Commit 42f8848ac6 for openssl.org

commit 42f8848ac6cbd727264fd3a9bfa97861e4ab71b5
Author: Neil Horman <nhorman@openssl.org>
Date:   Fri Jul 24 12:14:33 2026 -0400

    add a test to exercize the identity config directive on fips

    Reviewed-by: Bob Beck <beck@openssl.org>
    Reviewed-by: Simo Sorce <simo@redhat.com>
    MergeDate: Wed Aug 12 19:26:04 2026
    (Merged from https://github.com/openssl/openssl/pull/32060)

diff --git a/test/fipsidentity.cnf b/test/fipsidentity.cnf
new file mode 100644
index 0000000000..34bf5881d4
--- /dev/null
+++ b/test/fipsidentity.cnf
@@ -0,0 +1,19 @@
+openssl_conf = openssl_init
+
+# Comment out the next line to ignore configuration errors
+config_diagnostics = 1
+
+.include fipsmodule.cnf
+
+[openssl_init]
+providers = provider_sect
+
+[provider_sect]
+default = default_sect
+fips = fips_sect
+
+[default_sect]
+activate = yes
+
+[fips_sect]
+identity = fips-identity
diff --git a/test/recipes/20-test_cli_fips.t b/test/recipes/20-test_cli_fips.t
index 2abc4d2434..e4089cf03a 100644
--- a/test/recipes/20-test_cli_fips.t
+++ b/test/recipes/20-test_cli_fips.t
@@ -26,11 +26,12 @@ use platform;
 my $no_check = disabled("fips") || disabled('fips-securitychecks');
 plan skip_all => "Test only supported in a fips build with security checks"
     if $no_check;
-plan tests => 12;
+plan tests => 13;

 my $fipsmodule = bldtop_file('providers', platform->dso('fips'));
 my $fipsconf = srctop_file("test", "fips-and-base.cnf");
 my $defaultconf = srctop_file("test", "default.cnf");
+my $identityconf = srctop_file("test" ,"fips-identity.cnf");
 my $tbs_data = $fipsmodule;
 my $bogus_data = $fipsconf;

@@ -282,6 +283,43 @@ SKIP: {
     };
 }

+SKIP: {
+    skip "FIPS RSA tests because of no rsa in this build", 1
+        if disabled("rsa");
+
+    subtest RSA_identity => sub {
+        my $testtext_prefix = 'RSA';
+        my $fips_key = $testtext_prefix.'.fips.priv.pem';
+        my $fips_pub_key = $testtext_prefix.'.fips.pub.pem';
+        my $nonfips_key = $testtext_prefix.'.nonfips.priv.pem';
+        my $nonfips_pub_key = $testtext_prefix.'.nonfips.pub.pem';
+        my $testtext = '';
+
+        plan tests => 2;
+
+        my $destfips = bldtop_file("test-runs", "test_cli_fips", platform->dso("fips-identity"));
+        copy($fipsmodule, $destfips) or die("Couldn't copy file");
+        $ENV{OPENSSL_CONF} = $identityconf;
+        my $oldmodules = $ENV{OPENSSL_MODULES};
+        $ENV{OPENSSL_MODULES} = bldtop_dir("test-runs", "test_cli_fips");
+        $testtext = $testtext_prefix.': '.
+            'Generate a key with a non-FIPS algorithm with the default provider';
+        print "Running genpkey";
+        ok(run(app(['openssl', 'genpkey', '-algorithm', 'RSA',
+                    '-pkeyopt', 'rsa_keygen_bits:512',
+                    '-out', $nonfips_key])),
+           $testtext);
+
+        $testtext = $testtext_prefix.': '.
+            'Generate a key with a FIPS algorithm';
+        ok(run(app(['openssl', 'genpkey', '-algorithm', 'RSA',
+                    '-pkeyopt', 'rsa_keygen_bits:2048',
+                    '-out', $fips_key])),
+           $testtext);
+        $ENV{OPENSSL_MODULES} = $oldmodules;
+    };
+}
+
 SKIP : {
     skip "FIPS DSA tests because of no dsa in this build", 1
         if disabled("dsa") || $dsasignpass == '0';