8 files changed, 549 insertions, 15 deletions

diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt
index eaf4ed1..e155ab7 100644
--- a/tests/CMakeLists.txt
+++ b/tests/CMakeLists.txt
@@ -68,7 +68,7 @@ file(TO_NATIVE_PATH ${CMAKE_CURRENT_SOURCE_DIR} TEST_SOURCE_DIR)
 function(prepare_emscripten_test_target TARGET_NAME)
         if(EMSCRIPTEN)
                 set_target_properties(${TARGET_NAME} PROPERTIES LINK_FLAGS
-                        "-sALLOW_MEMORY_GROWTH --preload-file ${TEST_SOURCE_DIR} ")
+                        "-sALLOW_MEMORY_GROWTH -sNODERAWFS=1")
         endif()
 endfunction()
 
@@ -283,6 +283,15 @@ add_executable(bn_mont bn_mont.c)
 target_link_libraries(bn_mont ${OPENSSL_TEST_LIBS})
 add_platform_test(bn_mont bn_mont)
 
+# bn_mul_div is mostly benchmark code with non-standard timing dependencies,
+# while the non-benchmark test coverage is not worth the cross-platform fallout.
+# # bn_mul_div
+# if(NOT (WIN32 OR EMSCRIPTEN OR SOLARIS))
+#       add_executable(bn_mul_div bn_mul_div.c)
+#       target_link_libraries(bn_mul_div ${OPENSSL_TEST_LIBS})
+#       add_platform_test(bn_mul_div bn_mul_div)
+# endif()
+
 # bn_primes
 add_executable(bn_primes bn_primes.c)
 target_link_libraries(bn_primes ${OPENSSL_TEST_LIBS})
@@ -333,8 +342,30 @@ add_executable(bytestringtest bytestringtest.c)
 target_link_libraries(bytestringtest ${OPENSSL_TEST_LIBS})
 add_platform_test(bytestringtest bytestringtest)
 
-# callback
-# callbackfailures
+# x509_callbacks
+add_executable(callback callback.c)
+target_link_libraries(callback ${OPENSSL_TEST_LIBS})
+add_executable(callbackfailures callbackfailures.c)
+target_link_libraries(callbackfailures ${OPENSSL_TEST_LIBS})
+add_executable(expirecallback expirecallback.c)
+target_link_libraries(expirecallback ${OPENSSL_TEST_LIBS})
+add_dependencies(callback openssl)
+if(NOT WIN32 AND NOT EMSCRIPTEN AND PERL_EXECUTABLE)
+        add_test(NAME x509_callbacks COMMAND
+            ${CMAKE_CURRENT_SOURCE_DIR}/x509_callbacks.sh
+            $<TARGET_FILE:callback>
+            $<TARGET_FILE:callbackfailures>
+            $<TARGET_FILE:expirecallback>
+            $<TARGET_FILE:openssl>)
+        set_tests_properties(x509_callbacks PROPERTIES
+            ENVIRONMENT "srcdir=${TEST_SOURCE_DIR};PERL=${PERL_EXECUTABLE}"
+            WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR})
+        # These tests use the same certificate corpus as x509_verify and can
+        # exceed the range of a 32-bit time_t.
+        if(SMALL_TIME_T)
+                set_property(TEST x509_callbacks PROPERTY WILL_FAIL TRUE)
+        endif()
+endif()
 
 # casttest
 add_executable(casttest casttest.c)
@@ -415,6 +446,16 @@ add_platform_test(dsatest dsatest)
 #       set_tests_properties(dtlstest PROPERTIES ENVIRONMENT "srcdir=${TEST_SOURCE_DIR}")
 # endif()
 
+# dtls_handshake_msg_test
+add_executable(dtls_handshake_msg_test dtls_handshake_msg_test.c)
+target_link_libraries(dtls_handshake_msg_test ${OPENSSL_TEST_LIBS})
+add_platform_test(dtls_handshake_msg_test dtls_handshake_msg_test)
+
+# dtls_wire_test
+add_executable(dtls_wire_test dtls_wire_test.c)
+target_link_libraries(dtls_wire_test ${OPENSSL_TEST_LIBS})
+add_platform_test(dtls_wire_test dtls_wire_test)
+
 # ecc_cdh
 add_executable(ecc_cdh ecc_cdh.c)
 target_link_libraries(ecc_cdh ${OPENSSL_TEST_LIBS})
@@ -484,8 +525,6 @@ add_executable(exdata_test exdata_test.c)
 target_link_libraries(exdata_test ${OPENSSL_TEST_LIBS})
 add_platform_test(exdata_test exdata_test)
 
-# expirecallback.c
-
 # explicit_bzero
 # SA_ONSTACK is unavailable on Windows, sigsuspend is unavailable on Emscripten
 if(NOT (WIN32 OR EMSCRIPTEN))
@@ -805,6 +844,11 @@ target_link_libraries(ssl_get_shared_ciphers ${OPENSSL_TEST_LIBS})
 prepare_emscripten_test_target(ssl_get_shared_ciphers)
 add_platform_test(ssl_get_shared_ciphers ssl_get_shared_ciphers)
 
+# ssl_kex
+add_executable(ssl_kex ssl_kex.c)
+target_link_libraries(ssl_kex ${OPENSSL_TEST_LIBS})
+add_platform_test(ssl_kex ssl_kex)
+
 # ssl_methods
 add_executable(ssl_methods ssl_methods.c)
 target_link_libraries(ssl_methods ${OPENSSL_TEST_LIBS})
@@ -820,11 +864,39 @@ add_executable(ssl_verify_param ssl_verify_param.c)
 target_link_libraries(ssl_verify_param ${OPENSSL_TEST_LIBS})
 add_platform_test(ssl_verify_param ssl_verify_param)
 
+# ssl_verify
+add_executable(ssl_verify ssl_verify.c)
+target_link_libraries(ssl_verify ${OPENSSL_TEST_LIBS})
+prepare_emscripten_test_target(ssl_verify)
+if(HAVE_PERL_IO_SOCKET_SSL_UTILS)
+        if(WIN32)
+                add_test(NAME ssl_verify COMMAND
+                    ${CMAKE_CURRENT_SOURCE_DIR}/ssl_verify.bat
+                    $<TARGET_FILE:ssl_verify>)
+        else()
+                add_test(NAME ssl_verify COMMAND
+                    ${CMAKE_CURRENT_SOURCE_DIR}/ssl_verify.sh
+                    $<TARGET_FILE:ssl_verify>)
+        endif()
+        set_tests_properties(ssl_verify PROPERTIES
+            ENVIRONMENT "srcdir=${TEST_SOURCE_DIR};PERL=${PERL_EXECUTABLE}"
+            WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR})
+endif()
+
 # ssl_versions
 add_executable(ssl_versions ssl_versions.c)
 target_link_libraries(ssl_versions ${OPENSSL_TEST_LIBS})
 add_platform_test(ssl_versions ssl_versions)
 
+# ssl_tlstest
+add_executable(ssl_tlstest ssl_tlstest.c)
+target_link_libraries(ssl_tlstest ${OPENSSL_TEST_LIBS})
+prepare_emscripten_test_target(ssl_tlstest)
+add_platform_test(ssl_tlstest $<TARGET_FILE:ssl_tlstest>
+    ${CMAKE_CURRENT_SOURCE_DIR}/server1-rsa.pem
+    ${CMAKE_CURRENT_SOURCE_DIR}/server1-rsa-chain.pem
+    ${CMAKE_CURRENT_SOURCE_DIR}/ca-root-rsa.pem)
+
 # ssltest
 add_executable(ssltest ssltest.c)
 target_link_libraries(ssltest ${OPENSSL_TEST_LIBS})
@@ -921,6 +993,23 @@ add_executable(valid_handshakes_terminate valid_handshakes_terminate.c)
 target_link_libraries(valid_handshakes_terminate ${OPENSSL_TEST_LIBS})
 add_platform_test(valid_handshakes_terminate valid_handshakes_terminate)
 
+# x509_verify
+add_executable(x509_verify x509_verify.c)
+target_link_libraries(x509_verify ${OPENSSL_TEST_LIBS})
+add_dependencies(x509_verify openssl)
+if(NOT WIN32 AND NOT EMSCRIPTEN AND PERL_EXECUTABLE)
+        add_test(NAME x509_verify COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/x509_verify.sh
+            $<TARGET_FILE:x509_verify> $<TARGET_FILE:openssl>)
+        set_tests_properties(x509_verify PROPERTIES
+            ENVIRONMENT "srcdir=${TEST_SOURCE_DIR};PERL=${PERL_EXECUTABLE}"
+            WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR})
+        # This test depends on certificate times that can exceed 32-bit time_t
+        # range, so match the existing time tests and expect failure there.
+        if(SMALL_TIME_T)
+                set_property(TEST x509_verify PROPERTY WILL_FAIL TRUE)
+        endif()
+endif()
+
 # verifytest
 add_executable(verifytest verifytest.c)
 target_link_libraries(verifytest ${LIBTLS_TEST_LIBS})
@@ -947,6 +1036,11 @@ target_link_libraries(x509_asn1 ${OPENSSL_TEST_LIBS})
 prepare_emscripten_test_target(x509_asn1)
 add_platform_test(x509_asn1 x509_asn1)
 
+# x509_crl
+add_executable(x509_crl x509_crl.c)
+target_link_libraries(x509_crl ${OPENSSL_TEST_LIBS})
+add_platform_test(x509_crl x509_crl)
+
 # x509_extensions_test
 add_executable(x509_extensions_test x509_extensions_test.c)
 target_link_libraries(x509_extensions_test ${OPENSSL_TEST_LIBS})
diff --git a/tests/Makefile.am b/tests/Makefile.am
index 22e3dee..aec438b 100644
--- a/tests/Makefile.am
+++ b/tests/Makefile.am
@@ -94,6 +94,7 @@ libtest_la_SOURCES = empty.c
 
 LDADD = libtest.la $(PLATFORM_LDADD) $(PROG_LDADD)
 
+TESTS_ENVIRONMENT = PERL='$(PERL)'
 TEST_LOG_DRIVER = env AM_TAP_AWK='$(AWK)' $(SHELL) $(top_srcdir)/tap-driver.sh
 
 TESTS =
@@ -102,6 +103,11 @@ check_PROGRAMS =
 EXTRA_DIST = CMakeLists.txt
 DISTCLEANFILES = pidwraptest.txt
 
+distclean-local:
+        rm -rf ssl_verify-certs
+        rm -rf x509_callback-certs
+        rm -rf x509_verify-certs
+
 # XXX - should probably be in their own static lib
 TEST_HELPER_SRC = test.c test_util.c
 noinst_HEADERS = test.h
@@ -303,6 +309,17 @@ TESTS += bn_mont
 check_PROGRAMS += bn_mont
 bn_mont_SOURCES = bn_mont.c
 
+# bn_mul_div is mostly benchmark code with non-standard timing dependencies,
+# while the non-benchmark test coverage is not worth the cross-platform fallout.
+## bn_mul_div
+#if !HOST_WIN
+#if !HOST_SOLARIS
+#TESTS += bn_mul_div
+#check_PROGRAMS += bn_mul_div
+#bn_mul_div_SOURCES = bn_mul_div.c
+#endif
+#endif
+
 # bn_primes
 TESTS += bn_primes
 check_PROGRAMS += bn_primes
@@ -349,8 +366,21 @@ TESTS += bytestringtest
 check_PROGRAMS += bytestringtest
 bytestringtest_SOURCES = bytestringtest.c
 
-# callback
-# callbackfailures
+# x509_callbacks
+if HAVE_PERL
+# These tests use the same certificate corpus as x509_verify and can exceed
+# the range of a 32-bit time_t.
+if SMALL_TIME_T
+XFAIL_TESTS += x509_callbacks.sh
+endif
+TESTS += x509_callbacks.sh
+check_PROGRAMS += callback callbackfailures expirecallback
+endif
+callback_SOURCES = callback.c
+callbackfailures_SOURCES = callbackfailures.c
+expirecallback_SOURCES = expirecallback.c
+EXTRA_DIST += x509_callbacks.sh
+EXTRA_DIST += callback.pl
 
 # casttest
 TESTS += casttest
@@ -431,6 +461,16 @@ dsatest_SOURCES = dsatest.c
 #endif
 #EXTRA_DIST += dtlstest.sh
 
+# dtls_handshake_msg_test
+TESTS += dtls_handshake_msg_test
+check_PROGRAMS += dtls_handshake_msg_test
+dtls_handshake_msg_test_SOURCES = dtls_handshake_msg_test.c
+
+# dtls_wire_test
+TESTS += dtls_wire_test
+check_PROGRAMS += dtls_wire_test
+dtls_wire_test_SOURCES = dtls_wire_test.c
+
 # ecc_cdh
 TESTS += ecc_cdh
 check_PROGRAMS += ecc_cdh
@@ -498,8 +538,6 @@ TESTS += exdata_test
 check_PROGRAMS += exdata_test
 exdata_test_SOURCES = exdata_test.c
 
-# expirecallback.c
-
 # explicit_bzero
 # explicit_bzero relies on SA_ONSTACK, which is unavailable on Windows
 if !HOST_WIN
@@ -810,6 +848,11 @@ ssl_get_shared_ciphers_CPPFLAGS = $(AM_CPPFLAGS) -DCERTSDIR=\"$(srcdir)\"
 check_PROGRAMS += ssl_get_shared_ciphers
 ssl_get_shared_ciphers_SOURCES = ssl_get_shared_ciphers.c
 
+# ssl_kex
+TESTS += ssl_kex
+check_PROGRAMS += ssl_kex
+ssl_kex_SOURCES = ssl_kex.c
+
 # ssl_methods
 TESTS += ssl_methods
 check_PROGRAMS += ssl_methods
@@ -825,11 +868,27 @@ TESTS += ssl_verify_param
 check_PROGRAMS += ssl_verify_param
 ssl_verify_param_SOURCES = ssl_verify_param.c
 
+# ssl_verify
+if HAVE_PERL_IO_SOCKET_SSL_UTILS
+TESTS += ssl_verify.sh
+check_PROGRAMS += ssl_verify
+endif
+ssl_verify_SOURCES = ssl_verify.c
+EXTRA_DIST += ssl_verify.sh
+EXTRA_DIST += ssl_verify.bat
+EXTRA_DIST += create-libressl-test-certs.pl
+
 # ssl_versions
 TESTS += ssl_versions
 check_PROGRAMS += ssl_versions
 ssl_versions_SOURCES = ssl_versions.c
 
+# ssl_tlstest
+TESTS += ssl_tlstest.sh
+check_PROGRAMS += ssl_tlstest
+ssl_tlstest_SOURCES = ssl_tlstest.c
+EXTRA_DIST += ssl_tlstest.sh
+
 # ssltest
 TESTS += ssltest.sh
 check_PROGRAMS += ssltest
@@ -905,6 +964,21 @@ TESTS += valid_handshakes_terminate
 check_PROGRAMS += valid_handshakes_terminate
 valid_handshakes_terminate_SOURCES = valid_handshakes_terminate.c
 
+# x509_verify
+if HAVE_PERL
+# This test depends on certificate times that can exceed 32-bit time_t
+# range, so match the existing time tests and expect failure there.
+if SMALL_TIME_T
+XFAIL_TESTS += x509_verify.sh
+endif
+TESTS += x509_verify.sh
+check_PROGRAMS += x509_verify
+endif
+x509_verify_SOURCES = x509_verify.c
+EXTRA_DIST += x509_verify.sh
+EXTRA_DIST += make-dir-roots.pl
+EXTRA_DIST += certs
+
 # verifytest
 TESTS += verifytest
 check_PROGRAMS += verifytest
@@ -930,6 +1004,11 @@ TESTS += x509_asn1
 check_PROGRAMS += x509_asn1
 x509_asn1_SOURCES = x509_asn1.c
 
+# x509_crl
+TESTS += x509_crl
+check_PROGRAMS += x509_crl
+x509_crl_SOURCES = x509_crl.c
+
 # x509_extensions_test
 TESTS += x509_extensions_test
 check_PROGRAMS += x509_extensions_test
diff --git a/tests/compat/pipe2.c b/tests/compat/pipe2.c
index d7b4062..3e79575 100644
--- a/tests/compat/pipe2.c
+++ b/tests/compat/pipe2.c
@@ -18,9 +18,10 @@ static int setfd(int fd, int flag)
 {
         int rc = -1;
         if (flag & FD_CLOEXEC) {
-                HANDLE h = (HANDLE)_get_osfhandle(fd);
-                if (h != NULL)
-                        rc = SetHandleInformation(h, HANDLE_FLAG_INHERIT, 0) == 0 ? -1 : 0;
+                /* fd is a Winsock SOCKET, not a CRT descriptor: use it as a
+                 * handle directly rather than translating with _get_osfhandle. */
+                HANDLE h = (HANDLE)(LONG_PTR)fd;
+                rc = SetHandleInformation(h, HANDLE_FLAG_INHERIT, 0) == 0 ? -1 : 0;
         }
         return rc;
 }
@@ -38,16 +39,20 @@ static int setfl(int fd, int flag)
 /*
  * Have open() temporarily use up file descriptors until reaching beyond the
  * allocated sockets, then leak the ones conflicting with any of the latter.
+ *
+ * open()/close() are redefined to posix_open()/posix_close() in this file,
+ * which tag descriptors with the 0x80000000 bit. Use the raw CRT _open/_close
+ * so the values compare against the socket handles in the same namespace.
  */
 static void create_issue_1069_sentinels(int socket_vector[2])
 {
-        int fd = open("CONIN$", O_RDONLY);
+        int fd = _open("CONIN$", O_RDONLY);
         if (fd == -1 || (fd > socket_vector[0] && fd > socket_vector[1])) {
                 return;
         }
         create_issue_1069_sentinels(socket_vector);
         if (fd != socket_vector[0] && fd != socket_vector[1]) {
-                close(fd);
+                _close(fd);
         }
 }
 
@@ -70,8 +75,15 @@ int socketpair(int domain, int type, int protocol, int socket_vector[2])
                 .sin_port = 0,
         };
 
+        struct sockaddr_in self, peer;
         int yes = 1, e;
-        if (setsockopt(listener, SOL_SOCKET, SO_REUSEADDR,
+
+        /*
+         * SO_REUSEADDR does not mean here what it means on unix: it lets any
+         * other process bind the same address and port and take over the
+         * rendezvous. SO_EXCLUSIVEADDRUSE is the flag that keeps the port ours.
+         */
+        if (setsockopt(listener, SOL_SOCKET, SO_EXCLUSIVEADDRUSE,
                         (void *)&yes, sizeof yes) == -1)
                 goto err;
 
@@ -100,6 +112,28 @@ int socketpair(int domain, int type, int protocol, int socket_vector[2])
         if (socket_vector[1] == -1)
                 goto err;
 
+        /*
+         * The listening port is enumerable by anything running as the user, so
+         * the connection we just accepted is not necessarily the one we made.
+         * Pair the two halves only if they are each other's peer.
+         */
+        memset(&self, 0, sizeof self);
+        addrlen = sizeof self;
+        if (getsockname(socket_vector[0], (struct sockaddr *)&self, &addrlen) != 0)
+                goto err;
+
+        memset(&peer, 0, sizeof peer);
+        addrlen = sizeof peer;
+        if (getpeername(socket_vector[1], (struct sockaddr *)&peer, &addrlen) != 0)
+                goto err;
+
+        if (self.sin_family != peer.sin_family ||
+            self.sin_addr.s_addr != peer.sin_addr.s_addr ||
+            self.sin_port != peer.sin_port) {
+                WSASetLastError(WSAECONNREFUSED);
+                goto err;
+        }
+
         closesocket(listener);
 
         create_issue_1069_sentinels(socket_vector);
diff --git a/tests/ssl_tlstest.sh b/tests/ssl_tlstest.sh
new file mode 100755
index 0000000..cde8a4f
--- /dev/null
+++ b/tests/ssl_tlstest.sh
@@ -0,0 +1,43 @@
+#!/bin/sh
+#
+# Copyright (c) 2026 Kenjiro Nakayama
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+set -e
+
+if [ $# -ge 1 ]; then
+        ssl_tlstest_bin=$1
+else
+        ssl_tlstest_bin=./ssl_tlstest
+        if [ -e ./ssl_tlstest.exe ]; then
+                ssl_tlstest_bin=./ssl_tlstest.exe
+        elif [ -e ./ssl_tlstest.js ]; then
+                ssl_tlstest_bin=./ssl_tlstest.js
+        fi
+fi
+
+if [ -z "$srcdir" ]; then
+        srcdir=.
+fi
+
+case "$ssl_tlstest_bin" in
+*.js)
+        node "$ssl_tlstest_bin" "$srcdir/server1-rsa.pem" \
+            "$srcdir/server1-rsa-chain.pem" "$srcdir/ca-root-rsa.pem"
+        ;;
+*)
+        "$ssl_tlstest_bin" "$srcdir/server1-rsa.pem" \
+            "$srcdir/server1-rsa-chain.pem" "$srcdir/ca-root-rsa.pem"
+        ;;
+esac
diff --git a/tests/ssl_verify.bat b/tests/ssl_verify.bat
new file mode 100644
index 0000000..1b8c1dc
--- /dev/null
+++ b/tests/ssl_verify.bat
@@ -0,0 +1,42 @@
+@echo off

+setlocal

+

+:: Copyright (c) 2026 Kenjiro Nakayama

+::

+:: Permission to use, copy, modify, and distribute this software for any

+:: purpose with or without fee is hereby granted, provided that the above

+:: copyright notice and this permission notice appear in all copies.

+::

+:: THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES

+:: WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF

+:: MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR

+:: ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES

+:: WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN

+:: ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF

+:: OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

+

+if "%~1" == "" exit /b 1

+

+set "ssl_verify_bin=%~1"

+set "ssl_verify_bin=%ssl_verify_bin:/=\%"

+if not exist "%ssl_verify_bin%" exit /b 1

+

+if not defined srcdir set "srcdir=."

+if not defined PERL set "PERL=perl"

+

+set "workdir=ssl_verify-certs"

+if exist "%workdir%" rmdir /s /q "%workdir%"

+mkdir "%workdir%" || exit /b 1

+pushd "%workdir%" || exit /b 1

+

+set "status=1"

+"%PERL%" "%srcdir%/create-libressl-test-certs.pl"

+if errorlevel 1 goto cleanup

+

+"%ssl_verify_bin%"

+set "status=%errorlevel%"

+

+:cleanup

+popd

+rmdir /s /q "%workdir%"

+exit /b %status%

diff --git a/tests/ssl_verify.sh b/tests/ssl_verify.sh
new file mode 100755
index 0000000..bb090db
--- /dev/null
+++ b/tests/ssl_verify.sh
@@ -0,0 +1,67 @@
+#!/bin/sh
+#
+# Copyright (c) 2026 Kenjiro Nakayama
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+set -e
+
+if [ -z "$srcdir" ]; then
+        srcdir=.
+fi
+
+if [ -z "$PERL" ]; then
+        PERL=perl
+fi
+
+case "$srcdir" in
+/*)
+        create_certs="$srcdir/create-libressl-test-certs.pl"
+        ;;
+*)
+        create_certs="`pwd`/$srcdir/create-libressl-test-certs.pl"
+        ;;
+esac
+
+if [ $# -ge 1 ]; then
+        verify_bin=$1
+else
+        verify_bin="`pwd`/ssl_verify"
+        if [ -e ./ssl_verify.exe ]; then
+                verify_bin="`pwd`/ssl_verify.exe"
+        fi
+fi
+
+workdir=ssl_verify-certs
+
+cleanup()
+{
+        rm -rf "$workdir"
+}
+trap cleanup EXIT
+
+rm -rf "$workdir"
+mkdir "$workdir"
+
+(
+        cd "$workdir"
+        "$PERL" "$create_certs"
+        case "$verify_bin" in
+        *.js)
+                node "$verify_bin"
+                ;;
+        *)
+                "$verify_bin"
+                ;;
+        esac
+)
diff --git a/tests/x509_callbacks.sh b/tests/x509_callbacks.sh
new file mode 100755
index 0000000..a48e638
--- /dev/null
+++ b/tests/x509_callbacks.sh
@@ -0,0 +1,94 @@
+#!/bin/sh
+#
+# Copyright (c) 2026 Kenjiro Nakayama
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+set -e
+
+if [ -z "$srcdir" ]; then
+        srcdir=.
+fi
+
+if [ -z "$PERL" ]; then
+        PERL=perl
+fi
+
+case "$srcdir" in
+/*)
+        certs_path="$srcdir/certs"
+        ca_file="$srcdir/../cert.pem"
+        callback_check="$srcdir/callback.pl"
+        make_dir_roots="$srcdir/make-dir-roots.pl"
+        openssl_conf="$srcdir/openssl.cnf"
+        ;;
+*)
+        certs_path="`pwd`/$srcdir/certs"
+        ca_file="`pwd`/$srcdir/../cert.pem"
+        callback_check="`pwd`/$srcdir/callback.pl"
+        make_dir_roots="`pwd`/$srcdir/make-dir-roots.pl"
+        openssl_conf="`pwd`/$srcdir/openssl.cnf"
+        ;;
+esac
+
+if [ $# -ge 3 ]; then
+        callback_bin=$1
+        callbackfailures_bin=$2
+        expirecallback_bin=$3
+else
+        callback_bin="`pwd`/callback"
+        callbackfailures_bin="`pwd`/callbackfailures"
+        expirecallback_bin="`pwd`/expirecallback"
+        if [ -e ./callback.exe ]; then
+                callback_bin="`pwd`/callback.exe"
+                callbackfailures_bin="`pwd`/callbackfailures.exe"
+                expirecallback_bin="`pwd`/expirecallback.exe"
+        fi
+fi
+
+if [ $# -ge 4 ]; then
+        openssl_dir=`dirname "$4"`
+elif [ -d ../apps/openssl ]; then
+        openssl_dir="`pwd`/../apps/openssl"
+else
+        openssl_dir="`pwd`/../apps"
+fi
+
+PATH="$openssl_dir:$PATH"
+export PATH
+
+if [ -f "$openssl_conf" ]; then
+        OPENSSL_CONF="$openssl_conf"
+        export OPENSSL_CONF
+fi
+
+workdir=x509_callback-certs
+
+cleanup()
+{
+        rm -rf "$workdir"
+}
+trap cleanup EXIT
+
+rm -rf "$workdir"
+mkdir "$workdir"
+
+"$PERL" "$make_dir_roots" "$certs_path" "$workdir"
+
+(
+        cd "$workdir"
+        "$callback_bin" "$certs_path"
+        "$PERL" "$callback_check" callback.out
+        "$callbackfailures_bin" "$certs_path" "$ca_file"
+        "$expirecallback_bin" "$certs_path"
+)
diff --git a/tests/x509_verify.sh b/tests/x509_verify.sh
new file mode 100755
index 0000000..b43063f
--- /dev/null
+++ b/tests/x509_verify.sh
@@ -0,0 +1,81 @@
+#!/bin/sh
+#
+# Copyright (c) 2026 Kenjiro Nakayama
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+set -e
+
+if [ -z "$srcdir" ]; then
+        srcdir=.
+fi
+
+if [ -z "$PERL" ]; then
+        PERL=perl
+fi
+
+case "$srcdir" in
+/*)
+        certs_path="$srcdir/certs"
+        make_dir_roots="$srcdir/make-dir-roots.pl"
+        openssl_conf="$srcdir/openssl.cnf"
+        ;;
+*)
+        certs_path="`pwd`/$srcdir/certs"
+        make_dir_roots="`pwd`/$srcdir/make-dir-roots.pl"
+        openssl_conf="`pwd`/$srcdir/openssl.cnf"
+        ;;
+esac
+
+if [ $# -ge 1 ]; then
+        verify_bin=$1
+else
+        verify_bin="`pwd`/x509_verify"
+        if [ -e ./x509_verify.exe ]; then
+                verify_bin="`pwd`/x509_verify.exe"
+        fi
+fi
+
+if [ $# -ge 2 ]; then
+        openssl_dir=`dirname "$2"`
+elif [ -d ../apps/openssl ]; then
+        openssl_dir="`pwd`/../apps/openssl"
+else
+        openssl_dir="`pwd`/../apps"
+fi
+
+PATH="$openssl_dir:$PATH"
+export PATH
+
+if [ -f "$openssl_conf" ]; then
+        OPENSSL_CONF="$openssl_conf"
+        export OPENSSL_CONF
+fi
+
+workdir=x509_verify-certs
+
+cleanup()
+{
+        rm -rf "$workdir"
+}
+trap cleanup EXIT
+
+rm -rf "$workdir"
+mkdir "$workdir"
+
+"$PERL" "$make_dir_roots" "$certs_path" "$workdir"
+
+(
+        cd "$workdir"
+        "$verify_bin" "$certs_path"
+)