add libssl verify test

Copy regress/lib/libssl/verify/verify.c as ssl_verify.c to avoid
basename collisions when regress tests are flattened into tests.

Copy create-libressl-test-certs.pl and add a wrapper that generates
the test certificates before running ssl_verify. Detect the required
IO::Socket::SSL::Utils Perl module and register the test with both
autotools and CMake when it is available.

Also document x509/bettertls is not included.

7 files changed, 109 insertions, 0 deletions

diff --git a/.gitignore b/.gitignore
index 8a72400..d85df81 100644
--- a/.gitignore
+++ b/.gitignore
@@ -141,10 +141,12 @@ tests/*test.c
 tests/pbkdf2*
 tests/*.pem
 tests/certs/
+tests/create-libressl-test-certs.pl
 tests/make-dir-roots.pl
 tests/testssl
 tests/*.txt
 tests/compat/*.c
+tests/ssl_verify.c
 tests/verify*
 tests/x509_verify*
 !tests/x509_verify.sh
diff --git a/CMakeLists.txt b/CMakeLists.txt
index 699603b..4ffe67b 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -33,6 +33,15 @@ include(GNUInstallDirs)
 
 enable_testing()
 find_program(PERL_EXECUTABLE perl perl5)
+set(HAVE_PERL_IO_SOCKET_SSL_UTILS FALSE)
+if(PERL_EXECUTABLE)
+        execute_process(COMMAND ${PERL_EXECUTABLE} -MIO::Socket::SSL::Utils -e 1
+            RESULT_VARIABLE PERL_IO_SOCKET_SSL_UTILS_RESULT
+            OUTPUT_QUIET ERROR_QUIET)
+        if(PERL_IO_SOCKET_SSL_UTILS_RESULT EQUAL 0)
+                set(HAVE_PERL_IO_SOCKET_SSL_UTILS TRUE)
+        endif()
+endif()
 
 file(READ ${CMAKE_CURRENT_SOURCE_DIR}/ssl/VERSION SSL_VERSION)
 string(STRIP ${SSL_VERSION} SSL_VERSION)
diff --git a/configure.ac b/configure.ac
index 9012535..23f0c38 100644
--- a/configure.ac
+++ b/configure.ac
@@ -34,6 +34,17 @@ LT_INIT([pic-only])
 
 AC_CHECK_PROGS([PERL], [perl perl5])
 AM_CONDITIONAL([HAVE_PERL], [test "x$PERL" != x])
+AC_CACHE_CHECK([for IO::Socket::SSL::Utils],
+        [ac_cv_perl_io_socket_ssl_utils],
+        [if test "x$PERL" = x; then
+                ac_cv_perl_io_socket_ssl_utils=no
+        elif "$PERL" -MIO::Socket::SSL::Utils -e 1 >/dev/null 2>&1; then
+                ac_cv_perl_io_socket_ssl_utils=yes
+        else
+                ac_cv_perl_io_socket_ssl_utils=no
+        fi])
+AM_CONDITIONAL([HAVE_PERL_IO_SOCKET_SSL_UTILS],
+        [test "x$ac_cv_perl_io_socket_ssl_utils" = xyes])
 
 CHECK_OS_OPTIONS
 
diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt
index ede7463..45681a1 100644
--- a/tests/CMakeLists.txt
+++ b/tests/CMakeLists.txt
@@ -844,6 +844,17 @@ add_executable(ssl_verify_param ssl_verify_param.c)
 target_link_libraries(ssl_verify_param ${OPENSSL_TEST_LIBS})
 add_platform_test(ssl_verify_param ssl_verify_param)
 
+# ssl_verify
+add_executable(ssl_verify ssl_verify.c)
+target_link_libraries(ssl_verify ${OPENSSL_TEST_LIBS})
+if(NOT WIN32 AND NOT EMSCRIPTEN AND HAVE_PERL_IO_SOCKET_SSL_UTILS)
+        add_test(NAME ssl_verify COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/ssl_verify.sh
+            $<TARGET_FILE:ssl_verify>)
+        set_tests_properties(ssl_verify PROPERTIES
+            ENVIRONMENT "srcdir=${TEST_SOURCE_DIR};PERL=${PERL_EXECUTABLE}"
+            WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR})
+endif()
+
 # ssl_versions
 add_executable(ssl_versions ssl_versions.c)
 target_link_libraries(ssl_versions ${OPENSSL_TEST_LIBS})
diff --git a/tests/Makefile.am b/tests/Makefile.am
index 9b58724..7d581c8 100644
--- a/tests/Makefile.am
+++ b/tests/Makefile.am
@@ -104,6 +104,7 @@ EXTRA_DIST = CMakeLists.txt
 DISTCLEANFILES = pidwraptest.txt
 
 distclean-local:
+        rm -rf ssl_verify-certs
         rm -rf x509_verify-certs
 
 # XXX - should probably be in their own static lib
@@ -855,6 +856,15 @@ TESTS += ssl_verify_param
 check_PROGRAMS += ssl_verify_param
 ssl_verify_param_SOURCES = ssl_verify_param.c
 
+# ssl_verify
+if HAVE_PERL_IO_SOCKET_SSL_UTILS
+TESTS += ssl_verify.sh
+check_PROGRAMS += ssl_verify
+endif
+ssl_verify_SOURCES = ssl_verify.c
+EXTRA_DIST += ssl_verify.sh
+EXTRA_DIST += create-libressl-test-certs.pl
+
 # ssl_versions
 TESTS += ssl_versions
 check_PROGRAMS += ssl_versions
diff --git a/tests/ssl_verify.sh b/tests/ssl_verify.sh
new file mode 100755
index 0000000..ed32911
--- /dev/null
+++ b/tests/ssl_verify.sh
@@ -0,0 +1,60 @@
+#!/bin/sh
+#
+# Copyright (c) 2026 Kenjiro Nakayama
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+set -e
+
+if [ -z "$srcdir" ]; then
+        srcdir=.
+fi
+
+if [ -z "$PERL" ]; then
+        PERL=perl
+fi
+
+case "$srcdir" in
+/*)
+        create_certs="$srcdir/create-libressl-test-certs.pl"
+        ;;
+*)
+        create_certs="`pwd`/$srcdir/create-libressl-test-certs.pl"
+        ;;
+esac
+
+if [ $# -ge 1 ]; then
+        verify_bin=$1
+else
+        verify_bin="`pwd`/ssl_verify"
+        if [ -e ./ssl_verify.exe ]; then
+                verify_bin="`pwd`/ssl_verify.exe"
+        fi
+fi
+
+workdir=ssl_verify-certs
+
+cleanup()
+{
+        rm -rf "$workdir"
+}
+trap cleanup EXIT
+
+rm -rf "$workdir"
+mkdir "$workdir"
+
+(
+        cd "$workdir"
+        "$PERL" "$create_certs"
+        "$verify_bin"
+)
diff --git a/update.sh b/update.sh
index a6d0ebd..83864d3 100755
--- a/update.sh
+++ b/update.sh
@@ -336,6 +336,8 @@ for i in `find $libcrypto_regress -name '*.[ch]'`; do
 done
 # x509/verify.c collides with x509/bettertls/verify.c when flattened.
 $CP $libcrypto_regress/x509/verify.c tests/x509_verify.c
+# Do not copy x509/bettertls/verify.c: it requires the large bettertls
+# certificate corpus, which is not worth bundling in release tarballs.
 $CP $libcrypto_regress/evp/evptests.txt tests
 $CP $libcrypto_regress/aead/*.txt tests
 $CP $libcrypto_regress/ct/ctlog.conf tests
@@ -371,6 +373,10 @@ for i in `find $libssl_regress -name '*.c'`; do
 done
 # tls/tlstest.c collides with libtls/tls/tlstest.c when flattened.
 $CP $libssl_regress/tls/tlstest.c tests/ssl_tlstest.c
+# verify/verify.c collides with other verify tests when flattened.
+rm -f tests/verify.c
+$CP $libssl_regress/verify/verify.c tests/ssl_verify.c
+$CP $libssl_regress/verify/create-libressl-test-certs.pl tests
 $CP $libssl_regress/unit/tests.h tests
 $CP $libssl_regress/certs/*.pem tests
 $CP $libssl_regress/certs/*.crl tests