Commit 4f258c3f3c for openssl.org
commit 4f258c3f3c016502b04681c2eb4c6732525beed5
Author: John Claus <johnclaus@gmail.com>
Date: Fri Apr 10 03:21:30 2026 -0600
Fix DSA with SHA-384 / SHA-512 X.509 verification (issue openssl#30432)
Register dsa_with_SHA384 and dsa_with_SHA512 in obj_xref so signature verification resolves digest + DSA key type.
Add test_verify regression tests and PEM fixtures; add executable DSA cert generation in test/certs/setup.sh. CHANGES.md and NEWS.md entries for 4.0→4.1.
Address review: plan tests 215, remove CHANGES merge artifact, replace comment-only setup.sh notes with actual openssl commands.
Fixes openssl#30432
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Mon Jul 20 11:10:47 2026
(Merged from https://github.com/openssl/openssl/pull/30655)
diff --git a/CHANGES.md b/CHANGES.md
index 6a262083a2..6fb71f7d9c 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -180,6 +180,12 @@ OpenSSL Releases
*Bob Beck*
+ * Fixed X.509 verification of certificate chains that use DSA signatures
+ with SHA-384 or SHA-512 by registering `dsa_with_SHA384` and
+ `dsa_with_SHA512` in the signature-algorithm cross-reference table.
+
+ *John Claus*
+
* Added AVX2 optimized ML-DSA NTT operations on `x86_64`.
*Marcel Cornu and Tomasz Kantecki*
diff --git a/NEWS.md b/NEWS.md
index 278ec1309d..239f195de0 100644
--- a/NEWS.md
+++ b/NEWS.md
@@ -31,6 +31,8 @@ OpenSSL 4.1
* API calls `CRYPTO_atomic_load_ptr`, `CRYPTO_atomic_store_ptr`, and
`CRYPTO_atomic_cmp_exch_ptr` have been added.
+ * Fixed verification of DSA certificates signed with SHA-384 or SHA-512.
+
OpenSSL 4.0
-----------
diff --git a/crypto/objects/obj_xref.h b/crypto/objects/obj_xref.h
index 955571e134..46de3ccf4a 100644
--- a/crypto/objects/obj_xref.h
+++ b/crypto/objects/obj_xref.h
@@ -81,6 +81,8 @@ static const nid_triple sigoid_srt[] = {
NID_id_GostR3410_2012_512},
{NID_ED25519, NID_undef, NID_ED25519},
{NID_ED448, NID_undef, NID_ED448},
+ {NID_dsa_with_SHA384, NID_sha384, NID_dsa},
+ {NID_dsa_with_SHA512, NID_sha512, NID_dsa},
{NID_ecdsa_with_SHA3_224, NID_sha3_224, NID_X9_62_id_ecPublicKey},
{NID_ecdsa_with_SHA3_256, NID_sha3_256, NID_X9_62_id_ecPublicKey},
{NID_ecdsa_with_SHA3_384, NID_sha3_384, NID_X9_62_id_ecPublicKey},
@@ -129,10 +131,12 @@ static const nid_triple *const sigoid_srt_xref[] = {
&sigoid_srt[32],
&sigoid_srt[37],
&sigoid_srt[14],
+ &sigoid_srt[44],
&sigoid_srt[21],
&sigoid_srt[33],
&sigoid_srt[38],
&sigoid_srt[15],
+ &sigoid_srt[45],
&sigoid_srt[22],
&sigoid_srt[34],
&sigoid_srt[39],
@@ -147,15 +151,15 @@ static const nid_triple *const sigoid_srt_xref[] = {
&sigoid_srt[28],
&sigoid_srt[40],
&sigoid_srt[41],
- &sigoid_srt[48],
- &sigoid_srt[44],
- &sigoid_srt[49],
- &sigoid_srt[45],
&sigoid_srt[50],
&sigoid_srt[46],
&sigoid_srt[51],
&sigoid_srt[47],
&sigoid_srt[52],
+ &sigoid_srt[48],
+ &sigoid_srt[53],
+ &sigoid_srt[49],
+ &sigoid_srt[54],
};
/* clang-format on */
diff --git a/crypto/objects/obj_xref.txt b/crypto/objects/obj_xref.txt
index 71bc12af74..2f82617a84 100644
--- a/crypto/objects/obj_xref.txt
+++ b/crypto/objects/obj_xref.txt
@@ -64,6 +64,8 @@ ecdsa_with_SHA3_512 sha3_512 X9_62_id_ecPublicKey
dsa_with_SHA224 sha224 dsa
dsa_with_SHA256 sha256 dsa
+dsa_with_SHA384 sha384 dsa
+dsa_with_SHA512 sha512 dsa
id_GostR3411_94_with_GostR3410_2001 id_GostR3411_94 id_GostR3410_2001
id_GostR3411_94_with_GostR3410_94 id_GostR3411_94 id_GostR3410_94
diff --git a/test/certs/ee-cert-dsa-sha384.pem b/test/certs/ee-cert-dsa-sha384.pem
new file mode 100644
index 0000000000..ab3fe14687
--- /dev/null
+++ b/test/certs/ee-cert-dsa-sha384.pem
@@ -0,0 +1,26 @@
+-----BEGIN CERTIFICATE-----
+MIIEdjCCBCSgAwIBAgIUNbayaptPn6T0hvP2mKuB8L/W9k8wCwYJYIZIAWUDBAMD
+MCgxJjAkBgNVBAMMHU9wZW5TU0wgVGVzdCBEU0EgU0hBLTM4NCBSb290MB4XDTI2
+MDQxMDA3MzMzMFoXDTM2MDQwNzA3MzMzMFowJjEkMCIGA1UEAwwbT3BlblNTTCBU
+ZXN0IERTQSBTSEEtMzg0IEVFMIIDQjCCAjUGByqGSM44BAEwggIoAoIBAQDA154m
+/UL7G6MMLDAr2BoxQzgT8eNaOV2Ls89BvjF3SS9qgOMQSv9TK8gcb16jpqd6aQ6G
+WLedKu3fRUrXCihRaZZaeftJCntAVaDIhtYaYdsua6IDGjWd1SHHmFdQnH3AYLxV
+dRmnq3Jjt6oelPQYKDbpWAtT8DsFJ/d6bGpQ6mxW4J1u1FnmKwzuxbR/ZxOV1gQy
+D08gfkct7+UtQ5rJUIiIeK2RWsJhF6tdvH+g8VhBXsXo0ZprA/iQHst/aeXSGUBC
++vby1LYog2VFLXD+zl5rzXZUNJLXPt/9Dvs/qYknPlUEboQ8J/afbyuA8S10gsAu
+8bnyQ/oTzmA+4Uy5Ah0A0QDXg1zTwGDdtB3OqMZOhhyL+oLzZeFsowwBzwKCAQAs
+wjjcjD2G/brbwZuNaZWDHqrpTmmAhvg17+QGp9gaWWb/08TfZ+PbhIL4jV8kf5PZ
+kPZVJyocYGduRJsIxiJDlssdaYzgkJ4zJG0A6gYtpBpaD/h6di0E0nzjm+80a9jo
+xrgq3jRxkGVHpHvDd4ps0q2UXH44nFCEPWaoebpR4BXCLzXuFw30gUldrClqcMWt
+OqQUwf7/ZndhQvLA2PiJEC/5EQFzeMzjl+XAOjW+781rO8BPmniFVXmRGAVWCycL
+Qj0pQzvfDDi1M4LZBAw+g6RAa/IAB1mpKNOfsh2wDYS+nJn6q77COZRVn0DZLiVz
+M8ENRqH0uRF1osCgqAuBA4IBBQACggEAXj8recOQ2JRABFgypUmG2PA0ibD5z1j3
+Xx7i5UXdwzOMJrtPtzjTmykgg73JpYA38kyqUtaZLKqtR2up+M9Bpj0l8GPZ5brM
+E5zJbWukvSw8pnAUvq92izRHlmEK7QUPrkYM2e+NjJKYEOeJ8I1O7mZUBHNsbYGW
+jGi0FW+LpcUywCUH7ccxHLFBXJnMUS7zipc6fwBjumFtYTyjsoeE5pyVGs6Cau0o
+dzCgR3Ss0gc73qnHv+7t4NP2385AaTKhNeykrtwhrFL6MDGYf0Bs2Y5SE5vEnIZJ
+Rb4I+8YnhsxaPGiKy9N6R+1CisnBg+4cx1mEVl3moQtAT6POruJaMqNCMEAwHQYD
+VR0OBBYEFNfDDHDjB5VsPYFzEcuRXWZilvyIMB8GA1UdIwQYMBaAFDXj0oV+Bxtx
+dRByLwz7g8OjZg/ZMAsGCWCGSAFlAwQDAwM/ADA8AhwezQQknbLR8wtcYnQJLvlv
+tILlrOxyRlvUCUGtAhxGW+R77sJNGghc76jH+g3Kkent+0+G3VxrgrOc
+-----END CERTIFICATE-----
diff --git a/test/certs/ee-cert-dsa-sha512.pem b/test/certs/ee-cert-dsa-sha512.pem
new file mode 100644
index 0000000000..e3741ed0dd
--- /dev/null
+++ b/test/certs/ee-cert-dsa-sha512.pem
@@ -0,0 +1,26 @@
+-----BEGIN CERTIFICATE-----
+MIIEdzCCBCSgAwIBAgIUG0h9XyzEews1+X1q3CMHaNZuXhkwCwYJYIZIAWUDBAME
+MCgxJjAkBgNVBAMMHU9wZW5TU0wgVGVzdCBEU0EgU0hBLTUxMiBSb290MB4XDTI2
+MDQxMDA3MzMzMFoXDTM2MDQwNzA3MzMzMFowJjEkMCIGA1UEAwwbT3BlblNTTCBU
+ZXN0IERTQSBTSEEtNTEyIEVFMIIDQjCCAjUGByqGSM44BAEwggIoAoIBAQDA154m
+/UL7G6MMLDAr2BoxQzgT8eNaOV2Ls89BvjF3SS9qgOMQSv9TK8gcb16jpqd6aQ6G
+WLedKu3fRUrXCihRaZZaeftJCntAVaDIhtYaYdsua6IDGjWd1SHHmFdQnH3AYLxV
+dRmnq3Jjt6oelPQYKDbpWAtT8DsFJ/d6bGpQ6mxW4J1u1FnmKwzuxbR/ZxOV1gQy
+D08gfkct7+UtQ5rJUIiIeK2RWsJhF6tdvH+g8VhBXsXo0ZprA/iQHst/aeXSGUBC
++vby1LYog2VFLXD+zl5rzXZUNJLXPt/9Dvs/qYknPlUEboQ8J/afbyuA8S10gsAu
+8bnyQ/oTzmA+4Uy5Ah0A0QDXg1zTwGDdtB3OqMZOhhyL+oLzZeFsowwBzwKCAQAs
+wjjcjD2G/brbwZuNaZWDHqrpTmmAhvg17+QGp9gaWWb/08TfZ+PbhIL4jV8kf5PZ
+kPZVJyocYGduRJsIxiJDlssdaYzgkJ4zJG0A6gYtpBpaD/h6di0E0nzjm+80a9jo
+xrgq3jRxkGVHpHvDd4ps0q2UXH44nFCEPWaoebpR4BXCLzXuFw30gUldrClqcMWt
+OqQUwf7/ZndhQvLA2PiJEC/5EQFzeMzjl+XAOjW+781rO8BPmniFVXmRGAVWCycL
+Qj0pQzvfDDi1M4LZBAw+g6RAa/IAB1mpKNOfsh2wDYS+nJn6q77COZRVn0DZLiVz
+M8ENRqH0uRF1osCgqAuBA4IBBQACggEADpK5z3E7aC/bPkHbIApYwMui0PlPm9mZ
+fJcOUYkUxrGwsVB7MLlFKaYogohKW/6llyTQ9KVv0GhXGBU8KZAwYi2IvEqZWt96
+QWMReZkr85mcfWPPr0nhPaiKPFLuzbrJS5+8pRZ0JZICAs7fWK2ieTFzF5T52+uU
+HW3d8hRW0faGy3JVChySx2zKhznax0ugOeO6xpw+GIhh7DtoLN9+WCUD4gHxcT1e
+ngH3SPr9kSAc179ZheLPV8K96D6h62xLyDOv66jKqxuEuwKMezKhI8NoWlIjFlwq
+qeg+/URRSKaemF7CeEtjfxfyhPyWFBA3ied6v8lgcvm8xEK1fOuWtaNCMEAwHQYD
+VR0OBBYEFG70aEHyZTHkRfESJAk59LuyXqj2MB8GA1UdIwQYMBaAFLO3mEJ4Js8i
+80dWuZffkE17675DMAsGCWCGSAFlAwQDBANAADA9AhxQI/S0oZhUBxth3amipFkw
+px3NJNYZEdKm1x4hAh0AotKopAK/hiDc2IGgHC+L2kjsvg/tqofl54aZ6w==
+-----END CERTIFICATE-----
diff --git a/test/certs/root-cert-dsa-sha384.pem b/test/certs/root-cert-dsa-sha384.pem
new file mode 100644
index 0000000000..107e855b42
--- /dev/null
+++ b/test/certs/root-cert-dsa-sha384.pem
@@ -0,0 +1,27 @@
+-----BEGIN CERTIFICATE-----
+MIIEizCCBDigAwIBAgIUL44kPKEDy7eaEgXNH4xXTuVw77owCwYJYIZIAWUDBAMD
+MCgxJjAkBgNVBAMMHU9wZW5TU0wgVGVzdCBEU0EgU0hBLTM4NCBSb290MB4XDTI2
+MDQxMDA3MzMzMFoXDTM2MDQwNzA3MzMzMFowKDEmMCQGA1UEAwwdT3BlblNTTCBU
+ZXN0IERTQSBTSEEtMzg0IFJvb3QwggNDMIICNQYHKoZIzjgEATCCAigCggEBAMDX
+nib9QvsbowwsMCvYGjFDOBPx41o5XYuzz0G+MXdJL2qA4xBK/1MryBxvXqOmp3pp
+DoZYt50q7d9FStcKKFFpllp5+0kKe0BVoMiG1hph2y5rogMaNZ3VIceYV1CcfcBg
+vFV1GaercmO3qh6U9BgoNulYC1PwOwUn93psalDqbFbgnW7UWeYrDO7FtH9nE5XW
+BDIPTyB+Ry3v5S1DmslQiIh4rZFawmEXq128f6DxWEFexejRmmsD+JAey39p5dIZ
+QEL69vLUtiiDZUUtcP7OXmvNdlQ0ktc+3/0O+z+piSc+VQRuhDwn9p9vK4DxLXSC
+wC7xufJD+hPOYD7hTLkCHQDRANeDXNPAYN20Hc6oxk6GHIv6gvNl4WyjDAHPAoIB
+ACzCONyMPYb9utvBm41plYMequlOaYCG+DXv5Aan2BpZZv/TxN9n49uEgviNXyR/
+k9mQ9lUnKhxgZ25EmwjGIkOWyx1pjOCQnjMkbQDqBi2kGloP+Hp2LQTSfOOb7zRr
+2OjGuCreNHGQZUeke8N3imzSrZRcfjicUIQ9Zqh5ulHgFcIvNe4XDfSBSV2sKWpw
+xa06pBTB/v9md2FC8sDY+IkQL/kRAXN4zOOX5cA6Nb7vzWs7wE+aeIVVeZEYBVYL
+JwtCPSlDO98MOLUzgtkEDD6DpEBr8gAHWako05+yHbANhL6cmfqrvsI5lFWfQNku
+JXMzwQ1GofS5EXWiwKCoC4EDggEGAAKCAQEAqBWUzoivwm10KhCOVj4dLJ376hik
+coO7wh8szq+0lBCKVQu0XgZdpR67ibiInCslpi4D31QX1ciP8Ds3Tnr92Xq9fp6F
+Q9+M94it5BWvXq8uWnsCYRLIXds+8DKnUMTPc0U5Qc/HnfkdgHockBya5ZKRLzgW
+THC5n29NjBoIH9TBFddxanUqOqM2a0+0uC23jC/rmsmIXKKLIRnBjDjCfWGkpvDR
+V0TmgU+wBN7Fu6/PDdb2h1omgx5iJ0hR9bSQMevPzxKWIIYt3jBa3JWRJVshZbCX
+zGSycHIM4IPPEWtDEMR/s/aO5+HcQdV42itClvOQxhVfYTtBCV8TiMYFAKNTMFEw
+HQYDVR0OBBYEFDXj0oV+BxtxdRByLwz7g8OjZg/ZMB8GA1UdIwQYMBaAFDXj0oV+
+BxtxdRByLwz7g8OjZg/ZMA8GA1UdEwEB/wQFMAMBAf8wCwYJYIZIAWUDBAMDA0AA
+MD0CHQC/zbfFT+FeeYr9PmYtblMAGmtUgM2VyUcargqPAhwnaYxJwO0tJHKZDXOG
+38UfhwBTUj0PNyAwbOG/
+-----END CERTIFICATE-----
diff --git a/test/certs/root-cert-dsa-sha512.pem b/test/certs/root-cert-dsa-sha512.pem
new file mode 100644
index 0000000000..5dbe393aea
--- /dev/null
+++ b/test/certs/root-cert-dsa-sha512.pem
@@ -0,0 +1,27 @@
+-----BEGIN CERTIFICATE-----
+MIIEiTCCBDagAwIBAgITGBs2j74eZNOfebavEYuJJZKVKTALBglghkgBZQMEAwQw
+KDEmMCQGA1UEAwwdT3BlblNTTCBUZXN0IERTQSBTSEEtNTEyIFJvb3QwHhcNMjYw
+NDEwMDczMzMwWhcNMzYwNDA3MDczMzMwWjAoMSYwJAYDVQQDDB1PcGVuU1NMIFRl
+c3QgRFNBIFNIQS01MTIgUm9vdDCCA0IwggI1BgcqhkjOOAQBMIICKAKCAQEAwNee
+Jv1C+xujDCwwK9gaMUM4E/HjWjldi7PPQb4xd0kvaoDjEEr/UyvIHG9eo6anemkO
+hli3nSrt30VK1wooUWmWWnn7SQp7QFWgyIbWGmHbLmuiAxo1ndUhx5hXUJx9wGC8
+VXUZp6tyY7eqHpT0GCg26VgLU/A7BSf3emxqUOpsVuCdbtRZ5isM7sW0f2cTldYE
+Mg9PIH5HLe/lLUOayVCIiHitkVrCYRerXbx/oPFYQV7F6NGaawP4kB7Lf2nl0hlA
+Qvr28tS2KINlRS1w/s5ea812VDSS1z7f/Q77P6mJJz5VBG6EPCf2n28rgPEtdILA
+LvG58kP6E85gPuFMuQIdANEA14Nc08Bg3bQdzqjGToYci/qC82XhbKMMAc8CggEA
+LMI43Iw9hv2628GbjWmVgx6q6U5pgIb4Ne/kBqfYGllm/9PE32fj24SC+I1fJH+T
+2ZD2VScqHGBnbkSbCMYiQ5bLHWmM4JCeMyRtAOoGLaQaWg/4enYtBNJ845vvNGvY
+6Ma4Kt40cZBlR6R7w3eKbNKtlFx+OJxQhD1mqHm6UeAVwi817hcN9IFJXawpanDF
+rTqkFMH+/2Z3YULywNj4iRAv+REBc3jM45flwDo1vu/NazvAT5p4hVV5kRgFVgsn
+C0I9KUM73ww4tTOC2QQMPoOkQGvyAAdZqSjTn7IdsA2EvpyZ+qu+wjmUVZ9A2S4l
+czPBDUah9LkRdaLAoKgLgQOCAQUAAoIBAAHb5mq9RGf+mLtQi12GnLIlWF45bhHr
+0+gNYMzTA7PBzb/E+SfeizOnNuJtNU3LSiNE+sHNMnn/WY4KvjMCryuRxz7b8Y8+
+0nGwN0YfyY/cK5CehRa+lfhahlTorF8VY98gcQJOyKjG0eloZ8H29MhPhYTF0qTS
+5dbDb4nf5r5Uqx5/6gBmskpMG+xiXA2I7q2aLW92pZrFWYrkrNgaAAQqSl0whhG6
+EZXP6fAbndJbt706xFlySr/ZHkgWybEAXYO8TbjyDkZP/h9UyR6CnKeb3L6qw8be
+8U5scYfx2HjhCv5GLqqauRm+0oJwbXmOWuMpeynGHy24O+wKAX/ePhujUzBRMB0G
+A1UdDgQWBBSzt5hCeCbPIvNHVrmX35BNe+u+QzAfBgNVHSMEGDAWgBSzt5hCeCbP
+IvNHVrmX35BNe+u+QzAPBgNVHRMBAf8EBTADAQH/MAsGCWCGSAFlAwQDBANAADA9
+AhxgdnguNQoOQZyseelUWc5tD7m/ESvTuAV2aiEwAh0Apmc4SMIg7nKTA2jp7M1E
+V7kA7INPUKKx/+iWgA==
+-----END CERTIFICATE-----
diff --git a/test/certs/setup.sh b/test/certs/setup.sh
index 3bee78ec32..3056b1f90a 100755
--- a/test/certs/setup.sh
+++ b/test/certs/setup.sh
@@ -497,6 +497,37 @@ OPENSSL_SIGALG="sha3-256" ./mkcert.sh genee server.example ee-key-ec-named-named
OPENSSL_SIGALG="sha3-384" ./mkcert.sh genee server.example ee-key-ec-named-named ee-cert-ec-sha3-384 ca-key-ec-named ca-cert-ec-named
OPENSSL_SIGALG="sha3-512" ./mkcert.sh genee server.example ee-key-ec-named-named ee-cert-ec-sha3-512 ca-key-ec-named ca-cert-ec-named
+# DSA roots and EE certs: id-dsa-with-sha384 / id-dsa-with-sha512
+# (regression for https://github.com/openssl/openssl/issues/30432)
+_DSA_CERT_DIR=$(cd "$(dirname "$0")" && pwd)
+(
+ set -e
+ d=$(mktemp -d)
+ trap 'rm -rf "$d"' EXIT
+ cd "$d"
+ openssl dsaparam -out dsap.pem 2048
+ openssl gendsa -out ca384k.pem dsap.pem
+ openssl req -new -x509 -key ca384k.pem -sha384 -out root-cert-dsa-sha384.pem \
+ -days 3650 -subj "/CN=OpenSSL Test DSA SHA-384 Root" -nodes
+ openssl gendsa -out ee384k.pem dsap.pem
+ openssl req -new -key ee384k.pem -out ee384.csr \
+ -subj "/CN=OpenSSL Test DSA SHA-384 EE"
+ openssl x509 -req -in ee384.csr -CA root-cert-dsa-sha384.pem -CAkey ca384k.pem \
+ -CAcreateserial -out ee-cert-dsa-sha384.pem -days 3650 -sha384
+ openssl gendsa -out ca512k.pem dsap.pem
+ openssl req -new -x509 -key ca512k.pem -sha512 -out root-cert-dsa-sha512.pem \
+ -days 3650 -subj "/CN=OpenSSL Test DSA SHA-512 Root" -nodes
+ openssl gendsa -out ee512k.pem dsap.pem
+ openssl req -new -key ee512k.pem -out ee512.csr \
+ -subj "/CN=OpenSSL Test DSA SHA-512 EE"
+ openssl x509 -req -in ee512.csr -CA root-cert-dsa-sha512.pem -CAkey ca512k.pem \
+ -CAcreateserial -out ee-cert-dsa-sha512.pem -days 3650 -sha512
+ cp root-cert-dsa-sha384.pem ee-cert-dsa-sha384.pem \
+ root-cert-dsa-sha512.pem ee-cert-dsa-sha512.pem \
+ "$_DSA_CERT_DIR"
+)
+unset _DSA_CERT_DIR
+
# EC cert seigned RSA intermediate CA
OPENSSL_KEYALG=ec OPENSSL_KEYBITS=prime256v1 ./mkcert.sh genee \
"P-256 cert EE issuer" p256-ee-rsa-ca-key \
diff --git a/test/recipes/25-test_verify.t b/test/recipes/25-test_verify.t
index 9564e78153..6efe24087a 100644
--- a/test/recipes/25-test_verify.t
+++ b/test/recipes/25-test_verify.t
@@ -30,7 +30,7 @@ sub verify {
run(app([@args]));
}
-plan tests => 219;
+plan tests => 221;
# Canonical success
ok(verify("ee-cert", "sslserver", ["root-cert"], ["ca-cert"]),
@@ -362,6 +362,17 @@ SKIP: {
ok(verify("ee-cert-ec-sha3-512", "", ["root-cert"], ["ca-cert-ec-named"], ),
"accept cert generated with EC and SHA3-512");
}
+
+# DSA chains using id-dsa-with-sha384 / id-dsa-with-sha512 (GitHub issue #30432)
+SKIP: {
+ skip "DSA is not supported by this OpenSSL build", 2
+ if disabled("dsa");
+
+ ok(verify("ee-cert-dsa-sha384", "", ["root-cert-dsa-sha384"], [], ),
+ "accept DSA cert chain with SHA-384 signatures");
+ ok(verify("ee-cert-dsa-sha512", "", ["root-cert-dsa-sha512"], [], ),
+ "accept DSA cert chain with SHA-512 signatures");
+}
# Same as above but with base provider used for decoding
SKIP: {
my $no_fips = disabled('fips') || ($ENV{NO_FIPS} // 0);