Commit 12e823ba6d for openssl.org

commit 12e823ba6d9e7bbc572605442652390252705a0d
Author: Dr. David von Oheimb <dev@ddvo.net>
Date:   Wed Aug 26 08:48:14 2026 +0200

    25-test_verify.t and test/certs/: add mixed 3-level RSA/ECC chain and validation test for it

    Reviewed-by: Mounir Idrassi <mounir.idrassi@idrix.fr>
    Reviewed-by: Andrew Dinh <andrewd@openssl.org>
    MergeDate: Thu Sep 10 13:24:41 2026
    (Merged from https://github.com/openssl/openssl/pull/31611)

diff --git a/test/certs/mixed-ca-cert.pem b/test/certs/mixed-ca-cert.pem
new file mode 100644
index 0000000000..b13221a9bc
--- /dev/null
+++ b/test/certs/mixed-ca-cert.pem
@@ -0,0 +1,14 @@
+-----BEGIN CERTIFICATE-----
+MIICNTCCAR2gAwIBAgIBAjANBgkqhkiG9w0BAQsFADASMRAwDgYDVQQDDAdSb290
+IENBMCAXDTI2MDgyNjA2NDU1MFoYDzIxMjYwODI2MDY0NTUwWjARMQ8wDQYDVQQD
+DAZFQ0MgQ0EwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAQ6kBXIVAhdGlu7oAXO
+KXbHZDmzstAX2H+xiLWcPNL95h/m5+66YM1EyqdZOd3Smfn9AEdp0LM+iA4to58F
+xvVLo2AwXjAPBgNVHRMBAf8EBTADAQH/MAsGA1UdDwQEAwIBBjAdBgNVHQ4EFgQU
+jgOuoPFFR3/WUu6Dmy9LlSaSqtQwHwYDVR0jBBgwFoAUjvUlrx6ba4Q9fICayVOc
+TXL3o1IwDQYJKoZIhvcNAQELBQADggEBANE/H0nkpWNrb6JzWAFauPfgrkS5nL9T
+fAUe5itZI04SlS/lA61/GzebhCm4M78wZ89Oxzcy4hTstIirxbZbiVDQ8tNgJZxN
+WXfCbBFZr0Kx7qISllFIltEUlIO08cQDnu5uDCdxU54hVjIlWj69a75H8w00ubLh
+zbQZi7Tk1vDDtgeIqaF6klAmIccU49QdFV/PyzrrFSeuhd1yqvS8ATW7wpT7dfVm
+AyTe8OcwemVb7HV5/H/fQOWVqRIu8c8dpNtNSzBCpVp7OXsm6puo1RxvgCj+vgr9
+Wcn0G3ITMpSWmORaR6AirdzYjJO5Gxk8IwusGrJhm6yrN8Zgx+KWbAs=
+-----END CERTIFICATE-----
diff --git a/test/certs/mixed-ca-key.pem b/test/certs/mixed-ca-key.pem
new file mode 100644
index 0000000000..89c53b9166
--- /dev/null
+++ b/test/certs/mixed-ca-key.pem
@@ -0,0 +1,5 @@
+-----BEGIN PRIVATE KEY-----
+MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgDD4017Lvk96sqd9f
+A3Ae2ZnpVkQOLU1WYZF+68wLOTOhRANCAAQ6kBXIVAhdGlu7oAXOKXbHZDmzstAX
+2H+xiLWcPNL95h/m5+66YM1EyqdZOd3Smfn9AEdp0LM+iA4to58FxvVL
+-----END PRIVATE KEY-----
diff --git a/test/certs/mixed-ee-cert.pem b/test/certs/mixed-ee-cert.pem
new file mode 100644
index 0000000000..19014ae13b
--- /dev/null
+++ b/test/certs/mixed-ee-cert.pem
@@ -0,0 +1,16 @@
+-----BEGIN CERTIFICATE-----
+MIICcjCCAhegAwIBAgIBAjAKBggqhkjOPQQDAjARMQ8wDQYDVQQDDAZFQ0MgQ0Ew
+IBcNMjYwODI2MDY1NjA1WhgPMjEyNjA4MjYwNjU2MDVaMB8xHTAbBgNVBAMMFHNl
+cnZlciBtaXhlZCBFQ0MvUlNBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
+AQEA4FIzcg3wxMVqFFCFXG7ZTNi4vz31ghEXdDy6wiiRZW6FjWwrzRMqY73imzxG
+9AWUppIrRx76toJGdJVCC0A4JVKLiQwX7yhtoMbfUns0X1aShp+O81tgV310Ut0m
+WA/yfXdeUjMdDD6hTynPUz0It/5yH+Shwbz8GWNeC+7VeB4JVGj1rvnU9+ljekCT
+q11QZNJaJCPAkqjXzLJMPZMuV6nsyzNBQOJxvmwtVcfGvYc4ytszPwQQKeg3iFpm
+s+jpwOk93jwWRsEr5Uku8WFarxH40rpTDy0HlmDUwiD/N1SBk4xUKur2iDBCMvzC
+Bb4GDCFpxvQSFPKo5UnuuzvRkQIDAQABo4GEMIGBMB0GA1UdDgQWBBTgABQ2S34t
+6BygRV9+yezITphvnjAfBgNVHSMEGDAWgBSOA66g8UVHf9ZS7oObL0uVJpKq1DAJ
+BgNVHRMEAjAAMBMGA1UdJQQMMAoGCCsGAQUFBwMBMB8GA1UdEQQYMBaCFHNlcnZl
+ciBtaXhlZCBFQ0MvUlNBMAoGCCqGSM49BAMCA0kAMEYCIQCPBR01cg5ayHE5Po9T
+vpxjC5TJpyQ6Auti9bzRSUHIjgIhAOjFQ0c7chZzUXNQdY6oeFWiC2QUZ+lKb+SW
+GZDUG4sV
+-----END CERTIFICATE-----
diff --git a/test/certs/mixed-ee-key.pem b/test/certs/mixed-ee-key.pem
new file mode 100644
index 0000000000..e1c327bebd
--- /dev/null
+++ b/test/certs/mixed-ee-key.pem
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDgUjNyDfDExWoU
+UIVcbtlM2Li/PfWCERd0PLrCKJFlboWNbCvNEypjveKbPEb0BZSmkitHHvq2gkZ0
+lUILQDglUouJDBfvKG2gxt9SezRfVpKGn47zW2BXfXRS3SZYD/J9d15SMx0MPqFP
+Kc9TPQi3/nIf5KHBvPwZY14L7tV4HglUaPWu+dT36WN6QJOrXVBk0lokI8CSqNfM
+skw9ky5XqezLM0FA4nG+bC1Vx8a9hzjK2zM/BBAp6DeIWmaz6OnA6T3ePBZGwSvl
+SS7xYVqvEfjSulMPLQeWYNTCIP83VIGTjFQq6vaIMEIy/MIFvgYMIWnG9BIU8qjl
+Se67O9GRAgMBAAECggEAB5l5UTScMspeWuRUdEp0Faik76OteNPT59Xz3MaLkHRj
+VWR0Am1TCxCAiBJNdBBpVhBPI4hu5XZ55RK2a1OoY0lN3V15xRopRqBeKfjvEAjK
+i4GF0gRHOgePxIvl8+dMZ4g++4lsQ0Eu7VPlCHShojweSSrReRMKNmD5q21SsZBA
+q83roNYFGOpgT90yEF73xMKWmnOOf5ZnhW6tdMTxdcJt7u1ty4F4i2PS8nJKOQwS
+3p65QVRB2BaSr3QLDBsdl/qqe48aer8FzR2Ew5TO1UnYLQN2wT7TYkb4vB9JO3pu
+fcRVHfsMRolaLpWEmYs0xls88NfUJqJDQxHME7l0PQKBgQD+pjMVa7Hyfma3Nvjv
+dsH9qV3IXbIHb3IfIta8SsdwvH3w7obIUZxuruzrSO/D7RDBdA2RoKXhnz0yOsoa
+KC53hEgJz8XssjNwEPRlrT2gesd8DB83RNJPGglUJsDwGHU2wn9awAiPTdaS39YP
+zaSf/bhQpu4SKyaYXl484BnH9QKBgQDhgtFA8W2J30vvivfcSts+AlqdAzgMisuX
+ytcMrs7TzqrD7ZTWrtizFela3dwOTkCSaaxaJ2c97GzXWhrzMrmWWCgyrP4KslSJ
+zRaCDjLXgj5igNT1mesJEfaW4NesVWuPoROPVQP7/K18BcoAL2qQR0+NoPVAsEzP
+xnlpyh9NrQKBgBo6R/ym0Pcm6bFpKg6P7r8PmKcwb0uwwNJQJknSceQ8pcQQ7TTo
+ovILdj9tjbRiUF18dIFRSISKgCUSRQqYpOCOcVUBX2NXn1CljmaCh1xmCPHP1c89
+eWPITLmsHCcefcQcGD3ilX8dB0KtZ0DNb21DFp7H8rFQXHNJFO+0LTOZAoGAUR/W
+Vx6C4U5K6ul7MOxc4nnGTyWRTDHB++Eka5OXI+r8027sVC6iFgqT3/Rf7WWJJSKO
+tf/mzAf5P59SgpqE2OjtzQ0edoqgjtIQfsjM0WoxNw5RjejI/IJRywUnkP9Jqmmv
+t6hFvqivYCZU/KwSEcUVgUWd9J93gmdL1hq4GCECgYEA+2fMsJCchaxH7h/5mngN
+oQp0mqV6+CULGXpwrjhRCZu3zf/UJaZPLHY5PF2KQwzqxW8+7Bnbq7K8gnfu2+y2
+opKnCV28P3c2S01/jJpc+KGuEn5r4xzsIrr8O50u45RUBZY9dGIvO/ddE18CjIxj
+1bQ+CzDjDUL4LXJTBkDtXd4=
+-----END PRIVATE KEY-----
diff --git a/test/certs/setup.sh b/test/certs/setup.sh
index 3056b1f90a..c32813c3d8 100755
--- a/test/certs/setup.sh
+++ b/test/certs/setup.sh
@@ -528,7 +528,13 @@ _DSA_CERT_DIR=$(cd "$(dirname "$0")" && pwd)
 )
 unset _DSA_CERT_DIR

-# EC cert seigned RSA intermediate CA
+# EC end-entity cert signed by RSA intermediate CA
 OPENSSL_KEYALG=ec OPENSSL_KEYBITS=prime256v1 ./mkcert.sh genee \
     "P-256 cert EE issuer" p256-ee-rsa-ca-key \
     p256-ee-rsa-ca-cert ca-key ca-cert
+
+# Mixed chain: RSA root -> ECC intermediate CA -> RSA end entity
+OPENSSL_KEYALG=ec OPENSSL_KEYBITS=prime256v1 ./mkcert.sh genca \
+    "ECC CA" mixed-ca-key mixed-ca-cert root-key root-cert
+OPENSSL_KEYALG=rsa OPENSSL_KEYBITS=2048 ./mkcert.sh genee \
+    "server mixed ECC/RSA" mixed-ee-key mixed-ee-cert mixed-ca-key mixed-ca-cert
diff --git a/test/recipes/25-test_verify.t b/test/recipes/25-test_verify.t
index 97053561b6..d911ea27b1 100644
--- a/test/recipes/25-test_verify.t
+++ b/test/recipes/25-test_verify.t
@@ -80,11 +80,17 @@ EOF
              "-out", $crl]));
 }

-plan tests => 225;
+plan tests => 226;

 # Canonical success
 ok(verify("ee-cert", "sslserver", ["root-cert"], ["ca-cert"]),
    "accept compat trust");
+SKIP: {
+    skip "EC is not supported by this OpenSSL build; mixed RSA/ECC chain unavailable", 1
+        if disabled("ec") || !(-f srctop_file(@certspath, "mixed-ca-cert.pem"));
+    ok(verify("mixed-ee-cert", "sslserver", ["root-cert"], ["mixed-ca-cert"]),
+       "accept mixed RSA/ECC chain");
+}

 # Root CA variants
 ok(!verify("ee-cert", "sslserver", [qw(root-nonca)], [qw(ca-cert)]),