Commit f2d0bb7f69 for openssl.org

commit f2d0bb7f6951cdc1aa1e4a5cad12424f9e36df9b
Author: Mounir IDRASSI <mounir.idrassi@idrix.fr>
Date:   Mon Aug 10 22:18:49 2026 +0900

    Fix RSA SHA-512 truncated digest signature mappings

    Register the missing RSA signature OID mappings for SHA-512/224 and SHA-512/256.

    This lets certificate request and X.509 verification resolve the digest and key type.

    Fixes #32252

    Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
    Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
    Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
    Merge-date: Wed Aug 12 10:07:33 2026
    Merged-from: https://github.com/openssl/openssl/pull/32269

diff --git a/crypto/objects/obj_xref.h b/crypto/objects/obj_xref.h
index 46de3ccf4a..2a393e977d 100644
--- a/crypto/objects/obj_xref.h
+++ b/crypto/objects/obj_xref.h
@@ -91,6 +91,8 @@ static const nid_triple sigoid_srt[] = {
     {NID_RSA_SHA3_256, NID_sha3_256, NID_rsaEncryption},
     {NID_RSA_SHA3_384, NID_sha3_384, NID_rsaEncryption},
     {NID_RSA_SHA3_512, NID_sha3_512, NID_rsaEncryption},
+    {NID_sha512_224WithRSAEncryption, NID_sha512_224, NID_rsaEncryption},
+    {NID_sha512_256WithRSAEncryption, NID_sha512_256, NID_rsaEncryption},
     {NID_SM2_with_SM3, NID_sm3, NID_sm2},
     {NID_ML_DSA_44, NID_undef, NID_ML_DSA_44},
     {NID_ML_DSA_65, NID_undef, NID_ML_DSA_65},
@@ -151,6 +153,8 @@ static const nid_triple *const sigoid_srt_xref[] = {
     &sigoid_srt[28],
     &sigoid_srt[40],
     &sigoid_srt[41],
+    &sigoid_srt[54],
+    &sigoid_srt[55],
     &sigoid_srt[50],
     &sigoid_srt[46],
     &sigoid_srt[51],
@@ -159,7 +163,7 @@ static const nid_triple *const sigoid_srt_xref[] = {
     &sigoid_srt[48],
     &sigoid_srt[53],
     &sigoid_srt[49],
-    &sigoid_srt[54],
+    &sigoid_srt[56],
 };
 /* clang-format on */

diff --git a/crypto/objects/obj_xref.txt b/crypto/objects/obj_xref.txt
index 2f82617a84..e0ab9ecf43 100644
--- a/crypto/objects/obj_xref.txt
+++ b/crypto/objects/obj_xref.txt
@@ -11,6 +11,8 @@ sha256WithRSAEncryption sha256	rsaEncryption
 sha384WithRSAEncryption	sha384	rsaEncryption
 sha512WithRSAEncryption	sha512	rsaEncryption
 sha224WithRSAEncryption	sha224	rsaEncryption
+sha512_224WithRSAEncryption sha512_224 rsaEncryption
+sha512_256WithRSAEncryption sha512_256 rsaEncryption
 mdc2WithRSA		mdc2	rsaEncryption
 ripemd160WithRSA	ripemd160 rsaEncryption
 RSA_SHA3_224		sha3_224 rsaEncryption
diff --git a/test/recipes/25-test_req.t b/test/recipes/25-test_req.t
index 67ad5b7a17..069b5474a3 100644
--- a/test/recipes/25-test_req.t
+++ b/test/recipes/25-test_req.t
@@ -15,7 +15,7 @@ use OpenSSL::Test qw/:DEFAULT srctop_file/;

 setup("test_req");

-plan tests => 132;
+plan tests => 133;

 require_ok(srctop_file('test', 'recipes', 'tconversion.pl'));

@@ -147,6 +147,28 @@ subtest "generating certificate requests with RSA" => sub {
     }
 };

+subtest "RSA requests with truncated SHA-512 digests" => sub {
+    plan tests => 2;
+
+    SKIP: {
+        skip "RSA is not supported by this OpenSSL build", 2
+            if disabled("rsa");
+
+        foreach my $digest ("sha512-224", "sha512-256") {
+            my $request = "testreq-rsa-$digest.pem";
+
+            ok(run(app(["openssl", "req",
+                        "-config", srctop_file("test", "test.cnf"),
+                        "-new", "-out", $request,
+                        "-key", srctop_file("test", "testrsa.pem"),
+                        "-$digest"]))
+               && run(app(["openssl", "req", "-verify",
+                           "-in", $request, "-noout"])),
+               "Generating and verifying request with RSA and $digest");
+        }
+    }
+};
+
 subtest "generating certificate requests with RSA-PSS" => sub {
     plan tests => 12;