add libssl verify test

Copy regress/lib/libssl/verify/verify.c as ssl_verify.c to avoid
basename collisions when regress tests are flattened into tests.

Copy create-libressl-test-certs.pl and add a wrapper that generates
the test certificates before running ssl_verify. Detect the required
IO::Socket::SSL::Utils Perl module and register the test with both
autotools and CMake when it is available.

Also document x509/bettertls is not included.

3 files changed, 81 insertions, 0 deletions

diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt
index ede7463..45681a1 100644
--- a/tests/CMakeLists.txt
+++ b/tests/CMakeLists.txt
@@ -844,6 +844,17 @@ add_executable(ssl_verify_param ssl_verify_param.c)
 target_link_libraries(ssl_verify_param ${OPENSSL_TEST_LIBS})
 add_platform_test(ssl_verify_param ssl_verify_param)
 
+# ssl_verify
+add_executable(ssl_verify ssl_verify.c)
+target_link_libraries(ssl_verify ${OPENSSL_TEST_LIBS})
+if(NOT WIN32 AND NOT EMSCRIPTEN AND HAVE_PERL_IO_SOCKET_SSL_UTILS)
+        add_test(NAME ssl_verify COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/ssl_verify.sh
+            $<TARGET_FILE:ssl_verify>)
+        set_tests_properties(ssl_verify PROPERTIES
+            ENVIRONMENT "srcdir=${TEST_SOURCE_DIR};PERL=${PERL_EXECUTABLE}"
+            WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR})
+endif()
+
 # ssl_versions
 add_executable(ssl_versions ssl_versions.c)
 target_link_libraries(ssl_versions ${OPENSSL_TEST_LIBS})
diff --git a/tests/Makefile.am b/tests/Makefile.am
index 9b58724..7d581c8 100644
--- a/tests/Makefile.am
+++ b/tests/Makefile.am
@@ -104,6 +104,7 @@ EXTRA_DIST = CMakeLists.txt
 DISTCLEANFILES = pidwraptest.txt
 
 distclean-local:
+        rm -rf ssl_verify-certs
         rm -rf x509_verify-certs
 
 # XXX - should probably be in their own static lib
@@ -855,6 +856,15 @@ TESTS += ssl_verify_param
 check_PROGRAMS += ssl_verify_param
 ssl_verify_param_SOURCES = ssl_verify_param.c
 
+# ssl_verify
+if HAVE_PERL_IO_SOCKET_SSL_UTILS
+TESTS += ssl_verify.sh
+check_PROGRAMS += ssl_verify
+endif
+ssl_verify_SOURCES = ssl_verify.c
+EXTRA_DIST += ssl_verify.sh
+EXTRA_DIST += create-libressl-test-certs.pl
+
 # ssl_versions
 TESTS += ssl_versions
 check_PROGRAMS += ssl_versions
diff --git a/tests/ssl_verify.sh b/tests/ssl_verify.sh
new file mode 100755
index 0000000..ed32911
--- /dev/null
+++ b/tests/ssl_verify.sh
@@ -0,0 +1,60 @@
+#!/bin/sh
+#
+# Copyright (c) 2026 Kenjiro Nakayama
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+set -e
+
+if [ -z "$srcdir" ]; then
+        srcdir=.
+fi
+
+if [ -z "$PERL" ]; then
+        PERL=perl
+fi
+
+case "$srcdir" in
+/*)
+        create_certs="$srcdir/create-libressl-test-certs.pl"
+        ;;
+*)
+        create_certs="`pwd`/$srcdir/create-libressl-test-certs.pl"
+        ;;
+esac
+
+if [ $# -ge 1 ]; then
+        verify_bin=$1
+else
+        verify_bin="`pwd`/ssl_verify"
+        if [ -e ./ssl_verify.exe ]; then
+                verify_bin="`pwd`/ssl_verify.exe"
+        fi
+fi
+
+workdir=ssl_verify-certs
+
+cleanup()
+{
+        rm -rf "$workdir"
+}
+trap cleanup EXIT
+
+rm -rf "$workdir"
+mkdir "$workdir"
+
+(
+        cd "$workdir"
+        "$PERL" "$create_certs"
+        "$verify_bin"
+)