Commit 28071a8c01 for openssl.org

commit 28071a8c0112c0bebfaa5eb73ddf051d94d9e3b4
Author: Jakub Zelenka <jakub.zelenka@openssl.foundation>
Date:   Thu Jul 9 09:27:35 2026 +0200

    apps: cover the req -pkeyopt option

    The -pkeyopt option of the req app was previously untested. It adds a
    subtest that generates an EC request with -pkeyopt
    ec_paramgen_curve:P-384 and verifies the selected curve is used, and
    that an unknown -pkeyopt value makes the command fail.

    Assisted-by: Claude:claude-opus-4-8

    Reviewed-by: Paul Dale <paul.dale@oracle.com>
    Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
    MergeDate: Mon Jul 13 15:36:42 2026
    (Merged from https://github.com/openssl/openssl/pull/31905)

diff --git a/test/recipes/25-test_req.t b/test/recipes/25-test_req.t
index b23e41ee2c..a37686736f 100644
--- a/test/recipes/25-test_req.t
+++ b/test/recipes/25-test_req.t
@@ -15,7 +15,7 @@ use OpenSSL::Test qw/:DEFAULT srctop_file/;

 setup("test_req");

-plan tests => 130;
+plan tests => 131;

 require_ok(srctop_file('test', 'recipes', 'tconversion.pl'));

@@ -522,6 +522,34 @@ subtest "generating certificate with -set_serial" => sub {
        "Supplying -set_serial twice fails");
 };

+subtest "generating certificate requests with -pkeyopt" => sub {
+    plan tests => 3;
+
+    SKIP: {
+        skip "EC is not supported by this OpenSSL build", 3 if disabled("ec");
+
+        my $key = "testreq-pkeyopt-key.pem";
+        my $req = "testreq-pkeyopt.pem";
+        my $text = "testreq-pkeyopt.txt";
+
+        ok(run(app(["openssl", "req", "-new",
+                    "-config", srctop_file("test", "test.cnf"),
+                    "-newkey", "ec", "-pkeyopt", "ec_paramgen_curve:P-384",
+                    "-nodes", "-keyout", $key, "-out", $req])),
+           "Generating request with -pkeyopt ec_paramgen_curve:P-384");
+
+        run(app(["openssl", "req", "-in", $req, "-noout", "-text",
+                 "-out", $text]));
+        test_file_contains("request", $text, "ASN1 OID: secp384r1", 1);
+
+        ok(!run(app(["openssl", "req", "-new",
+                     "-config", srctop_file("test", "test.cnf"),
+                     "-newkey", "ec", "-pkeyopt", "bogus_opt:1",
+                     "-nodes", "-keyout", $key, "-out", $req])),
+           "Supplying an unknown -pkeyopt fails");
+    }
+};
+
 my @openssl_args = ("req", "-config", srctop_file("apps", "openssl.cnf"));

 run_conversion('req conversions',