tls13.server_group = client_preferred_group;
-                                preferred_group_found = 1;
+                                shared_group_found = 1;
                                 break;
                         }
                 }
         }
 
+        if (!shared_group_found) {
+                /*
+                 * There are no supported groups that are shared between the
+                 * client and server - this is treated as a handshake failure
+                 * or as insufficient security - see RFC 9846 section 4.2.1.
+                 */
+                *alert = TLS13_ALERT_HANDSHAKE_FAILURE;
+                return 0;
+        }
+
         if (!CBS_get_u16_length_prefixed(cbs, &client_shares))
                 return 0;
 
@@ -1631,7 +1660,7 @@ tlsext_keyshare_server_process(SSL *s, uint16_t msg_type, CBS *cbs, int *alert)
                  * less preferred, and we choose to to use it instead of
                  * requesting the more preferred group.
                  */
-                if (!preferred_group_found || group != client_preferred_group)
+                if (group != client_preferred_group)
                         continue;
 
                 /* Decode and store the selected key share. */
@@ -1749,7 +1778,7 @@ tlsext_keyshare_client_process(SSL *s, uint16_t msg_type, CBS *cbs, int *alert)
 }
 
 /*
- * Supported Versions - RFC 8446 section 4.2.1.
+ * Supported Versions - RFC 9846 section 4.3.1.
  */
 static int
 tlsext_versions_client_needs(SSL *s, uint16_t msg_type)
@@ -1851,7 +1880,7 @@ tlsext_versions_client_process(SSL *s, uint16_t msg_type, CBS *cbs, int *alert)
 
 
 /*
- * Cookie - RFC 8446 section 4.2.2.
+ * Cookie - RFC 9846 section 4.3.2.
  */
 
 static int
@@ -1963,7 +1992,7 @@ tlsext_cookie_client_process(SSL *s, uint16_t msg_type, CBS *cbs, int *alert)
 }
 
 /*
- * Pre-Shared Key Exchange Modes - RFC 8446, 4.2.9.
+ * Pre-Shared Key Exchange Modes - RFC 9846 section 4.3.9.
  */
 
 static int
@@ -2033,7 +2062,7 @@ tlsext_psk_kex_modes_client_process(SSL *s, uint16_t msg_type, CBS *cbs,
 }
 
 /*
- * Pre-Shared Key Extension - RFC 8446, 4.2.11
+ * Pre-Shared Key Extension - RFC 9846 section 4.3.11
  */
 
 static int
@@ -2467,7 +2496,7 @@ tlsext_randomize_build_order(SSL *s)
                 return 0;
         s->tlsext_build_order_len = N_TLS_EXTENSIONS;
 
-        /* RFC 8446, section 4.2 - PSK MUST be the last extension in the CH. */
+        /* RFC 9846 section 4.3 - PSK MUST be the last extension in the CH. */
         if ((psk_ext = tls_extension_find(TLSEXT_TYPE_pre_shared_key,
             NULL)) == NULL)
                 return 0;
@@ -2521,7 +2550,7 @@ tlsext_build(SSL *s, int is_server, uint16_t msg_type, CBB *cbb)
                 tlsext = s->tlsext_build_order[i];
                 ext = tlsext_funcs(tlsext, is_server);
 
-                /* RFC 8446 Section 4.2 */
+                /* RFC 9846 section 4.3 */
                 if (tls_version >= TLS1_3_VERSION &&
                     !(tlsext->messages & msg_type))
                         continue;
@@ -2550,14 +2579,15 @@ tlsext_build(SSL *s, int is_server, uint16_t msg_type, CBB *cbb)
         return 1;
 }
 
-int
+static int
 tlsext_clienthello_hash_extension(SSL *s, uint16_t type, CBS *cbs)
 {
         /*
-         * RFC 8446 4.1.2. For subsequent CH, early data will be removed,
+         * RFC 9846, 4.2.2. For subsequent CH, early data will be removed,
          * cookie may be added, padding may be removed.
          */
         struct tls13_ctx *ctx = s->tls13;
+        uint16_t len = CBS_len(cbs);
 
         if (type == TLSEXT_TYPE_early_data || type == TLSEXT_TYPE_cookie ||
             type == TLSEXT_TYPE_padding)
@@ -2571,6 +2601,8 @@ tlsext_clienthello_hash_extension(SSL *s, uint16_t type, CBS *cbs)
          */
         if (type == TLSEXT_TYPE_pre_shared_key || type == TLSEXT_TYPE_key_share)
                 return 1;
+        if (!tls13_clienthello_hash_update_bytes(ctx, (void *)&len, sizeof(len)))
+                return 0;
         if (!tls13_clienthello_hash_update(ctx, cbs))
                 return 0;
 
@@ -2624,7 +2656,7 @@ tlsext_parse(SSL *s, struct tlsext_data *td, int is_server, uint16_t msg_type,
                                 goto err;
                 }
 
-                /* RFC 8446 Section 4.2 */
+                /* RFC 9846 section 4.3 */
                 if (tls_version >= TLS1_3_VERSION &&
                     !(tlsext->messages & msg_type)) {
                         alert_desc = SSL_AD_ILLEGAL_PARAMETER;
diff --git a/src/lib/libssl/ssl_tlsext.h b/src/lib/libssl/ssl_tlsext.h
index 4fd2ec05a0..e1fc2634c2 100644
--- a/src/lib/libssl/ssl_tlsext.h
+++ b/src/lib/libssl/ssl_tlsext.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl_tlsext.h,v 1.34 2024/03/26 03:44:11 beck Exp $ */
+/* $OpenBSD: ssl_tlsext.h,v 1.35 2026/08/21 17:15:22 tb Exp $ */
 /*
  * Copyright (c) 2016, 2017 Joel Sing <jsing@openbsd.org>
  * Copyright (c) 2017 Doug Hogan <doug@openbsd.org>
@@ -20,7 +20,7 @@
 #ifndef HEADER_SSL_TLSEXT_H
 #define HEADER_SSL_TLSEXT_H
 
-/* TLSv1.3 - RFC 8446 Section 4.2. */
+/* TLSv1.3 - RFC 9846 section 4.3. */
 #define SSL_TLSEXT_MSG_CH       0x0001  /* ClientHello */
 #define SSL_TLSEXT_MSG_SH       0x0002  /* ServerHello */
 #define SSL_TLSEXT_MSG_EE       0x0004  /* EncryptedExtension */
diff --git a/src/lib/libssl/ssl_versions.c b/src/lib/libssl/ssl_versions.c
index 8273546062..edd077b166 100644
--- a/src/lib/libssl/ssl_versions.c
+++ b/src/lib/libssl/ssl_versions.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl_versions.c,v 1.27 2023/07/02 17:21:32 beck Exp $ */
+/* $OpenBSD: ssl_versions.c,v 1.28 2026/06/04 12:05:57 tb Exp $ */
 /*
  * Copyright (c) 2016, 2017 Joel Sing <jsing@openbsd.org>
  *
@@ -125,7 +125,7 @@ ssl_version_set_max(const SSL_METHOD *meth, uint16_t proto_ver,
 }
 
 int
-ssl_enabled_tls_version_range(SSL *s, uint16_t *min_ver, uint16_t *max_ver)
+ssl_enabled_tls_version_range(const SSL *s, uint16_t *min_ver, uint16_t *max_ver)
 {
         uint16_t min_version, max_version;
         unsigned long options;
@@ -186,7 +186,8 @@ ssl_enabled_tls_version_range(SSL *s, uint16_t *min_ver, uint16_t *max_ver)
 }
 
 int
-ssl_supported_tls_version_range(SSL *s, uint16_t *min_ver, uint16_t *max_ver)
+ssl_supported_tls_version_range(const SSL *s, uint16_t *min_ver,
+    uint16_t *max_ver)
 {
         uint16_t min_version, max_version;
 
@@ -222,7 +223,7 @@ ssl_tls_version(uint16_t version)
 }
 
 uint16_t
-ssl_effective_tls_version(SSL *s)
+ssl_effective_tls_version(const SSL *s)
 {
         if (s->s3->hs.negotiated_tls_version > 0)
                 return s->s3->hs.negotiated_tls_version;
@@ -231,7 +232,7 @@ ssl_effective_tls_version(SSL *s)
 }
 
 int
-ssl_max_supported_version(SSL *s, uint16_t *max_ver)
+ssl_max_supported_version(const SSL *s, uint16_t *max_ver)
 {
         uint16_t max_version;
 
@@ -251,7 +252,7 @@ ssl_max_supported_version(SSL *s, uint16_t *max_ver)
 }
 
 int
-ssl_max_legacy_version(SSL *s, uint16_t *max_ver)
+ssl_max_legacy_version(const SSL *s, uint16_t *max_ver)
 {
         uint16_t max_version;
 
@@ -269,7 +270,7 @@ ssl_max_legacy_version(SSL *s, uint16_t *max_ver)
 }
 
 int
-ssl_max_shared_version(SSL *s, uint16_t peer_ver, uint16_t *max_ver)
+ssl_max_shared_version(const SSL *s, uint16_t peer_ver, uint16_t *max_ver)
 {
         uint16_t min_version, max_version, peer_tls_version, shared_version;
 
@@ -338,7 +339,7 @@ ssl_max_shared_version(SSL *s, uint16_t peer_ver, uint16_t *max_ver)
 }
 
 int
-ssl_check_version_from_server(SSL *s, uint16_t server_version)
+ssl_check_version_from_server(const SSL *s, uint16_t server_version)
 {
         uint16_t min_tls_version, max_tls_version, server_tls_version;
 
@@ -363,7 +364,7 @@ ssl_check_version_from_server(SSL *s, uint16_t server_version)
 }
 
 int
-ssl_legacy_stack_version(SSL *s, uint16_t version)
+ssl_legacy_stack_version(const SSL *s, uint16_t version)
 {
         if (SSL_is_dtls(s))
                 return version == DTLS1_VERSION || version == DTLS1_2_VERSION;
diff --git a/src/lib/libssl/t1_lib.c b/src/lib/libssl/t1_lib.c
index 912bea592a..9dfcc0c0f3 100644
--- a/src/lib/libssl/t1_lib.c
+++ b/src/lib/libssl/t1_lib.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: t1_lib.c,v 1.207 2025/12/04 21:16:17 beck Exp $ */
+/* $OpenBSD: t1_lib.c,v 1.209 2026/06/06 08:45:41 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -154,6 +154,7 @@ struct supported_group {
         uint16_t group_id;
         int nid;
         int bits;
+        uint16_t min_version;
 };
 
 /*
@@ -310,6 +311,7 @@ static const struct supported_group nid_list[] = {
                 .group_id = 4588,
                 .nid = NID_X25519MLKEM768,
                 .bits = 128,
+                .min_version = TLS1_3_VERSION,
         },
 };
 
@@ -512,6 +514,17 @@ tls1_group_id_present(uint16_t group_id, const uint16_t *list, size_t list_len)
         return 0;
 }
 
+static int
+tls1_group_id_allowed(const SSL *ssl, uint16_t group_id)
+{
+        const struct supported_group *sg;
+
+        if ((sg = tls1_supported_group_by_id(group_id)) == NULL)
+                return 0;
+
+        return ssl_effective_tls_version(ssl) >= sg->min_version;
+}
+
 int
 tls1_count_shared_groups(const SSL *ssl, size_t *out_count)
 {
@@ -529,6 +542,9 @@ tls1_count_shared_groups(const SSL *ssl, size_t *out_count)
                 if (!ssl_security_shared_group(ssl, pref[i]))
                         continue;
 
+                if (!tls1_group_id_allowed(ssl, pref[i]))
+                        continue;
+
                 count++;
         }
 
@@ -555,6 +571,9 @@ tls1_group_by_index(const SSL *ssl, size_t n, int *out_nid,
                 if (!ssl_security_fn(ssl, pref[i]))
                         continue;
 
+                if (!tls1_group_id_allowed(ssl, pref[i]))
+                        continue;
+
                 if (count++ == n)
                         return tls1_ec_group_id2nid(pref[i], out_nid);
         }
@@ -659,6 +678,10 @@ tls1_check_group(SSL *s, uint16_t group_id)
         for (i = 0; i < groupslen; i++) {
                 if (!ssl_security_supported_group(s, groups[i]))
                         continue;
+
+                if (!tls1_group_id_allowed(s, groups[i]))
+                        continue;
+
                 if (groups[i] == group_id)
                         return 1;
         }
@@ -788,7 +811,7 @@ int
 ssl_check_clienthello_tlsext_late(SSL *s)
 {
         int ret = SSL_TLSEXT_ERR_OK;
-        int al = 0;     /* XXX gcc3 */
+        int al;
 
         /* If status request then ask callback what to do.
          * Note: this must be called after servername callbacks in case
diff --git a/src/lib/libssl/tls1.h b/src/lib/libssl/tls1.h
index 2d5dffc6cf..42451a4214 100644
--- a/src/lib/libssl/tls1.h
+++ b/src/lib/libssl/tls1.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: tls1.h,v 1.61 2025/04/18 07:34:01 tb Exp $ */
+/* $OpenBSD: tls1.h,v 1.62 2026/08/21 17:15:22 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -240,7 +240,7 @@ extern "C" {
 /* ExtensionType value from RFC 5054. */
 #define TLSEXT_TYPE_srp                         12
 
-/* ExtensionType value from RFC 5246/RFC 8446. */
+/* ExtensionType value from RFC 5246/RFC 9846. */
 #define TLSEXT_TYPE_signature_algorithms        13
 
 /* ExtensionType value from RFC 5764. */
@@ -258,7 +258,7 @@ extern "C" {
 /* ExtensionType value from RFC 4507. */
 #define TLSEXT_TYPE_session_ticket              35
 
-/* ExtensionType values from RFC 8446 section 4.2 */
+/* ExtensionType values from RFC 9846 section 4.3 */
 #if defined(LIBRESSL_HAS_TLS1_3) || defined(LIBRESSL_INTERNAL)
 #define TLSEXT_TYPE_pre_shared_key              41
 #define TLSEXT_TYPE_early_data                  42
@@ -279,7 +279,7 @@ extern "C" {
 
 /*
  * TLS 1.3 extension names from OpenSSL, where they decided to use a different
- * name from that given in RFC 8446.
+ * name from that given in RFC 9846.
  */
 #if defined(LIBRESSL_HAS_TLS1_3)
 #define TLSEXT_TYPE_psk                         TLSEXT_TYPE_pre_shared_key
@@ -486,7 +486,7 @@ SSL_CTX_callback_ctrl(ssl,SSL_CTRL_SET_TLSEXT_TICKET_KEY_CB,(void (*)(void))cb)
 #define TLS1_CK_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256    0x030000C4
 #define TLS1_CK_ADH_WITH_CAMELLIA_256_CBC_SHA256        0x030000C5
 
-/* TLS 1.3 cipher suites from RFC 8446 appendix B.4. */
+/* TLS 1.3 cipher suites from RFC 9846 appendix B.4. */
 #if defined(LIBRESSL_HAS_TLS1_3) || defined(LIBRESSL_INTERNAL)
 #define TLS1_3_CK_AES_128_GCM_SHA256                    0x03001301
 #define TLS1_3_CK_AES_256_GCM_SHA384                    0x03001302
@@ -725,7 +725,7 @@ SSL_CTX_callback_ctrl(ssl,SSL_CTRL_SET_TLSEXT_TICKET_KEY_CB,(void (*)(void))cb)
 #define TLS1_TXT_ECDHE_ECDSA_WITH_CHACHA20_POLY1305     "ECDHE-ECDSA-CHACHA20-POLY1305"
 #define TLS1_TXT_DHE_RSA_WITH_CHACHA20_POLY1305         "DHE-RSA-CHACHA20-POLY1305"
 
-/* TLS 1.3 cipher suites from RFC 8446 appendix B.4. */
+/* TLS 1.3 cipher suites from RFC 9846 appendix B.4. */
 #if defined(LIBRESSL_HAS_TLS1_3) || defined(LIBRESSL_INTERNAL)
 #define TLS1_3_TXT_AES_128_GCM_SHA256                   "AEAD-AES128-GCM-SHA256"
 #define TLS1_3_TXT_AES_256_GCM_SHA384                   "AEAD-AES256-GCM-SHA384"
diff --git a/src/lib/libssl/tls13_client.c b/src/lib/libssl/tls13_client.c
index 21d3960796..8abfdbdd1f 100644
--- a/src/lib/libssl/tls13_client.c
+++ b/src/lib/libssl/tls13_client.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: tls13_client.c,v 1.106 2025/12/04 21:16:17 beck Exp $ */
+/* $OpenBSD: tls13_client.c,v 1.109 2026/08/21 17:15:22 tb Exp $ */
 /*
  * Copyright (c) 2018, 2019 Joel Sing <jsing@openbsd.org>
  *
@@ -73,8 +73,8 @@ tls13_client_init(struct tls13_ctx *ctx)
         /*
          * The legacy session identifier should either be set to an
          * unpredictable 32-byte value or zero length... a non-zero length
-         * legacy session identifier triggers compatibility mode (see RFC 8446
-         * Appendix D.4). In the pre-TLSv1.3 case a zero length value is used.
+         * legacy session identifier triggers compatibility mode (see RFC 9846
+         * Appendix E.4). In the pre-TLSv1.3 case a zero length value is used.
          */
         if (ctx->middlebox_compat &&
             ctx->hs->our_max_tls_version >= TLS1_3_VERSION) {
@@ -242,7 +242,7 @@ tls13_server_hello_process(struct tls13_ctx *ctx, CBS *cbs)
         if (tls13_server_hello_is_legacy(cbs)) {
                 if (ctx->hs->our_max_tls_version >= TLS1_3_VERSION) {
                         /*
-                         * RFC 8446 section 4.1.3: we must not downgrade if
+                         * RFC 9846 section 4.2.3: we must not downgrade if
                          * the server random value contains the TLS 1.2 or 1.1
                          * magical value.
                          */
@@ -285,7 +285,7 @@ tls13_server_hello_process(struct tls13_ctx *ctx, CBS *cbs)
         /*
          * The supported versions extension indicated 0x0304 or greater.
          * Ensure that it was 0x0304 and that legacy version is set to 0x0303
-         * (RFC 8446 section 4.2.1).
+         * (RFC 9846 section 4.3.1).
          */
         if (ctx->hs->tls13.server_version != TLS1_3_VERSION ||
             legacy_version != TLS1_2_VERSION) {
@@ -318,7 +318,7 @@ tls13_server_hello_process(struct tls13_ctx *ctx, CBS *cbs)
         if (!(ctx->handshake_stage.hs_type & WITHOUT_HRR) && !ctx->hs->tls13.hrr) {
                 /*
                  * A ServerHello following a HelloRetryRequest MUST use the same
-                 * cipher suite (RFC 8446 section 4.1.4).
+                 * cipher suite (RFC 9846 section 4.2.4).
                  */
                 if (ctx->hs->cipher != cipher) {
                         ctx->alert = TLS13_ALERT_ILLEGAL_PARAMETER;
@@ -450,15 +450,29 @@ tls13_client_hello_retry_send(struct tls13_ctx *ctx, CBB *cbb)
         /*
          * Ensure that the server supported group is one that we listed in our
          * supported groups and is not the same as the key share we previously
-         * offered.
+         * offered. See RFC 9846 section 4.3.8.
          */
-        if (!tls1_check_group(ctx->ssl, ctx->hs->tls13.server_group))
-                return 0; /* XXX alert */
-        if (ctx->hs->tls13.server_group == tls_key_share_group(ctx->hs->key_share))
-                return 0; /* XXX alert */
+        if (!tls1_check_group(ctx->ssl, ctx->hs->tls13.server_group)) {
+                ctx->alert = TLS13_ALERT_ILLEGAL_PARAMETER;
+                return 0;
+        }
+        if (ctx->hs->tls13.server_group == tls_key_share_group(ctx->hs->key_share)) {
+                ctx->alert = TLS13_ALERT_ILLEGAL_PARAMETER;
+                return 0;
+        }
+        if (ctx->hs->tls13.key_share != NULL &&
+            ctx->hs->tls13.server_group == tls_key_share_group(ctx->hs->tls13.key_share)) {
+                ctx->alert = TLS13_ALERT_ILLEGAL_PARAMETER;
+                return 0;
+        }
 
-        /* Switch to new key share. */
+        /* Free original key shares. */
         tls_key_share_free(ctx->hs->key_share);
+        ctx->hs->key_share = NULL;
+        tls_key_share_free(ctx->hs->tls13.key_share);
+        ctx->hs->tls13.key_share = NULL;
+
+        /* Create new key share for server selected group. */
         if ((ctx->hs->key_share =
             tls_key_share_new(ctx->hs->tls13.server_group)) == NULL)
                 return 0;
@@ -841,8 +855,8 @@ tls13_client_select_certificate(struct tls13_ctx *ctx, SSL_CERT_PKEY **out_cpk,
         *out_sigalg = NULL;
 
         /*
-         * XXX - RFC 8446, 4.4.2.3: the server can communicate preferences
-         * with the certificate_authorities (4.2.4) and oid_filters (4.2.5)
+         * XXX - RFC 9846, 4.5.1.2: the server can communicate preferences
+         * with the certificate_authorities (4.3.4) and oid_filters (4.3.5)
          * extensions. We should honor the former and must apply the latter.
          */
 
diff --git a/src/lib/libssl/tls13_handshake.c b/src/lib/libssl/tls13_handshake.c
index 0dc2333708..24178a3396 100644
--- a/src/lib/libssl/tls13_handshake.c
+++ b/src/lib/libssl/tls13_handshake.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: tls13_handshake.c,v 1.73 2024/02/03 19:57:14 tb Exp $ */
+/*      $OpenBSD: tls13_handshake.c,v 1.74 2026/08/21 17:15:22 tb Exp $ */
 /*
  * Copyright (c) 2018-2021 Theo Buehler <tb@openbsd.org>
  * Copyright (c) 2019 Joel Sing <jsing@openbsd.org>
@@ -22,7 +22,7 @@
 #include "tls13_handshake.h"
 #include "tls13_internal.h"
 
-/* Based on RFC 8446 and inspired by s2n's TLS 1.2 state machine. */
+/* Based on RFC 9846 and inspired by s2n's TLS 1.2 state machine. */
 
 struct tls13_handshake_action {
         uint8_t handshake_type;
diff --git a/src/lib/libssl/tls13_internal.h b/src/lib/libssl/tls13_internal.h
index 7a7f8abc63..d3d7ddb9b3 100644
--- a/src/lib/libssl/tls13_internal.h
+++ b/src/lib/libssl/tls13_internal.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: tls13_internal.h,v 1.105 2025/03/09 15:12:18 tb Exp $ */
+/* $OpenBSD: tls13_internal.h,v 1.106 2026/08/21 17:15:22 tb Exp $ */
 /*
  * Copyright (c) 2018 Bob Beck <beck@openbsd.org>
  * Copyright (c) 2018 Theo Buehler <tb@openbsd.org>
@@ -114,7 +114,7 @@ struct tls13_secret {
         size_t len;
 };
 
-/* RFC 8446 Section 7.1  Page 92 */
+/* RFC 9846 section 7.1 */
 struct tls13_secrets {
         const EVP_MD *digest;
         int resumption;
@@ -339,7 +339,7 @@ int tls13_legacy_shutdown(SSL *ssl);
 int tls13_legacy_servername_process(struct tls13_ctx *ctx, uint8_t *alert);
 
 /*
- * Message Types - RFC 8446, Section B.3.
+ * Message Types - RFC 9846 section B.3.
  *
  * Values listed as "_RESERVED" were used in previous versions of TLS and are
  * listed here for completeness.  TLS 1.3 implementations MUST NOT send them but
diff --git a/src/lib/libssl/tls13_key_schedule.c b/src/lib/libssl/tls13_key_schedule.c
index 05bcf0f006..01fbe6603e 100644
--- a/src/lib/libssl/tls13_key_schedule.c
+++ b/src/lib/libssl/tls13_key_schedule.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: tls13_key_schedule.c,v 1.18 2022/11/26 16:08:56 tb Exp $ */
+/* $OpenBSD: tls13_key_schedule.c,v 1.19 2026/08/21 17:15:22 tb Exp $ */
 /*
  * Copyright (c) 2018, Bob Beck <beck@openbsd.org>
  *
@@ -47,7 +47,7 @@ tls13_secret_cleanup(struct tls13_secret *secret)
 
 /*
  * Allocate a set of secrets for a key schedule using
- * a size of hash_length from RFC 8446 section 7.1.
+ * a size of hash_length from RFC 9846 section 7.1.
  */
 struct tls13_secrets *
 tls13_secrets_create(const EVP_MD *digest, int resumption)
@@ -256,7 +256,7 @@ tls13_derive_early_secrets(struct tls13_secrets *secrets,
             &secrets->empty_hash))
                 return 0;
 
-        /* RFC 8446 recommends */
+        /* RFC 9846 recommends */
         if (!secrets->insecure)
                 explicit_bzero(secrets->extracted_early.data,
                     secrets->extracted_early.len);
@@ -300,7 +300,7 @@ tls13_derive_handshake_secrets(struct tls13_secrets *secrets,
             &secrets->empty_hash))
                 return 0;
 
-        /* RFC 8446 recommends */
+        /* RFC 9846 recommends */
         if (!secrets->insecure)
                 explicit_bzero(secrets->extracted_handshake.data,
                     secrets->extracted_handshake.len);
@@ -349,7 +349,7 @@ tls13_derive_application_secrets(struct tls13_secrets *secrets,
             context))
                 return 0;
 
-        /* RFC 8446 recommends */
+        /* RFC 9846 recommends */
         if (!secrets->insecure)
                 explicit_bzero(secrets->extracted_master.data,
                     secrets->extracted_master.len);
@@ -400,7 +400,7 @@ tls13_exporter(struct tls13_ctx *ctx, const uint8_t *label, size_t label_len,
         int ret = 0;
 
         /*
-         * RFC 8446 Section 7.5.
+         * RFC 9846 section 7.5.
          */
 
         memset(&context, 0, sizeof(context));
diff --git a/src/lib/libssl/tls13_legacy.c b/src/lib/libssl/tls13_legacy.c
index 6a06330b22..e42600b2cd 100644
--- a/src/lib/libssl/tls13_legacy.c
+++ b/src/lib/libssl/tls13_legacy.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: tls13_legacy.c,v 1.45 2026/04/03 07:17:36 jsing Exp $ */
+/*      $OpenBSD: tls13_legacy.c,v 1.46 2026/08/21 08:50:34 jsing Exp $ */
 /*
  * Copyright (c) 2018, 2019 Joel Sing <jsing@openbsd.org>
  *
@@ -317,51 +317,34 @@ static int
 tls13_use_legacy_stack(struct tls13_ctx *ctx)
 {
         SSL *s = ctx->ssl;
-        CBB cbb, fragment;
         CBS cbs;
 
-        memset(&cbb, 0, sizeof(cbb));
-
         if (!ssl3_setup_init_buffer(s))
-                goto err;
+                return 0;
         if (!ssl3_setup_buffers(s))
-                goto err;
+                return 0;
         if (!ssl_init_wbio_buffer(s, 1))
-                goto err;
+                return 0;
 
         /* Stash any unprocessed data from the last record. */
         tls13_record_layer_rcontent(ctx->rl, &cbs);
         if (CBS_len(&cbs) > 0) {
-                if (!CBB_init_fixed(&cbb, s->s3->rbuf.buf,
-                    s->s3->rbuf.len))
-                        goto err;
-                if (!CBB_add_u8(&cbb, SSL3_RT_HANDSHAKE))
-                        goto err;
-                if (!CBB_add_u16(&cbb, TLS1_2_VERSION))
-                        goto err;
-                if (!CBB_add_u16_length_prefixed(&cbb, &fragment))
-                        goto err;
-                if (!CBB_add_bytes(&fragment, CBS_data(&cbs), CBS_len(&cbs)))
-                        goto err;
-                if (!CBB_finish(&cbb, NULL, NULL))
-                        goto err;
-
-                s->s3->rbuf.offset = SSL3_RT_HEADER_LENGTH;
-                s->s3->rbuf.left = CBS_len(&cbs);
-                s->s3->rrec.type = SSL3_RT_HANDSHAKE;
-                s->s3->rrec.length = CBS_len(&cbs);
-                s->rstate = SSL_ST_READ_BODY;
-                s->packet = s->s3->rbuf.buf;
-                s->packet_length = SSL3_RT_HEADER_LENGTH;
+                if (s->s3->rcontent != NULL)
+                        return 0;
+                if ((s->s3->rcontent = tls_content_new()) == NULL)
+                        return 0;
+                if (!tls_content_dup_data(s->s3->rcontent, 
+                    SSL3_RT_HANDSHAKE, CBS_data(&cbs), CBS_len(&cbs)))
+                        return 0;
         }
 
         /* Stash the current handshake message. */
         tls13_handshake_msg_data(ctx->hs_msg, &cbs);
         if (!BUF_MEM_grow_clean(s->init_buf, CBS_len(&cbs)))
-                goto err;
+                return 0;
         if (!CBS_write_bytes(&cbs, s->init_buf->data,
             s->init_buf->length, NULL))
-                goto err;
+                return 0;
 
         s->s3->hs.tls12.reuse_message = 1;
         s->s3->hs.tls12.message_type = tls13_handshake_msg_type(ctx->hs_msg);
@@ -374,11 +357,6 @@ tls13_use_legacy_stack(struct tls13_ctx *ctx)
         s->method = tls_legacy_method();
 
         return 1;
-
- err:
-        CBB_cleanup(&cbb);
-
-        return 0;
 }
 
 int
diff --git a/src/lib/libssl/tls13_lib.c b/src/lib/libssl/tls13_lib.c
index c3470b2931..f93452402f 100644
--- a/src/lib/libssl/tls13_lib.c
+++ b/src/lib/libssl/tls13_lib.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: tls13_lib.c,v 1.78 2025/06/07 10:25:12 tb Exp $ */
+/*      $OpenBSD: tls13_lib.c,v 1.79 2026/08/21 17:15:22 tb Exp $ */
 /*
  * Copyright (c) 2018, 2019 Joel Sing <jsing@openbsd.org>
  * Copyright (c) 2019 Bob Beck <beck@openbsd.org>
@@ -25,14 +25,14 @@
 #include "tls13_internal.h"
 
 /*
- * RFC 8446, section 4.6.1. Servers must not indicate a lifetime longer than
+ * RFC 9846 section 4.7.1. Servers must not indicate a lifetime longer than
  * 7 days and clients must not cache tickets for longer than 7 days.
  */
 
 #define TLS13_MAX_TICKET_LIFETIME       (7 * 24 * 3600)
 
 /*
- * Downgrade sentinels - RFC 8446 section 4.1.3, magic values which must be set
+ * Downgrade sentinels - RFC 9846 section 4.2.3, magic values which must be set
  * by the server in server random if it is willing to downgrade but supports
  * TLSv1.3
  */
@@ -44,7 +44,7 @@ const uint8_t tls13_downgrade_11[8] = {
 };
 
 /*
- * HelloRetryRequest hash - RFC 8446 section 4.1.3.
+ * HelloRetryRequest hash - RFC 9846 section 4.2.3.
  */
 const uint8_t tls13_hello_retry_request_hash[32] = {
         0xcf, 0x21, 0xad, 0x74, 0xe5, 0x9a, 0x61, 0x11,
@@ -54,7 +54,7 @@ const uint8_t tls13_hello_retry_request_hash[32] = {
 };
 
 /*
- * Certificate Verify padding - RFC 8446 section 4.4.3.
+ * Certificate Verify padding - RFC 9846 section 4.5.2.
  */
 const uint8_t tls13_cert_verify_pad[64] = {
         0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
@@ -156,7 +156,7 @@ tls13_alert_received_cb(uint8_t alert_level, uint8_t alert_desc, void *arg)
         if (alert_desc == TLS13_ALERT_USER_CANCELED) {
                 /*
                  * We treat this as advisory, since a close_notify alert
-                 * SHOULD follow this alert (RFC 8446 section 6.1).
+                 * MUST follow this alert (RFC 9846 section 6.1).
                  */
                 return;
         }
@@ -369,7 +369,7 @@ tls13_key_update_recv(struct tls13_ctx *ctx, CBS *cbs)
         return tls13_send_alert(ctx->rl, alert);
 }
 
-/* RFC 8446 section 4.6.1 */
+/* RFC 9846 section 4.7.1 */
 static ssize_t
 tls13_new_session_ticket_recv(struct tls13_ctx *ctx, CBS *cbs)
 {
@@ -628,7 +628,7 @@ tls13_synthetic_handshake_message(struct tls13_ctx *ctx)
 
         /*
          * Replace ClientHello with synthetic handshake message - see
-         * RFC 8446 section 4.4.1.
+         * RFC 9846 section 4.1.
          */
         if (!tls1_transcript_hash_init(s))
                 goto err;
diff --git a/src/lib/libssl/tls13_record.c b/src/lib/libssl/tls13_record.c
index dbc835c546..0723fa3b0a 100644
--- a/src/lib/libssl/tls13_record.c
+++ b/src/lib/libssl/tls13_record.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: tls13_record.c,v 1.10 2022/07/22 19:33:53 jsing Exp $ */
+/* $OpenBSD: tls13_record.c,v 1.11 2026/08/21 02:23:33 kenjiro Exp $ */
 /*
  * Copyright (c) 2018, 2019 Joel Sing <jsing@openbsd.org>
  *
@@ -32,19 +32,7 @@ struct tls13_record {
 struct tls13_record *
 tls13_record_new(void)
 {
-        struct tls13_record *rec = NULL;
-
-        if ((rec = calloc(1, sizeof(struct tls13_record))) == NULL)
-                goto err;
-        if ((rec->buf = tls_buffer_new(TLS13_RECORD_MAX_LEN)) == NULL)
-                goto err;
-
-        return rec;
-
- err:
-        tls13_record_free(rec);
-
-        return NULL;
+        return calloc(1, sizeof(struct tls13_record));
 }
 
 void
@@ -129,6 +117,11 @@ tls13_record_recv(struct tls13_record *rec, tls_read_cb wire_read,
         if (rec->data != NULL)
                 return TLS13_IO_FAILURE;
 
+        if (rec->buf == NULL)
+                rec->buf = tls_buffer_new(TLS13_RECORD_HEADER_LEN);
+        if (rec->buf == NULL)
+                return TLS13_IO_FAILURE;
+
         if (rec->content_type == 0) {
                 if ((ret = tls_buffer_extend(rec->buf,
                     TLS13_RECORD_HEADER_LEN, wire_read, wire_arg)) <= 0)
diff --git a/src/lib/libssl/tls13_record.h b/src/lib/libssl/tls13_record.h
index 18e4fa1aba..e9bcae6efd 100644
--- a/src/lib/libssl/tls13_record.h
+++ b/src/lib/libssl/tls13_record.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: tls13_record.h,v 1.5 2021/10/23 13:12:14 jsing Exp $ */
+/* $OpenBSD: tls13_record.h,v 1.6 2026/08/21 17:15:22 tb Exp $ */
 /*
  * Copyright (c) 2019 Joel Sing <jsing@openbsd.org>
  *
@@ -23,7 +23,7 @@
 __BEGIN_HIDDEN_DECLS
 
 /*
- * TLSv1.3 Record Protocol - RFC 8446 section 5.
+ * TLSv1.3 Record Protocol - RFC 9846 section 5.
  *
  * The maximum plaintext is 2^14, however for inner plaintext an additional
  * byte is allowed for the content type. A maximum AEAD overhead of 255-bytes
@@ -41,7 +41,7 @@ __BEGIN_HIDDEN_DECLS
         (TLS13_RECORD_HEADER_LEN + TLS13_RECORD_MAX_CIPHERTEXT_LEN)
 
 /*
- * TLSv1.3 Per-Record Nonces and Sequence Numbers - RFC 8446 section 5.3.
+ * TLSv1.3 Per-Record Nonces and Sequence Numbers - RFC 9846 section 5.3.
  */
 #define TLS13_RECORD_SEQ_NUM_LEN 8
 
diff --git a/src/lib/libssl/tls13_record_layer.c b/src/lib/libssl/tls13_record_layer.c
index f5604adbeb..e573b50760 100644
--- a/src/lib/libssl/tls13_record_layer.c
+++ b/src/lib/libssl/tls13_record_layer.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: tls13_record_layer.c,v 1.74 2024/09/09 03:32:29 tb Exp $ */
+/* $OpenBSD: tls13_record_layer.c,v 1.76 2026/08/21 17:15:22 tb Exp $ */
 /*
  * Copyright (c) 2018, 2019 Joel Sing <jsing@openbsd.org>
  *
@@ -31,13 +31,13 @@ struct tls13_record_protection {
         uint8_t seq_num[TLS13_RECORD_SEQ_NUM_LEN];
 };
 
-struct tls13_record_protection *
+static struct tls13_record_protection *
 tls13_record_protection_new(void)
 {
         return calloc(1, sizeof(struct tls13_record_protection));
 }
 
-void
+static void
 tls13_record_protection_clear(struct tls13_record_protection *rp)
 {
         EVP_AEAD_CTX_free(rp->aead_ctx);
@@ -48,7 +48,7 @@ tls13_record_protection_clear(struct tls13_record_protection *rp)
         memset(rp, 0, sizeof(*rp));
 }
 
-void
+static void
 tls13_record_protection_free(struct tls13_record_protection *rp)
 {
         if (rp == NULL)
@@ -95,7 +95,7 @@ struct tls13_record_layer {
         uint8_t alert_level;
         uint8_t alert_desc;
 
-        /* Pending post-handshake handshake messages (RFC 8446, section 4.6). */
+        /* Pending post-handshake handshake messages (RFC 9846, section 4.7). */
         CBS phh_cbs;
         uint8_t *phh_data;
         size_t phh_len;
@@ -200,7 +200,7 @@ tls13_record_layer_inc_seq_num(uint8_t *seq_num)
 {
         int i;
 
-        /* RFC 8446 section 5.3 - sequence numbers must not wrap. */
+        /* RFC 9846 section 5.3 - sequence numbers must not wrap. */
         if (memcmp(seq_num, tls13_max_seq_num, TLS13_RECORD_SEQ_NUM_LEN) == 0)
                 return 0;
 
@@ -222,7 +222,7 @@ tls13_record_layer_update_nonce(struct tls13_secret *nonce,
                 return 0;
 
         /*
-         * RFC 8446 section 5.3 - sequence number is zero padded and XOR'd
+         * RFC 9846 section 5.3 - sequence number is zero padded and XOR'd
          * with the IV to produce a per-record nonce. The IV will also be
          * at least 8-bytes in length.
          */
@@ -284,7 +284,7 @@ tls13_record_layer_process_alert(struct tls13_record_layer *rl)
         ssize_t ret = TLS13_IO_FAILURE;
 
         /*
-         * RFC 8446 - sections 5.1 and 6.
+         * RFC 9846 - sections 5.1 and 6.
          *
          * A TLSv1.3 alert record can only contain a single alert - this means
          * that processing the alert must consume all of the record. The alert
@@ -305,8 +305,8 @@ tls13_record_layer_process_alert(struct tls13_record_layer *rl)
         tls_content_clear(rl->rcontent);
 
         /*
-         * Alert level is ignored for closure alerts (RFC 8446 section 6.1),
-         * however for error alerts (RFC 8446 section 6.2), the alert level
+         * Alert level is ignored for closure alerts (RFC 9846 section 6.1),
+         * however for error alerts (RFC 9846 section 6.2), the alert level
          * must be specified as fatal.
          */
         if (alert_desc == TLS13_ALERT_CLOSE_NOTIFY) {
@@ -344,7 +344,7 @@ tls13_record_layer_send_alert(struct tls13_record_layer *rl)
 {
         ssize_t ret;
 
-        /* This has to fit into a single record, per RFC 8446 section 5.1. */
+        /* This has to fit into a single record, per RFC 9846 section 5.1. */
         if ((ret = tls13_record_layer_write_record(rl, SSL3_RT_ALERT,
             rl->alert_data, rl->alert_len)) != rl->alert_len) {
                 if (ret == TLS13_IO_EOF)
@@ -604,7 +604,7 @@ tls13_record_layer_open_record_protected(struct tls13_record_layer *rl)
                         break;
         }
         if (content_type == 0) {
-                /* Unexpected message per RFC 8446 section 5.4. */
+                /* Unexpected message per RFC 9846 section 5.4. */
                 rl->alert = TLS13_ALERT_UNEXPECTED_MESSAGE;
                 goto err;
         }
@@ -835,7 +835,7 @@ tls13_record_layer_read_record(struct tls13_record_layer *rl)
         /*
          * In response to a client hello we may receive an alert in a
          * record with a legacy version. Otherwise enforce that the
-         * legacy record version is 0x0303 per RFC 8446, section 5.1.
+         * legacy record version is 0x0303 per RFC 9846, section 5.1.
          */
         if (rl->legacy_version == TLS1_2_VERSION &&
             tls13_record_version(rl->rrec) != TLS1_2_VERSION &&
@@ -846,7 +846,7 @@ tls13_record_layer_read_record(struct tls13_record_layer *rl)
          * Bag of hacks ahead... after the first ClientHello message has been
          * sent or received and before the peer's Finished message has been
          * received, we may receive an unencrypted ChangeCipherSpec record
-         * (see RFC 8446 section 5 and appendix D.4). This record must be
+         * (see RFC 9846 section 5 and appendix E.4). This record must be
          * ignored.
          */
         if (content_type == SSL3_RT_CHANGE_CIPHER_SPEC) {
@@ -881,7 +881,7 @@ tls13_record_layer_read_record(struct tls13_record_layer *rl)
         /*
          * On receiving a handshake or alert record with empty inner plaintext,
          * we must terminate the connection with an unexpected_message alert.
-         * See RFC 8446 section 5.4.
+         * See RFC 9846 section 5.4.
          */
         if (tls_content_remaining(rl->rcontent) == 0 &&
             (tls_content_type(rl->rcontent) == SSL3_RT_ALERT ||
diff --git a/src/lib/libssl/tls13_server.c b/src/lib/libssl/tls13_server.c
index 604dab4cba..8b0dc8a26b 100644
--- a/src/lib/libssl/tls13_server.c
+++ b/src/lib/libssl/tls13_server.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: tls13_server.c,v 1.112 2025/12/04 21:03:42 beck Exp $ */
+/* $OpenBSD: tls13_server.c,v 1.114 2026/08/21 17:15:22 tb Exp $ */
 /*
  * Copyright (c) 2019, 2020 Joel Sing <jsing@openbsd.org>
  * Copyright (c) 2020 Bob Beck <beck@openbsd.org>
@@ -96,19 +96,19 @@ tls13_client_hello_is_legacy(CBS *cbs)
         return (max_version < TLS1_3_VERSION);
 }
 
-int
+static int
 tls13_client_hello_required_extensions(struct tls13_ctx *ctx)
 {
         SSL *s = ctx->ssl;
 
         /*
-         * RFC 8446, section 9.2. If the ClientHello has supported_versions
+         * RFC 9846 section 9.2. If the ClientHello has supported_versions
          * containing TLSv1.3, presence or absence of some extensions requires
          * presence or absence of others.
          */
 
         /*
-         * RFC 8446 section 4.2.9 - if we received a pre_shared_key, then we
+         * RFC 9846 section 4.3.9 - if we received a pre_shared_key, then we
          * also need psk_key_exchange_modes. Otherwise, section 9.2 specifies
          * that we need both signature_algorithms and supported_groups.
          */
@@ -133,7 +133,7 @@ tls13_client_hello_required_extensions(struct tls13_ctx *ctx)
 
         /*
          * XXX - Require server_name from client? If so, we SHOULD enforce
-         * this here - RFC 8446, 9.2.
+         * this here - RFC 9846, 9.2.
          */
 
         return 1;
@@ -246,7 +246,7 @@ tls13_client_hello_process(struct tls13_ctx *ctx, CBS *cbs)
         /*
          * The legacy session identifier must either be zero length or a 32 byte
          * value (in which case the client is requesting middlebox compatibility
-         * mode), as per RFC 8446 section 4.1.2. If it is valid, store the value
+         * mode), as per RFC 9846 section 4.2.2. If it is valid, store the value
          * so that we can echo it back to the client.
          */
         if (CBS_len(&session_id) != 0 &&
@@ -459,7 +459,7 @@ tls13_server_hello_retry_request_sent(struct tls13_ctx *ctx)
         /*
          * If the client has requested middlebox compatibility mode,
          * we MUST send a dummy CCS following our first handshake message.
-         * See RFC 8446 Appendix D.4.
+         * See RFC 9846 Appendix E.4.
          */
         if (ctx->hs->tls13.legacy_session_id_len > 0)
                 ctx->send_dummy_ccs_after = 1;
@@ -519,7 +519,7 @@ tls13_server_hello_sent(struct tls13_ctx *ctx)
         /*
          * If the client has requested middlebox compatibility mode,
          * we MUST send a dummy CCS following our first handshake message.
-         * See RFC 8446 Appendix D.4.
+         * See RFC 9846 Appendix E.4.
          */
         if ((ctx->handshake_stage.hs_type & WITHOUT_HRR) &&
             ctx->hs->tls13.legacy_session_id_len > 0)
@@ -572,7 +572,7 @@ tls13_server_check_certificate(struct tls13_ctx *ctx, SSL_CERT_PKEY *cpk,
 
         /*
          * The digitalSignature bit MUST be set if the Key Usage extension is
-         * present as per RFC 8446 section 4.4.2.2.
+         * present as per RFC 9846 section 4.5.1.2.
          */
         if (!(X509_get_key_usage(cpk->x509) & X509v3_KU_DIGITAL_SIGNATURE))
                 goto done;
diff --git a/src/lib/libssl/tls_key_share.c b/src/lib/libssl/tls_key_share.c
index 9e04cb7b75..adaf147584 100644
--- a/src/lib/libssl/tls_key_share.c
+++ b/src/lib/libssl/tls_key_share.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: tls_key_share.c,v 1.10 2026/01/01 12:47:52 tb Exp $ */
+/* $OpenBSD: tls_key_share.c,v 1.12 2026/06/08 11:38:04 tb Exp $ */
 /*
  * Copyright (c) 2020, 2021 Joel Sing <jsing@openbsd.org>
  *
@@ -469,6 +469,9 @@ int
 tls_key_share_peer_params(struct tls_key_share *ks, CBS *cbs,
     int *decode_error, int *invalid_params)
 {
+        *decode_error = 0;
+        *invalid_params = 0;
+
         if (ks->nid != NID_dhKeyAgreement)
                 return 0;
 
@@ -488,7 +491,8 @@ tls_key_share_peer_public_dhe(struct tls_key_share *ks, CBS *cbs,
 }
 
 static int
-tls_key_share_peer_public_ecdhe_ecp(struct tls_key_share *ks, CBS *cbs)
+tls_key_share_peer_public_ecdhe_ecp(struct tls_key_share *ks, CBS *cbs,
+    int *decode_error)
 {
         EC_KEY *ecdhe = NULL;
         int ret = 0;
@@ -498,7 +502,7 @@ tls_key_share_peer_public_ecdhe_ecp(struct tls_key_share *ks, CBS *cbs)
 
         if ((ecdhe = EC_KEY_new()) == NULL)
                 goto err;
-        if (!ssl_kex_peer_public_ecdhe_ecp(ecdhe, ks->nid, cbs))
+        if (!ssl_kex_peer_public_ecdhe_ecp(ecdhe, ks->nid, cbs, decode_error))
                 goto err;
 
         ks->ecdhe_peer = ecdhe;
@@ -518,8 +522,6 @@ tls_key_share_peer_public_x25519(struct tls_key_share *ks, CBS *cbs,
 {
         size_t out_len;
 
-        *decode_error = 0;
-
         if (ks->x25519_peer_public != NULL)
                 return 0;
 
@@ -570,8 +572,6 @@ tls_key_share_server_peer_public_mlkem768x25519(struct tls_key_share *ks,
         CBS x25519_cbs, mlkem768_cbs;
         size_t out_len;
 
-        *decode_error = 0;
-
         /* The server should not have an mlkem private key */
         if (ks->mlkem_private != NULL)
                 return 0;
@@ -619,11 +619,6 @@ static int
 tls_key_share_peer_public(struct tls_key_share *ks, CBS *cbs, int *decode_error,
     int *invalid_key)
 {
-        *decode_error = 0;
-
-        if (invalid_key != NULL)
-                *invalid_key = 0;
-
         if (ks->nid == NID_dhKeyAgreement)
                 return tls_key_share_peer_public_dhe(ks, cbs, decode_error,
                     invalid_key);
@@ -631,7 +626,7 @@ tls_key_share_peer_public(struct tls_key_share *ks, CBS *cbs, int *decode_error,
         if (ks->nid == NID_X25519)
                 return tls_key_share_peer_public_x25519(ks, cbs, decode_error);
 
-        return tls_key_share_peer_public_ecdhe_ecp(ks, cbs);
+        return tls_key_share_peer_public_ecdhe_ecp(ks, cbs, decode_error);
 }
 
 /* Called from client to process a server peer */
@@ -639,6 +634,11 @@ int
 tls_key_share_client_peer_public(struct tls_key_share *ks, CBS *cbs,
     int *decode_error, int *invalid_key)
 {
+        *decode_error = 0;
+
+        if (invalid_key != NULL)
+                *invalid_key = 0;
+
         if (ks->nid == NID_X25519MLKEM768)
                 return tls_key_share_client_peer_public_mlkem768x25519(ks, cbs,
                     decode_error);
@@ -651,6 +651,11 @@ int
 tls_key_share_server_peer_public(struct tls_key_share *ks, CBS *cbs,
     int *decode_error, int *invalid_key)
 {
+        *decode_error = 0;
+
+        if (invalid_key != NULL)
+                *invalid_key = 0;
+
         if (ks->nid == NID_X25519MLKEM768)
                 return tls_key_share_server_peer_public_mlkem768x25519(ks, cbs,
                     decode_error);
diff --git a/src/lib/libtls/man/tls_config_set_protocols.3 b/src/lib/libtls/man/tls_config_set_protocols.3
index 403bc10b82..b9ef27ee6a 100644
--- a/src/lib/libtls/man/tls_config_set_protocols.3
+++ b/src/lib/libtls/man/tls_config_set_protocols.3
@@ -1,4 +1,4 @@
-.\" $OpenBSD: tls_config_set_protocols.3,v 1.13 2025/07/07 10:54:00 schwarze Exp $
+.\" $OpenBSD: tls_config_set_protocols.3,v 1.14 2026/06/06 16:23:30 sthen Exp $
 .\"
 .\" Copyright (c) 2014 Ted Unangst <tedu@openbsd.org>
 .\" Copyright (c) 2015, 2016 Joel Sing <jsing@openbsd.org>
@@ -16,7 +16,7 @@
 .\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 .\"
-.Dd $Mdocdate: July 7 2025 $
+.Dd $Mdocdate: June 6 2026 $
 .Dt TLS_CONFIG_SET_PROTOCOLS 3
 .Os
 .Sh NAME
@@ -174,8 +174,8 @@ which disables DHE key exchange.
 specifies the names of the elliptic curves that may be used during Elliptic
 Curve Diffie-Hellman Ephemeral (ECDHE) key exchange.
 This is a comma separated list, given in order of preference.
-The special value of "default" will use the default curves (currently X25519,
-P-256 and P-384).
+The special value of "default" will use the default curves (currently
+X25519MLKEM768, X25519, P-256 and P-384).
 This function replaces
 .Fn tls_config_set_ecdhecurve ,
 which is deprecated.
diff --git a/src/lib/libtls/man/tls_conn_version.3 b/src/lib/libtls/man/tls_conn_version.3
index 3a386cf11f..f88f2cf260 100644
--- a/src/lib/libtls/man/tls_conn_version.3
+++ b/src/lib/libtls/man/tls_conn_version.3
@@ -1,4 +1,4 @@
-.\" $OpenBSD: tls_conn_version.3,v 1.12 2025/07/07 10:54:00 schwarze Exp $
+.\" $OpenBSD: tls_conn_version.3,v 1.13 2026/06/07 12:06:30 tb Exp $
 .\"
 .\" Copyright (c) 2015 Bob Beck <beck@openbsd.org>
 .\" Copyright (c) 2016, 2018 Joel Sing <jsing@openbsd.org>
@@ -15,7 +15,7 @@
 .\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 .\"
-.Dd $Mdocdate: July 7 2025 $
+.Dd $Mdocdate: June 7 2026 $
 .Dt TLS_CONN_VERSION 3
 .Os
 .Sh NAME
@@ -218,6 +218,7 @@ appeared in
 .Fn tls_conn_cipher_strength
 appeared in
 .Ox 6.7 .
+.Pp
 .Fn tls_peer_cert_common_name
 appeared in
 .Ox 7.7 .
diff --git a/src/lib/libtls/tls_internal.h b/src/lib/libtls/tls_internal.h
index 8e566a34e0..434efc196a 100644
--- a/src/lib/libtls/tls_internal.h
+++ b/src/lib/libtls/tls_internal.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: tls_internal.h,v 1.86 2024/12/10 08:40:30 tb Exp $ */
+/* $OpenBSD: tls_internal.h,v 1.87 2026/06/06 16:23:30 sthen Exp $ */
 /*
  * Copyright (c) 2014 Jeremie Courreges-Anglas <jca@openbsd.org>
  * Copyright (c) 2014 Joel Sing <jsing@openbsd.org>
@@ -37,7 +37,7 @@ __BEGIN_HIDDEN_DECLS
 #define TLS_CIPHERS_LEGACY      "HIGH:MEDIUM:!aNULL"
 #define TLS_CIPHERS_ALL         "ALL:!aNULL:!eNULL"
 
-#define TLS_ECDHE_CURVES        "X25519,P-256,P-384"
+#define TLS_ECDHE_CURVES        "X25519MLKEM768,X25519,P-256,P-384"
 
 union tls_addr {
         struct in_addr ip4;
diff --git a/src/lib/libtls/tls_verify.c b/src/lib/libtls/tls_verify.c
index de95ab8117..edf2bcdae3 100644
--- a/src/lib/libtls/tls_verify.c
+++ b/src/lib/libtls/tls_verify.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: tls_verify.c,v 1.33 2026/03/28 11:33:33 tb Exp $ */
+/* $OpenBSD: tls_verify.c,v 1.34 2026/05/30 17:06:09 jsing Exp $ */
 /*
  * Copyright (c) 2014 Jeremie Courreges-Anglas <jca@openbsd.org>
  *
@@ -59,6 +59,9 @@ tls_match_name(const char *cert_name, const char *name)
                 /* Disallow "*.bar" */
                 if (next_dot == NULL)
                         return -1;
+                /* Disallow "*.bar." */
+                if (next_dot[1] == '\0')
+                        return -1;
                 /* Disallow "*.bar.." */
                 if (next_dot[1] == '.')
                         return -1;
diff --git a/src/regress/lib/libc/Makefile b/src/regress/lib/libc/Makefile
index 7a8db225ef..c43cb5aa6c 100644
--- a/src/regress/lib/libc/Makefile
+++ b/src/regress/lib/libc/Makefile
@@ -1,13 +1,13 @@
-#       $OpenBSD: Makefile,v 1.62 2025/08/04 06:10:40 tb Exp $
+#       $OpenBSD: Makefile,v 1.65 2026/08/31 15:17:51 deraadt Exp $
 
 SUBDIR+= _setjmp
 SUBDIR+= alloca arc4random-fork atexit
 SUBDIR+= basename
 SUBDIR+= cephes cxa-atexit
 SUBDIR+= db dirname
-SUBDIR+= elf_aux_info
+SUBDIR+= elf_aux_info getexecpath
 SUBDIR+= env explicit_bzero
-SUBDIR+= ffs fmemopen fnmatch fpclassify fread
+SUBDIR+= ffs fmemopen fnmatch fpclassify fread freeaddrinfo
 SUBDIR+= gcvt getaddrinfo getcap getopt getopt_long glob
 SUBDIR+= hash
 SUBDIR+= hsearch
@@ -15,7 +15,7 @@ SUBDIR+= ieeefp ifnameindex illumos
 SUBDIR+= ldexp locale longjmp
 SUBDIR+= malloc mkstemp modf
 SUBDIR+= netdb
-SUBDIR+= open_memstream orientation
+SUBDIR+= open_memstream orientation open_wmemstream
 SUBDIR+= popen printf
 SUBDIR+= qsort
 SUBDIR+= regex
diff --git a/src/regress/lib/libc/asr/bin/Makefile.inc b/src/regress/lib/libc/asr/bin/Makefile.inc
index 80b4805136..c515546808 100644
--- a/src/regress/lib/libc/asr/bin/Makefile.inc
+++ b/src/regress/lib/libc/asr/bin/Makefile.inc
@@ -1,8 +1,9 @@
-#       $OpenBSD: Makefile.inc,v 1.2 2012/09/05 21:21:13 eric Exp $
+#       $OpenBSD: Makefile.inc,v 1.3 2026/05/08 04:02:24 tb Exp $
 
 NOMAN=  noman
 
 SRCS+=          common.c
 CFLAGS+=        -Wall -Wstrict-prototypes -Werror -Wundef -g
+CFLAGS+=        -Wno-unused-but-set-variable
 LDSTATIC=       ${STATIC}
 PROG:=          ${PROG}${EXT}
diff --git a/src/regress/lib/libc/asr/bin/threads.c b/src/regress/lib/libc/asr/bin/threads.c
index f296f1d6f7..3bc0fc250e 100644
--- a/src/regress/lib/libc/asr/bin/threads.c
+++ b/src/regress/lib/libc/asr/bin/threads.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: threads.c,v 1.1.1.1 2012/07/13 17:49:53 eric Exp $    */
+/*      $OpenBSD: threads.c,v 1.2 2026/05/08 04:01:04 tb Exp $  */
 /*
  * Copyright (c) 2012 Eric Faurot <eric@openbsd.org>
  *
@@ -34,9 +34,9 @@ char	**av;
 int       loop;
 int       nthreads;
 
-int long_err;
-int gai_errno;
-int rrset_errno;
+extern int long_err;
+extern int gai_errno;
+extern int rrset_errno;
 
 void async_resolver_done(void *);
 
diff --git a/src/regress/lib/libc/asr/regress.sh b/src/regress/lib/libc/asr/regress.sh
index a0950cefde..d6ced49d6b 100644
--- a/src/regress/lib/libc/asr/regress.sh
+++ b/src/regress/lib/libc/asr/regress.sh
@@ -1,6 +1,6 @@
-#       $OpenBSD: regress.sh,v 1.7 2017/03/10 17:23:48 eric Exp $
+#       $OpenBSD: regress.sh,v 1.8 2026/05/08 04:13:44 tb Exp $
 
-. regress.subr
+. ${PWD}/regress.subr
 
 test_res_mkquery()
 {
diff --git a/src/regress/lib/libc/asr/regress.subr b/src/regress/lib/libc/asr/regress.subr
index 6ce645bc33..731b9741c5 100644
--- a/src/regress/lib/libc/asr/regress.subr
+++ b/src/regress/lib/libc/asr/regress.subr
@@ -1,5 +1,5 @@
 #!/bin/sh
-#       $OpenBSD: regress.subr,v 1.4 2017/03/14 20:22:06 eric Exp $
+#       $OpenBSD: regress.subr,v 1.5 2026/05/08 04:02:59 tb Exp $
 
 set -e
 
@@ -65,7 +65,6 @@ regress_setenv()
         cp /etc/hosts "${ROOTDIR}/etc/"
         cp /etc/resolv.conf "${ROOTDIR}/etc/"
         cp /etc/protocols "${ROOTDIR}/etc/"
-        cp /etc/networks "${ROOTDIR}/etc/"
         cp /etc/services "${ROOTDIR}/etc/"
 
         case $_name in
diff --git a/src/regress/lib/libc/freeaddrinfo/Makefile b/src/regress/lib/libc/freeaddrinfo/Makefile
new file mode 100644
index 0000000000..f5ccd611eb
--- /dev/null
+++ b/src/regress/lib/libc/freeaddrinfo/Makefile
@@ -0,0 +1,5 @@
+#       $OpenBSD: Makefile,v 1.1 2026/06/27 17:52:29 jca Exp $
+
+PROG =          freeaddrinfo
+
+.include <bsd.regress.mk>
diff --git a/src/regress/lib/libc/freeaddrinfo/freeaddrinfo.c b/src/regress/lib/libc/freeaddrinfo/freeaddrinfo.c
new file mode 100644
index 0000000000..520ba6251e
--- /dev/null
+++ b/src/regress/lib/libc/freeaddrinfo/freeaddrinfo.c
@@ -0,0 +1,22 @@
+/* $OpenBSD: freeaddrinfo.c,v 1.1 2026/06/27 17:52:29 jca Exp $ */
+
+/* Public Domain */
+
+#include <sys/types.h>
+#include <sys/socket.h>
+
+#include <netdb.h>
+
+#include <stddef.h>
+
+int
+main(void)
+{
+        /*
+         * The behavior of freeaddrinfo(NULL) isn't specified,
+         * but we want to gracefully handle it (ie avoid a crash).
+         */
+        freeaddrinfo(NULL);
+
+        return 0;
+}
diff --git a/src/regress/lib/libc/getaddrinfo/gaitest.c b/src/regress/lib/libc/getaddrinfo/gaitest.c
index 2508c05e02..86967e3e24 100644
--- a/src/regress/lib/libc/getaddrinfo/gaitest.c
+++ b/src/regress/lib/libc/getaddrinfo/gaitest.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: gaitest.c,v 1.7 2020/02/14 19:17:33 schwarze Exp $    */
+/*      $OpenBSD: gaitest.c,v 1.9 2026/06/27 17:33:50 jca Exp $ */
 /*      $NetBSD: gaitest.c,v 1.3 2002/07/05 15:47:43 itojun Exp $       */
 
 /*
@@ -55,20 +55,15 @@ int vflag = 0;
 
 static void usage(void);
 static void print1(const char *, const struct addrinfo *, char *, char *);
-int main(int, char *[]);
 
 static void
-usage()
+usage(void)
 {
         fprintf(stderr, "usage: test [-f family] [-s socktype] [-p proto] [-DPRSv46] host serv\n");
 }
 
 static void
-print1(title, res, h, s)
-        const char *title;
-        const struct addrinfo *res;
-        char *h;
-        char *s;
+print1(const char *title, const struct addrinfo *res, char *h, char *s)
 {
         char *start, *end;
         int error;
@@ -112,9 +107,7 @@ print1(title, res, h, s)
 }
 
 int
-main(argc, argv)
-        int argc;
-        char *argv[];
+main(int argc, char *argv[])
 {
         struct addrinfo *res;
         int error, i;
diff --git a/src/regress/lib/libc/getexecpath/Makefile b/src/regress/lib/libc/getexecpath/Makefile
new file mode 100644
index 0000000000..c952c5cb38
--- /dev/null
+++ b/src/regress/lib/libc/getexecpath/Makefile
@@ -0,0 +1,8 @@
+PROG=getexecpath
+
+WARNINGS=yes
+
+run-regress-${PROG}:    ${PROG}
+        ./${PROG} `cd ${.OBJDIR} && pwd -P`/${PROG}
+
+.include <bsd.regress.mk>
diff --git a/src/regress/lib/libc/getexecpath/getexecpath.c b/src/regress/lib/libc/getexecpath/getexecpath.c
new file mode 100644
index 0000000000..c0ee005ca2
--- /dev/null
+++ b/src/regress/lib/libc/getexecpath/getexecpath.c
@@ -0,0 +1,24 @@
+#include <sys/types.h>
+#include <sys/auxv.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <limits.h>
+#include <stdio.h>
+#include <err.h>
+
+int
+main(int argc, char *argv[])
+{
+        char path[PATH_MAX];
+
+        if (argc < 1)
+                errx(1, "usage: getexecpath expected-path");
+
+        if (getexecpath(path, sizeof path) == -1)
+                err(1, "getexepath: on path");
+        if (strcmp(path, argv[1]) != 0)
+                exit(1);
+        printf("getexecpath(3) is working\n");
+        exit(0);
+}
diff --git a/src/regress/lib/libc/illumos/oclo/Makefile b/src/regress/lib/libc/illumos/oclo/Makefile
index 284e49dc73..24d939da15 100644
--- a/src/regress/lib/libc/illumos/oclo/Makefile
+++ b/src/regress/lib/libc/illumos/oclo/Makefile
@@ -1,7 +1,9 @@
-#       $OpenBSD: Makefile,v 1.2 2025/08/09 18:17:42 anton Exp $
+#       $OpenBSD: Makefile,v 1.3 2026/06/24 12:24:04 bluhm Exp $
 
 .if exists(/usr/local/share/illumos-os-tests)
 
+MAKE :=         ulimit -n 256; ${MAKE}
+
 PROGS =         oclo
 PROGS +=        oclo_errors
 PROGS +=        ocloexec_verify
diff --git a/src/regress/lib/libc/open_wmemstream/Makefile b/src/regress/lib/libc/open_wmemstream/Makefile
new file mode 100644
index 0000000000..232bc4a176
--- /dev/null
+++ b/src/regress/lib/libc/open_wmemstream/Makefile
@@ -0,0 +1,5 @@
+#       $OpenBSD: Makefile,v 1.1 2026/05/08 14:37:16 millert Exp $
+
+PROG=   open_wmemstreamtest
+
+.include <bsd.regress.mk>
diff --git a/src/regress/lib/libc/open_wmemstream/open_wmemstreamtest.c b/src/regress/lib/libc/open_wmemstream/open_wmemstreamtest.c
new file mode 100644
index 0000000000..fa2a17d33c
--- /dev/null
+++ b/src/regress/lib/libc/open_wmemstream/open_wmemstreamtest.c
@@ -0,0 +1,189 @@
+/*      $OpenBSD: open_wmemstreamtest.c,v 1.1 2026/05/08 14:37:16 millert Exp $ */
+
+/*
+ * Copyright (c) 2011 Martin Pieuchot <mpi@openbsd.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <err.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <wchar.h>
+#include <unistd.h>
+
+#define OFFSET 16384
+
+const wchar_t start[] = { 's', 't', 'a', 'r', 't', 0 };
+const wchar_t hello[] = { 'h', 'e', 'l', 'l', 'o', 0 };
+
+int
+main(void)
+{
+        FILE    *fp;
+        wchar_t *buf = (wchar_t *)0xff;
+        size_t   size = 0;
+        off_t    off;
+        int      i, failures = 0;
+
+        if ((fp = open_wmemstream(&buf, &size)) == NULL) {
+                warn("open_wmemstream failed");
+                return (1);
+        }
+
+        off = ftello(fp);
+        if (off != 0) {
+                warnx("ftello failed. (1)");
+                failures++;
+        }
+
+        if (fflush(fp) != 0) {
+                warnx("fflush failed. (2)");
+                failures++;
+        }
+
+        if (size != 0) {
+                warnx("string should be empty. (3)");
+                failures++;
+        }
+
+        if (buf == (wchar_t *)0xff) {
+                warnx("buf not updated. (4)");
+                failures++;
+        }
+
+        if (fseek(fp, OFFSET, SEEK_SET) != 0) {
+                warnx("failed to fseek. (5)");
+                failures++;
+        }
+
+        if (fwprintf(fp, hello) == EOF) {
+                warnx("fwprintf failed. (6)");
+                failures++;
+        }
+
+        if (fflush(fp) == EOF) {
+                warnx("fflush failed. (7)");
+                failures++;
+        }
+
+        if (size != OFFSET + wcslen(hello)) {
+                warnx("failed, size %zu should be %zu. (8)",
+                    size, OFFSET + wcslen(hello));
+                failures++;
+        }
+
+        if (fseek(fp, 0, SEEK_SET) != 0) {
+                warnx("failed to fseek. (9)");
+                failures++;
+        }
+
+        if (fwprintf(fp, start) == EOF) {
+                warnx("fwprintf failed. (10)");
+                failures++;
+        }
+
+        if (fflush(fp) == EOF) {
+                warnx("fflush failed. (11)");
+                failures++;
+        }
+
+        if (size != wcslen(start)) {
+                warnx("failed, size %zu should be %zu. (12)",
+                    size, wcslen(start));
+                failures++;
+        }
+
+        /* Needed for sparse files */
+        if (wcsncmp(buf, start, wcslen(start)) != 0) {
+                char buf[sizeof(start)];
+                wcstombs(buf, start, sizeof(buf));
+                warnx("failed, buffer didn't start with '%s'. (13)", buf);
+                failures++;
+        }
+        for (i = wcslen(start); i < OFFSET; i++)
+                if (buf[i] != '\0') {
+                        warnx("failed, buffer non zero (offset %d). (14)", i);
+                        failures++;
+                        break;
+                }
+
+        if (memcmp(buf + OFFSET, hello, wcslen(hello)) != 0) {
+                warnx("written string incorrect. (15)");
+                failures++;
+        }
+
+        /* verify that simply seeking past the end doesn't increase the size */
+        if (fseek(fp, 100, SEEK_END) != 0) {
+                warnx("failed to fseek. (16)");
+                failures++;
+        }
+
+        if (fflush(fp) == EOF) {
+                warnx("fflush failed. (17)");
+                failures++;
+        }
+
+        if (size != OFFSET + wcslen(hello)) {
+                warnx("failed, size %zu should be %zu. (18)",
+                    size, OFFSET + wcslen(hello));
+                failures++;
+        }
+
+        if (fseek(fp, -1, SEEK_END) != 0) {
+                warnx("failed to fseek. (19)");
+                failures++;
+        }
+
+        if (fseek(fp, 8, SEEK_SET) != 0) {
+                warnx("failed to fseek. (20)");
+                failures++;
+        }
+
+        if (ftell(fp) != 8) {
+                warnx("failed seek test. (21)");
+                failures++;
+        }
+
+        /* Try to seek backward */
+        if (fseek(fp, -1, SEEK_CUR) != 0) {
+                warnx("failed to fseek. (22)");
+                failures++;
+        }
+
+        if (ftell(fp) != 7) {
+                warnx("failed seeking backward. (23)");
+                failures++;
+        }
+
+        if (fseek(fp, 5, SEEK_CUR) != 0) {
+                warnx("failed to fseek. (24)");
+                failures++;
+        }
+
+        if (fclose(fp) == EOF) {
+                warnx("fclose failed. (25)");
+                failures++;
+        }
+
+        if (size != 12) {
+                warnx("failed, size %zu should be %u.  (26)",
+                    size, 12);
+                failures++;
+        }
+
+        free(buf);
+
+        return (failures);
+}
diff --git a/src/regress/lib/libc/strlcpy/Makefile b/src/regress/lib/libc/strlcpy/Makefile
index 921354432b..a6678102ba 100644
--- a/src/regress/lib/libc/strlcpy/Makefile
+++ b/src/regress/lib/libc/strlcpy/Makefile
@@ -1,5 +1,7 @@
-#       $OpenBSD: Makefile,v 1.1 2014/12/02 20:23:05 millert Exp $
+#       $OpenBSD: Makefile,v 1.2 2026/05/30 05:07:03 anton Exp $
 
 PROG=   strlcpytest
 
+CFLAGS+=-fno-builtin
+
 .include <bsd.regress.mk>
diff --git a/src/regress/lib/libc/sys/Makefile b/src/regress/lib/libc/sys/Makefile
index 5ff237d4e7..b9772fed89 100644
--- a/src/regress/lib/libc/sys/Makefile
+++ b/src/regress/lib/libc/sys/Makefile
@@ -1,4 +1,4 @@
-#       $OpenBSD: Makefile,v 1.18 2023/10/31 08:00:33 claudio Exp $
+#       $OpenBSD: Makefile,v 1.19 2026/07/09 05:30:32 anton Exp $
 
 # Copyright (c) 2019 Moritz Buhl <openbsd@moritzbuhl.de>
 # Copyright (c) 2019 Alexander Bluhm <bluhm@openbsd.org>
@@ -77,7 +77,6 @@ PROGS +=	t_write
 # failing tests
 REGRESS_EXPECTED_FAILURES =
 REGRESS_EXPECTED_FAILURES +=    run-t_mlock-4
-REGRESS_EXPECTED_FAILURES +=    run-t_msgrcv-3
 
 . for t in run-t_fork-{3,4,5}
 ${t}:
diff --git a/src/regress/lib/libc/time/time_conversion/timetest.c b/src/regress/lib/libc/time/time_conversion/timetest.c
index 1405f1c6a5..9a83a6397d 100644
--- a/src/regress/lib/libc/time/time_conversion/timetest.c
+++ b/src/regress/lib/libc/time/time_conversion/timetest.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: timetest.c,v 1.5 2025/08/17 08:43:03 phessler Exp $ */
+/*      $OpenBSD: timetest.c,v 1.6 2026/07/17 18:56:42 millert Exp $ */
 
 /*
  * Copyright (c) 2022 Bob Beck <beck@openbsd.org>
@@ -462,14 +462,14 @@ struct timetest timetests[] = {
                         .tm_year=138,
                         .tm_mon=0,
                         .tm_mday=18,
-                        .tm_hour=20,
+                        .tm_hour=21,
                         .tm_min=14,
                         .tm_sec=7,
                         .tm_wday=1,
                         .tm_yday=17,
                         .tm_isdst=0,
-                        .tm_gmtoff=-25200,
-                        .tm_zone="MST"
+                        .tm_gmtoff=-21600,
+                        .tm_zone="CST"
                 },
                 .gmt_tm=                {
                         .tm_year=138,
@@ -524,14 +524,14 @@ struct timetest timetests[] = {
                         .tm_year=138,
                         .tm_mon=0,
                         .tm_mday=18,
-                        .tm_hour=20,
+                        .tm_hour=21,
                         .tm_min=14,
                         .tm_sec=8,
                         .tm_wday=1,
                         .tm_yday=17,
                         .tm_isdst=0,
-                        .tm_gmtoff=-25200,
-                        .tm_zone="MST"
+                        .tm_gmtoff=-21600,
+                        .tm_zone="CST"
                 },
                 .gmt_tm=                {
                         .tm_year=138,
@@ -772,14 +772,14 @@ struct timetest timetests[] = {
                         .tm_year=2147481747,
                         .tm_mon=0,
                         .tm_mday=31,
-                        .tm_hour=16,
+                        .tm_hour=17,
                         .tm_min=59,
                         .tm_sec=32,
                         .tm_wday=4,
                         .tm_yday=30,
                         .tm_isdst=0,
-                        .tm_gmtoff=-25200,
-                        .tm_zone="MST"
+                        .tm_gmtoff=-21600,
+                        .tm_zone="CST"
                 },
                 .gmt_tm=                {
                         .tm_year=2147481747,
@@ -989,14 +989,14 @@ struct timetest timetests[] = {
                         .tm_year=8099,
                         .tm_mon=11,
                         .tm_mday=31,
-                        .tm_hour=16,
+                        .tm_hour=17,
                         .tm_min=59,
                         .tm_sec=59,
                         .tm_wday=5,
                         .tm_yday=364,
                         .tm_isdst=0,
-                        .tm_gmtoff=-25200,
-                        .tm_zone="MST"
+                        .tm_gmtoff=-21600,
+                        .tm_zone="CST"
                 },
                 .gmt_tm=                {
                         .tm_year=8099,
@@ -1051,14 +1051,14 @@ struct timetest timetests[] = {
                         .tm_year=8099,
                         .tm_mon=11,
                         .tm_mday=31,
-                        .tm_hour=16,
+                        .tm_hour=17,
                         .tm_min=59,
                         .tm_sec=32,
                         .tm_wday=5,
                         .tm_yday=364,
                         .tm_isdst=0,
-                        .tm_gmtoff=-25200,
-                        .tm_zone="MST"
+                        .tm_gmtoff=-21600,
+                        .tm_zone="CST"
                 },
                 .gmt_tm=                {
                         .tm_year=8099,
@@ -1830,7 +1830,7 @@ int main() {
         if (stat("/usr/share/zoneinfo/posix", &sb) == -1 ||
             stat("/usr/share/zoneinfo/right", &sb) == -1) {
                 fprintf(stderr, "POSIX time zones missing, run the following command:\n\n"
-                    "\tmake -C ../../../../../share/zoneinfo other_two\n\n"
+                    "\tmake -C ../../../../share/zoneinfo other_two\n\n"
                     "SKIPPED\n");
                 exit(0);
         }
diff --git a/src/regress/lib/libc/timingsafe/timingsafe.c b/src/regress/lib/libc/timingsafe/timingsafe.c
index d768a808b6..6e3461cd27 100644
--- a/src/regress/lib/libc/timingsafe/timingsafe.c
+++ b/src/regress/lib/libc/timingsafe/timingsafe.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: timingsafe.c,v 1.4 2024/02/04 20:51:21 tb Exp $       */
+/*      $OpenBSD: timingsafe.c,v 1.5 2026/07/29 02:16:37 tb Exp $       */
 /*
  * Copyright (c) 2014 Google Inc.
  *
@@ -27,7 +27,7 @@ enum {
 
 static unsigned char bufone[N], buftwo[N];
 
-void
+static void
 check(void)
 {
         int cmp = memcmp(bufone, buftwo, N);
diff --git a/src/regress/lib/libcrypto/bn/bn_mul_div.c b/src/regress/lib/libcrypto/bn/bn_mul_div.c
index dbad01004e..41280e385c 100644
--- a/src/regress/lib/libcrypto/bn/bn_mul_div.c
+++ b/src/regress/lib/libcrypto/bn/bn_mul_div.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: bn_mul_div.c,v 1.8 2025/08/12 10:29:35 jsing Exp $ */
+/*      $OpenBSD: bn_mul_div.c,v 1.9 2026/07/21 04:55:34 tb Exp $ */
 /*
  * Copyright (c) 2023 Joel Sing <jsing@openbsd.org>
  *
@@ -399,7 +399,7 @@ benchmark_run(const struct benchmark *bm, int seconds)
         timespecsub(&end, &start, &duration);
         fprintf(stderr, "%d iterations in %f seconds - %llu op/s\n", i,
             duration.tv_sec + duration.tv_nsec / 1000000000.0,
-            (uint64_t)i * 1000000000 /
+            (unsigned long long)i * 1000000000 /
             (duration.tv_sec * 1000000000 + duration.tv_nsec));
 
         BN_CTX_end(bn_ctx);
diff --git a/src/regress/lib/libcrypto/c2sp/Makefile b/src/regress/lib/libcrypto/c2sp/Makefile
index 73ee0b8c22..6da6a8d29e 100644
--- a/src/regress/lib/libcrypto/c2sp/Makefile
+++ b/src/regress/lib/libcrypto/c2sp/Makefile
@@ -1,4 +1,4 @@
-# $OpenBSD: Makefile,v 1.7 2025/07/23 07:35:21 tb Exp $
+# $OpenBSD: Makefile,v 1.8 2026/06/12 08:19:44 tb Exp $
 
 C2SP_TESTVECTORS = /usr/local/share/c2sp-testvectors/
 
@@ -18,7 +18,7 @@ cctv: cctv.go
 OSSL_LIB =      /usr/local/lib/eopenssl
 OSSL_INC =      /usr/local/include/eopenssl
 
-. for V in 35
+. for V in 35 40
 .  if exists(/usr/local/bin/eopenssl$V)
 PROGS +=        cctv-openssl$V
 SRCS_cctv-openssl$V =
diff --git a/src/regress/lib/libcrypto/certs/README b/src/regress/lib/libcrypto/certs/README
index 93165249ec..26a3c477ce 100644
--- a/src/regress/lib/libcrypto/certs/README
+++ b/src/regress/lib/libcrypto/certs/README
@@ -124,3 +124,9 @@ intermediate certificates are contained in a bundle.pem file.
 13a. A leaf certificate signed by an intermediate, that is signed by an
      expired root certificate and cross signed as an intermediate, by a
      second root (should verify with one chain).
+
+14a. Deep chain with 32 certificates including root and leaf
+     (should verify with one chain).
+
+14b. Deep chain with 33 certificates including root and leaf
+     (should fail to verify).
diff --git a/src/regress/lib/libcrypto/dsa/dsatest.c b/src/regress/lib/libcrypto/dsa/dsatest.c
index 3a761961f0..79c83e04bc 100644
--- a/src/regress/lib/libcrypto/dsa/dsatest.c
+++ b/src/regress/lib/libcrypto/dsa/dsatest.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: dsatest.c,v 1.11 2024/02/29 20:04:43 tb Exp $ */
+/*      $OpenBSD: dsatest.c,v 1.12 2026/08/30 12:19:37 kenjiro Exp $    */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -193,11 +193,10 @@ end:
         if (!ret)
                 ERR_print_errors(bio_err);
         DSA_free(dsa);
-        CRYPTO_cleanup_all_ex_data();
-        ERR_remove_thread_state(NULL);
-        ERR_free_strings();
         BIO_free(bio_err);
         bio_err = NULL;
+        ERR_remove_thread_state(NULL);
+        OPENSSL_cleanup();
 
         return !ret;
 }
diff --git a/src/regress/lib/libcrypto/ec/ectest.c b/src/regress/lib/libcrypto/ec/ectest.c
index 3e81954174..edfc9ada46 100644
--- a/src/regress/lib/libcrypto/ec/ectest.c
+++ b/src/regress/lib/libcrypto/ec/ectest.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: ectest.c,v 1.36 2025/07/23 07:40:07 tb Exp $  */
+/*      $OpenBSD: ectest.c,v 1.37 2026/08/30 12:19:37 kenjiro Exp $     */
 /*
  * Originally written by Bodo Moeller for the OpenSSL project.
  */
@@ -668,9 +668,8 @@ main(int argc, char *argv[])
 
         prime_field_tests();
 
-        CRYPTO_cleanup_all_ex_data();
-        ERR_free_strings();
         ERR_remove_thread_state(NULL);
+        OPENSSL_cleanup();
 
         return 0;
 }
diff --git a/src/regress/lib/libcrypto/ecdsa/ecdsatest.c b/src/regress/lib/libcrypto/ecdsa/ecdsatest.c
index ef724c74b5..cfc1317bda 100644
--- a/src/regress/lib/libcrypto/ecdsa/ecdsatest.c
+++ b/src/regress/lib/libcrypto/ecdsa/ecdsatest.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: ecdsatest.c,v 1.18 2023/11/19 13:11:06 tb Exp $       */
+/*      $OpenBSD: ecdsatest.c,v 1.19 2026/08/30 12:19:37 kenjiro Exp $  */
 /*
  * Written by Nils Larsch for the OpenSSL project.
  */
@@ -337,9 +337,8 @@ main(void)
                 ERR_print_errors_fp(stdout);
         }
 
-        CRYPTO_cleanup_all_ex_data();
         ERR_remove_thread_state(NULL);
-        ERR_free_strings();
+        OPENSSL_cleanup();
 
         return failed;
 }
diff --git a/src/regress/lib/libcrypto/evp/evptest.c b/src/regress/lib/libcrypto/evp/evptest.c
index 6c47e38a5f..b83ef33ce9 100644
--- a/src/regress/lib/libcrypto/evp/evptest.c
+++ b/src/regress/lib/libcrypto/evp/evptest.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: evptest.c,v 1.15 2024/03/30 09:49:59 tb Exp $ */
+/*      $OpenBSD: evptest.c,v 1.16 2026/08/30 12:19:37 kenjiro Exp $    */
 /* Written by Ben Laurie, 2001 */
 /*
  * Copyright (c) 2001 The OpenSSL Project.  All rights reserved.
@@ -431,10 +431,8 @@ main(int argc, char **argv)
         }
         fclose(f);
 
-        EVP_cleanup();
-        CRYPTO_cleanup_all_ex_data();
         ERR_remove_thread_state(NULL);
-        ERR_free_strings();
+        OPENSSL_cleanup();
 
         return 0;
 }
diff --git a/src/regress/lib/libcrypto/exdata/exdata_test.c b/src/regress/lib/libcrypto/exdata/exdata_test.c
index a82cb4a66c..7c283470f1 100644
--- a/src/regress/lib/libcrypto/exdata/exdata_test.c
+++ b/src/regress/lib/libcrypto/exdata/exdata_test.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: exdata_test.c,v 1.3 2024/10/02 14:12:21 jsing Exp $ */
+/* $OpenBSD: exdata_test.c,v 1.4 2026/08/30 12:19:37 kenjiro Exp $ */
 /*
  * Copyright (c) 2023 Joel Sing <jsing@openbsd.org>
  *
@@ -264,8 +264,7 @@ main(int argc, char **argv)
         failed |= ex_data_test();
         failed |= ex_new_index_test();
 
-        /* Force a clean up. */
-        CRYPTO_cleanup_all_ex_data();
+        OPENSSL_cleanup();
 
         return failed;
 }
diff --git a/src/regress/lib/libcrypto/free/freenull.awk b/src/regress/lib/libcrypto/free/freenull.awk
index 3a10d99ebb..fb2addc400 100644
--- a/src/regress/lib/libcrypto/free/freenull.awk
+++ b/src/regress/lib/libcrypto/free/freenull.awk
@@ -1,4 +1,4 @@
-# $OpenBSD: freenull.awk,v 1.4 2023/11/19 13:11:06 tb Exp $
+# $OpenBSD: freenull.awk,v 1.5 2026/09/04 16:47:02 tb Exp $
 # Copyright (c) 2018 Theo Buehler <tb@openbsd.org>
 #
 # Permission to use, copy, modify, and distribute this software for any
@@ -15,30 +15,12 @@
 
 # usage: awk -f freenull.awk < Symbols.list > freenull.c.body
 
-# Skip this function because it calls abort(3).
-/^CRYPTO_dbg_free/ {
-        next
-}
-
 # Skip *_free functions that take more than one or no argument.
 /^ASN1_item_ex_free$/                           ||
 /^ASN1_item_free$/                              ||
 /^CONF_modules_free$/                           ||
-/^EVP_PKEY_asn1_set_free$/                      ||
-/^X509V3_section_free$/                         ||
-/^X509V3_string_free$/                          ||
-/^sk_pop_free$/ {
-        next
-}
-
-# Skip functions that are prototyped in a .c file.
-/^BIO_CONNECT_free$/                            ||
 /^CRYPTO_free$/                                 ||
-/^EC_PRIVATEKEY_free$/                          ||
-/^ECPARAMETERS_free$/                           ||
-/^ECPKPARAMETERS_free$/                         ||
-/^X9_62_CHARACTERISTIC_TWO_free$/               ||
-/^X9_62_PENTANOMIAL_free$/ {
+/^sk_pop_free$/ {
         next
 }
 
diff --git a/src/regress/lib/libcrypto/pbkdf2/pbkdf2.c b/src/regress/lib/libcrypto/pbkdf2/pbkdf2.c
index 33b683f0a0..4a11126c34 100644
--- a/src/regress/lib/libcrypto/pbkdf2/pbkdf2.c
+++ b/src/regress/lib/libcrypto/pbkdf2/pbkdf2.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: pbkdf2.c,v 1.3 2023/11/19 13:11:06 tb Exp $   */
+/*      $OpenBSD: pbkdf2.c,v 1.4 2026/08/30 12:19:37 kenjiro Exp $      */
 /* Written by Christian Heimes, 2013 */
 /*
  * Copyright (c) 2013 The OpenSSL Project.  All rights reserved.
@@ -196,9 +196,7 @@ main(int argc,char **argv)
                 test_p5_pbkdf2(n, "sha512", test, sha512_results[n]);
         }
 
-        EVP_cleanup();
-        CRYPTO_cleanup_all_ex_data();
         ERR_remove_thread_state(NULL);
-        ERR_free_strings();
+        OPENSSL_cleanup();
         return 0;
 }
diff --git a/src/regress/lib/libcrypto/pkcs7/pkcs7test.c b/src/regress/lib/libcrypto/pkcs7/pkcs7test.c
index 88126ea082..fc4af436af 100644
--- a/src/regress/lib/libcrypto/pkcs7/pkcs7test.c
+++ b/src/regress/lib/libcrypto/pkcs7/pkcs7test.c
@@ -1,6 +1,7 @@
-/*      $OpenBSD: pkcs7test.c,v 1.6 2026/04/21 05:18:35 tb Exp $        */
+/*      $OpenBSD: pkcs7test.c,v 1.11 2026/08/31 09:18:25 tb Exp $       */
 /*
  * Copyright (c) 2014 Joel Sing <jsing@openbsd.org>
+ * Copyright (c) 2026 Theo Buehler <tb@openbsd.org>
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -16,13 +17,16 @@
  */
 
 #include <err.h>
+#include <stdarg.h>
+#include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
-#include <unistd.h>
 
+#include <openssl/asn1.h>
 #include <openssl/bio.h>
 #include <openssl/err.h>
 #include <openssl/evp.h>
+#include <openssl/objects.h>
 #include <openssl/pem.h>
 #include <openssl/pkcs7.h>
 #include <openssl/x509.h>
@@ -100,9 +104,13 @@ x509_store_callback(int ok, X509_STORE_CTX *ctx)
 }
 
 static void
-fatal(const char *msg)
+fatal(const char *msg, ...)
 {
-        warnx("%s", msg);
+        va_list ap;
+
+        va_start(ap, msg);
+        vwarnx(msg, ap);
+        va_end(ap);
         ERR_print_errors_fp(stderr);
         exit(1);
 }
@@ -300,12 +308,165 @@ pkcs7_basics(void)
         return 0;
 }
 
+static int
+pkcs7_stream_missing_content_nid(int nid)
+{
+        PKCS7 *p7 = NULL;
+        const unsigned char *p, *name;
+        unsigned char **boundary = NULL;
+        unsigned char *der = NULL;
+        int der_len = 0;
+        int ret;
+        int failed = 1;
+
+        name = OBJ_nid2sn(nid);
+
+        /*
+         * Create a PKCS7 object with Content Type corresponding to nid
+         * and omit the optional content.
+         */
+
+        if ((p7 = PKCS7_new()) == NULL)
+                fatal("PKCS7_new NID %d (%s)", nid, name);
+        ASN1_OBJECT_free(p7->type);
+        if ((p7->type = OBJ_nid2obj(nid)) == NULL)
+                fatal("OBJ_nid2obj NID %d (%s)", nid, name);
+
+        /*
+         * Round trip this through DER.
+         */
+
+        if ((der_len = i2d_PKCS7(p7, &der)) <= 0)
+                fatal("i2d_PKCS7 NID %d (%s)", nid, name);
+
+        PKCS7_free(p7);
+        p7 = NULL;
+
+        p = der;
+        if ((p7 = d2i_PKCS7(NULL, &p, der_len)) == NULL)
+                fatal("d2i_PKCS7 NID %d (%s)", nid, name);
+
+        /*
+         * It deserialized, so we can safely stream it, right?
+         */
+
+        if ((ret = PKCS7_stream(&boundary, p7)) != 0) {
+                fprintf(stderr, "FAILURE: PKCS7_stream for NID %d (%s) "
+                    "want 0, got %d\n", nid, name, ret);
+                goto out;
+        }
+
+        failed = 0;
+
+ out:
+        PKCS7_free(p7);
+        freezero(der, der_len);
+
+        return failed;
+}
+
+/*
+ * For each Content Type OID (RFC 2315, section 14), create a PKCS7 object that
+ * d2i_PKCS7() accepts. For x in [1..6] we use an object that encodes to
+ *
+ * SEQUENCE {
+ *   OBJECT_IDENTIFIER { 1.2.840.113549.1.7.x }
+ * }
+ *
+ * This works because RFC 2315 section 7 marks the content optional:
+ *
+ *  ContentInfo ::= SEQUENCE {
+ *    contentType ContentType,
+ *    content
+ *      [0] EXPLICIT ANY DEFINED BY contentType OPTIONAL }
+ *
+ * reflected in the ASN1_TFLG_OPTIONAL in pk7_asn1.c's p7default_tt.
+ */
+
+static int
+pkcs7_stream_missing_content(void)
+{
+        int failed = 0;
+
+        /* NID naming consistency is king. */
+        failed |= pkcs7_stream_missing_content_nid(NID_pkcs7_data);
+        failed |= pkcs7_stream_missing_content_nid(NID_pkcs7_signed);
+        failed |= pkcs7_stream_missing_content_nid(NID_pkcs7_enveloped);
+        failed |= pkcs7_stream_missing_content_nid(NID_pkcs7_signedAndEnveloped);
+        failed |= pkcs7_stream_missing_content_nid(NID_pkcs7_digest);
+        failed |= pkcs7_stream_missing_content_nid(NID_pkcs7_encrypted);
+
+        return failed;
+}
+
+/*
+ * SEQUENCE {
+ *   # signedData
+ *   OBJECT_IDENTIFIER { 1.2.840.113549.1.7.2 }
+ *   [0] {
+ *     SEQUENCE {
+ *       INTEGER { 1 }
+ *       SET {}
+ *       SEQUENCE {
+ *         # id-ct-TSTInfo
+ *         OBJECT_IDENTIFIER { 1.2.840.113549.1.9.16.1.4 }
+ *         [0] {
+ *           SEQUENCE {
+ *             INTEGER { 1 }
+ *             OCTET_STRING { `deadbeef` }
+ *           }
+ *         }
+ *       }
+ *       SET {}
+ *     }
+ *   }
+ * }
+ */
+static const uint8_t pkcs7_malformed_der[] = {
+         0x30, 0x32, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86,
+         0xf7, 0x0d, 0x01, 0x07, 0x02, 0xa0, 0x25, 0x30,
+         0x23, 0x02, 0x01, 0x01, 0x31, 0x00, 0x30, 0x1a,
+         0x06, 0x0b, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d,
+         0x01, 0x09, 0x10, 0x01, 0x04, 0xa0, 0x0b, 0x30,
+         0x09, 0x02, 0x01, 0x01, 0x04, 0x04, 0xde, 0xad,
+         0xbe, 0xef, 0x31, 0x00,
+};
+static int pkcs7_malformed_der_len = sizeof(pkcs7_malformed_der);
+
+static int
+pkcs7_stream_signedData_oob(void)
+{
+        PKCS7 *p7 = NULL;
+        const unsigned char *p;
+        unsigned char **boundary = NULL;
+        int ret;
+        int failed = 1;
+
+        p = pkcs7_malformed_der;
+        if ((p7 = d2i_PKCS7(NULL, &p, pkcs7_malformed_der_len)) == NULL)
+                fatal("d2i_PKCS7 malformed");
+
+        if ((ret = PKCS7_stream(&boundary, p7)) != 0) {
+                fprintf(stderr, "FAILURE: PKCS7_stream want 0, got %d\n", ret);
+                goto out;
+        }
+
+        failed = 0;
+
+ out:
+        PKCS7_free(p7);
+
+        return failed;
+}
+
 int
 main(int argc, char **argv)
 {
         int failed = 0;
 
         failed |= pkcs7_basics();
+        failed |= pkcs7_stream_missing_content();
+        failed |= pkcs7_stream_signedData_oob();
 
         return failed;
 }
diff --git a/src/regress/lib/libcrypto/rsa/rsa_padding_test.c b/src/regress/lib/libcrypto/rsa/rsa_padding_test.c
index 1b3a0ba1e5..45d4a3fefa 100644
--- a/src/regress/lib/libcrypto/rsa/rsa_padding_test.c
+++ b/src/regress/lib/libcrypto/rsa/rsa_padding_test.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: rsa_padding_test.c,v 1.2 2024/03/30 02:20:39 jsing Exp $      */
+/*      $OpenBSD: rsa_padding_test.c,v 1.3 2026/05/10 14:08:02 tb Exp $ */
 /*
  * Copyright (c) 2024 Joel Sing <jsing@openbsd.org>
  *
@@ -174,7 +174,7 @@ test_pkcs1_type1(void)
                 err = ERR_peek_error();
                 if (pt->want == -1 && ERR_GET_REASON(err) != pt->want_error) {
                         fprintf(stderr, "FAIL: test %zu - PKCS1 type 1 padding "
-                            "check failed with error reason %i, want %i\n",
+                            "check failed with error reason %d, want %d\n",
                             i, ERR_GET_REASON(err), pt->want_error);
                         ERR_print_errors_fp(stderr);
                         goto failed;
@@ -310,7 +310,7 @@ test_pkcs1_type2(void)
                 err = ERR_peek_error();
                 if (pt->want == -1 && ERR_GET_REASON(err) != pt->want_error) {
                         fprintf(stderr, "FAIL: test %zu - PKCS1 type 2 padding "
-                            "check failed with error reason %i, want %i\n",
+                            "check failed with error reason %d, want %d\n",
                             i, ERR_GET_REASON(err), pt->want_error);
                         ERR_print_errors_fp(stderr);
                         goto failed;
diff --git a/src/regress/lib/libcrypto/wycheproof/Makefile b/src/regress/lib/libcrypto/wycheproof/Makefile
index 133de436df..4c4a321a80 100644
--- a/src/regress/lib/libcrypto/wycheproof/Makefile
+++ b/src/regress/lib/libcrypto/wycheproof/Makefile
@@ -1,4 +1,4 @@
-# $OpenBSD: Makefile,v 1.12 2026/01/22 11:40:25 tb Exp $
+# $OpenBSD: Makefile,v 1.13 2026/05/05 12:56:12 tb Exp $
 
 WYCHEPROOF_TESTVECTORS = /usr/local/share/wycheproof/testvectors_v1/
 
@@ -13,7 +13,7 @@ REGRESS_TARGETS += regress-wycheproof-primes
 
 . if exists(/usr/local/bin/go)
 
-REGRESS_TARGETS += regress-wycheproof
+REGRESS_TARGETS += regress-wycheproof regress-fmt-wycheproof
 
 CLEANFILES +=   wycheproof
 
@@ -23,6 +23,9 @@ wycheproof: wycheproof.go
 regress-wycheproof: wycheproof
         ./wycheproof
 
+regress-fmt-wycheproof:
+        gofmt -d ${.CURDIR}/wycheproof.go
+
 REGRESS_CLEANUP =       clean-go-cache
 
 clean-go-cache:
diff --git a/src/regress/lib/libcrypto/wycheproof/wycheproof.go b/src/regress/lib/libcrypto/wycheproof/wycheproof.go
index d36cd18de4..7f000b454f 100644
--- a/src/regress/lib/libcrypto/wycheproof/wycheproof.go
+++ b/src/regress/lib/libcrypto/wycheproof/wycheproof.go
@@ -1,4 +1,4 @@
-/* $OpenBSD: wycheproof.go,v 1.202 2026/04/21 20:55:21 tb Exp $ */
+/* $OpenBSD: wycheproof.go,v 1.205 2026/08/11 18:25:42 tb Exp $ */
 /*
  * Copyright (c) 2018,2023 Joel Sing <jsing@openbsd.org>
  * Copyright (c) 2018,2019,2022-2025 Theo Buehler <tb@openbsd.org>
@@ -2393,7 +2393,7 @@ func runMLKEMTestGroup(rank C.int, wt *wycheproofTestMLKEM) bool {
         if C.MLKEM_private_key_from_seed(privKey, (*C.uchar)(unsafe.Pointer(&seed[0])), C.size_t(seedLen)) != 1 {
                 if wt.Result != "invalid" {
                         fmt.Printf("%s - MLKEM_private_key_from_seed failed\n", wt)
-                        return false;
+                        return false
                 }
                 return true
         }
@@ -2453,7 +2453,7 @@ func runMLKEMEncapsTestGroup(rank C.int, wt *wycheproofTestMLKEM) bool {
         if C.MLKEM_parse_public_key(pubKey, (*C.uchar)(unsafe.Pointer(&ek[0])), (C.size_t)(ekLen)) != 1 {
                 if wt.Result != "invalid" {
                         fmt.Printf("FAIL: %s: MLKEM_parse_public_key failed !!!\n", wt)
-                        return false;
+                        return false
                 }
                 return true
         }
@@ -2544,9 +2544,9 @@ func runMLKEMKeyGenTest(rank C.int, wt *wycheproofTestMLKEM) bool {
 
         dK, _ := mustDecodeHexString(wt.Dk, "dK")
         eK, _ := mustDecodeHexString(wt.Ek, "eK")
-        
+
         if (bytes.Equal(dK, gotDk) && bytes.Equal(eK, gotEk)) != (wt.Result != "invalid") {
-                fmt.Printf("FAIL: %s - encoded keys differ", wt);
+                fmt.Printf("FAIL: %s - encoded keys differ", wt)
                 return false
         }
 
@@ -3085,6 +3085,8 @@ func testGroupFromTestVector(wtv *wycheproofTestVectorsV1) (wycheproofTestGroupR
                 return nil, Skip
         case "CHACHA20-POLY1305", "XCHACHA20-POLY1305":
                 return &wycheproofTestGroupChaCha{}, variant
+        case "Cobblestone-128", "Cobblestone-256":
+                return nil, Skip
         case "DSA":
                 if wtv.Schema == "dsa_p1363_verify_schema_v1.json" {
                         variant = P1363
@@ -3192,7 +3194,7 @@ func runTestVectors(path string) bool {
                         return wtg.run(wtv.Algorithm, variant)
                 })
         }
-        for _ = range wtv.TestGroups {
+        for range wtv.TestGroups {
                 result := <-testc.resultCh
                 if !result {
                         success = false
diff --git a/src/regress/lib/libcrypto/x509/Makefile b/src/regress/lib/libcrypto/x509/Makefile
index 94e9e476a0..7e593f7274 100644
--- a/src/regress/lib/libcrypto/x509/Makefile
+++ b/src/regress/lib/libcrypto/x509/Makefile
@@ -1,8 +1,8 @@
-#       $OpenBSD: Makefile,v 1.25 2025/05/05 06:33:34 tb Exp $
+#       $OpenBSD: Makefile,v 1.29 2026/06/26 06:08:08 tb Exp $
 
 PROGS = constraints verify x509attribute x509req_ext callback
 PROGS += expirecallback callbackfailures x509_asn1 x509_extensions_test
-PROGS += x509_name_test
+PROGS += x509_crl x509_name_test
 LDADD = -lcrypto
 DPADD = ${LIBCRYPTO}
 
diff --git a/src/regress/lib/libcrypto/x509/bettertls/verify.c b/src/regress/lib/libcrypto/x509/bettertls/verify.c
index e1d97d42ef..3911369cc2 100644
--- a/src/regress/lib/libcrypto/x509/bettertls/verify.c
+++ b/src/regress/lib/libcrypto/x509/bettertls/verify.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: verify.c,v 1.9 2020/10/26 12:11:47 beck Exp $ */
+/* $OpenBSD: verify.c,v 1.10 2026/05/29 13:21:15 tb Exp $ */
 /*
  * Copyright (c) 2020 Joel Sing <jsing@openbsd.org>
  * Copyright (c) 2020 Bob Beck <beck@openbsd.org>
@@ -29,7 +29,7 @@
 #include <openssl/x509_vfy.h>
 
 static int verbose = 0;
-static int json = 0; /* print out json like bettertls expects resuls in */
+static int json = 0; /* print out json like bettertls expects results in */
 
 static int
 passwd_cb(char *buf, int size, int rwflag, void *u)
diff --git a/src/regress/lib/libcrypto/x509/callback.c b/src/regress/lib/libcrypto/x509/callback.c
index a3717bca24..a021115531 100644
--- a/src/regress/lib/libcrypto/x509/callback.c
+++ b/src/regress/lib/libcrypto/x509/callback.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: callback.c,v 1.6 2026/03/31 13:39:48 jsing Exp $ */
+/* $OpenBSD: callback.c,v 1.8 2026/05/04 13:52:39 tb Exp $ */
 /*
  * Copyright (c) 2020 Joel Sing <jsing@openbsd.org>
  * Copyright (c) 2020-2021 Bob Beck <beck@openbsd.org>
@@ -110,7 +110,7 @@ verify_cert_cb(int ok, X509_STORE_CTX *xsc)
 
 static void
 verify_cert(const char *roots_dir, const char *roots_file,
-    const char *bundle_file, int *chains, int mode)
+    const char *bundle_file, int *chains, int set_depth, int mode)
 {
         STACK_OF(X509) *roots = NULL, *bundle = NULL;
         X509_STORE_CTX *xsc = NULL;
@@ -141,6 +141,10 @@ verify_cert(const char *roots_dir, const char *roots_file,
                 if (!X509_STORE_load_locations(store, NULL, roots_dir))
                         errx(1, "failed to set by_dir directory of %s", roots_dir);
         }
+        if (set_depth > 0) {
+                X509_VERIFY_PARAM_set_depth(X509_STORE_CTX_get0_param(xsc),
+                    set_depth);
+        }
         if (mode == MODE_LEGACY_VFY)
                 X509_STORE_CTX_set_flags(xsc, X509_V_FLAG_LEGACY_VERIFY);
         else
@@ -173,7 +177,9 @@ verify_cert(const char *roots_dir, const char *roots_file,
 }
 
 struct verify_cert_test {
+        const char *desc;
         const char *id;
+        int set_depth;
         int want_chains;
         int failing;
 };
@@ -188,6 +194,24 @@ struct verify_cert_test verify_cert_tests[] = {
                 .want_chains = 1,
         },
         {
+                .desc = "2a with depth 2",
+                .id = "2a",
+                .set_depth = 2,
+                .want_chains = 1,
+        },
+        {
+                .desc = "2a with depth 1",
+                .id = "2a",
+                .set_depth = 1,
+                .want_chains = 0,
+        },
+        {
+                .desc = "2a with depth 1",
+                .id = "2a",
+                .set_depth = 1,
+                .want_chains = 0,
+        },
+        {
                 .id = "2b",
                 .want_chains = 0,
         },
@@ -375,10 +399,12 @@ verify_cert_test(const char *certs_path, int mode)
                 if (asprintf(&roots_dir, "./%s/roots", vct->id) == -1)
                         errx(1, "asprintf");
 
-                fprintf(output, "== Test %zu (%s)\n", i, vct->id);
+                fprintf(output, "== Test %zu (%s)\n", i,
+                    vct->desc != NULL ? vct->desc : vct->id);
                 fprintf(output, "== Legacy:\n");
                 mode = MODE_LEGACY_VFY;
-                verify_cert(roots_dir, roots_file, bundle_file, &chains, mode);
+                verify_cert(roots_dir, roots_file, bundle_file, &chains,
+                   vct->set_depth, mode);
                 if ((mode == MODE_VERIFY && chains == vct->want_chains) ||
                     (chains == 0 && vct->want_chains == 0) ||
                     (chains == 1 && vct->want_chains > 0)) {
@@ -395,7 +421,8 @@ verify_cert_test(const char *certs_path, int mode)
                 fprintf(output, "\n");
                 fprintf(output, "== Modern:\n");
                 mode = MODE_MODERN_VFY;
-                verify_cert(roots_dir, roots_file, bundle_file, &chains, mode);
+                verify_cert(roots_dir, roots_file, bundle_file, &chains,
+                    vct->set_depth, mode);
                 if ((mode == MODE_VERIFY && chains == vct->want_chains) ||
                     (chains == 0 && vct->want_chains == 0) ||
                     (chains == 1 && vct->want_chains > 0)) {
diff --git a/src/regress/lib/libcrypto/x509/callbackfailures.c b/src/regress/lib/libcrypto/x509/callbackfailures.c
index 9230122146..112f936fcb 100644
--- a/src/regress/lib/libcrypto/x509/callbackfailures.c
+++ b/src/regress/lib/libcrypto/x509/callbackfailures.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: callbackfailures.c,v 1.3 2024/08/23 12:56:26 anton Exp $ */
+/* $OpenBSD: callbackfailures.c,v 1.4 2026/07/31 06:32:34 kenjiro Exp $ */
 /*
  * Copyright (c) 2020 Joel Sing <jsing@openbsd.org>
  * Copyright (c) 2020-2021 Bob Beck <beck@openbsd.org>
@@ -214,9 +214,9 @@ struct verify_cert_test verify_cert_tests[] = {
     (sizeof(verify_cert_tests) / sizeof(*verify_cert_tests))
 
 static int
-verify_cert_test(const char *certs_path, int mode)
+verify_cert_test(const char *certs_path, const char *roots_file, int mode)
 {
-        char *roots_file, *bundle_file, *bundle_file2, *roots_dir;
+        char *bundle_file, *bundle_file2, *roots_dir;
         struct verify_cert_test *vct;
         int failed = 0;
         int chains;
@@ -225,8 +225,6 @@ verify_cert_test(const char *certs_path, int mode)
         for (i = 0; i < N_VERIFY_CERT_TESTS; i++) {
                 vct = &verify_cert_tests[i];
 
-                if (asprintf(&roots_file, "/etc/ssl/cert.pem") == -1)
-                        errx(1, "asprintf");
                 if (asprintf(&bundle_file, "%s/%s/bundle.pem", certs_path,
                     vct->id) == -1)
                         errx(1, "asprintf");
@@ -270,7 +268,6 @@ verify_cert_test(const char *certs_path, int mode)
                 }
                 fprintf(stderr, "\n");
 
-                free(roots_file);
                 free(bundle_file);
                 free(bundle_file2);
                 free(roots_dir);
@@ -282,17 +279,21 @@ verify_cert_test(const char *certs_path, int mode)
 int
 main(int argc, char **argv)
 {
+        const char *roots_file = "/etc/ssl/cert.pem";
         int failed = 0;
 
-        if (argc != 2) {
-                fprintf(stderr, "usage: %s <certs_path>\n", argv[0]);
+        if (argc < 2 || argc > 3) {
+                fprintf(stderr, "usage: %s <certs_path> [roots_file]\n",
+                    argv[0]);
                 exit(1);
         }
+        if (argc == 3)
+                roots_file = argv[2];
 
         fprintf(stderr, "\n\nTesting legacy x509_vfy\n");
-        failed |= verify_cert_test(argv[1], MODE_LEGACY_VFY);
+        failed |= verify_cert_test(argv[1], roots_file, MODE_LEGACY_VFY);
         fprintf(stderr, "\n\nTesting modern x509_vfy\n");
-        failed |= verify_cert_test(argv[1], MODE_MODERN_VFY);
+        failed |= verify_cert_test(argv[1], roots_file, MODE_MODERN_VFY);
 
         return (failed);
 }
diff --git a/src/regress/lib/libcrypto/x509/constraints.c b/src/regress/lib/libcrypto/x509/constraints.c
index 54bb654a31..136dd07f6e 100644
--- a/src/regress/lib/libcrypto/x509/constraints.c
+++ b/src/regress/lib/libcrypto/x509/constraints.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: constraints.c,v 1.19 2026/04/13 17:04:23 beck Exp $   */
+/*      $OpenBSD: constraints.c,v 1.21 2026/07/14 15:54:14 jsing Exp $  */
 /*
  * Copyright (c) 2020 Bob Beck <beck@openbsd.org>
  *
@@ -160,6 +160,10 @@ unsigned char *invaliduri[] = {
         "https://192.168..1.1/",
         "https://.2001:0DB8:AC10:FE01::/",
         "https://.2001:0DB8:AC10:FE01::|/",
+        "https://2001:0DB8:AC10:FE01::1/",
+        "https://beck@openbsd.org@example.com",
+        "https://beck:password@openbsd.org:4433:example.com/",
+        "//:/",
         "///",
         "//",
         "/",
@@ -167,13 +171,47 @@ unsigned char *invaliduri[] = {
         NULL,
 };
 
-unsigned char *validuri[] = {
-        "https://www.openbsd.org/meep/meep/meep/",
-        "https://192.168.1.1/",
-        "https://2001:0DB8:AC10:FE01::/",
-        "https://192.168.1/",  /* Not an IP, but valid component */
-        "https://999.999.999.999/", /* Not an IP, but valid component */
-        NULL,
+struct uri_test {
+        unsigned char *uri;
+        unsigned char *hostpart;
+};
+
+static const struct uri_test validuri[] = {
+        {
+                .uri = "https://www.openbsd.org/meep/meep/meep/",
+                .hostpart = "www.openbsd.org",
+        },
+        {
+                .uri = "https://beck:password@openbsd.org:4433/",
+                .hostpart = "openbsd.org",
+        },
+        {
+                .uri = "https://192.168.1.1/",
+                .hostpart = "192.168.1.1",
+        },
+        {
+                .uri = "https://[2001:0DB8:AC10:FE01::1]/",
+                .hostpart = "[2001:0DB8:AC10:FE01::1]",
+        },
+        {
+                .uri = "https://[2001:0DB8:AC10:FE01::1]:443/",
+                .hostpart = "[2001:0DB8:AC10:FE01::1]",
+        },
+        {
+                .uri = "https://beck:password@[2001:0DB8:AC10:FE01::1]:443/",
+                .hostpart = "[2001:0DB8:AC10:FE01::1]",
+        },
+        {
+                .uri = "https://192.168.1/",  /* Not an IP, but valid component */
+                .hostpart = "192.168.1",
+        },
+        {
+                .uri = "https://999.999.999.999/", /* Not an IP, but valid component */
+                .hostpart = "999.999.999.999",
+        },
+        {
+                .uri = NULL,
+        },
 };
 
 static int
@@ -395,11 +433,17 @@ test_valid_uri(void)
         int j, failure = 0;
         char *hostpart = NULL;
 
-        for (j = 0; validuri[j] != NULL; j++) {
-                if (x509_constraints_uri_host(validuri[j],
-                    strlen(invaliduri[j]), &hostpart) == 0) {
+        for (j = 0; validuri[j].uri != NULL; j++) {
+                if (x509_constraints_uri_host(validuri[j].uri,
+                    strlen(validuri[j].uri), &hostpart) == 0) {
                         FAIL("Valid URI '%s' NOT accepted\n",
-                            validuri[j]);
+                            validuri[j].uri);
+                        failure = 1;
+                        goto done;
+                }
+                if (strcmp(hostpart, validuri[j].hostpart) != 0) {
+                        FAIL("Valid URI hostpart '%s' != '%s'\n",
+                            hostpart, validuri[j].hostpart);
                         failure = 1;
                         goto done;
                 }
@@ -452,6 +496,7 @@ test_constraints1(void)
                 "https://www.openbsd.net?",
                 "https://org#",
                 "herp://beck@org:",
+                "https://openbsd.org:password@example.com/path",
                 "///",
                 "//",
                 "/",
diff --git a/src/regress/lib/libcrypto/x509/rfc3779/rfc3779.c b/src/regress/lib/libcrypto/x509/rfc3779/rfc3779.c
index 61556f096f..f9cc24122c 100644
--- a/src/regress/lib/libcrypto/x509/rfc3779/rfc3779.c
+++ b/src/regress/lib/libcrypto/x509/rfc3779/rfc3779.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: rfc3779.c,v 1.12 2026/03/13 06:47:34 tb Exp $ */
+/*      $OpenBSD: rfc3779.c,v 1.17 2026/06/04 12:01:55 tb Exp $ */
 /*
  * Copyright (c) 2021 Theo Buehler <tb@openbsd.org>
  *
@@ -41,9 +41,10 @@ report_hexdump(const char *func, const char *description, const char *msg,
     const unsigned char *want, size_t want_len,
     const unsigned char *got, size_t got_len)
 {
-        fprintf(stderr, "%s: \"%s\" %s\nwant:\n", func, description, msg);
+        fprintf(stderr, "%s: \"%s\" %s\nwant %zu bytes:\n",
+            func, description, msg, want_len);
         hexdump(want, want_len);
-        fprintf(stderr, "got:\n");
+        fprintf(stderr, "got %zu bytes:\n", got_len);
         hexdump(got, got_len);
 }
 
@@ -228,7 +229,7 @@ const struct IPAddressOrRange_test IPAddressOrRange_test_data[] = {
                         0x03, 0x04, 0x06, 0xc4, 0x01, 0x00,
                 },
                 .der_len = 14,
-                    .afi = IANA_AFI_IPV4,
+                .afi = IANA_AFI_IPV4,
                 .min = {
                         0xc4, 0x01, 0x07, 0x00,
                 },
@@ -331,8 +332,7 @@ run_IPAddressOrRange_tests(void)
         int failed = 0;
 
         for (i = 0; i < N_IPADDRESSORRANGE_TESTS; i++)
-                failed |=
-                    test_IPAddressOrRange(&IPAddressOrRange_test_data[i]);
+                failed |= test_IPAddressOrRange(&IPAddressOrRange_test_data[i]);
 
         return failed;
 }
@@ -986,7 +986,7 @@ build_addr_block_test(const struct build_addr_block_test_data *test)
                             " failed\n", __func__, test->description);
                         goto err;
                 }
-                if (test->afis[i] != afi){
+                if (test->afis[i] != afi) {
                         fprintf(stderr, "%s: \"%s\" afi[%d] mismatch. "
                             "want: %u, got: %u\n", __func__,
                             test->description, i, test->afis[i], afi);
@@ -1527,7 +1527,6 @@ build_asid_test(const struct ASIdentifiers_build_test *test)
                 goto err;
         }
 
-
         memcmp_failed = (size_t)out_len != test->der_len;
         if (!memcmp_failed)
                 memcmp_failed = memcmp(out, test->der, test->der_len);
@@ -2006,6 +2005,188 @@ run_ASIdentifiers_subset_test(void)
         return failed;
 }
 
+/*
+ * IPAddressFamily_cmp() is well exercised with mostly valid data via canonize
+ * and is_canonical. Squeeze invalid inheriting address families between valid
+ * ones, then sort. This would previously call memcmp() on NULL.
+ */
+
+static const uint8_t invalid_block[] = {
+        0x30, 0x26,
+        0x30, 0x04, 0x04, 0x00, 0x05, 0x00,             /* Invalid empty AF. */
+        0x30, 0x06, 0x04, 0x02, 0x00, 0x01, 0x05, 0x00, /* IPv4 */
+        0x30, 0x06, 0x04, 0x02, 0x00, 0x02, 0x05, 0x00, /* IPv6 */
+        0x30, 0x07, 0x04, 0x03, 0x00, 0x02, 0x04, 0x05, 0x00, /* IPv6 NLRI */
+        0x30, 0x05, 0x04, 0x01, 0x01, 0x05, 0x00,       /* invalid AF 0x01 */
+};
+static const size_t invalid_block_len = sizeof(invalid_block);
+
+static int
+run_IPAddressFamily_cmp_ub_test(void)
+{
+        IPAddrBlocks *addrs;
+        IPAddressFamily *af = NULL;
+        const unsigned char *p;
+        unsigned char *out = NULL;
+        int out_len = 0;
+        unsigned int nlri_safi = 4;
+        int memcmp_failed;
+        int failed = 1;
+
+        if ((addrs = IPAddrBlocks_new()) == NULL) {
+                fprintf(stderr, "%s: IPAddrBlocks_new\n", __func__);
+                goto err;
+        }
+
+        /*
+         * Add IPv6 NLRI, inheriting
+         */
+
+        if (!X509v3_addr_add_inherit(addrs, IANA_AFI_IPV6, &nlri_safi)) {
+                fprintf(stderr, "%s: X509v3_addr_add_inherit IPv6\n", __func__);
+                goto err;
+        }
+
+        /*
+         * Add IPv6, inheriting
+         */
+
+        if (!X509v3_addr_add_inherit(addrs, IANA_AFI_IPV6, NULL)) {
+                fprintf(stderr, "%s: X509v3_addr_add_inherit IPv6\n", __func__);
+                goto err;
+        }
+
+        /*
+         * Add an inheriting IPAddressFamily with invalid empty addressFamily.
+         */
+
+        if ((af = IPAddressFamily_new()) == NULL) {
+                fprintf(stderr, "%s: IPAddressFamily_new\n", __func__);
+                goto err;
+        }
+        if ((af->ipAddressChoice->u.inherit = ASN1_NULL_new()) == NULL) {
+                fprintf(stderr, "%s: ASN1_NULL_new()\n", __func__);
+                goto err;
+        }
+        af->ipAddressChoice->type = IPAddressChoice_inherit;
+
+        if (sk_IPAddressFamily_push(addrs, af) <= 0) {
+                fprintf(stderr, "%s: sk_IPAddressFamily_push\n", __func__);
+                goto err;
+        }
+        af = NULL;
+
+        /*
+         * Add an inheriting IPAddressFamily with invalid addressFamily 0x01.
+         */
+
+        if ((af = IPAddressFamily_new()) == NULL) {
+                fprintf(stderr, "%s: IPAddressFamily_new\n", __func__);
+                goto err;
+        }
+        if (!ASN1_OCTET_STRING_set(af->addressFamily, "\x01", 1)) {
+                fprintf(stderr, "%s: ASN1_OCTET_STRING_set\n", __func__);
+                goto err;
+        }
+        if ((af->ipAddressChoice->u.inherit = ASN1_NULL_new()) == NULL) {
+                fprintf(stderr, "%s: ASN1_NULL_new()\n", __func__);
+                goto err;
+        }
+        af->ipAddressChoice->type = IPAddressChoice_inherit;
+
+        if (sk_IPAddressFamily_push(addrs, af) <= 0) {
+                fprintf(stderr, "%s: sk_IPAddressFamily_push\n", __func__);
+                goto err;
+        }
+        af = NULL;
+
+        /*
+         * Add IPv4, inheriting
+         */
+
+        if (!X509v3_addr_add_inherit(addrs, IANA_AFI_IPV4, NULL)) {
+                fprintf(stderr, "%s: X509v3_addr_add_inherit IPv4\n", __func__);
+                goto err;
+        }
+
+        /*
+         * Sort the thing.
+         */
+
+        sk_IPAddressFamily_sort(addrs);
+
+        /*
+         * Since addrs contains two invalid AFIs, X509v3_addr_is_canonical()
+         * should reject it. Serializing works nevertheless.
+         */
+
+        if (X509v3_addr_is_canonical(addrs)) {
+                fprintf(stderr, "%s: X509v3_addr_is_canonical\n", __func__);
+                goto err;
+        }
+
+        if ((out_len = i2d_IPAddrBlocks(addrs, &out)) <= 0) {
+                fprintf(stderr, "%s: i2d_IPAddrBlocks failed\n", __func__);
+                out_len = 0;
+                goto err;
+        }
+
+        memcmp_failed = 0;
+        if (invalid_block_len != (size_t)out_len)
+                memcmp_failed = 1;
+        if (!memcmp_failed)
+                memcmp_failed = memcmp(invalid_block, out, out_len) != 0;
+
+        if (memcmp_failed) {
+                report_hexdump(__func__, "invalid IPAddrBlock", "memcmp DER failed",
+                    invalid_block, invalid_block_len, out, out_len);
+                goto err;
+        }
+
+        /*
+         * We can also parse this garbage.
+         */
+
+        IPAddrBlocks_free(addrs);
+        addrs = NULL;
+
+        p = invalid_block;
+        if ((addrs = d2i_IPAddrBlocks(NULL, &p, invalid_block_len)) == NULL) {
+                fprintf(stderr, "%s: d2i_IPAddrBlocks\n", __func__);
+                goto err;
+        }
+
+        freezero(out, out_len);
+        out = NULL;
+
+        if ((out_len = i2d_IPAddrBlocks(addrs, &out)) <= 0) {
+                fprintf(stderr, "%s: i2d_IPAddrBlocks (2) failed\n", __func__);
+                out_len = 0;
+                goto err;
+        }
+
+        memcmp_failed = 0;
+        if (invalid_block_len != (size_t)out_len)
+                memcmp_failed = 1;
+        if (!memcmp_failed)
+                memcmp_failed = memcmp(invalid_block, out, out_len) != 0;
+
+        if (memcmp_failed) {
+                report_hexdump(__func__, "invalid IPAddrBlock (2)", "memcmp DER failed",
+                    invalid_block, invalid_block_len, out, out_len);
+                goto err;
+        }
+
+        failed = 0;
+
+ err:
+        IPAddrBlocks_free(addrs);
+        IPAddressFamily_free(af);
+        freezero(out, out_len);
+
+        return failed;
+}
+
 int
 main(void)
 {
@@ -2015,6 +2196,7 @@ main(void)
         failed |= run_IPAddrBlock_tests();
         failed |= run_ASIdentifiers_build_test();
         failed |= run_ASIdentifiers_subset_test();
+        failed |= run_IPAddressFamily_cmp_ub_test();
 
         return failed;
 }
diff --git a/src/regress/lib/libcrypto/x509/verify.c b/src/regress/lib/libcrypto/x509/verify.c
index 77cdbfd915..17e7251d0d 100644
--- a/src/regress/lib/libcrypto/x509/verify.c
+++ b/src/regress/lib/libcrypto/x509/verify.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: verify.c,v 1.14 2026/04/01 14:39:11 jsing Exp $ */
+/* $OpenBSD: verify.c,v 1.17 2026/07/29 02:08:31 tb Exp $ */
 /*
  * Copyright (c) 2020 Joel Sing <jsing@openbsd.org>
  * Copyright (c) 2020-2021 Bob Beck <beck@openbsd.org>
@@ -102,10 +102,45 @@ verify_cert_cb(int ok, X509_STORE_CTX *xsc)
         return ok;
 }
 
+static int
+verify_cert_depth_cb(int ok, X509_STORE_CTX *xsc)
+{
+        int verify_err;
+
+        ok = verify_cert_cb(ok, xsc);
+
+        verify_err = X509_STORE_CTX_get_error(xsc);
+        if (verify_err == X509_V_ERR_CERT_CHAIN_TOO_LONG) {
+                fprintf(stderr, "overriding verify error at depth %d: %s\n",
+                    X509_STORE_CTX_get_error_depth(xsc),
+                    X509_verify_cert_error_string(verify_err));
+                ok = 1;
+        }
+
+        return ok;
+}
+
+static int
+verify_cert_yolo_cb(int ok, X509_STORE_CTX *xsc)
+{
+        int verify_err;
+
+        verify_cert_cb(ok, xsc);
+
+        verify_err = X509_STORE_CTX_get_error(xsc);
+        if (verify_err != X509_V_OK) {
+                fprintf(stderr, "overriding verify error at depth %d: %s\n",
+                    X509_STORE_CTX_get_error_depth(xsc),
+                    X509_verify_cert_error_string(verify_err));
+        }
+
+        return 1;
+}
+
 static void
 verify_cert(const char *roots_dir, const char *roots_file,
     const char *bundle_file, int *chains, int *error, int *error_depth,
-    int mode)
+    int set_depth, int (*verify_cb)(int, X509_STORE_CTX *), int mode)
 {
         STACK_OF(X509) *roots = NULL, *bundle = NULL;
         X509_STORE_CTX *xsc = NULL;
@@ -140,14 +175,21 @@ verify_cert(const char *roots_dir, const char *roots_file,
                 if (!X509_STORE_load_locations(store, NULL, roots_dir))
                         errx(1, "failed to set by_dir directory of %s", roots_dir);
         }
+        if (set_depth > 0) {
+                X509_VERIFY_PARAM_set_depth(X509_STORE_CTX_get0_param(xsc),
+                    set_depth);
+        }
         if (mode == MODE_LEGACY_VFY)
                 X509_STORE_CTX_set_flags(xsc, X509_V_FLAG_LEGACY_VERIFY);
         else
                 X509_VERIFY_PARAM_clear_flags(X509_STORE_CTX_get0_param(xsc),
                     X509_V_FLAG_LEGACY_VERIFY);
 
-        if (verbose)
-                X509_STORE_CTX_set_verify_cb(xsc, verify_cert_cb);
+        if (verbose && verify_cb == NULL)
+                verify_cb = verify_cert_cb;
+        if (verify_cb != NULL)
+                X509_STORE_CTX_set_verify_cb(xsc, verify_cb);
+
         if (!use_dir)
                 X509_STORE_CTX_set0_trusted_stack(xsc, roots);
 
@@ -176,7 +218,8 @@ verify_cert(const char *roots_dir, const char *roots_file,
 }
 
 static void
-verify_cert_new(const char *roots_file, const char *bundle_file, int *chains)
+verify_cert_new(const char *roots_file, const char *bundle_file, int *chains,
+    int set_depth, int (*verify_cb)(int, X509_STORE_CTX *))
 {
         STACK_OF(X509) *roots = NULL, *bundle = NULL;
         X509_STORE_CTX *xsc = NULL;
@@ -199,16 +242,22 @@ verify_cert_new(const char *roots_file, const char *bundle_file, int *chains)
                 ERR_print_errors_fp(stderr);
                 errx(1, "failed to init store context");
         }
-        if (verbose)
-                X509_STORE_CTX_set_verify_cb(xsc, verify_cert_cb);
+        if (verbose && verify_cb == NULL)
+                verify_cb = verify_cert_cb;
+        if (verify_cb != NULL)
+                X509_STORE_CTX_set_verify_cb(xsc, verify_cb);
 
         if ((ctx = x509_verify_ctx_new(roots)) == NULL)
                 errx(1, "failed to create ctx");
         if (!x509_verify_ctx_set_intermediates(ctx, bundle))
                 errx(1, "failed to set intermediates");
+        if (set_depth > 0) {
+                if (!x509_verify_ctx_set_max_depth(ctx, set_depth))
+                        errx(1, "failed to set max depth");
+        }
 
         if ((*chains = x509_verify(ctx, leaf, NULL)) == 0) {
-                fprintf(stderr, "failed to verify at %lu: %s\n",
+                fprintf(stderr, "failed to verify at %zu: %s\n",
                     x509_verify_ctx_error_depth(ctx),
                     x509_verify_ctx_error_string(ctx));
         } else {
@@ -237,9 +286,12 @@ verify_cert_new(const char *roots_file, const char *bundle_file, int *chains)
 }
 
 struct verify_cert_test {
+        const char *desc;
         const char *id;
+        int (*verify_cb)(int, X509_STORE_CTX *);
         int want_chains;
         int want_error;
+        int set_depth;
         int want_error_depth;
         int want_legacy_error;
         int want_legacy_error_depth;
@@ -256,6 +308,32 @@ struct verify_cert_test verify_cert_tests[] = {
                 .want_chains = 1,
         },
         {
+                .desc = "2a with depth 2",
+                .id = "2a",
+                .set_depth = 2,
+                .want_chains = 1,
+        },
+        {
+                .desc = "2a with depth 1",
+                .id = "2a",
+                .set_depth = 1,
+                .want_chains = 0,
+                .want_error = X509_V_ERR_CERT_CHAIN_TOO_LONG,
+                .want_error_depth = 1,
+                .want_legacy_error = X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY,
+                .want_legacy_error_depth = 1,
+        },
+        {
+                .desc = "2a with depth 1 and depth callback",
+                .id = "2a",
+                .verify_cb = verify_cert_depth_cb,
+                .set_depth = 1,
+                .want_chains = 1,
+                .want_legacy_error = X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY,
+                .want_legacy_error_depth = 1,
+                .failing = 1,
+        },
+        {
                 .id = "2b",
                 .want_chains = 0,
                 .want_error = X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY,
@@ -466,6 +544,13 @@ struct verify_cert_test verify_cert_tests[] = {
                 .want_error_depth = 0,
         },
         {
+                .desc = "14a with yolo callback",
+                .id = "14a",
+                .verify_cb = verify_cert_yolo_cb,
+                .want_chains = 1,
+                .want_error_depth = 0,
+        },
+        {
                 .id = "14b",
                 .want_chains = 0,
                 .want_error = X509_V_ERR_CERT_CHAIN_TOO_LONG,
@@ -474,6 +559,17 @@ struct verify_cert_test verify_cert_tests[] = {
                 .want_legacy_error_depth = 0,
                 .failing = 1,
         },
+        {
+                .desc = "14b with yolo callback",
+                .id = "14b",
+                .verify_cb = verify_cert_yolo_cb,
+                .want_chains = 0,
+                .want_error = X509_V_ERR_CERT_CHAIN_TOO_LONG,
+                .want_error_depth = 32,
+                .want_legacy_error = 0,
+                .want_legacy_error_depth = 0,
+                .failing = 1,
+        },
 };
 
 #define N_VERIFY_CERT_TESTS \
@@ -503,12 +599,15 @@ verify_cert_test(const char *certs_path, int mode)
                 error = 0;
                 error_depth = 0;
 
-                fprintf(stderr, "== Test %zu (%s)\n", i, vct->id);
+                fprintf(stderr, "== Test %zu (%s)\n", i,
+                    vct->desc != NULL ? vct->desc : vct->id);
                 if (mode == MODE_VERIFY)
-                        verify_cert_new(roots_file, bundle_file, &chains);
+                        verify_cert_new(roots_file, bundle_file, &chains,
+                            vct->set_depth, vct->verify_cb);
                 else
                         verify_cert(roots_dir, roots_file, bundle_file, &chains,
-                            &error, &error_depth, mode);
+                            &error, &error_depth, vct->set_depth, vct->verify_cb,
+                            mode);
 
                 if ((mode == MODE_VERIFY && chains == vct->want_chains) ||
                     (chains == 0 && vct->want_chains == 0) ||
diff --git a/src/regress/lib/libcrypto/x509/x509_crl.c b/src/regress/lib/libcrypto/x509/x509_crl.c
new file mode 100644
index 0000000000..941b865263
--- /dev/null
+++ b/src/regress/lib/libcrypto/x509/x509_crl.c
@@ -0,0 +1,362 @@
+/*      $OpenBSD: x509_crl.c,v 1.2 2026/06/26 05:59:11 tb Exp $ */
+
+/*
+ * Copyright (c) 2015, Google Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <openssl/bio.h>
+#include <openssl/crypto.h>
+#include <openssl/err.h>
+#include <openssl/pem.h>
+#include <openssl/x509.h>
+
+#include <err.h>
+#include <stdio.h>
+#include <string.h>
+
+static const char *kCRLTestRoot =
+    "-----BEGIN CERTIFICATE-----\n"
+    "MIIDbzCCAlegAwIBAgIJAODri7v0dDUFMA0GCSqGSIb3DQEBCwUAME4xCzAJBgNV\n"
+    "BAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRYwFAYDVQQHDA1Nb3VudGFpbiBW\n"
+    "aWV3MRIwEAYDVQQKDAlCb3JpbmdTU0wwHhcNMTYwOTI2MTUwNjI2WhcNMjYwOTI0\n"
+    "MTUwNjI2WjBOMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQG\n"
+    "A1UEBwwNTW91bnRhaW4gVmlldzESMBAGA1UECgwJQm9yaW5nU1NMMIIBIjANBgkq\n"
+    "hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAo16WiLWZuaymsD8n5SKPmxV1y6jjgr3B\n"
+    "S/dUBpbrzd1aeFzNlI8l2jfAnzUyp+I21RQ+nh/MhqjGElkTtK9xMn1Y+S9GMRh+\n"
+    "5R/Du0iCb1tCZIPY07Tgrb0KMNWe0v2QKVVruuYSgxIWodBfxlKO64Z8AJ5IbnWp\n"
+    "uRqO6rctN9qUoMlTIAB6dL4G0tDJ/PGFWOJYwOMEIX54bly2wgyYJVBKiRRt4f7n\n"
+    "8H922qmvPNA9idmX9G1VAtgV6x97XXi7ULORIQvn9lVQF6nTYDBJhyuPB+mLThbL\n"
+    "P2o9orxGx7aCtnnBZUIxUvHNOI0FaSaZH7Fi0xsZ/GkG2HZe7ImPJwIDAQABo1Aw\n"
+    "TjAdBgNVHQ4EFgQUWPt3N5cZ/CRvubbrkqfBnAqhq94wHwYDVR0jBBgwFoAUWPt3\n"
+    "N5cZ/CRvubbrkqfBnAqhq94wDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOC\n"
+    "AQEAORu6M0MOwXy+3VEBwNilfTxyqDfruQsc1jA4PT8Oe8zora1WxE1JB4q2FJOz\n"
+    "EAuM3H/NXvEnBuN+ITvKZAJUfm4NKX97qmjMJwLKWe1gVv+VQTr63aR7mgWJReQN\n"
+    "XdMztlVeZs2dppV6uEg3ia1X0G7LARxGpA9ETbMyCpb39XxlYuTClcbA5ftDN99B\n"
+    "3Xg9KNdd++Ew22O3HWRDvdDpTO/JkzQfzi3sYwUtzMEonENhczJhGf7bQMmvL/w5\n"
+    "24Wxj4Z7KzzWIHsNqE/RIs6RV3fcW61j/mRgW2XyoWnMVeBzvcJr9NXp4VQYmFPw\n"
+    "amd8GKMZQvP0ufGnUn7D7uartA==\n"
+    "-----END CERTIFICATE-----\n";
+
+static const char *kCRLTestLeaf =
+    "-----BEGIN CERTIFICATE-----\n"
+    "MIIDkDCCAnigAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwTjELMAkGA1UEBhMCVVMx\n"
+    "EzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDU1vdW50YWluIFZpZXcxEjAQ\n"
+    "BgNVBAoMCUJvcmluZ1NTTDAeFw0xNjA5MjYxNTA4MzFaFw0xNzA5MjYxNTA4MzFa\n"
+    "MEsxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRIwEAYDVQQKDAlC\n"
+    "b3JpbmdTU0wxEzARBgNVBAMMCmJvcmluZy5zc2wwggEiMA0GCSqGSIb3DQEBAQUA\n"
+    "A4IBDwAwggEKAoIBAQDc5v1S1M0W+QWM+raWfO0LH8uvqEwuJQgODqMaGnSlWUx9\n"
+    "8iQcnWfjyPja3lWg9K62hSOFDuSyEkysKHDxijz5R93CfLcfnVXjWQDJe7EJTTDP\n"
+    "ozEvxN6RjAeYv7CF000euYr3QT5iyBjg76+bon1p0jHZBJeNPP1KqGYgyxp+hzpx\n"
+    "e0gZmTlGAXd8JQK4v8kpdYwD6PPifFL/jpmQpqOtQmH/6zcLjY4ojmqpEdBqIKIX\n"
+    "+saA29hMq0+NK3K+wgg31RU+cVWxu3tLOIiesETkeDgArjWRS1Vkzbi4v9SJxtNu\n"
+    "OZuAxWiynRJw3JwH/OFHYZIvQqz68ZBoj96cepjPAgMBAAGjezB5MAkGA1UdEwQC\n"
+    "MAAwLAYJYIZIAYb4QgENBB8WHU9wZW5TU0wgR2VuZXJhdGVkIENlcnRpZmljYXRl\n"
+    "MB0GA1UdDgQWBBTGn0OVVh/aoYt0bvEKG+PIERqnDzAfBgNVHSMEGDAWgBRY+3c3\n"
+    "lxn8JG+5tuuSp8GcCqGr3jANBgkqhkiG9w0BAQsFAAOCAQEAd2nM8gCQN2Dc8QJw\n"
+    "XSZXyuI3DBGGCHcay/3iXu0JvTC3EiQo8J6Djv7WLI0N5KH8mkm40u89fJAB2lLZ\n"
+    "ShuHVtcC182bOKnePgwp9CNwQ21p0rDEu/P3X46ZvFgdxx82E9xLa0tBB8PiPDWh\n"
+    "lV16jbaKTgX5AZqjnsyjR5o9/mbZVupZJXx5Syq+XA8qiJfstSYJs4KyKK9UOjql\n"
+    "ICkJVKpi2ahDBqX4MOH4SLfzVk8pqSpviS6yaA1RXqjpkxiN45WWaXDldVHMSkhC\n"
+    "5CNXsXi4b1nAntu89crwSLA3rEwzCWeYj+BX7e1T9rr3oJdwOU/2KQtW1js1yQUG\n"
+    "tjJMFw==\n"
+    "-----END CERTIFICATE-----\n";
+
+static const char *kBasicCRL =
+    "-----BEGIN X509 CRL-----\n"
+    "MIIBpzCBkAIBATANBgkqhkiG9w0BAQsFADBOMQswCQYDVQQGEwJVUzETMBEGA1UE\n"
+    "CAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNTW91bnRhaW4gVmlldzESMBAGA1UECgwJ\n"
+    "Qm9yaW5nU1NMFw0xNjA5MjYxNTEwNTVaFw0xNjEwMjYxNTEwNTVaoA4wDDAKBgNV\n"
+    "HRQEAwIBATANBgkqhkiG9w0BAQsFAAOCAQEAnrBKKgvd9x9zwK9rtUvVeFeJ7+LN\n"
+    "ZEAc+a5oxpPNEsJx6hXoApYEbzXMxuWBQoCs5iEBycSGudct21L+MVf27M38KrWo\n"
+    "eOkq0a2siqViQZO2Fb/SUFR0k9zb8xl86Zf65lgPplALun0bV/HT7MJcl04Tc4os\n"
+    "dsAReBs5nqTGNEd5AlC1iKHvQZkM//MD51DspKnDpsDiUVi54h9C1SpfZmX8H2Vv\n"
+    "diyu0fZ/bPAM3VAGawatf/SyWfBMyKpoPXEG39oAzmjjOj8en82psn7m474IGaho\n"
+    "/vBbhl1ms5qQiLYPjm4YELtnXQoFyC72tBjbdFd/ZE9k4CNKDbxFUXFbkw==\n"
+    "-----END X509 CRL-----\n";
+
+static const char *kRevokedCRL =
+    "-----BEGIN X509 CRL-----\n"
+    "MIIBvjCBpwIBATANBgkqhkiG9w0BAQsFADBOMQswCQYDVQQGEwJVUzETMBEGA1UE\n"
+    "CAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNTW91bnRhaW4gVmlldzESMBAGA1UECgwJ\n"
+    "Qm9yaW5nU1NMFw0xNjA5MjYxNTEyNDRaFw0xNjEwMjYxNTEyNDRaMBUwEwICEAAX\n"
+    "DTE2MDkyNjE1MTIyNlqgDjAMMAoGA1UdFAQDAgECMA0GCSqGSIb3DQEBCwUAA4IB\n"
+    "AQCUGaM4DcWzlQKrcZvI8TMeR8BpsvQeo5BoI/XZu2a8h//PyRyMwYeaOM+3zl0d\n"
+    "sjgCT8b3C1FPgT+P2Lkowv7rJ+FHJRNQkogr+RuqCSPTq65ha4WKlRGWkMFybzVH\n"
+    "NloxC+aU3lgp/NlX9yUtfqYmJek1CDrOOGPrAEAwj1l/BUeYKNGqfBWYJQtPJu+5\n"
+    "OaSvIYGpETCZJscUWODmLEb/O3DM438vLvxonwGqXqS0KX37+CHpUlyhnSovxXxp\n"
+    "Pz4aF+L7OtczxL0GYtD2fR9B7TDMqsNmHXgQrixvvOY7MUdLGbd4RfJL3yA53hyO\n"
+    "xzfKY2TzxLiOmctG0hXFkH5J\n"
+    "-----END X509 CRL-----\n";
+
+static const char *kBadIssuerCRL =
+    "-----BEGIN X509 CRL-----\n"
+    "MIIBwjCBqwIBATANBgkqhkiG9w0BAQsFADBSMQswCQYDVQQGEwJVUzETMBEGA1UE\n"
+    "CAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNTW91bnRhaW4gVmlldzEWMBQGA1UECgwN\n"
+    "Tm90IEJvcmluZ1NTTBcNMTYwOTI2MTUxMjQ0WhcNMTYxMDI2MTUxMjQ0WjAVMBMC\n"
+    "AhAAFw0xNjA5MjYxNTEyMjZaoA4wDDAKBgNVHRQEAwIBAjANBgkqhkiG9w0BAQsF\n"
+    "AAOCAQEAlBmjOA3Fs5UCq3GbyPEzHkfAabL0HqOQaCP12btmvIf/z8kcjMGHmjjP\n"
+    "t85dHbI4Ak/G9wtRT4E/j9i5KML+6yfhRyUTUJKIK/kbqgkj06uuYWuFipURlpDB\n"
+    "cm81RzZaMQvmlN5YKfzZV/clLX6mJiXpNQg6zjhj6wBAMI9ZfwVHmCjRqnwVmCUL\n"
+    "TybvuTmkryGBqREwmSbHFFjg5ixG/ztwzON/Ly78aJ8Bql6ktCl9+/gh6VJcoZ0q\n"
+    "L8V8aT8+Ghfi+zrXM8S9BmLQ9n0fQe0wzKrDZh14EK4sb7zmOzFHSxm3eEXyS98g\n"
+    "Od4cjsc3ymNk88S4jpnLRtIVxZB+SQ==\n"
+    "-----END X509 CRL-----\n";
+
+/*
+ * This is kBasicCRL but with a critical issuing distribution point
+ * extension.
+ */
+static const char *kKnownCriticalCRL =
+    "-----BEGIN X509 CRL-----\n"
+    "MIIBujCBowIBATANBgkqhkiG9w0BAQsFADBOMQswCQYDVQQGEwJVUzETMBEGA1UE\n"
+    "CAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNTW91bnRhaW4gVmlldzESMBAGA1UECgwJ\n"
+    "Qm9yaW5nU1NMFw0xNjA5MjYxNTEwNTVaFw0xNjEwMjYxNTEwNTVaoCEwHzAKBgNV\n"
+    "HRQEAwIBATARBgNVHRwBAf8EBzAFoQMBAf8wDQYJKoZIhvcNAQELBQADggEBAA+3\n"
+    "i+5e5Ub8sccfgOBs6WVJFI9c8gvJjrJ8/dYfFIAuCyeocs7DFXn1n13CRZ+URR/Q\n"
+    "mVWgU28+xeusuSPYFpd9cyYTcVyNUGNTI3lwgcE/yVjPaOmzSZKdPakApRxtpKKQ\n"
+    "NN/56aQz3bnT/ZSHQNciRB8U6jiD9V30t0w+FDTpGaG+7bzzUH3UVF9xf9Ctp60A\n"
+    "3mfLe0scas7owSt4AEFuj2SPvcE7yvdOXbu+IEv21cEJUVExJAbhvIweHXh6yRW+\n"
+    "7VVeiNzdIjkZjyTmAzoXGha4+wbxXyBRbfH+XWcO/H+8nwyG8Gktdu2QB9S9nnIp\n"
+    "o/1TpfOMSGhMyMoyPrk=\n"
+    "-----END X509 CRL-----\n";
+
+/*
+ * kUnknownCriticalCRL is kBasicCRL but with an unknown critical extension.
+ */
+static const char *kUnknownCriticalCRL =
+    "-----BEGIN X509 CRL-----\n"
+    "MIIBvDCBpQIBATANBgkqhkiG9w0BAQsFADBOMQswCQYDVQQGEwJVUzETMBEGA1UE\n"
+    "CAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNTW91bnRhaW4gVmlldzESMBAGA1UECgwJ\n"
+    "Qm9yaW5nU1NMFw0xNjA5MjYxNTEwNTVaFw0xNjEwMjYxNTEwNTVaoCMwITAKBgNV\n"
+    "HRQEAwIBATATBgwqhkiG9xIEAYS3CQABAf8EADANBgkqhkiG9w0BAQsFAAOCAQEA\n"
+    "GvBP0xqL509InMj/3493YVRV+ldTpBv5uTD6jewzf5XdaxEQ/VjTNe5zKnxbpAib\n"
+    "Kf7cwX0PMSkZjx7k7kKdDlEucwVvDoqC+O9aJcqVmM6GDyNb9xENxd0XCXja6MZC\n"
+    "yVgP4AwLauB2vSiEprYJyI1APph3iAEeDm60lTXX/wBM/tupQDDujKh2GPyvBRfJ\n"
+    "+wEDwGg3ICwvu4gO4zeC5qnFR+bpL9t5tOMAQnVZ0NWv+k7mkd2LbHdD44dxrfXC\n"
+    "nhtfERx99SDmC/jtUAJrGhtCO8acr7exCeYcduN7KKCm91OeCJKK6OzWst0Og1DB\n"
+    "kwzzU2rL3G65CrZ7H0SZsQ==\n"
+    "-----END X509 CRL-----\n";
+
+/*
+ * kUnknownCriticalCRL2 is kBasicCRL but with a critical issuing distribution
+ * point extension followed by an unknown critical extension
+ */
+static const char *kUnknownCriticalCRL2 =
+    "-----BEGIN X509 CRL-----\n"
+    "MIIBzzCBuAIBATANBgkqhkiG9w0BAQsFADBOMQswCQYDVQQGEwJVUzETMBEGA1UE\n"
+    "CAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNTW91bnRhaW4gVmlldzESMBAGA1UECgwJ\n"
+    "Qm9yaW5nU1NMFw0xNjA5MjYxNTEwNTVaFw0xNjEwMjYxNTEwNTVaoDYwNDAKBgNV\n"
+    "HRQEAwIBATARBgNVHRwBAf8EBzAFoQMBAf8wEwYMKoZIhvcSBAGEtwkAAQH/BAAw\n"
+    "DQYJKoZIhvcNAQELBQADggEBACTcpQC8jXL12JN5YzOcQ64ubQIe0XxRAd30p7qB\n"
+    "BTXGpgqBjrjxRfLms7EBYodEXB2oXMsDq3km0vT1MfYdsDD05S+SQ9CDsq/pUfaC\n"
+    "E2WNI5p8WircRnroYvbN2vkjlRbMd1+yNITohXYXCJwjEOAWOx3XIM10bwPYBv4R\n"
+    "rDobuLHoMgL3yHgMHmAkP7YpkBucNqeBV8cCdeAZLuhXFWi6yfr3r/X18yWbC/r2\n"
+    "2xXdkrSqXLFo7ToyP8YKTgiXpya4x6m53biEYwa2ULlas0igL6DK7wjYZX95Uy7H\n"
+    "GKljn9weIYiMPV/BzGymwfv2EW0preLwtyJNJPaxbdin6Jc=\n"
+    "-----END X509 CRL-----\n";
+
+static X509_CRL *
+X509_CRL_from_PEM(const char *pem)
+{
+        BIO *bio;
+        X509_CRL *crl;
+
+        if ((bio = BIO_new_mem_buf(pem, -1)) == NULL)
+                err(1, NULL);
+        if ((crl = PEM_read_bio_X509_CRL(bio, NULL, NULL, NULL)) == NULL)
+                errx(1, "PEM_read_bio_X509_CRL failed");
+        BIO_free(bio);
+
+        return crl;
+}
+
+static X509 *
+X509_from_PEM(const char *pem)
+{
+        BIO *bio;
+        X509 *x509;
+
+        if ((bio = BIO_new_mem_buf(pem, -1)) == NULL)
+                err(1, NULL);
+        if ((x509 = PEM_read_bio_X509(bio, NULL, NULL, NULL)) == NULL)
+                errx(1, "PEM_read_bio_X509 failed");
+        BIO_free(bio);
+
+        return x509;
+}
+
+/*
+ * Verify |leaf| certificate (chained up to |root|).  |crls| if
+ * not NULL, is a list of CRLs to include in the verification. It is
+ * also free'd before returning, which is kinda yucky but convenient.
+ * Returns a value from X509_V_ERR_xxx or X509_V_OK.
+ */
+static int
+verify(X509 *leaf, X509 *root, STACK_OF(X509_CRL) *crls, unsigned long flags)
+{
+        X509_STORE_CTX *ctx;
+        X509_STORE *store;
+        X509_VERIFY_PARAM *param;
+        STACK_OF(X509) *roots;
+        int status = X509_V_ERR_UNSPECIFIED;
+
+        if ((ctx = X509_STORE_CTX_new()) == NULL)
+                errx(1, "X509_STORE_CTX_new");
+        if ((store = X509_STORE_new()) == NULL)
+                errx(1, "X509_STORE_new");
+        if ((param = X509_VERIFY_PARAM_new()) == NULL)
+                errx(1, "X509_VERIFY_PARAM_new");
+        if ((roots = sk_X509_new_null()) == NULL)
+                errx(1, "sk_X509_new_null");
+
+        /* Create a stack; upref the cert because we free it below. */
+        X509_up_ref(root);
+        if (!sk_X509_push(roots, root))
+                errx(1, "sk_X509_push");
+
+        if (!X509_STORE_CTX_init(ctx, store, leaf, NULL))
+                errx(1, "X509_STORE_CTX_init");
+
+        X509_STORE_CTX_set0_trusted_stack(ctx, roots);
+        X509_STORE_CTX_set0_crls(ctx, crls);
+        X509_VERIFY_PARAM_set_time(param, 1474934400 /* Sep 27th, 2016 */);
+        X509_VERIFY_PARAM_set_depth(param, 16);
+        X509_VERIFY_PARAM_set_flags(param, flags);
+        X509_STORE_CTX_set0_param(ctx, param);
+
+        ERR_clear_error();
+        status = X509_V_OK;
+        if (X509_verify_cert(ctx) != 1)
+                status = X509_STORE_CTX_get_error(ctx);
+
+        sk_X509_pop_free(roots, X509_free);
+        sk_X509_CRL_pop_free(crls, X509_CRL_free);
+        X509_STORE_CTX_free(ctx);
+        X509_STORE_free(store);
+
+        return status;
+}
+
+/*
+ * Create a stack of CRLs.  Upref each one because we call pop_free on
+ * the stack and need to keep the CRLs around until the test exits.
+ * Yes this crashes on malloc failure; it forces us to debug.
+ */
+static STACK_OF(X509_CRL) *
+make_CRL_stack(X509_CRL *x1, X509_CRL *x2)
+{
+        STACK_OF(X509_CRL) *sk;
+
+        if ((sk = sk_X509_CRL_new_null()) == NULL)
+                errx(1, "sk_X509_CRL_new_null");
+
+        if (sk_X509_CRL_push(sk, x1) <= 0)
+                errx(1, "sk_X509_CRL_push");
+        X509_CRL_up_ref(x1);
+        if (x2 != NULL) {
+                if (sk_X509_CRL_push(sk, x2) <= 0)
+                        errx(1, "sk_X509_CRL_push");
+                X509_CRL_up_ref(x2);
+        }
+
+        return sk;
+}
+
+int
+main(void)
+{
+        X509 *root, *leaf;
+        X509_CRL *basic_crl, *revoked_crl, *bad_issuer_crl, *known_critical_crl;
+        X509_CRL *unknown_critical_crl, *unknown_critical_crl2;
+        int status = 1;
+
+        if ((root = X509_from_PEM(kCRLTestRoot)) == NULL)
+                errx(1, "X509_from_PEM(kCRLTestRoot)");
+        if ((leaf = X509_from_PEM(kCRLTestLeaf)) == NULL)
+                errx(1, "X509_from_PEM(kCRLTestLeaf)");
+        if ((basic_crl = X509_CRL_from_PEM(kBasicCRL)) == NULL)
+                errx(1, "X509_CRL_from_PEM(kBasicCRL)");
+        if ((revoked_crl = X509_CRL_from_PEM(kRevokedCRL)) == NULL)
+                errx(1, "X509_CRL_from_PEM(kRevokedCRL)");
+        if ((bad_issuer_crl = X509_CRL_from_PEM(kBadIssuerCRL)) == NULL)
+                errx(1, "X509_CRL_from_PEM(kBadIssuerCRL)");
+        if ((known_critical_crl = X509_CRL_from_PEM(kKnownCriticalCRL)) == NULL)
+                errx(1, "X509_CRL_from_PEM(kKnownCriticalCRL)");
+        if ((unknown_critical_crl = X509_CRL_from_PEM(kUnknownCriticalCRL)) == NULL)
+                errx(1, "X509_CRL_from_PEM(kUnknownCriticalCRL)");
+        if ((unknown_critical_crl2 = X509_CRL_from_PEM(kUnknownCriticalCRL2)) == NULL)
+                errx(1, "X509_CRL_from_PEM(kUnknownCriticalCRL2)");
+
+        if (verify(leaf, root, make_CRL_stack(basic_crl, NULL),
+            X509_V_FLAG_CRL_CHECK) != X509_V_OK) {
+                fprintf(stderr, "Cert with CRL didn't verify.\n");
+                goto err;
+        }
+
+        if (verify(leaf, root, make_CRL_stack(basic_crl, revoked_crl),
+            X509_V_FLAG_CRL_CHECK) != X509_V_ERR_CERT_REVOKED) {
+                fprintf(stderr, "Revoked CRL wasn't checked.\n");
+                goto err;
+        }
+
+        if (verify(leaf, root, NULL,
+            X509_V_FLAG_CRL_CHECK) != X509_V_ERR_UNABLE_TO_GET_CRL) {
+                fprintf(stderr, "CRLs were not required.\n");
+                goto err;
+        }
+
+        if (verify(leaf, root, make_CRL_stack(bad_issuer_crl, NULL),
+            X509_V_FLAG_CRL_CHECK) != X509_V_ERR_UNABLE_TO_GET_CRL) {
+                fprintf(stderr, "Bad CRL issuer was unnoticed.\n");
+                goto err;
+        }
+
+        if (verify(leaf, root, make_CRL_stack(known_critical_crl, NULL),
+            X509_V_FLAG_CRL_CHECK) != X509_V_OK) {
+                fprintf(stderr,
+                    "CRL with known critical extension was rejected.\n");
+                goto err;
+        }
+
+        if (verify(leaf, root, make_CRL_stack(unknown_critical_crl, NULL),
+            X509_V_FLAG_CRL_CHECK) !=
+            X509_V_ERR_UNHANDLED_CRITICAL_CRL_EXTENSION) {
+                fprintf(stderr,
+                    "CRL with unknown critical extension was accepted.\n");
+                goto err;
+        }
+
+        if (verify(leaf, root, make_CRL_stack(unknown_critical_crl2, NULL),
+            X509_V_FLAG_CRL_CHECK) !=
+            X509_V_ERR_UNHANDLED_CRITICAL_CRL_EXTENSION) {
+                fprintf(stderr,
+                    "CRL with unknown critical extension (2) was accepted.\n");
+                goto err;
+        }
+
+        status = 0;
+
+ err:
+        X509_free(root);
+        X509_free(leaf);
+        X509_CRL_free(basic_crl);
+        X509_CRL_free(revoked_crl);
+        X509_CRL_free(bad_issuer_crl);
+        X509_CRL_free(known_critical_crl);
+        X509_CRL_free(unknown_critical_crl);
+        X509_CRL_free(unknown_critical_crl2);
+
+        return status;
+}
diff --git a/src/regress/lib/libssl/dtls/Makefile b/src/regress/lib/libssl/dtls/Makefile
index b58dae61b6..739faf8b9e 100644
--- a/src/regress/lib/libssl/dtls/Makefile
+++ b/src/regress/lib/libssl/dtls/Makefile
@@ -1,6 +1,9 @@
-#       $OpenBSD: Makefile,v 1.4 2024/03/20 10:38:05 jsing Exp $
+#       $OpenBSD: Makefile,v 1.6 2026/06/06 08:13:50 jsing Exp $
+
+PROGS +=        dtlstest
+PROGS +=        dtls_handshake_msg_test
+PROGS +=        dtls_wire_test
 
-PROG=           dtlstest
 LDADD=          ${SSL_INT} -lcrypto
 DPADD=          ${LIBSSL} ${LIBCRYPTO}
 WARNINGS=       Yes
@@ -9,13 +12,21 @@ CFLAGS+=	-I${.CURDIR}/../../../../lib/libcrypto/bio
 CFLAGS+=        -I${.CURDIR}/../../../../lib/libssl
 
 REGRESS_TARGETS= \
-        regress-dtlstest
+        regress-dtlstest \
+        regress-dtls_handshake_msg_test \
+        regress-dtls_wire_test
 
 # XXX(jsing): use CA root and chain
-regress-dtlstest: ${PROG}
+regress-dtlstest: dtlstest
         ./dtlstest \
             ${.CURDIR}/../../libssl/certs/server1-rsa.pem \
             ${.CURDIR}/../../libssl/certs/server1-rsa.pem \
             ${.CURDIR}/../../libssl/certs/ca-int-rsa.pem
 
+regress-dtls_handshake_msg_test: dtls_handshake_msg_test
+        ./dtls_handshake_msg_test
+
+regress-dtls_wire_test: dtls_wire_test
+        ./dtls_wire_test
+
 .include <bsd.regress.mk>
diff --git a/src/regress/lib/libssl/dtls/dtls_handshake_msg_test.c b/src/regress/lib/libssl/dtls/dtls_handshake_msg_test.c
new file mode 100644
index 0000000000..4fbc8d8803
--- /dev/null
+++ b/src/regress/lib/libssl/dtls/dtls_handshake_msg_test.c
@@ -0,0 +1,369 @@
+/* $OpenBSD: dtls_handshake_msg_test.c,v 1.1 2026/06/06 08:13:50 jsing Exp $ */
+/*
+ * Copyright (c) 2026 Joel Sing <jsing@openbsd.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <stdio.h>
+#include <string.h>
+
+#include <openssl/ssl3.h>
+
+#include "bytestring.h"
+#include "dtls12_internal.h"
+
+static void
+hexdump(const unsigned char *buf, size_t len)
+{
+        size_t i;
+
+        for (i = 1; i <= len; i++)
+                fprintf(stderr, " 0x%02hhx,%s", buf[i - 1], i % 8 ? "" : "\n");
+
+        fprintf(stderr, "\n");
+}
+
+static const uint8_t dtls12_hs_msg_data[] = {
+        0x01, 0x00, 0x01, 0x00, 0xca, 0xfe, 0x00, 0x00,
+        0x00, 0x00, 0x01, 0x00, 0x00, 0x01, 0x02, 0x03,
+        0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b,
+        0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13,
+        0x14, 0x15, 0x16, 0x17, 0x18, 0x19, 0x1a, 0x1b,
+        0x1c, 0x1d, 0x1e, 0x1f, 0x20, 0x21, 0x22, 0x23,
+        0x24, 0x25, 0x26, 0x27, 0x28, 0x29, 0x2a, 0x2b,
+        0x2c, 0x2d, 0x2e, 0x2f, 0x30, 0x31, 0x32, 0x33,
+        0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x3a, 0x3b,
+        0x3c, 0x3d, 0x3e, 0x3f, 0x40, 0x41, 0x42, 0x43,
+        0x44, 0x45, 0x46, 0x47, 0x48, 0x49, 0x4a, 0x4b,
+        0x4c, 0x4d, 0x4e, 0x4f, 0x50, 0x51, 0x52, 0x53,
+        0x54, 0x55, 0x56, 0x57, 0x58, 0x59, 0x5a, 0x5b,
+        0x5c, 0x5d, 0x5e, 0x5f, 0x60, 0x61, 0x62, 0x63,
+        0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b,
+        0x6c, 0x6d, 0x6e, 0x6f, 0x70, 0x71, 0x72, 0x73,
+        0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7a, 0x7b,
+        0x7c, 0x7d, 0x7e, 0x7f, 0x80, 0x81, 0x82, 0x83,
+        0x84, 0x85, 0x86, 0x87, 0x88, 0x89, 0x8a, 0x8b,
+        0x8c, 0x8d, 0x8e, 0x8f, 0x90, 0x91, 0x92, 0x93,
+        0x94, 0x95, 0x96, 0x97, 0x98, 0x99, 0x9a, 0x9b,
+        0x9c, 0x9d, 0x9e, 0x9f, 0xa0, 0xa1, 0xa2, 0xa3,
+        0xa4, 0xa5, 0xa6, 0xa7, 0xa8, 0xa9, 0xaa, 0xab,
+        0xac, 0xad, 0xae, 0xaf, 0xb0, 0xb1, 0xb2, 0xb3,
+        0xb4, 0xb5, 0xb6, 0xb7, 0xb8, 0xb9, 0xba, 0xbb,
+        0xbc, 0xbd, 0xbe, 0xbf, 0xc0, 0xc1, 0xc2, 0xc3,
+        0xc4, 0xc5, 0xc6, 0xc7, 0xc8, 0xc9, 0xca, 0xcb,
+        0xcc, 0xcd, 0xce, 0xcf, 0xd0, 0xd1, 0xd2, 0xd3,
+        0xd4, 0xd5, 0xd6, 0xd7, 0xd8, 0xd9, 0xda, 0xdb,
+        0xdc, 0xdd, 0xde, 0xdf, 0xe0, 0xe1, 0xe2, 0xe3,
+        0xe4, 0xe5, 0xe6, 0xe7, 0xe8, 0xe9, 0xea, 0xeb,
+        0xec, 0xed, 0xee, 0xef, 0xf0, 0xf1, 0xf2, 0xf3,
+        0xf4, 0xf5, 0xf6, 0xf7, 0xf8, 0xf9, 0xfa, 0xfb,
+        0xfc, 0xfd, 0xfe, 0xff,
+};
+
+static const uint8_t dtls12_hm_content[] = {
+        0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
+        0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
+        0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
+        0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f,
+        0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27,
+        0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f,
+        0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37,
+        0x38, 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f,
+        0x40, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47,
+        0x48, 0x49, 0x4a, 0x4b, 0x4c, 0x4d, 0x4e, 0x4f,
+        0x50, 0x51, 0x52, 0x53, 0x54, 0x55, 0x56, 0x57,
+        0x58, 0x59, 0x5a, 0x5b, 0x5c, 0x5d, 0x5e, 0x5f,
+        0x60, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67,
+        0x68, 0x69, 0x6a, 0x6b, 0x6c, 0x6d, 0x6e, 0x6f,
+        0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77,
+        0x78, 0x79, 0x7a, 0x7b, 0x7c, 0x7d, 0x7e, 0x7f,
+        0x80, 0x81, 0x82, 0x83, 0x84, 0x85, 0x86, 0x87,
+        0x88, 0x89, 0x8a, 0x8b, 0x8c, 0x8d, 0x8e, 0x8f,
+        0x90, 0x91, 0x92, 0x93, 0x94, 0x95, 0x96, 0x97,
+        0x98, 0x99, 0x9a, 0x9b, 0x9c, 0x9d, 0x9e, 0x9f,
+        0xa0, 0xa1, 0xa2, 0xa3, 0xa4, 0xa5, 0xa6, 0xa7,
+        0xa8, 0xa9, 0xaa, 0xab, 0xac, 0xad, 0xae, 0xaf,
+        0xb0, 0xb1, 0xb2, 0xb3, 0xb4, 0xb5, 0xb6, 0xb7,
+        0xb8, 0xb9, 0xba, 0xbb, 0xbc, 0xbd, 0xbe, 0xbf,
+        0xc0, 0xc1, 0xc2, 0xc3, 0xc4, 0xc5, 0xc6, 0xc7,
+        0xc8, 0xc9, 0xca, 0xcb, 0xcc, 0xcd, 0xce, 0xcf,
+        0xd0, 0xd1, 0xd2, 0xd3, 0xd4, 0xd5, 0xd6, 0xd7,
+        0xd8, 0xd9, 0xda, 0xdb, 0xdc, 0xdd, 0xde, 0xdf,
+        0xe0, 0xe1, 0xe2, 0xe3, 0xe4, 0xe5, 0xe6, 0xe7,
+        0xe8, 0xe9, 0xea, 0xeb, 0xec, 0xed, 0xee, 0xef,
+        0xf0, 0xf1, 0xf2, 0xf3, 0xf4, 0xf5, 0xf6, 0xf7,
+        0xf8, 0xf9, 0xfa, 0xfb, 0xfc, 0xfd, 0xfe, 0xff,
+};
+
+static const uint8_t dtls12_hs_msg_frag_0[] = {
+        0x01, 0x00, 0x01, 0x00, 0xca, 0xfe, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x40, 0x00, 0x01, 0x02, 0x03,
+        0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b,
+        0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13,
+        0x14, 0x15, 0x16, 0x17, 0x18, 0x19, 0x1a, 0x1b,
+        0x1c, 0x1d, 0x1e, 0x1f, 0x20, 0x21, 0x22, 0x23,
+        0x24, 0x25, 0x26, 0x27, 0x28, 0x29, 0x2a, 0x2b,
+        0x2c, 0x2d, 0x2e, 0x2f, 0x30, 0x31, 0x32, 0x33,
+        0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x3a, 0x3b,
+        0x3c, 0x3d, 0x3e, 0x3f,
+};
+
+static const uint8_t dtls12_hs_msg_frag_1[] = {
+        0x01, 0x00, 0x01, 0x00, 0xca, 0xfe, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x20, 0x00, 0x01, 0x02, 0x03,
+        0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b,
+        0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13,
+        0x14, 0x15, 0x16, 0x17, 0x18, 0x19, 0x1a, 0x1b,
+        0x1c, 0x1d, 0x1e, 0x1f,
+};
+
+static const uint8_t dtls12_hs_msg_frag_2[] = {
+        0x01, 0x00, 0x01, 0x00, 0xca, 0xfe, 0x00, 0x00,
+        0x20, 0x00, 0x00, 0x80, 0x20, 0x21, 0x22, 0x23,
+        0x24, 0x25, 0x26, 0x27, 0x28, 0x29, 0x2a, 0x2b,
+        0x2c, 0x2d, 0x2e, 0x2f, 0x30, 0x31, 0x32, 0x33,
+        0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x3a, 0x3b,
+        0x3c, 0x3d, 0x3e, 0x3f, 0x40, 0x41, 0x42, 0x43,
+        0x44, 0x45, 0x46, 0x47, 0x48, 0x49, 0x4a, 0x4b,
+        0x4c, 0x4d, 0x4e, 0x4f, 0x50, 0x51, 0x52, 0x53,
+        0x54, 0x55, 0x56, 0x57, 0x58, 0x59, 0x5a, 0x5b,
+        0x5c, 0x5d, 0x5e, 0x5f, 0x60, 0x61, 0x62, 0x63,
+        0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b,
+        0x6c, 0x6d, 0x6e, 0x6f, 0x70, 0x71, 0x72, 0x73,
+        0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7a, 0x7b,
+        0x7c, 0x7d, 0x7e, 0x7f, 0x80, 0x81, 0x82, 0x83,
+        0x84, 0x85, 0x86, 0x87, 0x88, 0x89, 0x8a, 0x8b,
+        0x8c, 0x8d, 0x8e, 0x8f, 0x90, 0x91, 0x92, 0x93,
+        0x94, 0x95, 0x96, 0x97, 0x98, 0x99, 0x9a, 0x9b,
+        0x9c, 0x9d, 0x9e, 0x9f,
+};
+
+static const uint8_t dtls12_hs_msg_frag_3[] = {
+        0x01, 0x00, 0x01, 0x00, 0xca, 0xfe, 0x00, 0x00,
+        0xa0, 0x00, 0x00, 0x60, 0xa0, 0xa1, 0xa2, 0xa3,
+        0xa4, 0xa5, 0xa6, 0xa7, 0xa8, 0xa9, 0xaa, 0xab,
+        0xac, 0xad, 0xae, 0xaf, 0xb0, 0xb1, 0xb2, 0xb3,
+        0xb4, 0xb5, 0xb6, 0xb7, 0xb8, 0xb9, 0xba, 0xbb,
+        0xbc, 0xbd, 0xbe, 0xbf, 0xc0, 0xc1, 0xc2, 0xc3,
+        0xc4, 0xc5, 0xc6, 0xc7, 0xc8, 0xc9, 0xca, 0xcb,
+        0xcc, 0xcd, 0xce, 0xcf, 0xd0, 0xd1, 0xd2, 0xd3,
+        0xd4, 0xd5, 0xd6, 0xd7, 0xd8, 0xd9, 0xda, 0xdb,
+        0xdc, 0xdd, 0xde, 0xdf, 0xe0, 0xe1, 0xe2, 0xe3,
+        0xe4, 0xe5, 0xe6, 0xe7, 0xe8, 0xe9, 0xea, 0xeb,
+        0xec, 0xed, 0xee, 0xef, 0xf0, 0xf1, 0xf2, 0xf3,
+        0xf4, 0xf5, 0xf6, 0xf7, 0xf8, 0xf9, 0xfa, 0xfb,
+        0xfc, 0xfd, 0xfe, 0xff,
+};
+
+static int
+dtls_handshake_msg_test(void)
+{
+        struct dtls12_handshake_msg *hs_msg = NULL;
+        uint8_t *p;
+        int i;
+        CBB cbb;
+        CBS cbs;
+        int failed = 1;
+
+        memset(&cbb, 0, sizeof(cbb));
+
+        if ((hs_msg = dtls12_handshake_msg_new()) == NULL) {
+                fprintf(stderr, "FAIL: dtls12_handshake_msg_new\n");
+                goto failure;
+        }
+        if (!dtls12_handshake_msg_start(hs_msg, &cbb, SSL3_MT_CLIENT_HELLO,
+            0xcafe)) {
+                fprintf(stderr, "FAIL: dtls12_handshake_msg_start\n");
+                goto failure;
+        }
+        if (!CBB_add_space(&cbb, &p, 256)) {
+                fprintf(stderr, "FAIL: CBB_add_space\n");
+                goto failure;
+        }
+        for (i = 0; i < 256; i++)
+                p[i] = i;
+        if (!dtls12_handshake_msg_finish(hs_msg)) {
+                fprintf(stderr, "FAIL: dtls12_handshake_msg_finish\n");
+                goto failure;
+        }
+
+        dtls12_handshake_msg_data(hs_msg, &cbs);
+        if (CBS_len(&cbs) != sizeof(dtls12_hs_msg_data)) {
+                fprintf(stderr, "FAIL: handshake message data length = %zu, want %zu\n",
+                    CBS_len(&cbs), sizeof(dtls12_hs_msg_data));
+                goto failure;
+        }
+        if (memcmp(CBS_data(&cbs), dtls12_hs_msg_data, CBS_len(&cbs)) != 0) {
+                fprintf(stderr, "FAIL: got handshake message data:\n");
+                hexdump(CBS_data(&cbs), CBS_len(&cbs));
+                fprintf(stderr, "want handshake message data:\n");
+                hexdump(dtls12_hs_msg_data, CBS_len(&cbs));
+        }
+
+        dtls12_handshake_msg_content(hs_msg, &cbs);
+        if (CBS_len(&cbs) != sizeof(dtls12_hm_content)) {
+                fprintf(stderr, "FAIL: handshake message content length = %zu, want %zu\n",
+                    CBS_len(&cbs), sizeof(dtls12_hm_content));
+                goto failure;
+        }
+        if (memcmp(CBS_data(&cbs), dtls12_hm_content, CBS_len(&cbs)) != 0) {
+                fprintf(stderr, "FAIL: got handshake message content:\n");
+                hexdump(CBS_data(&cbs), CBS_len(&cbs));
+                fprintf(stderr, "want handshake message content:\n");
+                hexdump(dtls12_hm_content, CBS_len(&cbs));
+        }
+
+        if (!dtls12_handshake_msg_fragment_pending(hs_msg)) {
+                fprintf(stderr, "FAIL: handshake message should have pending fragments\n");
+                goto failure;
+        }
+        if (!dtls12_handshake_msg_fragment_build(hs_msg, 64, &cbs)) {
+                fprintf(stderr, "FAIL: failed to build handshake message fragment 0\n");
+                goto failure;
+        }
+        if (CBS_len(&cbs) != sizeof(dtls12_hs_msg_frag_0)) {
+                fprintf(stderr, "FAIL: handshake message fragment 0 length = %zu, want %zu\n",
+                    CBS_len(&cbs), sizeof(dtls12_hs_msg_frag_0));
+                goto failure;
+        }
+        if (memcmp(CBS_data(&cbs), dtls12_hs_msg_frag_0, CBS_len(&cbs)) != 0) {
+                fprintf(stderr, "FAIL: got handshake message fragment:\n");
+                hexdump(CBS_data(&cbs), CBS_len(&cbs));
+                fprintf(stderr, "want handshake message fragment:\n");
+                hexdump(dtls12_hs_msg_frag_0, CBS_len(&cbs));
+        }
+
+        if (!dtls12_handshake_msg_fragment_build(hs_msg, 32, &cbs)) {
+                fprintf(stderr, "FAIL: failed to build handshake message fragment 1\n");
+                goto failure;
+        }
+        if (CBS_len(&cbs) != sizeof(dtls12_hs_msg_frag_1)) {
+                fprintf(stderr, "FAIL: handshake message fragment 1 length = %zu, want %zu\n",
+                    CBS_len(&cbs), sizeof(dtls12_hs_msg_frag_1));
+                goto failure;
+        }
+        if (memcmp(CBS_data(&cbs), dtls12_hs_msg_frag_1, CBS_len(&cbs)) != 0) {
+                fprintf(stderr, "FAIL: got handshake message 1 fragment:\n");
+                hexdump(CBS_data(&cbs), CBS_len(&cbs));
+                fprintf(stderr, "want handshake message 1 fragment:\n");
+                hexdump(dtls12_hs_msg_frag_1, CBS_len(&cbs));
+        }
+
+        if (!dtls12_handshake_msg_fragment_build(hs_msg, 32, &cbs)) {
+                fprintf(stderr, "FAIL: failed to rebuild handshake message fragment 1\n");
+                goto failure;
+        }
+        if (CBS_len(&cbs) != sizeof(dtls12_hs_msg_frag_1)) {
+                fprintf(stderr, "FAIL: handshake message fragment 1 length = %zu, want %zu\n",
+                    CBS_len(&cbs), sizeof(dtls12_hs_msg_frag_1));
+                goto failure;
+        }
+        if (memcmp(CBS_data(&cbs), dtls12_hs_msg_frag_1, CBS_len(&cbs)) != 0) {
+                fprintf(stderr, "FAIL: got handshake message 1 fragment:\n");
+                hexdump(CBS_data(&cbs), CBS_len(&cbs));
+                fprintf(stderr, "want handshake message 1 fragment:\n");
+                hexdump(dtls12_hs_msg_frag_1, CBS_len(&cbs));
+        }
+
+        if (!dtls12_handshake_msg_fragment_next(hs_msg)) {
+                fprintf(stderr, "FAIL: failed to progress to next fragment\n");
+                goto failure;
+        }
+        if (!dtls12_handshake_msg_fragment_pending(hs_msg)) {
+                fprintf(stderr, "FAIL: handshake message should have pending fragments\n");
+                goto failure;
+        }
+
+        if (!dtls12_handshake_msg_fragment_build(hs_msg, 128, &cbs)) {
+                fprintf(stderr, "FAIL: failed to build handshake message fragment 2\n");
+                goto failure;
+        }
+        if (CBS_len(&cbs) != sizeof(dtls12_hs_msg_frag_2)) {
+                fprintf(stderr, "FAIL: handshake message fragment 2 length = %zu, want %zu\n",
+                    CBS_len(&cbs), sizeof(dtls12_hs_msg_frag_2));
+                goto failure;
+        }
+        if (memcmp(CBS_data(&cbs), dtls12_hs_msg_frag_2, CBS_len(&cbs)) != 0) {
+                fprintf(stderr, "FAIL: got handshake message 2 fragment:\n");
+                hexdump(CBS_data(&cbs), CBS_len(&cbs));
+                fprintf(stderr, "want handshake message 2 fragment:\n");
+                hexdump(dtls12_hs_msg_frag_2, CBS_len(&cbs));
+        }
+
+        if (!dtls12_handshake_msg_fragment_next(hs_msg)) {
+                fprintf(stderr, "FAIL: failed to progress to next fragment\n");
+                goto failure;
+        }
+        if (!dtls12_handshake_msg_fragment_pending(hs_msg)) {
+                fprintf(stderr, "FAIL: handshake message should have pending fragments\n");
+                goto failure;
+        }
+
+        if (!dtls12_handshake_msg_fragment_build(hs_msg, 128, &cbs)) {
+                fprintf(stderr, "FAIL: failed to build handshake message fragment 3\n");
+                goto failure;
+        }
+        if (CBS_len(&cbs) != sizeof(dtls12_hs_msg_frag_3)) {
+                fprintf(stderr, "FAIL: handshake message fragment 3 length = %zu, want %zu\n",
+                    CBS_len(&cbs), sizeof(dtls12_hs_msg_frag_3));
+                goto failure;
+        }
+        if (memcmp(CBS_data(&cbs), dtls12_hs_msg_frag_3, CBS_len(&cbs)) != 0) {
+                fprintf(stderr, "FAIL: got handshake message 3 fragment:\n");
+                hexdump(CBS_data(&cbs), CBS_len(&cbs));
+                fprintf(stderr, "want handshake message 3 fragment:\n");
+                hexdump(dtls12_hs_msg_frag_2, CBS_len(&cbs));
+        }
+
+        if (!dtls12_handshake_msg_fragment_next(hs_msg)) {
+                fprintf(stderr, "FAIL: failed to progress to next fragment\n");
+                goto failure;
+        }
+        if (dtls12_handshake_msg_fragment_pending(hs_msg)) {
+                fprintf(stderr, "FAIL: handshake message should not have pending fragments\n");
+                goto failure;
+        }
+        if (dtls12_handshake_msg_fragment_next(hs_msg)) {
+                fprintf(stderr, "FAIL: should have failed to progress to next fragment\n");
+                goto failure;
+        }
+
+        if (!dtls12_handshake_msg_fragment_reset(hs_msg)) {
+                fprintf(stderr, "FAIL: failed to reset handshake message fragments\n");
+                goto failure;
+        }
+        if (!dtls12_handshake_msg_fragment_pending(hs_msg)) {
+                fprintf(stderr, "FAIL: handshake message should have pending fragments after reset\n");
+                goto failure;
+        }
+
+        failed = 0;
+
+ failure:
+        dtls12_handshake_msg_free(hs_msg);
+
+        CBB_cleanup(&cbb);
+
+        return failed;
+}
+
+int
+main(int argc, char **argv)
+{
+        int failed = 0;
+
+        failed |= dtls_handshake_msg_test();
+
+        return failed;
+}
diff --git a/src/regress/lib/libssl/dtls/dtls_wire_test.c b/src/regress/lib/libssl/dtls/dtls_wire_test.c
new file mode 100644
index 0000000000..fa9717a3e1
--- /dev/null
+++ b/src/regress/lib/libssl/dtls/dtls_wire_test.c
@@ -0,0 +1,376 @@
+/* $OpenBSD: dtls_wire_test.c,v 1.1 2026/04/25 14:36:12 jsing Exp $ */
+/*
+ * Copyright (c) 2026 Joel Sing <jsing@openbsd.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <stdio.h>
+
+#include <openssl/bio.h>
+#include <openssl/ssl.h>
+
+#include "dtls_local.h"
+#include "ssl_local.h"
+
+static void
+hexdump(const unsigned char *buf, size_t len)
+{
+        size_t i;
+
+        for (i = 1; i <= len; i++)
+                fprintf(stderr, " 0x%02hhx,%s", buf[i - 1], i % 8 ? "" : "\n");
+
+        fprintf(stderr, "\n");
+}
+
+static const uint8_t dtls12_hm_wire_bytes[] = {
+        0x16, 0xfe, 0xff, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x01, 0xf3, 0x16, 0x00, 0x04,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
+        0xe7, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x16, 0xfe, 0xff, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x01, 0x01, 0xf3, 0x16, 0x00, 0x04,
+        0x00, 0x00, 0x00, 0x00, 0x01, 0xe7, 0x00, 0x01,
+        0xe7, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x16, 0xfe, 0xff, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x02, 0x00, 0x3e, 0x16, 0x00, 0x04,
+        0x00, 0x00, 0x00, 0x00, 0x03, 0xce, 0x00, 0x00,
+        0x32, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41,
+};
+
+static int
+dtls_send_handshake_message_test(void)
+{
+        BIO *rbio = NULL, *wbio = NULL;
+        char *wbuf, rbuf[1];
+        CBB handshake, body;
+        uint8_t *p;
+        SSL_CTX *ssl_ctx = NULL;
+        SSL *ssl = NULL;
+        long len;
+        int failed = 1;
+
+        if ((ssl_ctx = SSL_CTX_new(DTLS_client_method())) == NULL) {
+                fprintf(stderr, "FAIL: failed to create SSL_CTX\n");
+                goto failure;
+        }
+        if ((ssl = SSL_new(ssl_ctx)) == NULL) {
+                fprintf(stderr, "FAIL: failed to create SSL\n");
+                goto failure;
+        }
+
+        if ((rbio = BIO_new_mem_buf(rbuf, sizeof(rbuf))) == NULL) {
+                fprintf(stderr, "FAIL: failed to create rbio\n");
+                goto failure;
+        }
+        if ((wbio = BIO_new(BIO_s_mem())) == NULL) {
+                fprintf(stderr, "FAIL: failed to create wbio\n");
+                goto failure;
+        }
+
+        BIO_up_ref(rbio);
+        BIO_up_ref(wbio);
+        SSL_set_bio(ssl, rbio, wbio);
+
+        if (!ssl3_setup_init_buffer(ssl)) {
+                fprintf(stderr, "FAIL: failed to setup init buffer\n");
+                goto failure;
+        }
+        if (!ssl3_setup_write_buffer(ssl)) {
+                fprintf(stderr, "FAIL: failed to setup write buffer\n");
+                goto failure;
+        }
+        if (!ssl_get_new_session(ssl, 0)) {
+                fprintf(stderr, "FAIL: failed to create session\n");
+                goto failure;
+        }
+        if (!tls1_transcript_init(ssl)) {
+                fprintf(stderr, "FAIL: failed to init transcript\n");
+                goto failure;
+        }
+
+        ssl->s3->hs.cipher = ssl3_get_cipher_by_value(
+            TLS1_CK_ECDHE_RSA_WITH_AES_128_SHA256 & 0xffff);
+
+        ssl->s3->hs.state = SSL3_ST_CW_CLNT_HELLO_B;
+        ssl->d1->mtu = 512;
+
+        if (!ssl3_handshake_msg_start(ssl, &handshake, &body, SSL3_RT_HANDSHAKE)) {
+                fprintf(stderr, "FAIL: failed to start handshake message\n");
+                goto failure;
+        }
+        if (!CBB_add_space(&body, &p, 1024))
+                goto failure;
+        memset(p, 'A', 1024);
+        if (!ssl3_handshake_msg_finish(ssl, &handshake)) {
+                fprintf(stderr, "FAIL: failed to finish handshake message\n");
+                goto failure;
+        }
+
+        ssl3_connect(ssl);
+
+        if (ssl->s3->hs.state != SSL3_ST_CR_SRVR_HELLO_A) {
+                fprintf(stderr, "FAIL: got state 0x%x, want 0x%x\n",
+                    ssl->s3->hs.state, SSL3_ST_CR_SRVR_HELLO_A);
+                goto failure;
+        }
+
+        if ((len = BIO_get_mem_data(wbio, &wbuf)) != sizeof(dtls12_hm_wire_bytes)) {
+                fprintf(stderr, "FAIL: got handshake message length = %ld, want %zu\n",
+                    len, sizeof(dtls12_hm_wire_bytes));
+                goto failure;
+        }
+        if (memcmp(wbuf, dtls12_hm_wire_bytes, len) != 0) {
+                fprintf(stderr, "FAIL: got handshake message wire bytes:\n");
+                hexdump(wbuf, len);
+                fprintf(stderr, "want handshake message wire bytes:\n");
+                hexdump(dtls12_hm_wire_bytes, len);
+        }
+
+        failed = 0;
+
+ failure:
+        SSL_CTX_free(ssl_ctx);
+        SSL_free(ssl);
+
+        BIO_free(rbio);
+        BIO_free(wbio);
+
+        return failed;
+}
+
+static const uint8_t dtls12_ccs_wire_bytes[] = {
+        0x14, 0xfe, 0xff, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x01, 0x01,
+};
+
+static int
+dtls_send_ccs_test(void)
+{
+        BIO *rbio = NULL, *wbio = NULL;
+        char *wbuf, rbuf[1];
+        SSL_CTX *ssl_ctx = NULL;
+        SSL *ssl = NULL;
+        long len;
+        int failed = 1;
+
+        if ((ssl_ctx = SSL_CTX_new(DTLS_client_method())) == NULL) {
+                fprintf(stderr, "FAIL: failed to create SSL_CTX\n");
+                goto failure;
+        }
+        if ((ssl = SSL_new(ssl_ctx)) == NULL) {
+                fprintf(stderr, "FAIL: failed to create SSL\n");
+                goto failure;
+        }
+
+        if ((rbio = BIO_new_mem_buf(rbuf, sizeof(rbuf))) == NULL) {
+                fprintf(stderr, "FAIL: failed to create rbio\n");
+                goto failure;
+        }
+        if ((wbio = BIO_new(BIO_s_mem())) == NULL) {
+                fprintf(stderr, "FAIL: failed to create wbio\n");
+                goto failure;
+        }
+
+        BIO_up_ref(rbio);
+        BIO_up_ref(wbio);
+        SSL_set_bio(ssl, rbio, wbio);
+
+        if (!ssl3_setup_init_buffer(ssl)) {
+                fprintf(stderr, "FAIL: failed to setup init buffer\n");
+                goto failure;
+        }
+        if (!ssl3_setup_write_buffer(ssl)) {
+                fprintf(stderr, "FAIL: failed to setup write buffer\n");
+                goto failure;
+        }
+        if (!ssl_get_new_session(ssl, 0)) {
+                fprintf(stderr, "FAIL: failed to create session\n");
+                goto failure;
+        }
+
+        ssl->s3->hs.cipher = ssl3_get_cipher_by_value(
+            TLS1_CK_ECDHE_RSA_WITH_AES_128_SHA256 & 0xffff);
+
+        ssl->s3->hs.state = SSL3_ST_CW_CHANGE_A;
+        ssl->d1->mtu = 512;
+
+        ssl3_connect(ssl);
+
+        if (ssl->s3->hs.state != SSL3_ST_CW_FINISHED_A) {
+                fprintf(stderr, "FAIL: got state 0x%x, want 0x%x\n",
+                    ssl->s3->hs.state, SSL3_ST_CW_FINISHED_A);
+                goto failure;
+        }
+
+        if ((len = BIO_get_mem_data(wbio, &wbuf)) != sizeof(dtls12_ccs_wire_bytes)) {
+                fprintf(stderr, "FAIL: got CCS length = %ld, want %zu\n", len,
+                    sizeof(dtls12_ccs_wire_bytes));
+                goto failure;
+        }
+        if (memcmp(wbuf, dtls12_ccs_wire_bytes, len) != 0) {
+                fprintf(stderr, "FAIL: got CCS wire bytes:\n");
+                hexdump(wbuf, len);
+                fprintf(stderr, "want CCS wire bytes:\n");
+                hexdump(dtls12_ccs_wire_bytes, len);
+        }
+
+        failed = 0;
+
+ failure:
+        SSL_CTX_free(ssl_ctx);
+        SSL_free(ssl);
+
+        BIO_free(rbio);
+        BIO_free(wbio);
+
+        return failed;
+}
+
+int
+main(int argc, char **argv)
+{
+        int failed = 0;
+
+        failed |= dtls_send_handshake_message_test();
+        failed |= dtls_send_ccs_test();
+
+        return failed;
+}
diff --git a/src/regress/lib/libssl/handshake/handshake_table.c b/src/regress/lib/libssl/handshake/handshake_table.c
index 8ebed9a73e..c1c83a75bb 100644
--- a/src/regress/lib/libssl/handshake/handshake_table.c
+++ b/src/regress/lib/libssl/handshake/handshake_table.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: handshake_table.c,v 1.18 2022/12/01 13:49:12 tb Exp $ */
+/*      $OpenBSD: handshake_table.c,v 1.19 2026/08/21 17:16:29 tb Exp $ */
 /*
  * Copyright (c) 2019 Theo Buehler <tb@openbsd.org>
  *
@@ -26,7 +26,7 @@
 #define MAX_FLAGS (UINT8_MAX + 1)
 
 /*
- * From RFC 8446:
+ * From RFC 9846:
  *
  * Appendix A.  State Machine
  *
diff --git a/src/regress/lib/libssl/openssl-ruby/Makefile b/src/regress/lib/libssl/openssl-ruby/Makefile
index 19d2f2fc40..6e77ed963c 100644
--- a/src/regress/lib/libssl/openssl-ruby/Makefile
+++ b/src/regress/lib/libssl/openssl-ruby/Makefile
@@ -1,8 +1,8 @@
-#       $OpenBSD: Makefile,v 1.17 2025/06/27 03:32:08 tb Exp $
+#       $OpenBSD: Makefile,v 1.19 2026/06/18 03:56:36 tb Exp $
 
 OPENSSL_RUBY_TESTS =    /usr/local/share/openssl-ruby-tests
-.if exists(/usr/local/bin/ruby33)
-RUBY_BINREV =           33
+.if exists(/usr/local/bin/ruby40)
+RUBY_BINREV =           40
 .else
 RUBY_BINREV =           34
 .endif
diff --git a/src/regress/lib/libssl/renegotiation/Makefile b/src/regress/lib/libssl/renegotiation/Makefile
index 55f323e158..935586da62 100644
--- a/src/regress/lib/libssl/renegotiation/Makefile
+++ b/src/regress/lib/libssl/renegotiation/Makefile
@@ -1,10 +1,11 @@
-#       $OpenBSD: Makefile,v 1.2 2025/02/01 12:26:50 jsing Exp $
+#       $OpenBSD: Makefile,v 1.3 2026/06/14 14:33:36 jsing Exp $
 
 PROG=   renegotiation_test
-LDADD=  -lssl -lcrypto
+LDADD=  ${SSL_INT} -lcrypto
 DPADD=  ${LIBSSL} ${LIBCRYPTO}
 WARNINGS=       Yes
 CFLAGS+=        -DLIBRESSL_INTERNAL -Werror
+CFLAGS+=        -I${.CURDIR}/../../../../lib/libssl
 
 REGRESS_TARGETS= \
         regress-renegotiation-test
diff --git a/src/regress/lib/libssl/renegotiation/renegotiation_test.c b/src/regress/lib/libssl/renegotiation/renegotiation_test.c
index 1c9f35237f..a94da93b9a 100644
--- a/src/regress/lib/libssl/renegotiation/renegotiation_test.c
+++ b/src/regress/lib/libssl/renegotiation/renegotiation_test.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: renegotiation_test.c,v 1.3 2025/03/12 14:07:35 jsing Exp $ */
+/* $OpenBSD: renegotiation_test.c,v 1.4 2026/06/14 14:33:36 jsing Exp $ */
 /*
  * Copyright (c) 2020,2025 Joel Sing <jsing@openbsd.org>
  *
@@ -21,6 +21,8 @@
 #include <openssl/err.h>
 #include <openssl/ssl.h>
 
+#include "ssl_local.h"
+
 const char *server_ca_file;
 const char *server_cert_file;
 const char *server_key_file;
@@ -28,7 +30,13 @@ const char *server_key_file;
 int debug = 0;
 
 int tls_client_alert;
+int tls_client_error;
+
 int tls_server_alert;
+int tls_server_error;
+
+int tls_client_disable_ri;
+int tls_server_disable_ri;
 
 static void
 hexdump(const unsigned char *buf, size_t len)
@@ -101,7 +109,7 @@ tls_server(BIO *rbio, BIO *wbio)
 }
 
 static int
-ssl_error(SSL *ssl, const char *name, const char *desc, int ssl_ret)
+ssl_error(SSL *ssl, const char *name, const char *desc, int ssl_ret, int *error)
 {
         int ssl_err;
 
@@ -122,10 +130,11 @@ ssl_error(SSL *ssl, const char *name, const char *desc, int ssl_ret)
                 if (tls_client_alert >> 8 == SSL3_AL_WARNING ||
                     tls_server_alert >> 8 == SSL3_AL_WARNING) {
                         ERR_clear_error();
-                        return 1;
+                        return 0;
                 }
-                fprintf(stderr, "FAIL: %s %s failed - ssl err = %d, errno = %d\n",
+                fprintf(stderr, "INFO: %s %s failed - ssl err = %d, errno = %d\n",
                     name, desc, ssl_err, errno);
+                *error = ERR_peek_error();
                 ERR_print_errors_fp(stderr);
                 return 0;
         }
@@ -134,7 +143,7 @@ ssl_error(SSL *ssl, const char *name, const char *desc, int ssl_ret)
 }
 
 static int
-do_connect(SSL *ssl, const char *name, int *done)
+do_connect(SSL *ssl, const char *name, int *done, int *error)
 {
         int ssl_ret;
 
@@ -144,11 +153,11 @@ do_connect(SSL *ssl, const char *name, int *done)
                 return 1;
         }
 
-        return ssl_error(ssl, name, "connect", ssl_ret);
+        return ssl_error(ssl, name, "connect", ssl_ret, error);
 }
 
 static int
-do_accept(SSL *ssl, const char *name, int *done)
+do_accept(SSL *ssl, const char *name, int *done, int *error)
 {
         int ssl_ret;
 
@@ -158,11 +167,11 @@ do_accept(SSL *ssl, const char *name, int *done)
                 return 1;
         }
 
-        return ssl_error(ssl, name, "accept", ssl_ret);
+        return ssl_error(ssl, name, "accept", ssl_ret, error);
 }
 
 static int
-do_read(SSL *ssl, const char *name, int *done)
+do_read(SSL *ssl, const char *name, int *done, int *error)
 {
         uint8_t buf[512];
         int ssl_ret;
@@ -175,11 +184,11 @@ do_read(SSL *ssl, const char *name, int *done)
                 return 1;
         }
 
-        return ssl_error(ssl, name, "read", ssl_ret);
+        return ssl_error(ssl, name, "read", ssl_ret, error);
 }
 
 static int
-do_write(SSL *ssl, const char *name, int *done)
+do_write(SSL *ssl, const char *name, int *done, int *error)
 {
         const uint8_t buf[] = "Hello, World!\n";
         int ssl_ret;
@@ -190,11 +199,11 @@ do_write(SSL *ssl, const char *name, int *done)
                 return 1;
         }
 
-        return ssl_error(ssl, name, "write", ssl_ret);
+        return ssl_error(ssl, name, "write", ssl_ret, error);
 }
 
 static int
-do_shutdown(SSL *ssl, const char *name, int *done)
+do_shutdown(SSL *ssl, const char *name, int *done, int *error)
 {
         int ssl_ret;
 
@@ -204,10 +213,10 @@ do_shutdown(SSL *ssl, const char *name, int *done)
                 *done = 1;
                 return 1;
         }
-        return ssl_error(ssl, name, "shutdown", ssl_ret);
+        return ssl_error(ssl, name, "shutdown", ssl_ret, error);
 }
 
-typedef int (*ssl_func)(SSL *ssl, const char *name, int *done);
+typedef int (*ssl_func)(SSL *ssl, const char *name, int *done, int *error);
 
 static int
 do_client_server_loop(SSL *client, ssl_func client_func, SSL *server,
@@ -220,13 +229,15 @@ do_client_server_loop(SSL *client, ssl_func client_func, SSL *server,
                 if (!client_done) {
                         if (debug)
                                 fprintf(stderr, "DEBUG: client loop\n");
-                        if (!client_func(client, "client", &client_done))
+                        if (!client_func(client, "client", &client_done,
+                            &tls_client_error))
                                 return 0;
                 }
                 if (!server_done) {
                         if (debug)
                                 fprintf(stderr, "DEBUG: server loop\n");
-                        if (!server_func(server, "server", &server_done))
+                        if (!server_func(server, "server", &server_done,
+                            &tls_server_error))
                                 return 0;
                 }
         } while (i++ < 100 && (!client_done || !server_done));
@@ -245,8 +256,12 @@ struct tls_reneg_test {
         int renegotiate_client;
         int renegotiate_server;
         int client_ignored;
+        int client_disable_ri;
+        int server_disable_ri;
         int want_client_alert;
         int want_server_alert;
+        int want_client_connect_error;
+        int want_server_renegotiate_error;
         int want_failure;
 };
 
@@ -346,6 +361,38 @@ static const struct tls_reneg_test tls_reneg_tests[] = {
                 .want_failure = 1,
         },
         {
+                .desc = "TLSv1.2 - Server Renegotiation Indication disabled, "
+                    "client legacy connect",
+                .ssl_max_proto_version = TLS1_2_VERSION,
+                .ssl_client_options = SSL_OP_LEGACY_SERVER_CONNECT,
+                .server_disable_ri = 1,
+        },
+        {
+                .desc = "TLSv1.2 - Server Renegotiation Indication disabled, "
+                    "no client legacy connect",
+                .ssl_max_proto_version = TLS1_2_VERSION,
+                .server_disable_ri = 1,
+                .want_client_connect_error = SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED,
+        },
+        {
+                .desc = "TLSv1.2 - Server Renegotiation Indication disabled, "
+                    "client legacy connect, client renegotiates",
+                .ssl_max_proto_version = TLS1_2_VERSION,
+                .ssl_client_options = SSL_OP_LEGACY_SERVER_CONNECT,
+                .server_disable_ri = 1,
+                .renegotiate_client = 1,
+                .want_client_alert = SSL3_AL_WARNING << 8 | SSL_AD_NO_RENEGOTIATION,
+        },
+        {
+                .desc = "TLSv1.2 - Server Renegotiation Indication disabled, "
+                    "client legacy connect, server renegotiates",
+                .ssl_max_proto_version = TLS1_2_VERSION,
+                .ssl_client_options = SSL_OP_LEGACY_SERVER_CONNECT,
+                .server_disable_ri = 1,
+                .renegotiate_server = 1,
+                .want_server_renegotiate_error = SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED,
+        },
+        {
                 .desc = "TLSv1.3 - No renegotiation supported, no renegotiation",
                 .ssl_max_proto_version = TLS1_3_VERSION,
         },
@@ -376,6 +423,11 @@ tls_client_info_callback(const SSL *ssl, int where, int value)
                     SSL_alert_desc_string_long(value));
                 tls_client_alert = value;
         }
+
+        if (tls_client_disable_ri) {
+                ssl->s3->renegotiate_seen = 0;
+                ssl->s3->send_connection_binding = 0;
+        }
 }
 
 static void
@@ -387,6 +439,11 @@ tls_server_info_callback(const SSL *ssl, int where, int value)
                     SSL_alert_desc_string_long(value));
                 tls_server_alert = value;
         }
+
+        if (tls_server_disable_ri) {
+                ssl->s3->renegotiate_seen = 0;
+                ssl->s3->send_connection_binding = 0;
+        }
 }
 
 static int
@@ -445,6 +502,8 @@ tls_reneg_test(const struct tls_reneg_test *trt)
         if ((client = tls_client(server_wbio, client_wbio)) == NULL)
                 goto failure;
 
+        SSL_clear_options(client, SSL_OP_LEGACY_SERVER_CONNECT);
+
         SSL_set_options(client, trt->ssl_client_options);
         SSL_set_info_callback(client, tls_client_info_callback);
 
@@ -458,13 +517,33 @@ tls_reneg_test(const struct tls_reneg_test *trt)
                 goto failure;
 
         tls_client_alert = 0;
+        tls_client_error = 0;
+
         tls_server_alert = 0;
+        tls_server_error = 0;
+
+        tls_client_disable_ri = trt->client_disable_ri;
+        tls_server_disable_ri = trt->server_disable_ri;
 
         if (!do_client_server_loop(client, do_connect, server, do_accept)) {
+                if (trt->want_client_connect_error != 0) {
+                        if (ERR_GET_REASON(tls_client_error) != trt->want_client_connect_error) {
+                                fprintf(stderr, "FAIL: got client error 0x%x, want "
+                                    "error 0x%x\n", ERR_GET_REASON(tls_client_error),
+                                    trt->want_client_connect_error);
+                                goto failure;
+                        }
+                        goto done;
+                }
                 fprintf(stderr, "FAIL: client and server handshake failed\n");
                 goto failure;
         }
 
+        if (trt->want_client_connect_error != 0) {
+                fprintf(stderr, "FAIL: handshake should have failed\n");
+                goto failure;
+        }
+
         if (!do_client_server_loop(client, do_write, server, do_read)) {
                 fprintf(stderr, "FAIL: client write and server read failed\n");
                 goto failure;
@@ -500,7 +579,16 @@ tls_reneg_test(const struct tls_reneg_test *trt)
                         goto failure;
 
                 if (!do_client_server_loop(client, do_read, server, do_write)) {
-                        fprintf(stderr, "FAIL: client read and server write failed\n");
+                        if (trt->want_server_renegotiate_error != 0) {
+                                if (ERR_GET_REASON(tls_server_error) != trt->want_server_renegotiate_error) {
+                                        fprintf(stderr, "FAIL: got server error 0x%x, want "
+                                            "error 0x%x\n", ERR_GET_REASON(tls_server_error),
+                                            trt->want_server_renegotiate_error);
+                                        goto failure;
+                                }
+                                goto done;
+                        }
+                        fprintf(stderr, "FAIL: client write and server read failed\n");
                         goto failure;
                 }
 
diff --git a/src/regress/lib/libssl/ssl/ssltest.c b/src/regress/lib/libssl/ssl/ssltest.c
index 27adeeaf17..3bc5f99617 100644
--- a/src/regress/lib/libssl/ssl/ssltest.c
+++ b/src/regress/lib/libssl/ssl/ssltest.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: ssltest.c,v 1.45 2024/03/01 03:45:16 tb Exp $ */
+/*      $OpenBSD: ssltest.c,v 1.46 2026/08/30 12:19:37 kenjiro Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -759,11 +759,9 @@ end:
         SSL_CTX_free(c_ctx);
         BIO_free(bio_stdout);
 
-        CRYPTO_cleanup_all_ex_data();
-        ERR_free_strings();
-        ERR_remove_thread_state(NULL);
-        EVP_cleanup();
         BIO_free(bio_err);
+        ERR_remove_thread_state(NULL);
+        OPENSSL_cleanup();
 
         exit(ret);
         return ret;
diff --git a/src/regress/lib/libssl/tlsext/tlsexttest.c b/src/regress/lib/libssl/tlsext/tlsexttest.c
index 9c4c0f55a1..29b348154f 100644
--- a/src/regress/lib/libssl/tlsext/tlsexttest.c
+++ b/src/regress/lib/libssl/tlsext/tlsexttest.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: tlsexttest.c,v 1.97 2026/04/03 07:37:52 jsing Exp $ */
+/* $OpenBSD: tlsexttest.c,v 1.98 2026/08/29 05:12:47 tb Exp $ */
 /*
  * Copyright (c) 2017 Joel Sing <jsing@openbsd.org>
  * Copyright (c) 2017 Doug Hogan <doug@openbsd.org>
@@ -153,6 +153,14 @@ const uint8_t tlsext_alpn_single_proto[] = {
         0x68, 0x74, 0x74, 0x70, 0x2f, 0x31, 0x2e, 0x31
 };
 
+const uint8_t tlsext_alpn_single_proto_unadvertised[] = {
+        /* ProtocolName protocol_name_list<2..2^16-1> -- ALPN names */
+        0x00, 0x09, /* len of all names */
+        /* opaque ProtocolName<1..2^8-1> -- 'http/1.2' */
+        0x08, /* len */
+        0x68, 0x74, 0x74, 0x70, 0x2f, 0x31, 0x2e, 0x32
+};
+
 #define TLSEXT_TYPE_alpn TLSEXT_TYPE_application_layer_protocol_negotiation
 
 static int
@@ -334,6 +342,21 @@ test_tlsext_alpn_client(void)
                 goto err;
         }
 
+        /* Make sure we don't accept a protocol we did not advertise. */
+
+        CBS_init(&cbs, tlsext_alpn_single_proto_unadvertised,
+            sizeof(tlsext_alpn_single_proto_unadvertised));
+
+        if (client_funcs->process(ssl, SSL_TLSEXT_MSG_SH, &cbs, &alert)) {
+                FAIL("failed to reject unadvertised ALPN protocol\n");
+                goto err;
+        }
+        if (alert != SSL_AD_ILLEGAL_PARAMETER) {
+                FAIL("unadvertised ALPN: want illegal_parameter, got %s\n",
+                    SSL_alert_desc_string_long(alert));
+                goto err;
+        }
+
         /* Make sure we can remove the list and avoid ALPN */
 
         free(ssl->alpn_client_proto_list);
diff --git a/src/regress/lib/libssl/tlsfuzzer/tlsfuzzer.py b/src/regress/lib/libssl/tlsfuzzer/tlsfuzzer.py
index ff678ec9a8..a4d8746556 100644
--- a/src/regress/lib/libssl/tlsfuzzer/tlsfuzzer.py
+++ b/src/regress/lib/libssl/tlsfuzzer/tlsfuzzer.py
@@ -1,4 +1,4 @@
-#   $OpenBSD: tlsfuzzer.py,v 1.57 2025/06/15 09:44:57 tb Exp $
+#   $OpenBSD: tlsfuzzer.py,v 1.63 2026/07/28 10:32:37 tb Exp $
 #
 # Copyright (c) 2020 Theo Buehler <tb@openbsd.org>
 #
@@ -32,7 +32,15 @@ class Test:
 
     XXX Add client cert support.
     """
-    def __init__(self, name="", args=[], tls12_args=[], tls13_args=[]):
+
+    def __init__(self, name="", args=None, tls12_args=None, tls13_args=None):
+        if args is None:
+            args = []
+        if tls12_args is None:
+            tls12_args = []
+        if tls13_args is None:
+            tls13_args = []
+
         self.name = name
         self.tls12_args = args
         self.tls13_args = args
@@ -48,13 +56,15 @@ class Test:
             return self.tls12_args
 
     def __repr__(self):
-        return "<Test: %s tls12_args: %s tls13_args: %s>" % (
-                self.name, self.tls12_args, self.tls13_args
-            )
+        return f"<Test: {self.name} tls12_args: {self.tls12_args} tls13_args: {self.tls13_args}>"
 
 class TestGroup:
-    """ A group of Test objects to be run by TestRunner."""
-    def __init__(self, title="Tests", tests=[]):
+    """A group of Test objects to be run by TestRunner."""
+
+    def __init__(self, title="Tests", tests=None):
+        if tests is None:
+            tests = []
+
         self.title = title
         self.tests = tests
 
@@ -77,7 +87,7 @@ def substitute_alert(want, got):
 # Both alerts appear to be reasonable in this context, so work around this
 # in the test instead of the library.
 def generate_test_tls13_finished_args():
-    assertion = substitute_alert("decode_error", "decrypt_error");
+    assertion = substitute_alert("decode_error", "decrypt_error")
     paddings = [
         ("TLS_AES_128_GCM_SHA256", 0, 1),
         ("TLS_AES_128_GCM_SHA256", 0, 2),
@@ -649,11 +659,11 @@ failing_groups = [
 ]
 
 class TestRunner:
-    """ Runs the given tests against a server and displays stats. """
+    """Runs the given tests against a server and displays stats."""
 
     def __init__(
         self, timing=False, verbose=False, host="localhost", port=4433,
-        use_tls1_3=True, dry_run=False, tests=[], scriptdir=tlsfuzzer_scriptdir,
+        use_tls1_3=True, dry_run=False, scriptdir=tlsfuzzer_scriptdir,
     ):
         self.tests = []
 
@@ -670,8 +680,9 @@ class TestRunner:
         self.timing = timing
         self.verbose = verbose
 
-    def add(self, title="tests", tests=[]):
-        # tests.sort(key=lambda test: test.name)
+    def add(self, title="tests", tests=None):
+        if tests is None:
+            tests = []
         self.tests.append(TestGroup(title, tests))
 
     def add_group(self, group):
@@ -743,7 +754,7 @@ class TestRunner:
             print('\n'.join(self.missing))
 
 class TlsServer:
-    """ Spawns an s_server listening on localhost:port if necessary. """
+    """Spawns an s_server listening on localhost:port if necessary."""
 
     def __init__(self, host="localhost", port=4433):
         self.spawn = True
@@ -821,11 +832,11 @@ def list_or_missing(missing=True):
         missing = scripts - set(tests)
         if missing:
             print('\n'.join(sorted(missing)))
-        exit(0)
+        sys.exit(0)
 
     tests.sort()
     print('\n'.join(tests))
-    exit(0)
+    sys.exit(0)
 
 def usage():
     print("Usage: python3 tlsfuzzer.py [-flmnstv] [-p port] [script [test...]]")
@@ -838,7 +849,7 @@ def usage():
     print(" -s          run slow tests")
     print(" -t          show timing stats at end")
     print(" -v          verbose output")
-    exit(0)
+    sys.exit(0)
 
 def main():
     failing = False
@@ -879,13 +890,13 @@ def main():
 
     if not os.path.exists(tlsfuzzer_scriptdir):
         print("package py3-tlsfuzzer is required for this regress")
-        exit(1)
+        sys.exit(1)
 
     if list and failing:
         failing = [test.name for group in failing_groups for test in group]
         failing.sort()
         print('\n'.join(failing))
-        exit(0)
+        sys.exit(0)
 
     if list or missing:
         list_or_missing(missing)
@@ -896,7 +907,7 @@ def main():
 
     if args:
         (dir, script) = os.path.split(args[0])
-        if dir and not dir == '.':
+        if dir and dir != '.':
             tests.scriptdir = dir
 
         testargs = defaultargs(script, tls_server.has_tls1_3)
@@ -904,7 +915,7 @@ def main():
         tests.verbose = True
         tests.add("test from command line", [Test(script, testargs + args[1:])])
 
-        exit(not tests.run())
+        sys.exit(not tests.run())
 
     if failing:
         if tls_server.has_tls1_3:
@@ -929,7 +940,7 @@ def main():
 
     if not success:
         print("FAILED")
-        exit(1)
+        sys.exit(1)
 
 if __name__ == "__main__":
     main()
diff --git a/src/regress/lib/libssl/unit/Makefile b/src/regress/lib/libssl/unit/Makefile
index edc0d910c4..81b234b7ac 100644
--- a/src/regress/lib/libssl/unit/Makefile
+++ b/src/regress/lib/libssl/unit/Makefile
@@ -1,7 +1,8 @@
-#       $OpenBSD: Makefile,v 1.17 2025/10/24 11:44:08 tb Exp $
+#       $OpenBSD: Makefile,v 1.19 2026/06/08 11:53:51 tb Exp $
 
 PROGS += cipher_list
 PROGS += ssl_get_shared_ciphers
+PROGS += ssl_kex
 PROGS += ssl_methods
 PROGS += ssl_set_alpn_protos
 PROGS += ssl_verify_param
diff --git a/src/regress/lib/libssl/unit/ssl_kex.c b/src/regress/lib/libssl/unit/ssl_kex.c
new file mode 100644
index 0000000000..4050d04bd5
--- /dev/null
+++ b/src/regress/lib/libssl/unit/ssl_kex.c
@@ -0,0 +1,212 @@
+/*      $OpenBSD: ssl_kex.c,v 1.4 2026/06/09 05:20:38 tb Exp $ */
+
+/*
+ * Copyright (c) 2026 Theo Buehler <tb@openbsd.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <err.h>
+#include <stdio.h>
+
+#include <openssl/ec.h>
+#include <openssl/objects.h>
+
+#include "bytestring.h"
+#include "ssl_local.h"
+
+static const uint8_t point_at_infinity[] = {
+        0x00,
+};
+static const size_t point_at_infinity_len = sizeof(point_at_infinity);
+
+static const uint8_t secp384r1_uncompressed_point[] = {
+        0x04, 0xca, 0x0e, 0xc0, 0x60, 0xce, 0x24, 0x25,
+        0xa7, 0x6e, 0xd1, 0x96, 0x69, 0x33, 0x36, 0x04,
+        0x87, 0x69, 0x36, 0xfd, 0x2a, 0x83, 0x7a, 0x99,
+        0xad, 0xb7, 0x35, 0xe9, 0x4c, 0x2f, 0x56, 0xfc,
+        0xee, 0x7e, 0x68, 0x43, 0x90, 0x41, 0xb7, 0x3c,
+        0x64, 0xd4, 0xec, 0x82, 0xc1, 0xc6, 0xd9, 0x4b,
+        0x7d, 0xfa, 0xaa, 0x43, 0x46, 0x19, 0x94, 0x7f,
+        0xb4, 0xe2, 0xa7, 0xbd, 0x75, 0xaf, 0x4d, 0x8f,
+        0x45, 0xed, 0x3a, 0x8f, 0xef, 0x93, 0x57, 0x50,
+        0x3f, 0x24, 0xf4, 0xa8, 0x68, 0x22, 0xf8, 0xa3,
+        0x8c, 0xa9, 0x8b, 0xe8, 0xb9, 0x28, 0xff, 0x9f,
+        0xcf, 0xcd, 0xac, 0xc1, 0x20, 0x5f, 0x23, 0x07,
+        0x40,
+};
+static const size_t secp384r1_uncompressed_point_len =
+    sizeof(secp384r1_uncompressed_point);
+
+static const uint8_t secp384r1_compressed_point[] = {
+        0x02, 0xca, 0x0e, 0xc0, 0x60, 0xce, 0x24, 0x25,
+        0xa7, 0x6e, 0xd1, 0x96, 0x69, 0x33, 0x36, 0x04,
+        0x87, 0x69, 0x36, 0xfd, 0x2a, 0x83, 0x7a, 0x99,
+        0xad, 0xb7, 0x35, 0xe9, 0x4c, 0x2f, 0x56, 0xfc,
+        0xee, 0x7e, 0x68, 0x43, 0x90, 0x41, 0xb7, 0x3c,
+        0x64, 0xd4, 0xec, 0x82, 0xc1, 0xc6, 0xd9, 0x4b,
+        0x7d,
+};
+static const size_t secp384r1_compressed_point_len =
+    sizeof(secp384r1_compressed_point);
+
+static const uint8_t secp384r1_hybrid_point[] = {
+        0x06, 0xca, 0x0e, 0xc0, 0x60, 0xce, 0x24, 0x25,
+        0xa7, 0x6e, 0xd1, 0x96, 0x69, 0x33, 0x36, 0x04,
+        0x87, 0x69, 0x36, 0xfd, 0x2a, 0x83, 0x7a, 0x99,
+        0xad, 0xb7, 0x35, 0xe9, 0x4c, 0x2f, 0x56, 0xfc,
+        0xee, 0x7e, 0x68, 0x43, 0x90, 0x41, 0xb7, 0x3c,
+        0x64, 0xd4, 0xec, 0x82, 0xc1, 0xc6, 0xd9, 0x4b,
+        0x7d, 0xfa, 0xaa, 0x43, 0x46, 0x19, 0x94, 0x7f,
+        0xb4, 0xe2, 0xa7, 0xbd, 0x75, 0xaf, 0x4d, 0x8f,
+        0x45, 0xed, 0x3a, 0x8f, 0xef, 0x93, 0x57, 0x50,
+        0x3f, 0x24, 0xf4, 0xa8, 0x68, 0x22, 0xf8, 0xa3,
+        0x8c, 0xa9, 0x8b, 0xe8, 0xb9, 0x28, 0xff, 0x9f,
+        0xcf, 0xcd, 0xac, 0xc1, 0x20, 0x5f, 0x23, 0x07,
+        0x40,
+};
+static const size_t secp384r1_hybrid_point_len = sizeof(secp384r1_hybrid_point);
+
+static const uint8_t secp384r1_invalid_point[] = {
+        0x04, 0xca, 0x0e, 0xc0, 0x60, 0xce, 0x24, 0x25,
+        0xa7, 0x6e, 0xd1, 0x96, 0x69, 0x33, 0x36, 0x04,
+        0x87, 0x69, 0x36, 0xfd, 0x2a, 0x83, 0x7a, 0x99,
+        0xad, 0xb7, 0x35, 0xe9, 0x4c, 0x2f, 0x56, 0xfc,
+        0xee, 0x7e, 0x68, 0x43, 0x90, 0x41, 0xb7, 0x3c,
+        0x64, 0xd4, 0xec, 0x82, 0xc1, 0xc6, 0xd9, 0x4b,
+        0x7d, 0xfa, 0xaa, 0x43, 0x46, 0x19, 0x94, 0x7f,
+        0xb4, 0xe2, 0xa7, 0xbd, 0x75, 0xaf, 0x4d, 0x8f,
+        0x45, 0xed, 0x3a, 0x8f, 0xef, 0x93, 0x57, 0x50,
+        0x3f, 0x24, 0xf4, 0xa8, 0x68, 0x22, 0xf8, 0xa3,
+        0x8c, 0xa9, 0x8b, 0xe8, 0xb9, 0x28, 0xff, 0x9f,
+        0xcf, 0xcd, 0xac, 0xc1, 0x20, 0x5f, 0x23, 0x07,
+        0x41,
+};
+static const size_t secp384r1_invalid_point_len = sizeof(secp384r1_invalid_point);
+
+static int
+ssl_key_share_ecdhe_test(void)
+{
+        EC_KEY *ecdh = NULL, *ecdh_peer = NULL;
+        uint8_t *shared_key = NULL;
+        size_t shared_key_len = 0;
+        CBS cbs;
+        int nid = NID_secp384r1;
+        int decode_error = 0;
+        int failed = 0;
+
+        if ((ecdh = EC_KEY_new()) == NULL)
+                err(1, NULL);
+
+        if (!ssl_kex_generate_ecdhe_ecp(ecdh, nid)) {
+                fprintf(stderr, "FAIL: failed to generate P-384 key\n");
+                failed |= 1;
+        }
+
+        decode_error = 0;
+        CBS_init(&cbs, secp384r1_uncompressed_point, secp384r1_uncompressed_point_len);
+        if ((ecdh_peer = EC_KEY_new()) == NULL)
+                err(1, NULL);
+        if (!ssl_kex_peer_public_ecdhe_ecp(ecdh_peer, nid, &cbs, &decode_error)) {
+                fprintf(stderr, "FAIL: failed to parse uncompressed P-384 point\n");
+                failed |= 1;
+        }
+
+        if (!ssl_kex_derive_ecdhe_ecp(ecdh, ecdh_peer, &shared_key, &shared_key_len)) {
+                fprintf(stderr, "FAIL: failed to derive shared P-384 key\n");
+                failed |= 1;
+        }
+
+        EC_KEY_free(ecdh_peer);
+        ecdh_peer = NULL;
+
+        decode_error = 0;
+        CBS_init(&cbs, point_at_infinity, point_at_infinity_len);
+        if ((ecdh_peer = EC_KEY_new()) == NULL)
+                err(1, NULL);
+        if (ssl_kex_peer_public_ecdhe_ecp(ecdh_peer, nid, &cbs, &decode_error)) {
+                fprintf(stderr, "FAIL: parsed point at infinity\n");
+                failed |= 1;
+        }
+        if (!decode_error) {
+                fprintf(stderr, "FAIL: no decode_error for point at infinity\n");
+                failed |= 1;
+        }
+
+        EC_KEY_free(ecdh_peer);
+        ecdh_peer = NULL;
+
+        decode_error = 0;
+        CBS_init(&cbs, secp384r1_compressed_point, secp384r1_compressed_point_len);
+        if ((ecdh_peer = EC_KEY_new()) == NULL)
+                err(1, NULL);
+        if (ssl_kex_peer_public_ecdhe_ecp(ecdh_peer, nid, &cbs, &decode_error)) {
+                fprintf(stderr, "FAIL: parsed compressed P-384 point\n");
+                failed |= 1;
+        }
+        if (!decode_error) {
+                fprintf(stderr, "FAIL: no decode_error for compressed P-384 point\n");
+                failed |= 1;
+        }
+
+        EC_KEY_free(ecdh_peer);
+        ecdh_peer = NULL;
+
+        decode_error = 0;
+        CBS_init(&cbs, secp384r1_hybrid_point, secp384r1_hybrid_point_len);
+        if ((ecdh_peer = EC_KEY_new()) == NULL)
+                err(1, NULL);
+        if (ssl_kex_peer_public_ecdhe_ecp(ecdh_peer, nid, &cbs, &decode_error)) {
+                fprintf(stderr, "FAIL: parsed hybrid P-384 point\n");
+                failed |= 1;
+        }
+        if (!decode_error) {
+                fprintf(stderr, "FAIL: no decode_error for hybrid P-384 point\n");
+                failed |= 1;
+        }
+
+        EC_KEY_free(ecdh_peer);
+        ecdh_peer = NULL;
+
+        decode_error = 0;
+        CBS_init(&cbs, secp384r1_invalid_point, secp384r1_invalid_point_len);
+        if ((ecdh_peer = EC_KEY_new()) == NULL)
+                err(1, NULL);
+        if (ssl_kex_peer_public_ecdhe_ecp(ecdh_peer, nid, &cbs, &decode_error)) {
+                fprintf(stderr, "FAIL: parsed invalid P-384 point\n");
+                failed |= 1;
+        }
+        if (!decode_error) {
+                fprintf(stderr, "FAIL: no decode_error for invalid P-384 point\n");
+                failed |= 1;
+        }
+
+        EC_KEY_free(ecdh_peer);
+        ecdh_peer = NULL;
+
+        EC_KEY_free(ecdh);
+        freezero(shared_key, shared_key_len);
+
+        return failed;
+}
+
+int
+main(void)
+{
+        int failed = 0;
+
+        /* XXX - add DHE and X25519. */
+        failed |= ssl_key_share_ecdhe_test();
+
+        return failed;
+}
diff --git a/src/regress/lib/libtls/verify/verifytest.c b/src/regress/lib/libtls/verify/verifytest.c
index 57aa992149..72b8e4fd83 100644
--- a/src/regress/lib/libtls/verify/verifytest.c
+++ b/src/regress/lib/libtls/verify/verifytest.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: verifytest.c,v 1.8 2023/05/28 09:02:01 beck Exp $     */
+/*      $OpenBSD: verifytest.c,v 1.10 2026/05/30 17:04:48 jsing Exp $   */
 /*
  * Copyright (c) 2014 Joel Sing <jsing@openbsd.org>
  *
@@ -125,6 +125,14 @@ struct verify_test verify_tests[] = {
                 .want_match = 0,
         },
         {
+                /* CN wildcard without SANs - invalid CN wildcard. */
+                .common_name = "*.org.",
+                .common_name_len = -1,
+                .name = "openbsd.org.",
+                .want_return = 0,
+                .want_match = 0,
+        },
+        {
                 /* CN IPv4 without SANs - matching. */
                 .common_name = "1.2.3.4",
                 .common_name_len = -1,
@@ -497,8 +505,9 @@ do_verify_test(int test_no, struct verify_test *vt)
                 goto done;
         }
         if (match != vt->want_match) {
-                fprintf(stderr, "FAIL: test %i failed to match name '%s'\n",
-                    test_no, vt->name);
+                fprintf(stderr, "FAIL: test %i %s name '%s'\n",
+                    test_no, vt->want_match ? "failed to match" : "matched",
+                    vt->name);
                 goto done;
         }
 
diff --git a/src/usr.bin/openssl/apps.c b/src/usr.bin/openssl/apps.c
index 46197dfd49..49ce7495bc 100644
--- a/src/usr.bin/openssl/apps.c
+++ b/src/usr.bin/openssl/apps.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: apps.c,v 1.72 2025/03/18 13:03:08 tb Exp $ */
+/* $OpenBSD: apps.c,v 1.73 2026/08/30 23:03:33 jsg Exp $ */
 /*
  * Copyright (c) 2014 Joel Sing <jsing@openbsd.org>
  *
@@ -490,7 +490,7 @@ load_pkcs12(BIO *err, BIO *in, const char *desc, pem_password_cb *pem_cb,
                         pem_cb = password_callback;
                 len = pem_cb(tpass, PEM_BUFSIZE, 0, cb_data);
                 if (len < 0) {
-                        BIO_printf(err, "Passpharse callback error for %s\n",
+                        BIO_printf(err, "Passphrase callback error for %s\n",
                             desc);
                         goto die;
                 }
diff --git a/src/usr.bin/openssl/ca.c b/src/usr.bin/openssl/ca.c
index a2e8a68368..763b57ced8 100644
--- a/src/usr.bin/openssl/ca.c
+++ b/src/usr.bin/openssl/ca.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ca.c,v 1.64 2025/12/21 07:14:47 tb Exp $ */
+/* $OpenBSD: ca.c,v 1.65 2026/08/30 23:03:33 jsg Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -114,7 +114,7 @@
 
 /* Additional revocation information types */
 
-#define REV_NONE                0       /* No addditional information */
+#define REV_NONE                0       /* No additional information */
 #define REV_CRL_REASON          1       /* Value is CRL reason code */
 #define REV_HOLD                2       /* Value is hold instruction */
 #define REV_KEY_COMPROMISE      3       /* Value is cert key compromise time */
@@ -397,7 +397,7 @@ static const struct option ca_options[] = {
         {
                 .name = "extfile",
                 .argname = "file",
-                .desc = "Configuration file with X509v3 extentions to add",
+                .desc = "Configuration file with X509v3 extensions to add",
                 .type = OPTION_ARG,
                 .opt.arg = &cfg.extfile,
         },
@@ -959,7 +959,7 @@ ca_main(int argc, char **argv)
                 }
         }
         /*****************************************************************/
-        /* Read extentions config file                                   */
+        /* Read extensions config file                                   */
         if (cfg.extfile != NULL) {
                 extconf = NCONF_new(NULL);
                 if (NCONF_load(extconf, cfg.extfile, &errorline) <= 0) {
diff --git a/src/usr.bin/openssl/crl.c b/src/usr.bin/openssl/crl.c
index e64038dfda..54314bee73 100644
--- a/src/usr.bin/openssl/crl.c
+++ b/src/usr.bin/openssl/crl.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: crl.c,v 1.17 2023/03/06 14:32:05 tb Exp $ */
+/* $OpenBSD: crl.c,v 1.18 2026/05/09 14:28:18 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -327,10 +327,11 @@ crl_main(int argc, char **argv)
                 EVP_PKEY_free(pkey);
                 if (i < 0)
                         goto end;
-                if (i == 0)
+                if (i == 0) {
                         BIO_printf(bio_err, "verify failure\n");
-                else
-                        BIO_printf(bio_err, "verify OK\n");
+                        goto end;
+                }
+                BIO_printf(bio_err, "verify OK\n");
         }
 
         /* Print requested information the order that the flags were given. */
diff --git a/src/usr.bin/openssl/ecparam.c b/src/usr.bin/openssl/ecparam.c
index 285f5d563e..a4bb00f290 100644
--- a/src/usr.bin/openssl/ecparam.c
+++ b/src/usr.bin/openssl/ecparam.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ecparam.c,v 1.25 2025/01/19 10:24:17 tb Exp $ */
+/* $OpenBSD: ecparam.c,v 1.26 2026/05/09 14:24:58 tb Exp $ */
 /*
  * Written by Nils Larsch for the OpenSSL project.
  */
@@ -386,8 +386,9 @@ ecparam_main(int argc, char **argv)
                 if (!EC_GROUP_check(group, NULL)) {
                         BIO_printf(bio_err, "failed\n");
                         ERR_print_errors(bio_err);
-                } else
-                        BIO_printf(bio_err, "ok\n");
+                        goto end;
+                }
+                BIO_printf(bio_err, "ok\n");
 
         }
         if (!cfg.noout) {
diff --git a/src/usr.bin/openssl/openssl.1 b/src/usr.bin/openssl/openssl.1
index 20a1d69053..21edd84683 100644
--- a/src/usr.bin/openssl/openssl.1
+++ b/src/usr.bin/openssl/openssl.1
@@ -1,4 +1,4 @@
-.\" $OpenBSD: openssl.1,v 1.170 2026/03/14 06:06:48 tb Exp $
+.\" $OpenBSD: openssl.1,v 1.171 2026/08/25 00:08:28 jsg Exp $
 .\" ====================================================================
 .\" Copyright (c) 1998-2002 The OpenSSL Project.  All rights reserved.
 .\"
@@ -110,7 +110,7 @@
 .\" copied and put under another distribution licence
 .\" [including the GNU Public Licence.]
 .\"
-.Dd $Mdocdate: March 14 2026 $
+.Dd $Mdocdate: August 25 2026 $
 .Dt OPENSSL 1
 .Os
 .Sh NAME
@@ -1146,7 +1146,7 @@ form where the content is not included.
 This option will override any content if the input format is S/MIME and
 it uses the multipart/signed MIME content type.
 .It Fl crlfeol
-Output a S/MIME message with CR/LF end of line.
+Output an S/MIME message with CR/LF end of line.
 .It Fl debug_decrypt
 Set the CMS_DEBUG_DECRYPT flag when decrypting.
 This option should be used with caution, since this can be used to disable
diff --git a/src/usr.bin/openssl/openssl.c b/src/usr.bin/openssl/openssl.c
index 056912a9ed..b9d63fa43a 100644
--- a/src/usr.bin/openssl/openssl.c
+++ b/src/usr.bin/openssl/openssl.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: openssl.c,v 1.41 2026/01/02 00:14:24 kenjiro Exp $ */
+/* $OpenBSD: openssl.c,v 1.42 2026/08/30 12:19:37 kenjiro Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -360,10 +360,6 @@ openssl_shutdown(void)
         CONF_modules_unload(1);
         destroy_ui();
         OBJ_cleanup();
-        EVP_cleanup();
-        CRYPTO_cleanup_all_ex_data();
-        ERR_remove_thread_state(NULL);
-        ERR_free_strings();
 }
 
 int
@@ -461,6 +457,9 @@ main(int argc, char **argv)
                 BIO_free(bio_err);
                 bio_err = NULL;
         }
+        ERR_remove_thread_state(NULL);
+        OPENSSL_cleanup();
+
         return (ret);
 }
 
diff --git a/src/usr.bin/openssl/s_cb.c b/src/usr.bin/openssl/s_cb.c
index fcb2cd3076..b7832ff7db 100644
--- a/src/usr.bin/openssl/s_cb.c
+++ b/src/usr.bin/openssl/s_cb.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: s_cb.c,v 1.22 2025/01/02 13:10:03 tb Exp $ */
+/* $OpenBSD: s_cb.c,v 1.23 2026/08/10 20:27:51 kenjiro Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -847,8 +847,12 @@ generate_cookie_callback(SSL * ssl, unsigned char *cookie,
         }
 
         /* Calculate HMAC of buffer using the secret */
-        HMAC(EVP_sha1(), cookie_secret, COOKIE_SECRET_LENGTH,
-            buffer, length, result, &resultlength);
+        if (HMAC(EVP_sha1(), cookie_secret, COOKIE_SECRET_LENGTH,
+            buffer, length, result, &resultlength) == NULL) {
+                free(buffer);
+                return 0;
+        }
+
         free(buffer);
 
         memcpy(cookie, result, resultlength);
diff --git a/src/usr.bin/openssl/s_client.c b/src/usr.bin/openssl/s_client.c
index 2b05facc17..b053159f41 100644
--- a/src/usr.bin/openssl/s_client.c
+++ b/src/usr.bin/openssl/s_client.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: s_client.c,v 1.68 2026/02/01 08:45:31 martijn Exp $ */
+/* $OpenBSD: s_client.c,v 1.70 2026/08/30 23:03:33 jsg Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -1314,7 +1314,9 @@ s_client_main(int argc, char **argv)
                 }
                 BIO_printf(sbio,
                     "<starttls xmlns='urn:ietf:params:xml:ns:xmpp-tls'/>");
-                seen = BIO_read(sbio, sbuf, BUFSIZZ);
+                seen = BIO_read(sbio, sbuf, BUFSIZZ - 1);
+                if (seen <= 0)
+                        goto shut;
                 sbuf[seen] = 0;
                 if (!strstr(sbuf, "<proceed"))
                         goto shut;
@@ -1413,7 +1415,7 @@ s_client_main(int argc, char **argv)
                 }
                 if (SSL_is_dtls(con) &&
                     DTLSv1_handle_timeout(con) > 0)
-                        BIO_printf(bio_err, "TIMEOUT occured\n");
+                        BIO_printf(bio_err, "TIMEOUT occurred\n");
                 if (!ssl_pending &&
                     (pfd[2].revents & (POLLOUT|POLLERR|POLLNVAL))) {
                         if (pfd[2].revents & (POLLERR|POLLNVAL)) {
diff --git a/src/usr.bin/openssl/s_server.c b/src/usr.bin/openssl/s_server.c
index f56042a4b4..3c9059c2c5 100644
--- a/src/usr.bin/openssl/s_server.c
+++ b/src/usr.bin/openssl/s_server.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: s_server.c,v 1.61 2025/01/02 13:10:03 tb Exp $ */
+/* $OpenBSD: s_server.c,v 1.62 2026/08/30 23:03:33 jsg Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -1583,7 +1583,7 @@ sv_body(int s, unsigned char *context)
 
                         if (SSL_is_dtls(con) &&
                             DTLSv1_handle_timeout(con) > 0)
-                                BIO_printf(bio_err, "TIMEOUT occured\n");
+                                BIO_printf(bio_err, "TIMEOUT occurred\n");
                         if (i <= 0)
                                 continue;
                         if (pfd[0].revents) {
diff --git a/src/usr.bin/openssl/s_socket.c b/src/usr.bin/openssl/s_socket.c
index 86a23c56d1..a479eac06a 100644
--- a/src/usr.bin/openssl/s_socket.c
+++ b/src/usr.bin/openssl/s_socket.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: s_socket.c,v 1.14 2025/01/02 13:10:03 tb Exp $ */
+/* $OpenBSD: s_socket.c,v 1.15 2026/05/10 03:26:07 kenjiro Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -260,15 +260,8 @@ do_accept(int acc_sock, int *sock)
                 h2 = gethostbyname(host);
                 if (h2 == NULL) {
                         BIO_printf(bio_err, "gethostbyname failure\n");
-                        close(ret);
-                        free(host);
-                        return (0);
-                }
-                if (h2->h_addrtype != AF_INET) {
+                } else if (h2->h_addrtype != AF_INET) {
                         BIO_printf(bio_err, "gethostbyname addr is not AF_INET\n");
-                        close(ret);
-                        free(host);
-                        return (0);
                 }
         }
 
diff --git a/src/usr.bin/openssl/speed.c b/src/usr.bin/openssl/speed.c
index 760841d95f..142eb9bab0 100644
--- a/src/usr.bin/openssl/speed.c
+++ b/src/usr.bin/openssl/speed.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: speed.c,v 1.52 2026/03/19 20:28:46 tb Exp $ */
+/* $OpenBSD: speed.c,v 1.53 2026/05/05 03:32:46 kenjiro Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -156,6 +156,8 @@ static void
 pkey_print_message(const char *str, const char *str2,
     int bits, int sec);
 static void print_result(int alg, int run_no, int count, double time_used);
+static void speed_timer_start(int s);
+static double speed_timer_stop(int s);
 static int do_multi(int multi);
 
 #define SIZE_NUM        5
@@ -983,9 +985,6 @@ sig_done(int sig)
         run = 0;
 }
 
-#define START   TM_RESET
-#define STOP    TM_GET
-
 static double
 time_f(int s)
 {
@@ -995,6 +994,20 @@ time_f(int s)
         return app_timer_real(s);
 }
 
+static void
+speed_timer_start(int s)
+{
+        run = 1;
+        alarm(s);
+        time_f(TM_RESET);
+}
+
+static double
+speed_timer_stop(int s)
+{
+        return time_f(s);
+}
+
 static const int KDF1_SHA1_len = 20;
 static void *
 KDF1_SHA1(const void *in, size_t inlen, void *out, size_t * outlen)
@@ -1617,10 +1630,10 @@ speed_main(int argc, char **argv)
         if (doit[D_MD4]) {
                 for (j = 0; j < SIZE_NUM; j++) {
                         print_message(names[D_MD4], lengths[j]);
-                        time_f(START);
-                        for (count = 0, run = 1; COND; count++)
+                        speed_timer_start(SECONDS);
+                        for (count = 0; COND; count++)
                                 EVP_Digest(&(buf[0]), (unsigned long) lengths[j], md, NULL, EVP_md4(), NULL);
-                        d = time_f(STOP);
+                        d = speed_timer_stop(SECONDS);
                         print_result(D_MD4, j, count, d);
                 }
         }
@@ -1630,10 +1643,10 @@ speed_main(int argc, char **argv)
         if (doit[D_MD5]) {
                 for (j = 0; j < SIZE_NUM; j++) {
                         print_message(names[D_MD5], lengths[j]);
-                        time_f(START);
-                        for (count = 0, run = 1; COND; count++)
+                        speed_timer_start(SECONDS);
+                        for (count = 0; COND; count++)
                                 EVP_Digest(&(buf[0]), (unsigned long) lengths[j], md, NULL, EVP_get_digestbyname("md5"), NULL);
-                        d = time_f(STOP);
+                        d = speed_timer_stop(SECONDS);
                         print_result(D_MD5, j, count, d);
                 }
         }
@@ -1653,8 +1666,8 @@ speed_main(int argc, char **argv)
 
                 for (j = 0; j < SIZE_NUM; j++) {
                         print_message(names[D_HMAC], lengths[j]);
-                        time_f(START);
-                        for (count = 0, run = 1; COND; count++) {
+                        speed_timer_start(SECONDS);
+                        for (count = 0; COND; count++) {
                                 if (!HMAC_Init_ex(hctx, NULL, 0, NULL, NULL)) {
                                         HMAC_CTX_free(hctx);
                                         goto end;
@@ -1668,7 +1681,7 @@ speed_main(int argc, char **argv)
                                         goto end;
                                 }
                         }
-                        d = time_f(STOP);
+                        d = speed_timer_stop(SECONDS);
                         print_result(D_HMAC, j, count, d);
                 }
                 HMAC_CTX_free(hctx);
@@ -1678,10 +1691,10 @@ speed_main(int argc, char **argv)
         if (doit[D_SHA1]) {
                 for (j = 0; j < SIZE_NUM; j++) {
                         print_message(names[D_SHA1], lengths[j]);
-                        time_f(START);
-                        for (count = 0, run = 1; COND; count++)
+                        speed_timer_start(SECONDS);
+                        for (count = 0; COND; count++)
                                 EVP_Digest(buf, (unsigned long) lengths[j], md, NULL, EVP_sha1(), NULL);
-                        d = time_f(STOP);
+                        d = speed_timer_stop(SECONDS);
                         print_result(D_SHA1, j, count, d);
                 }
         }
@@ -1689,10 +1702,10 @@ speed_main(int argc, char **argv)
         if (doit[D_SHA256]) {
                 for (j = 0; j < SIZE_NUM; j++) {
                         print_message(names[D_SHA256], lengths[j]);
-                        time_f(START);
-                        for (count = 0, run = 1; COND; count++)
+                        speed_timer_start(SECONDS);
+                        for (count = 0; COND; count++)
                                 SHA256(buf, lengths[j], md);
-                        d = time_f(STOP);
+                        d = speed_timer_stop(SECONDS);
                         print_result(D_SHA256, j, count, d);
                 }
         }
@@ -1702,10 +1715,10 @@ speed_main(int argc, char **argv)
         if (doit[D_SHA512]) {
                 for (j = 0; j < SIZE_NUM; j++) {
                         print_message(names[D_SHA512], lengths[j]);
-                        time_f(START);
-                        for (count = 0, run = 1; COND; count++)
+                        speed_timer_start(SECONDS);
+                        for (count = 0; COND; count++)
                                 SHA512(buf, lengths[j], md);
-                        d = time_f(STOP);
+                        d = speed_timer_stop(SECONDS);
                         print_result(D_SHA512, j, count, d);
                 }
         }
@@ -1716,10 +1729,10 @@ speed_main(int argc, char **argv)
         if (doit[D_RMD160]) {
                 for (j = 0; j < SIZE_NUM; j++) {
                         print_message(names[D_RMD160], lengths[j]);
-                        time_f(START);
-                        for (count = 0, run = 1; COND; count++)
+                        speed_timer_start(SECONDS);
+                        for (count = 0; COND; count++)
                                 EVP_Digest(buf, (unsigned long) lengths[j], md, NULL, EVP_ripemd160(), NULL);
-                        d = time_f(STOP);
+                        d = speed_timer_stop(SECONDS);
                         print_result(D_RMD160, j, count, d);
                 }
         }
@@ -1728,11 +1741,11 @@ speed_main(int argc, char **argv)
         if (doit[D_RC4]) {
                 for (j = 0; j < SIZE_NUM; j++) {
                         print_message(names[D_RC4], lengths[j]);
-                        time_f(START);
-                        for (count = 0, run = 1; COND; count++)
+                        speed_timer_start(SECONDS);
+                        for (count = 0; COND; count++)
                                 RC4(&rc4_ks, (unsigned int) lengths[j],
                                     buf, buf);
-                        d = time_f(STOP);
+                        d = speed_timer_stop(SECONDS);
                         print_result(D_RC4, j, count, d);
                 }
         }
@@ -1741,23 +1754,23 @@ speed_main(int argc, char **argv)
         if (doit[D_CBC_DES]) {
                 for (j = 0; j < SIZE_NUM; j++) {
                         print_message(names[D_CBC_DES], lengths[j]);
-                        time_f(START);
-                        for (count = 0, run = 1; COND; count++)
+                        speed_timer_start(SECONDS);
+                        for (count = 0; COND; count++)
                                 DES_ncbc_encrypt(buf, buf, lengths[j], &sch,
                                     &DES_iv, DES_ENCRYPT);
-                        d = time_f(STOP);
+                        d = speed_timer_stop(SECONDS);
                         print_result(D_CBC_DES, j, count, d);
                 }
         }
         if (doit[D_EDE3_DES]) {
                 for (j = 0; j < SIZE_NUM; j++) {
                         print_message(names[D_EDE3_DES], lengths[j]);
-                        time_f(START);
-                        for (count = 0, run = 1; COND; count++)
+                        speed_timer_start(SECONDS);
+                        for (count = 0; COND; count++)
                                 DES_ede3_cbc_encrypt(buf, buf, lengths[j],
                                     &sch, &sch2, &sch3,
                                     &DES_iv, DES_ENCRYPT);
-                        d = time_f(STOP);
+                        d = speed_timer_stop(SECONDS);
                         print_result(D_EDE3_DES, j, count, d);
                 }
         }
@@ -1766,72 +1779,72 @@ speed_main(int argc, char **argv)
         if (doit[D_CBC_128_AES]) {
                 for (j = 0; j < SIZE_NUM; j++) {
                         print_message(names[D_CBC_128_AES], lengths[j]);
-                        time_f(START);
-                        for (count = 0, run = 1; COND; count++)
+                        speed_timer_start(SECONDS);
+                        for (count = 0; COND; count++)
                                 AES_cbc_encrypt(buf, buf,
                                     (unsigned long) lengths[j], &aes_ks1,
                                     iv, AES_ENCRYPT);
-                        d = time_f(STOP);
+                        d = speed_timer_stop(SECONDS);
                         print_result(D_CBC_128_AES, j, count, d);
                 }
         }
         if (doit[D_CBC_192_AES]) {
                 for (j = 0; j < SIZE_NUM; j++) {
                         print_message(names[D_CBC_192_AES], lengths[j]);
-                        time_f(START);
-                        for (count = 0, run = 1; COND; count++)
+                        speed_timer_start(SECONDS);
+                        for (count = 0; COND; count++)
                                 AES_cbc_encrypt(buf, buf,
                                     (unsigned long) lengths[j], &aes_ks2,
                                     iv, AES_ENCRYPT);
-                        d = time_f(STOP);
+                        d = speed_timer_stop(SECONDS);
                         print_result(D_CBC_192_AES, j, count, d);
                 }
         }
         if (doit[D_CBC_256_AES]) {
                 for (j = 0; j < SIZE_NUM; j++) {
                         print_message(names[D_CBC_256_AES], lengths[j]);
-                        time_f(START);
-                        for (count = 0, run = 1; COND; count++)
+                        speed_timer_start(SECONDS);
+                        for (count = 0; COND; count++)
                                 AES_cbc_encrypt(buf, buf,
                                     (unsigned long) lengths[j], &aes_ks3,
                                     iv, AES_ENCRYPT);
-                        d = time_f(STOP);
+                        d = speed_timer_stop(SECONDS);
                         print_result(D_CBC_256_AES, j, count, d);
                 }
         }
         if (doit[D_IGE_128_AES]) {
                 for (j = 0; j < SIZE_NUM; j++) {
                         print_message(names[D_IGE_128_AES], lengths[j]);
-                        time_f(START);
-                        for (count = 0, run = 1; COND; count++)
+                        speed_timer_start(SECONDS);
+                        for (count = 0; COND; count++)
                                 AES_ige_encrypt(buf, buf2,
                                     (unsigned long) lengths[j], &aes_ks1,
                                     iv, AES_ENCRYPT);
-                        d = time_f(STOP);
+                        d = speed_timer_stop(SECONDS);
                         print_result(D_IGE_128_AES, j, count, d);
                 }
         }
         if (doit[D_IGE_192_AES]) {
                 for (j = 0; j < SIZE_NUM; j++) {
                         print_message(names[D_IGE_192_AES], lengths[j]);
-                        time_f(START);
-                        for (count = 0, run = 1; COND; count++)
+                        speed_timer_start(SECONDS);
+                        for (count = 0; COND; count++)
                                 AES_ige_encrypt(buf, buf2,
                                     (unsigned long) lengths[j], &aes_ks2,
                                     iv, AES_ENCRYPT);
-                        d = time_f(STOP);
+                        d = speed_timer_stop(SECONDS);
                         print_result(D_IGE_192_AES, j, count, d);
                 }
         }
         if (doit[D_IGE_256_AES]) {
                 for (j = 0; j < SIZE_NUM; j++) {
                         print_message(names[D_IGE_256_AES], lengths[j]);
-                        time_f(START);
-                        for (count = 0, run = 1; COND; count++)
+                        speed_timer_start(SECONDS);
+                        for (count = 0; COND; count++)
                                 AES_ige_encrypt(buf, buf2,
                                     (unsigned long) lengths[j], &aes_ks3,
                                     iv, AES_ENCRYPT);
-                        d = time_f(STOP);
+                        d = speed_timer_stop(SECONDS);
                         print_result(D_IGE_256_AES, j, count, d);
                 }
         }
@@ -1841,10 +1854,10 @@ speed_main(int argc, char **argv)
 
                 for (j = 0; j < SIZE_NUM; j++) {
                         print_message(names[D_GHASH], lengths[j]);
-                        time_f(START);
-                        for (count = 0, run = 1; COND; count++)
+                        speed_timer_start(SECONDS);
+                        for (count = 0; COND; count++)
                                 CRYPTO_gcm128_aad(ctx, buf, lengths[j]);
-                        d = time_f(STOP);
+                        d = speed_timer_stop(SECONDS);
                         print_result(D_GHASH, j, count, d);
                 }
                 CRYPTO_gcm128_release(ctx);
@@ -1867,11 +1880,11 @@ speed_main(int argc, char **argv)
 
                 for (j = 0; j < SIZE_NUM; j++) {
                         print_message(names[D_AES_128_GCM], lengths[j]);
-                        time_f(START);
-                        for (count = 0, run = 1; COND; count++)
+                        speed_timer_start(SECONDS);
+                        for (count = 0; COND; count++)
                                 EVP_AEAD_CTX_seal(ctx, buf, &buf_len, BUFSIZE, nonce,
                                     nonce_len, buf, lengths[j], NULL, 0);
-                        d = time_f(STOP);
+                        d = speed_timer_stop(SECONDS);
                         print_result(D_AES_128_GCM,j,count,d);
                 }
                 EVP_AEAD_CTX_free(ctx);
@@ -1895,11 +1908,11 @@ speed_main(int argc, char **argv)
 
                 for (j = 0; j < SIZE_NUM; j++) {
                         print_message(names[D_AES_256_GCM], lengths[j]);
-                        time_f(START);
-                        for (count = 0, run = 1; COND; count++)
+                        speed_timer_start(SECONDS);
+                        for (count = 0; COND; count++)
                                 EVP_AEAD_CTX_seal(ctx, buf, &buf_len, BUFSIZE, nonce,
                                     nonce_len, buf, lengths[j], NULL, 0);
-                        d = time_f(STOP);
+                        d = speed_timer_stop(SECONDS);
                         print_result(D_AES_256_GCM, j, count, d);
                 }
                 EVP_AEAD_CTX_free(ctx);
@@ -1924,11 +1937,11 @@ speed_main(int argc, char **argv)
 
                 for (j = 0; j < SIZE_NUM; j++) {
                         print_message(names[D_CHACHA20_POLY1305], lengths[j]);
-                        time_f(START);
-                        for (count = 0, run = 1; COND; count++)
+                        speed_timer_start(SECONDS);
+                        for (count = 0; COND; count++)
                                 EVP_AEAD_CTX_seal(ctx, buf, &buf_len, BUFSIZE, nonce,
                                     nonce_len, buf, lengths[j], NULL, 0);
-                        d = time_f(STOP);
+                        d = speed_timer_stop(SECONDS);
                         print_result(D_CHACHA20_POLY1305, j, count, d);
                 }
                 EVP_AEAD_CTX_free(ctx);
@@ -1938,36 +1951,36 @@ speed_main(int argc, char **argv)
         if (doit[D_CBC_128_CML]) {
                 for (j = 0; j < SIZE_NUM; j++) {
                         print_message(names[D_CBC_128_CML], lengths[j]);
-                        time_f(START);
-                        for (count = 0, run = 1; COND; count++)
+                        speed_timer_start(SECONDS);
+                        for (count = 0; COND; count++)
                                 Camellia_cbc_encrypt(buf, buf,
                                     (unsigned long) lengths[j], &camellia_ks1,
                                     iv, CAMELLIA_ENCRYPT);
-                        d = time_f(STOP);
+                        d = speed_timer_stop(SECONDS);
                         print_result(D_CBC_128_CML, j, count, d);
                 }
         }
         if (doit[D_CBC_192_CML]) {
                 for (j = 0; j < SIZE_NUM; j++) {
                         print_message(names[D_CBC_192_CML], lengths[j]);
-                        time_f(START);
-                        for (count = 0, run = 1; COND; count++)
+                        speed_timer_start(SECONDS);
+                        for (count = 0; COND; count++)
                                 Camellia_cbc_encrypt(buf, buf,
                                     (unsigned long) lengths[j], &camellia_ks2,
                                     iv, CAMELLIA_ENCRYPT);
-                        d = time_f(STOP);
+                        d = speed_timer_stop(SECONDS);
                         print_result(D_CBC_192_CML, j, count, d);
                 }
         }
         if (doit[D_CBC_256_CML]) {
                 for (j = 0; j < SIZE_NUM; j++) {
                         print_message(names[D_CBC_256_CML], lengths[j]);
-                        time_f(START);
-                        for (count = 0, run = 1; COND; count++)
+                        speed_timer_start(SECONDS);
+                        for (count = 0; COND; count++)
                                 Camellia_cbc_encrypt(buf, buf,
                                     (unsigned long) lengths[j], &camellia_ks3,
                                     iv, CAMELLIA_ENCRYPT);
-                        d = time_f(STOP);
+                        d = speed_timer_stop(SECONDS);
                         print_result(D_CBC_256_CML, j, count, d);
                 }
         }
@@ -1976,12 +1989,12 @@ speed_main(int argc, char **argv)
         if (doit[D_CBC_IDEA]) {
                 for (j = 0; j < SIZE_NUM; j++) {
                         print_message(names[D_CBC_IDEA], lengths[j]);
-                        time_f(START);
-                        for (count = 0, run = 1; COND; count++)
+                        speed_timer_start(SECONDS);
+                        for (count = 0; COND; count++)
                                 idea_cbc_encrypt(buf, buf,
                                     (unsigned long) lengths[j], &idea_ks,
                                     iv, IDEA_ENCRYPT);
-                        d = time_f(STOP);
+                        d = speed_timer_stop(SECONDS);
                         print_result(D_CBC_IDEA, j, count, d);
                 }
         }
@@ -1990,12 +2003,12 @@ speed_main(int argc, char **argv)
         if (doit[D_CBC_RC2]) {
                 for (j = 0; j < SIZE_NUM; j++) {
                         print_message(names[D_CBC_RC2], lengths[j]);
-                        time_f(START);
-                        for (count = 0, run = 1; COND; count++)
+                        speed_timer_start(SECONDS);
+                        for (count = 0; COND; count++)
                                 RC2_cbc_encrypt(buf, buf,
                                     (unsigned long) lengths[j], &rc2_ks,
                                     iv, RC2_ENCRYPT);
-                        d = time_f(STOP);
+                        d = speed_timer_stop(SECONDS);
                         print_result(D_CBC_RC2, j, count, d);
                 }
         }
@@ -2004,12 +2017,12 @@ speed_main(int argc, char **argv)
         if (doit[D_CBC_BF]) {
                 for (j = 0; j < SIZE_NUM; j++) {
                         print_message(names[D_CBC_BF], lengths[j]);
-                        time_f(START);
-                        for (count = 0, run = 1; COND; count++)
+                        speed_timer_start(SECONDS);
+                        for (count = 0; COND; count++)
                                 BF_cbc_encrypt(buf, buf,
                                     (unsigned long) lengths[j], &bf_ks,
                                     iv, BF_ENCRYPT);
-                        d = time_f(STOP);
+                        d = speed_timer_stop(SECONDS);
                         print_result(D_CBC_BF, j, count, d);
                 }
         }
@@ -2018,12 +2031,12 @@ speed_main(int argc, char **argv)
         if (doit[D_CBC_CAST]) {
                 for (j = 0; j < SIZE_NUM; j++) {
                         print_message(names[D_CBC_CAST], lengths[j]);
-                        time_f(START);
-                        for (count = 0, run = 1; COND; count++)
+                        speed_timer_start(SECONDS);
+                        for (count = 0; COND; count++)
                                 CAST_cbc_encrypt(buf, buf,
                                     (unsigned long) lengths[j], &cast_ks,
                                     iv, CAST_ENCRYPT);
-                        d = time_f(STOP);
+                        d = speed_timer_stop(SECONDS);
                         print_result(D_CBC_CAST, j, count, d);
                 }
         }
@@ -2055,29 +2068,29 @@ speed_main(int argc, char **argv)
                                         EVP_EncryptInit_ex(ctx, evp_cipher, NULL, key16, iv);
                                 EVP_CIPHER_CTX_set_padding(ctx, 0);
 
-                                time_f(START);
+                                speed_timer_start(SECONDS);
                                 if (decrypt)
-                                        for (count = 0, run = 1; COND; count++)
+                                        for (count = 0; COND; count++)
                                                 EVP_DecryptUpdate(ctx, buf, &outl, buf, lengths[j]);
                                 else
-                                        for (count = 0, run = 1; COND; count++)
+                                        for (count = 0; COND; count++)
                                                 EVP_EncryptUpdate(ctx, buf, &outl, buf, lengths[j]);
                                 if (decrypt)
                                         EVP_DecryptFinal_ex(ctx, buf, &outl);
                                 else
                                         EVP_EncryptFinal_ex(ctx, buf, &outl);
-                                d = time_f(STOP);
+                                d = speed_timer_stop(SECONDS);
                                 EVP_CIPHER_CTX_free(ctx);
                         }
                         if (evp_md) {
                                 names[D_EVP] = OBJ_nid2ln(EVP_MD_type(evp_md));
                                 print_message(names[D_EVP], lengths[j]);
 
-                                time_f(START);
-                                for (count = 0, run = 1; COND; count++)
+                                speed_timer_start(SECONDS);
+                                for (count = 0; COND; count++)
                                         EVP_Digest(buf, lengths[j], &(md[0]), NULL, evp_md, NULL);
 
-                                d = time_f(STOP);
+                                d = speed_timer_stop(SECONDS);
                         }
                         print_result(D_EVP, j, count, d);
                 }
@@ -2097,8 +2110,8 @@ speed_main(int argc, char **argv)
                             rsa_bits[j],
                             RSA_SECONDS);
 /*                      RSA_blinding_on(rsa_key[j],NULL); */
-                        time_f(START);
-                        for (count = 0, run = 1; COND; count++) {
+                        speed_timer_start(RSA_SECONDS);
+                        for (count = 0; COND; count++) {
                                 ret = RSA_sign(NID_md5_sha1, buf, 36, buf2,
                                     &rsa_num, rsa_key[j]);
                                 if (ret == 0) {
@@ -2109,7 +2122,7 @@ speed_main(int argc, char **argv)
                                         break;
                                 }
                         }
-                        d = time_f(STOP);
+                        d = speed_timer_stop(RSA_SECONDS);
                         BIO_printf(bio_err, mr ? "+R1:%ld:%d:%.2f\n"
                             : "%ld %d bit private RSA in %.2fs\n",
                             count, rsa_bits[j], d);
@@ -2126,8 +2139,8 @@ speed_main(int argc, char **argv)
                         pkey_print_message("public", "rsa",
                             rsa_bits[j],
                             RSA_SECONDS);
-                        time_f(START);
-                        for (count = 0, run = 1; COND; count++) {
+                        speed_timer_start(RSA_SECONDS);
+                        for (count = 0; COND; count++) {
                                 ret = RSA_verify(NID_md5_sha1, buf, 36, buf2,
                                     rsa_num, rsa_key[j]);
                                 if (ret <= 0) {
@@ -2138,7 +2151,7 @@ speed_main(int argc, char **argv)
                                         break;
                                 }
                         }
-                        d = time_f(STOP);
+                        d = speed_timer_stop(RSA_SECONDS);
                         BIO_printf(bio_err, mr ? "+R2:%ld:%d:%.2f\n"
                             : "%ld %d bit public RSA in %.2fs\n",
                             count, rsa_bits[j], d);
@@ -2171,8 +2184,8 @@ speed_main(int argc, char **argv)
                         pkey_print_message("sign", "dsa",
                             dsa_bits[j],
                             DSA_SECONDS);
-                        time_f(START);
-                        for (count = 0, run = 1; COND; count++) {
+                        speed_timer_start(DSA_SECONDS);
+                        for (count = 0; COND; count++) {
                                 ret = DSA_sign(EVP_PKEY_DSA, buf, 20, buf2,
                                     &kk, dsa_key[j]);
                                 if (ret == 0) {
@@ -2183,7 +2196,7 @@ speed_main(int argc, char **argv)
                                         break;
                                 }
                         }
-                        d = time_f(STOP);
+                        d = speed_timer_stop(DSA_SECONDS);
                         BIO_printf(bio_err, mr ? "+R3:%ld:%d:%.2f\n"
                             : "%ld %d bit DSA signs in %.2fs\n",
                             count, dsa_bits[j], d);
@@ -2201,8 +2214,8 @@ speed_main(int argc, char **argv)
                         pkey_print_message("verify", "dsa",
                             dsa_bits[j],
                             DSA_SECONDS);
-                        time_f(START);
-                        for (count = 0, run = 1; COND; count++) {
+                        speed_timer_start(DSA_SECONDS);
+                        for (count = 0; COND; count++) {
                                 ret = DSA_verify(EVP_PKEY_DSA, buf, 20, buf2,
                                     kk, dsa_key[j]);
                                 if (ret <= 0) {
@@ -2213,7 +2226,7 @@ speed_main(int argc, char **argv)
                                         break;
                                 }
                         }
-                        d = time_f(STOP);
+                        d = speed_timer_stop(DSA_SECONDS);
                         BIO_printf(bio_err, mr ? "+R4:%ld:%d:%.2f\n"
                             : "%ld %d bit DSA verify in %.2fs\n",
                             count, dsa_bits[j], d);
@@ -2253,8 +2266,8 @@ speed_main(int argc, char **argv)
                                     test_curves_bits[j],
                                     ECDSA_SECONDS);
 
-                                time_f(START);
-                                for (count = 0, run = 1; COND; count++) {
+                                speed_timer_start(ECDSA_SECONDS);
+                                for (count = 0; COND; count++) {
                                         ret = ECDSA_sign(0, buf, 20,
                                             ecdsasig, &ecdsasiglen,
                                             ecdsa[j]);
@@ -2265,7 +2278,7 @@ speed_main(int argc, char **argv)
                                                 break;
                                         }
                                 }
-                                d = time_f(STOP);
+                                d = speed_timer_stop(ECDSA_SECONDS);
 
                                 BIO_printf(bio_err, mr ? "+R5:%ld:%d:%.2f\n" :
                                     "%ld %d bit ECDSA signs in %.2fs \n",
@@ -2285,8 +2298,8 @@ speed_main(int argc, char **argv)
                                 pkey_print_message("verify", "ecdsa",
                                     test_curves_bits[j],
                                     ECDSA_SECONDS);
-                                time_f(START);
-                                for (count = 0, run = 1; COND; count++) {
+                                speed_timer_start(ECDSA_SECONDS);
+                                for (count = 0; COND; count++) {
                                         ret = ECDSA_verify(0, buf, 20, ecdsasig, ecdsasiglen, ecdsa[j]);
                                         if (ret != 1) {
                                                 BIO_printf(bio_err, "ECDSA verify failure\n");
@@ -2295,7 +2308,7 @@ speed_main(int argc, char **argv)
                                                 break;
                                         }
                                 }
-                                d = time_f(STOP);
+                                d = speed_timer_stop(ECDSA_SECONDS);
                                 BIO_printf(bio_err, mr ? "+R6:%ld:%d:%.2f\n"
                                     : "%ld %d bit ECDSA verify in %.2fs\n",
                                     count, test_curves_bits[j], d);
@@ -2371,14 +2384,14 @@ speed_main(int argc, char **argv)
                                         pkey_print_message("", "ecdh",
                                             test_curves_bits[j],
                                             ECDH_SECONDS);
-                                        time_f(START);
-                                        for (count = 0, run = 1; COND; count++) {
+                                        speed_timer_start(ECDH_SECONDS);
+                                        for (count = 0; COND; count++) {
                                                 ECDH_compute_key(secret_a,
                                                     outlen,
                                                     EC_KEY_get0_public_key(ecdh_b[j]),
                                                     ecdh_a[j], kdf);
                                         }
-                                        d = time_f(STOP);
+                                        d = speed_timer_stop(ECDH_SECONDS);
                                         BIO_printf(bio_err, mr
                                             ? "+R7:%ld:%d:%.2f\n"
                                             : "%ld %d-bit ECDH ops in %.2fs\n",
@@ -2412,8 +2425,8 @@ speed_main(int argc, char **argv)
                         continue;
 
                 pkey_print_message("keygen", "mlkem", bits, MLKEM_SECONDS);
-                time_f(START);
-                for (count = 0, run = 1; COND; count++) {
+                speed_timer_start(MLKEM_SECONDS);
+                for (count = 0; COND; count++) {
                         /*
                          * MLKEM_generate_key requires an uninitialized key
                          * object, so allocate and free on every iteration.
@@ -2431,7 +2444,7 @@ speed_main(int argc, char **argv)
                         free(encoded_pub);
                         encoded_pub = NULL;
                 }
-                d = time_f(STOP);
+                d = speed_timer_stop(MLKEM_SECONDS);
                 if (run)
                         goto mlkem_err;
                 BIO_printf(bio_err, mr ? "+R8:%ld:%d:%.2f\n"
@@ -2450,8 +2463,8 @@ speed_main(int argc, char **argv)
                 encoded_pub = NULL;
 
                 pkey_print_message("encap", "mlkem", bits, MLKEM_SECONDS);
-                time_f(START);
-                for (count = 0, run = 1; COND; count++) {
+                speed_timer_start(MLKEM_SECONDS);
+                for (count = 0; COND; count++) {
                         if (!MLKEM_encap(pub, &ct, &ct_len, &ss,
                             &ss_len))
                                 break;
@@ -2460,7 +2473,7 @@ speed_main(int argc, char **argv)
                         free(ss);
                         ss = NULL;
                 }
-                d = time_f(STOP);
+                d = speed_timer_stop(MLKEM_SECONDS);
                 if (run)
                         goto mlkem_err;
                 BIO_printf(bio_err, mr ? "+R9:%ld:%d:%.2f\n"
@@ -2474,14 +2487,14 @@ speed_main(int argc, char **argv)
                 ss = NULL;
 
                 pkey_print_message("decap", "mlkem", bits, MLKEM_SECONDS);
-                time_f(START);
-                for (count = 0, run = 1; COND; count++) {
+                speed_timer_start(MLKEM_SECONDS);
+                for (count = 0; COND; count++) {
                         if (!MLKEM_decap(priv, ct, ct_len, &ss, &ss_len))
                                 break;
                         free(ss);
                         ss = NULL;
                 }
-                d = time_f(STOP);
+                d = speed_timer_stop(MLKEM_SECONDS);
                 if (run)
                         goto mlkem_err;
                 BIO_printf(bio_err, mr ? "+R10:%ld:%d:%.2f\n"
@@ -2679,7 +2692,6 @@ print_message(const char *s, int length)
         BIO_printf(bio_err, mr ? "+DT:%s:%d:%d\n"
             : "Doing %s for %ds on %d size blocks: ", s, SECONDS, length);
         (void) BIO_flush(bio_err);
-        alarm(SECONDS);
 }
 
 static void
@@ -2689,7 +2701,6 @@ pkey_print_message(const char *str, const char *str2,
         BIO_printf(bio_err, mr ? "+DTP:%d:%s:%s:%d\n"
             : "Doing %d bit %s %s for %ds: ", bits, str, str2, tm);
         (void) BIO_flush(bio_err);
-        alarm(tm);
 }
 
 static void
diff --git a/src/usr.sbin/ocspcheck/ocspcheck.c b/src/usr.sbin/ocspcheck/ocspcheck.c
index ae4b8364f6..8d6d30187b 100644
--- a/src/usr.sbin/ocspcheck/ocspcheck.c
+++ b/src/usr.sbin/ocspcheck/ocspcheck.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ocspcheck.c,v 1.34 2024/12/04 07:58:51 tb Exp $ */
+/* $OpenBSD: ocspcheck.c,v 1.35 2026/07/29 02:27:31 tb Exp $ */
 
 /*
  * Copyright (c) 2017,2020 Bob Beck <beck@openbsd.org>
@@ -399,8 +399,7 @@ ocsp_request_new_from_cert(const char *cadir, char *file, int nonce)
         return NULL;
 }
 
-
-int
+static int
 validate_response(char *buf, size_t size, ocsp_request *request,
     X509_STORE *store, char *host, char *file)
 {