Commit 4063c6d857 for bind

commit 4063c6d8576fd4d9c2b873fd4fad319e610ce8c4
Author: Mark Andrews <marka@isc.org>
Date:   Wed Sep 30 12:28:57 2026 +1000

    Tests if SSL Key negotiation logging worked

diff --git a/bin/tests/system/doth/ns1/named.env b/bin/tests/system/doth/ns1/named.env
new file mode 100644
index 0000000000..e6ac9c94e9
--- /dev/null
+++ b/bin/tests/system/doth/ns1/named.env
@@ -0,0 +1,2 @@
+# Log SSL key negotiation to named.sslkeylogfile
+SSLKEYLOGFILE=named.sslkeylogfile
diff --git a/bin/tests/system/doth/ns2/named.env b/bin/tests/system/doth/ns2/named.env
new file mode 100644
index 0000000000..629c6a6949
--- /dev/null
+++ b/bin/tests/system/doth/ns2/named.env
@@ -0,0 +1,2 @@
+# An empty SSLKEYLOGFILE environment variable
+SSLKEYLOGFILE=
diff --git a/bin/tests/system/doth/tests.sh b/bin/tests/system/doth/tests.sh
index 3fa763bfc7..a22ec23c93 100644
--- a/bin/tests/system/doth/tests.sh
+++ b/bin/tests/system/doth/tests.sh
@@ -884,5 +884,15 @@ grep "status: SERVFAIL" dig.out.test$n >/dev/null || ret=1
 if test $ret != 0; then echo_i "failed"; fi
 status=$((status + ret))

+n=$((n + 1))
+echo_i "tests if SSL Key negotiation logging worked ($n)"
+ret=0
+if test -s ns1/named.sslkeylogfile; then
+  grep SERVER_HANDSHAKE_TRAFFIC_SECRET ns1/named.sslkeylogfile >/dev/null || ret=1
+  grep CLIENT_HANDSHAKE_TRAFFIC_SECRET ns1/named.sslkeylogfile >/dev/null || ret=1
+else
+  ret=1
+fi
+
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/doth/tests_gnutls.py b/bin/tests/system/doth/tests_gnutls.py
index ffe5fbebe9..dda956946c 100644
--- a/bin/tests/system/doth/tests_gnutls.py
+++ b/bin/tests/system/doth/tests_gnutls.py
@@ -28,6 +28,7 @@ EXTRA_ARTIFACTS = pytest.mark.extra_artifacts(
     [
         "gnutls-cli.*",
         "ns*/example*.db",
+        "ns1/named.sslkeylogfile",
     ]
 )

diff --git a/bin/tests/system/doth/tests_sh_doth.py b/bin/tests/system/doth/tests_sh_doth.py
index b4e9dbd8b5..fa3c57efc7 100644
--- a/bin/tests/system/doth/tests_sh_doth.py
+++ b/bin/tests/system/doth/tests_sh_doth.py
@@ -17,6 +17,7 @@ EXTRA_ARTIFACTS = pytest.mark.extra_artifacts(
     [
         "dig.out.*",
         "ns*/example*.db",
+        "ns1/named.sslkeylogfile",
     ]
 )

diff --git a/bin/tests/system/doth/tests_sslyze.py b/bin/tests/system/doth/tests_sslyze.py
index f3a7502939..c58c4ea64c 100644
--- a/bin/tests/system/doth/tests_sslyze.py
+++ b/bin/tests/system/doth/tests_sslyze.py
@@ -22,6 +22,7 @@ EXTRA_ARTIFACTS = pytest.mark.extra_artifacts(
     [
         "sslyze.log.*",
         "ns*/example*.db",
+        "ns1/named.sslkeylogfile",
     ]
 )