Commit 7a1ae9e428 for openssl.org
commit 7a1ae9e4282b2a6aa0a240a6c76bf4ea37f54f3b
Author: Dr. David von Oheimb <dev@ddvo.net>
Date: Fri Jun 19 10:07:41 2026 +0200
65-test_cmp_vfy.t etc.: take 2-level and 3-level cert hierarchy from test/certs
Give up using old custom cert hierarchy, which included a meanwhile legacy NIST P-192 curve.
Doing so, replace
setup_path(CMP_VFY_TEST_FIXTURE **fixture, X509 *wrong, int expired)
by
setup_path(CMP_VFY_TEST_FIXTURE **fixture, X509 *wrong, int not_yet_valid)
because on 32-bit systems, cannot check expiration because normal test certs
are valid for 100 years, while 32-bit time_t will wrap around in early 2038.
Fixes #24193
Reviewed-by: Mounir Idrassi <mounir.idrassi@idrix.fr>
Reviewed-by: Andrew Dinh <andrewd@openssl.org>
MergeDate: Thu Sep 10 13:24:42 2026
(Merged from https://github.com/openssl/openssl/pull/31611)
diff --git a/test/certs/ee-cert1.pem b/test/certs/ee-cert1.pem
new file mode 100644
index 0000000000..f9fb6ae737
--- /dev/null
+++ b/test/certs/ee-cert1.pem
@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE-----
+MIIDJzCCAg+gAwIBAgIBAjANBgkqhkiG9w0BAQsFADASMRAwDgYDVQQDDAdSb290
+IENBMCAXDTI2MDYxOTA3NTU0NVoYDzIxMjYwNjE5MDc1NTQ1WjAaMRgwFgYDVQQD
+DA9zZXJ2ZXIuZXhhbXBsZTEwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB
+AQCo/4lYYYWu3tssD9Vz++K3qBt6dWAr1H08c3a1rt6TL38kkG3JHPSKOM2fooAW
+Vsu0LLuT5Rcf/w3GQ/4xNPgo2HXpo7uIgu+jcuJTYgVFTeAxl++qnRDSWA2eBp4y
+uxsIVl1lDz9mjsI2oBH/wFk1/Ukc3RxCMwZ4rgQ4I+XndWfTlK1aqUAfrFkQ9QzB
+ZK1KxMY1U7OWaoIbFYvRmavknm+UqtKW5Vf7jJFkijwkFsbSGb6CYBM7YrDtPh2z
+yvlr3zG5ep5LR2inKcc/SuIiJ7TvkGPX79ByST5brbkb1Ctvhmjd1XMSuEPJ3EEP
+oqNGT4tniIQPYf55NB9KiR+3AgMBAAGjfjB8MB0GA1UdDgQWBBTnm+IqrYpsOst2
+UeWOB5gil+FzojAfBgNVHSMEGDAWgBSO9SWvHptrhD18gJrJU5xNcvejUjAJBgNV
+HRMEAjAAMBMGA1UdJQQMMAoGCCsGAQUFBwMBMBoGA1UdEQQTMBGCD3NlcnZlci5l
+eGFtcGxlMTANBgkqhkiG9w0BAQsFAAOCAQEALEErPqzg89OMMS51cKZaLOA6Aemi
+kriioN8NEOJFKoOOSoz4/YlDiLKDeBeloVPn7MKu6+3L85v7E1yD6PbFJR6uYQ9g
+54DmqbTLqDRbpxs1sNhf9ExAWACaIkcUaMlkZzcpXeFxM3XlN9/KHMdJztasgzZ3
+z9rd/1Ts6r07caBvQ6/W1lFczuDJip1ZxSeLlrMjKxLk+Qp1EHmmFQ2pdTfREoPy
+QOBWpI7bzOidBGz4uU4h+CoHQMJweHSHgFK1DcmZG8TCpezKmPAULjHB4qSbxrBZ
+3i4X0bhXtjCrXBxWkS/upEEvw6a4jP/Y2IfNYy+o54bqbKHGYz4OdtGoDQ==
+-----END CERTIFICATE-----
diff --git a/test/certs/setup.sh b/test/certs/setup.sh
index c32813c3d8..e30e6012ab 100755
--- a/test/certs/setup.sh
+++ b/test/certs/setup.sh
@@ -163,6 +163,8 @@ openssl x509 -in sca-cert.pem -trustout \
./mkcert.sh genee server.example ee-key ee-name2 ca-key ca-name2
./mkcert.sh genee server.example ee-key ee-pathlen ca-key ca-cert \
-extfile <(echo "basicConstraints=CA:false,pathlen:0") # bash needed here
+# ee variant: issued directly by root CA (2-level chain)
+./mkcert.sh genee server.example1 ee-key ee-cert1 root-key root-cert
# purpose variants: clientAuth
./mkcert.sh genee -p clientAuth server.example ee-key ee-client ca-key ca-cert
# trust variants: +serverAuth, -serverAuth, +clientAuth, -clientAuth
diff --git a/test/cmp_vfy_test.c b/test/cmp_vfy_test.c
index 0ee58d720d..5c7fc247e3 100644
--- a/test/cmp_vfy_test.c
+++ b/test/cmp_vfy_test.c
@@ -34,6 +34,10 @@ typedef struct test_fixture {
OSSL_CMP_CTX *cmp_ctx;
OSSL_CMP_MSG *msg;
X509 *cert;
+ /*
+ * With execute_validate_msg_test(), this is the expected validated cert or NULL.
+ * With execute_validate_cert_path_test(), this is the target cert to be validated.
+ */
ossl_cmp_allow_unprotected_cb_t allow_unprotected_cb;
int additional_arg;
} CMP_VFY_TEST_FIXTURE;
@@ -48,7 +52,7 @@ static void tear_down(CMP_VFY_TEST_FIXTURE *fixture)
OPENSSL_free(fixture);
}
-static time_t test_time_valid = 0, test_time_after_expiration = 0;
+static time_t test_time_valid = 0, test_time_after_expiration = 0; /* for Insta certs */
static CMP_VFY_TEST_FIXTURE *set_up(const char *const test_case_name)
{
@@ -68,6 +72,7 @@ static CMP_VFY_TEST_FIXTURE *set_up(const char *const test_case_name)
X509_STORE_free(ts);
return NULL;
}
+ /* by default, set validation time relevant for Insta certs: */
X509_VERIFY_PARAM_set_time(X509_STORE_get0_param(ts), test_time_valid);
X509_STORE_set_verify_cb(ts, X509_STORE_CTX_print_verify_cb);
return fixture;
@@ -75,11 +80,9 @@ static CMP_VFY_TEST_FIXTURE *set_up(const char *const test_case_name)
static X509 *srvcert = NULL;
static X509 *clcert = NULL;
-/* chain */
-static X509 *endentity1 = NULL, *endentity2 = NULL,
- *intermediate = NULL, *root = NULL;
-/* INSTA chain */
-static X509 *insta_cert = NULL, *instaca_cert = NULL;
+static X509 *endentity2 = NULL, *intermediate = NULL, *root = NULL; /* 3-level chain */
+static X509 *endentity1 = NULL; /* 2-level chain together with same root as before */
+static X509 *insta_cert = NULL, *instaca_cert = NULL; /* 2-level Insta chain */
static unsigned char rand_data[OSSL_CMP_TRANSACTIONID_LENGTH];
static OSSL_CMP_MSG *ir_unprotected, *ir_rmprotection, *error_protected;
@@ -132,7 +135,7 @@ static int test_verify_popo_bad(void)
}
#endif
-/* indirectly checks also OSSL_CMP_validate_msg() */
+/* indirectly checks also OSSL_CMP_validate_msg(), uses only Insta or self-signed EE certs */
static int execute_validate_msg_test(CMP_VFY_TEST_FIXTURE *fixture)
{
int res = TEST_int_eq(fixture->expected,
@@ -143,17 +146,6 @@ static int execute_validate_msg_test(CMP_VFY_TEST_FIXTURE *fixture)
return res && (!fixture->expected || TEST_ptr_eq(validated, fixture->cert));
}
-static int execute_validate_cert_path_test(CMP_VFY_TEST_FIXTURE *fixture)
-{
- X509_STORE *ts = OSSL_CMP_CTX_get0_trusted(fixture->cmp_ctx);
- int res = TEST_int_eq(fixture->expected,
- OSSL_CMP_validate_cert_path(fixture->cmp_ctx,
- ts, fixture->cert));
-
- OSSL_CMP_CTX_print_errors(fixture->cmp_ctx);
- return res;
-}
-
static int test_validate_msg_mac_alg_protection(int miss, int wrong)
{
SETUP_TEST_FIXTURE(CMP_VFY_TEST_FIXTURE, set_up);
@@ -220,6 +212,8 @@ static int add_untrusted(OSSL_CMP_CTX *ctx, X509 *cert)
X509_ADD_FLAG_UP_REF);
}
+/* Message validation tests using self-signed certs for signature-based protection */
+
static int test_validate_msg_signature_partial_chain(int expired)
{
X509_STORE *ts;
@@ -299,6 +293,33 @@ static int test_validate_msg_signature_sender_cert_srvcert(void)
return test_validate_msg_signature_srvcert(0, 0, 0);
}
+static int test_validate_msg_with_sender(const X509_NAME *name, int expected)
+{
+ SETUP_TEST_FIXTURE(CMP_VFY_TEST_FIXTURE, set_up);
+ fixture->cert = srvcert;
+ fixture->expected = expected;
+ if (!TEST_ptr(fixture->msg = load_pkimsg(ir_protected_f, libctx))
+ || !TEST_true(OSSL_CMP_CTX_set1_expected_sender(fixture->cmp_ctx, name))
+ || !TEST_true(OSSL_CMP_CTX_set1_srvCert(fixture->cmp_ctx, srvcert))) {
+ tear_down(fixture);
+ fixture = NULL;
+ }
+ EXECUTE_TEST(execute_validate_msg_test, tear_down);
+ return result;
+}
+
+static int test_validate_msg_signature_expected_sender(void)
+{
+ return test_validate_msg_with_sender(X509_get_subject_name(srvcert), 1);
+}
+
+static int test_validate_msg_signature_unexpected_sender(void)
+{
+ return test_validate_msg_with_sender(X509_get_subject_name(root), 0);
+}
+
+/* Message validation tests using Insta or other certs for signature-based protection */
+
static int test_validate_msg_signature_sender_cert_untrusted(void)
{
SETUP_TEST_FIXTURE(CMP_VFY_TEST_FIXTURE, set_up);
@@ -358,31 +379,6 @@ static int test_validate_msg_signature_sender_cert_absent(void)
}
#endif
-static int test_validate_with_sender(const X509_NAME *name, int expected)
-{
- SETUP_TEST_FIXTURE(CMP_VFY_TEST_FIXTURE, set_up);
- fixture->cert = srvcert;
- fixture->expected = expected;
- if (!TEST_ptr(fixture->msg = load_pkimsg(ir_protected_f, libctx))
- || !TEST_true(OSSL_CMP_CTX_set1_expected_sender(fixture->cmp_ctx, name))
- || !TEST_true(OSSL_CMP_CTX_set1_srvCert(fixture->cmp_ctx, srvcert))) {
- tear_down(fixture);
- fixture = NULL;
- }
- EXECUTE_TEST(execute_validate_msg_test, tear_down);
- return result;
-}
-
-static int test_validate_msg_signature_expected_sender(void)
-{
- return test_validate_with_sender(X509_get_subject_name(srvcert), 1);
-}
-
-static int test_validate_msg_signature_unexpected_sender(void)
-{
- return test_validate_with_sender(X509_get_subject_name(root), 0);
-}
-
#ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
static int test_validate_msg_unprotected_request(void)
{
@@ -397,48 +393,6 @@ static int test_validate_msg_unprotected_request(void)
}
#endif
-static void setup_path(CMP_VFY_TEST_FIXTURE **fixture, X509 *wrong, int expired)
-{
- (*fixture)->cert = endentity2;
- (*fixture)->expected = wrong == NULL && !expired;
- if (expired) {
- X509_STORE *ts = OSSL_CMP_CTX_get0_trusted((*fixture)->cmp_ctx);
- X509_VERIFY_PARAM *vpm = X509_STORE_get0_param(ts);
-
- X509_VERIFY_PARAM_set_time(vpm, test_time_after_expiration);
- }
- if (!add_trusted((*fixture)->cmp_ctx, wrong == NULL ? root : wrong)
- || !add_untrusted((*fixture)->cmp_ctx, endentity1)
- || !add_untrusted((*fixture)->cmp_ctx, intermediate)) {
- tear_down((*fixture));
- (*fixture) = NULL;
- }
-}
-
-static int test_validate_cert_path_ok(void)
-{
- SETUP_TEST_FIXTURE(CMP_VFY_TEST_FIXTURE, set_up);
- setup_path(&fixture, NULL, 0);
- EXECUTE_TEST(execute_validate_cert_path_test, tear_down);
- return result;
-}
-
-static int test_validate_cert_path_wrong_anchor(void)
-{
- SETUP_TEST_FIXTURE(CMP_VFY_TEST_FIXTURE, set_up);
- setup_path(&fixture, srvcert /* wrong/non-root cert */, 0);
- EXECUTE_TEST(execute_validate_cert_path_test, tear_down);
- return result;
-}
-
-static int test_validate_cert_path_expired(void)
-{
- SETUP_TEST_FIXTURE(CMP_VFY_TEST_FIXTURE, set_up);
- setup_path(&fixture, NULL, 1);
- EXECUTE_TEST(execute_validate_cert_path_test, tear_down);
- return result;
-}
-
static int execute_msg_check_test(CMP_VFY_TEST_FIXTURE *fixture)
{
const OSSL_CMP_PKIHEADER *hdr = OSSL_CMP_MSG_get0_header(fixture->msg);
@@ -595,7 +549,8 @@ static int test_msg_check_recipient_nonce_error(void)
return result;
}
-/* Regression test for CVE-2026-63073 */
+/* Regression test for CVE-2026-63073, uses self-signed cert for signature-based protection */
+
static int execute_msg_check_update_malicious_sender(CMP_VFY_TEST_FIXTURE *fixture)
{
const char *data = NULL;
@@ -645,6 +600,72 @@ static int test_msg_check_update_malicious_sender(void)
return result;
}
+/*
+ * The functions below use the normal OpenSSL test certs from test/certs/,
+ * forming a 2-level and mostly 3-level chains,
+ * all of which are kept valid (for tests using the current time).
+ */
+
+static void setup_path(CMP_VFY_TEST_FIXTURE **fixture, X509 *wrong, int not_yet_valid)
+{
+ X509_STORE *ts = OSSL_CMP_CTX_get0_trusted((*fixture)->cmp_ctx);
+ X509_VERIFY_PARAM *vpm = X509_STORE_get0_param(ts);
+
+ X509_VERIFY_PARAM_set_time(vpm, not_yet_valid ? 0 /* January 1st, 1970 */
+ : time(NULL) /* override default validation time (set for Insta certs) by current time */);
+ (*fixture)->cert = endentity2;
+ (*fixture)->expected = wrong == NULL && !not_yet_valid;
+ if (!add_trusted((*fixture)->cmp_ctx, wrong == NULL ? root : wrong)
+ || !add_untrusted((*fixture)->cmp_ctx, endentity1)
+ || !add_untrusted((*fixture)->cmp_ctx, intermediate)) {
+ tear_down((*fixture));
+ (*fixture) = NULL;
+ }
+}
+
+static int execute_validate_cert_path_test(CMP_VFY_TEST_FIXTURE *fixture)
+{
+ X509_STORE *ts = OSSL_CMP_CTX_get0_trusted(fixture->cmp_ctx);
+ int res = TEST_int_eq(fixture->expected,
+ OSSL_CMP_validate_cert_path(fixture->cmp_ctx, ts, fixture->cert));
+
+ OSSL_CMP_CTX_print_errors(fixture->cmp_ctx);
+ return res;
+}
+
+static int test_validate_cert_path_2_level_ok(void)
+{
+ SETUP_TEST_FIXTURE(CMP_VFY_TEST_FIXTURE, set_up);
+ setup_path(&fixture, NULL, 0);
+ fixture->cert = endentity1;
+ EXECUTE_TEST(execute_validate_cert_path_test, tear_down);
+ return result;
+}
+
+static int test_validate_cert_path_ok(void)
+{
+ SETUP_TEST_FIXTURE(CMP_VFY_TEST_FIXTURE, set_up);
+ setup_path(&fixture, NULL, 0);
+ EXECUTE_TEST(execute_validate_cert_path_test, tear_down);
+ return result;
+}
+
+static int test_validate_cert_path_wrong_anchor(void)
+{
+ SETUP_TEST_FIXTURE(CMP_VFY_TEST_FIXTURE, set_up);
+ setup_path(&fixture, srvcert /* wrong/non-root cert */, 0);
+ EXECUTE_TEST(execute_validate_cert_path_test, tear_down);
+ return result;
+}
+
+static int test_validate_cert_path_not_yet_valid(void)
+{
+ SETUP_TEST_FIXTURE(CMP_VFY_TEST_FIXTURE, set_up);
+ setup_path(&fixture, NULL, 1);
+ EXECUTE_TEST(execute_validate_cert_path_test, tear_down);
+ return result;
+}
+
void cleanup_tests(void)
{
X509_free(srvcert);
@@ -683,8 +704,8 @@ int setup_tests(void)
ts.tm_year = 2018 - 1900; /* 2018 */
ts.tm_mon = 1; /* February */
ts.tm_mday = 18; /* 18th */
- test_time_valid = mktime(&ts); /* February 18th 2018 */
- ts.tm_year += 10; /* February 18th 2028 */
+ test_time_valid = mktime(&ts); /* February 18th 2018, within validity of insta_cert */
+ ts.tm_year += 10; /* February 18th 2028, past validity of instaca_cert */
test_time_after_expiration = mktime(&ts);
if (!test_skip_common_options()) {
@@ -715,7 +736,7 @@ int setup_tests(void)
if (!test_arg_libctx(&libctx, &default_null_provider, &provider, 15, USAGE))
return 0;
- /* Load certificates for cert chain */
+ /* Load certificates for 2-level and mixed 3-level chains */
if (!TEST_ptr(endentity1 = load_cert_pem(endentity1_f, libctx))
|| !TEST_ptr(endentity2 = load_cert_pem(endentity2_f, libctx))
|| !TEST_ptr(root = load_cert_pem(root_f, NULL))
@@ -737,11 +758,13 @@ int setup_tests(void)
|| !TEST_ptr(error_protected = load_pkimsg(error_protected_f, libctx)))
goto err;
- /* Message validation tests */
+ /* CRMF proof-of-possession self-signature tests */
ADD_TEST(test_verify_popo);
#ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
ADD_TEST(test_verify_popo_bad);
#endif
+
+ /* Message validation tests using self-signed certs for signature-based protection */
ADD_TEST(test_validate_msg_signature_trusted_ok);
#ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
ADD_TEST(test_validate_msg_signature_trusted_expired);
@@ -752,15 +775,16 @@ int setup_tests(void)
ADD_TEST(test_validate_msg_signature_bad);
#endif
ADD_TEST(test_validate_msg_signature_sender_cert_srvcert);
+ ADD_TEST(test_validate_msg_signature_expected_sender);
+ ADD_TEST(test_validate_msg_signature_unexpected_sender);
+ ADD_TEST(test_msg_check_update_malicious_sender);
+
+ /* Message validation tests using Insta or other certs for signature-based protection */
ADD_TEST(test_validate_msg_signature_sender_cert_untrusted);
ADD_TEST(test_validate_msg_signature_sender_cert_trusted);
ADD_TEST(test_validate_msg_signature_sender_cert_extracert);
#ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
ADD_TEST(test_validate_msg_signature_sender_cert_absent);
-#endif
- ADD_TEST(test_validate_msg_signature_expected_sender);
- ADD_TEST(test_validate_msg_signature_unexpected_sender);
-#ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
ADD_TEST(test_validate_msg_unprotected_request);
#endif
ADD_TEST(test_validate_msg_mac_alg_protection_ok);
@@ -770,11 +794,6 @@ int setup_tests(void)
ADD_TEST(test_validate_msg_mac_alg_protection_bad);
#endif
- /* Cert path validation tests */
- ADD_TEST(test_validate_cert_path_ok);
- ADD_TEST(test_validate_cert_path_expired);
- ADD_TEST(test_validate_cert_path_wrong_anchor);
-
#ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
ADD_TEST(test_msg_check_no_protection_no_cb);
ADD_TEST(test_msg_check_no_protection_restrictive_cb);
@@ -790,7 +809,12 @@ int setup_tests(void)
ADD_TEST(test_msg_check_recipient_nonce_bad);
#endif
ADD_TEST(test_msg_check_recipient_nonce_error);
- ADD_TEST(test_msg_check_update_malicious_sender);
+
+ /* Cert path validation tests, using normal OpenSSL test certs */
+ ADD_TEST(test_validate_cert_path_2_level_ok);
+ ADD_TEST(test_validate_cert_path_ok);
+ ADD_TEST(test_validate_cert_path_not_yet_valid);
+ ADD_TEST(test_validate_cert_path_wrong_anchor);
return 1;
diff --git a/test/recipes/25-test_verify.t b/test/recipes/25-test_verify.t
index d911ea27b1..0893f7b724 100644
--- a/test/recipes/25-test_verify.t
+++ b/test/recipes/25-test_verify.t
@@ -80,7 +80,7 @@ EOF
"-out", $crl]));
}
-plan tests => 226;
+plan tests => 227;
# Canonical success
ok(verify("ee-cert", "sslserver", ["root-cert"], ["ca-cert"]),
@@ -91,6 +91,8 @@ SKIP: {
ok(verify("mixed-ee-cert", "sslserver", ["root-cert"], ["mixed-ca-cert"]),
"accept mixed RSA/ECC chain");
}
+ok(verify("ee-cert1", "sslserver", ["root-cert"]),
+ "accept 2-level chain");
# Root CA variants
ok(!verify("ee-cert", "sslserver", [qw(root-nonca)], [qw(ca-cert)]),
diff --git a/test/recipes/65-test_cmp_vfy.t b/test/recipes/65-test_cmp_vfy.t
index d63940b6ee..8895482ab4 100644
--- a/test/recipes/65-test_cmp_vfy.t
+++ b/test/recipes/65-test_cmp_vfy.t
@@ -29,10 +29,19 @@ plan skip_all => "This test is not supported in a no-ec build"
plan tests => 2 + ($no_fips ? 0 : 1); #fips test
+# The cert hierarchy should be like this:
+# 1 - Root CA (self-signed)
+# 1.1 - EndEntity1 (directly issued by root, so 2-level chain)
+# 1.2 - Intermediate CA (here with different signature algorithm than root)
+# 1.2.1 - EndEntity2 (issued by intermediate CA, so 3-level chain)
+sub test_cert { srctop_file("test/certs", $_[0]); }
my @basic_cmd = ("cmp_vfy_test",
- data_file("server.crt"), data_file("client.crt"),
- data_file("EndEntity1.crt"), data_file("EndEntity2.crt"),
- data_file("Root_CA.crt"), data_file("Intermediate_CA.crt"),
+ data_file("server.crt"),
+ data_file("client.crt"),
+ test_cert("ee-cert1.pem"),
+ test_cert("mixed-ee-cert.pem"),
+ test_cert("root-cert.pem"),
+ test_cert("mixed-ca-cert.pem"),
data_file("IR_protected.der"),
data_file("IR_unprotected.der"),
data_file("IP_waitingStatus_PBM.der"),
diff --git a/test/recipes/65-test_cmp_vfy_data/EndEntity1.crt b/test/recipes/65-test_cmp_vfy_data/EndEntity1.crt
deleted file mode 100644
index 4e05449889..0000000000
--- a/test/recipes/65-test_cmp_vfy_data/EndEntity1.crt
+++ /dev/null
@@ -1,16 +0,0 @@
------BEGIN CERTIFICATE-----
-MIICnDCCAYSgAwIBAgIBAzANBgkqhkiG9w0BAQUFADASMRAwDgYDVQQDEwdSb290
-IENBMB4XDTE3MTEwODE1NDgwMFoXDTE4MTEwODExMTkwMFowETEPMA0GA1UEAxMG
-Q2xpZW50MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtNiWJufEotHe
-p6E/4b0laX7K1NRamNoUokLIsq78RoBieBXaGxIdbT6zmhLnLmZdb0UN3v7FUP75
-rqPN2yyj3TbS4o5ilh5El8bDDAPhW5lthCddvH/uBziRAM5oIB4xxOumNbgHpLUT
-Clh49sdXd4ydYpCTWld5emRouBmMUeP/0EkyWMBIrHGSBxrqtFVRXhxvVHImQv6Z
-hIKql7dCVCZbhUtxw6sLxIGL4xlhKoM2o31k4I/9tjZrWSZZ7KAIOlOLrjxZc/bQ
-MwvxVUgS+C+iXzhCY8v+N/K37jwtAAk4C1aOGv/VygNcN0C/ynfKSzFmtnfei4+3
-6GC7HtFzewIDAQABMA0GCSqGSIb3DQEBBQUAA4IBAQB3GYpPSCCYsJM5owKcODr/
-I1aJ8jQ+u5jCKjvYLp6Cnbr4AbRXzvKuMyV6UfIAQbrGOxAClvX++5/ZQbhY+TxN
-iiUM3yr5yYCLqj4MeYHhJ3gOzcppAO9LQ9V7eA8C830giZMm3cpApFSLP8CpwNUD
-W/fgoQfaOae5IYPZdea88Gmt5RVNbtHgVqtm4ifTQo577kfxTeh20s+M6pgYW3/R
-vftXy2ITEtk/j3NcRvOyZ7Bu1mAg7wNeUjL+gDWAaxs16LsWsCsUGwfr/Z2Rq1CF
-zB0XwIyigkVLDLqDzUShcw0Eb/zYy2KXsxNWA2tb27mw+T+tmmOszpn7JjLrlVks
------END CERTIFICATE-----
diff --git a/test/recipes/65-test_cmp_vfy_data/EndEntity2.crt b/test/recipes/65-test_cmp_vfy_data/EndEntity2.crt
deleted file mode 100644
index ba06210794..0000000000
--- a/test/recipes/65-test_cmp_vfy_data/EndEntity2.crt
+++ /dev/null
@@ -1,13 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIB3zCCAZSgAwIBAgIBBjAKBggqhkjOPQQDAzAVMRMwEQYDVQQDEwpad2lzY2hl
-bkNBMB4XDTE3MTEwODE2MDUwMFoXDTE4MTEwODExMTkwMFowEjEQMA4GA1UEAxMH
-Q2xpZW50MjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALTYlibnxKLR
-3qehP+G9JWl+ytTUWpjaFKJCyLKu/EaAYngV2hsSHW0+s5oS5y5mXW9FDd7+xVD+
-+a6jzdsso9020uKOYpYeRJfGwwwD4VuZbYQnXbx/7gc4kQDOaCAeMcTrpjW4B6S1
-EwpYePbHV3eMnWKQk1pXeXpkaLgZjFHj/9BJMljASKxxkgca6rRVUV4cb1RyJkL+
-mYSCqpe3QlQmW4VLccOrC8SBi+MZYSqDNqN9ZOCP/bY2a1kmWeygCDpTi648WXP2
-0DML8VVIEvgvol84QmPL/jfyt+48LQAJOAtWjhr/1coDXDdAv8p3yksxZrZ33ouP
-t+hgux7Rc3sCAwEAAaMNMAswCQYDVR0TBAIwADAKBggqhkjOPQQDAwM5ADA2AhkA
-qASBLwTauET6FGp/EBe7b/99jTyGB861AhkA5ILGkLX4KmjRkTcNxJ3JKB1Sumya
-cbqF
------END CERTIFICATE-----
diff --git a/test/recipes/65-test_cmp_vfy_data/Intermediate_CA.crt b/test/recipes/65-test_cmp_vfy_data/Intermediate_CA.crt
deleted file mode 100644
index 3416cdb959..0000000000
--- a/test/recipes/65-test_cmp_vfy_data/Intermediate_CA.crt
+++ /dev/null
@@ -1,12 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIB1jCBv6ADAgECAgEFMA0GCSqGSIb3DQEBDQUAMBIxEDAOBgNVBAMTB1Jvb3Qg
-Q0EwHhcNMTcxMTA4MTYwNDAwWhcNMTgxMTA4MTExOTAwWjAVMRMwEQYDVQQDEwpa
-d2lzY2hlbkNBMEkwEwYHKoZIzj0CAQYIKoZIzj0DAQEDMgAE9bJcmZWj2CmO6aW8
-9Qylkj1WgPREf9/s4Z1VYqFODeJnebPXFBLVH/aoGxnds9E9oxAwDjAMBgNVHRME
-BTADAQH/MA0GCSqGSIb3DQEBDQUAA4IBAQBwQD4NTIWMMevEsSrBpKjjQEWc81Ct
-eXoyAXr/d8wgVyuIZe9C7ekxPQCwowcmONUyeYQv9N2eYpdhkAQuk6DS4+aDR4s7
-I6rg5R5CUGGla5NUxM0BKIS3ZIezvEGlP1NFN+HBgJI7ZIIYQ3zDr0EYgo4J7Xvm
-5p58pcCZSsbVyKwKs6T+rTzOVVmJ2L1bWzywZEDmzxMkPmA6fP9XtB4Kx/b4oviw
-TEQl3Jf9EkBvBkKX2rRJs7aMJo4MwOnE4HHOV5GAQqhGrXltsuXmVfIQPtRN4xlK
-oNf/FukI1NcBh4A/iY4PmbyxHYmKy6qjFjng2u2VFtH15HDT4XlLP5gq
------END CERTIFICATE-----
diff --git a/test/recipes/65-test_cmp_vfy_data/Root_CA.crt b/test/recipes/65-test_cmp_vfy_data/Root_CA.crt
deleted file mode 100644
index 6ccf362546..0000000000
--- a/test/recipes/65-test_cmp_vfy_data/Root_CA.crt
+++ /dev/null
@@ -1,17 +0,0 @@
------BEGIN CERTIFICATE-----
-MIICrzCCAZegAwIBAgIBATANBgkqhkiG9w0BAQUFADASMRAwDgYDVQQDEwdSb290
-IENBMB4XDTE3MTEwODE1NDUwMFoXDTE4MTEwODExMTkwMFowEjEQMA4GA1UEAxMH
-Um9vdCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALiHdLAD2Wu+
-C5UDMK6WCL53Wz0CeU61RRRlGEVSqHrQOWnffgVutgftzsddxxgJJyGsqKo1B+nQ
-vapyJyugYJWYNQLN5+iffe4y1UBPnHMQFHiZ4cNR6PB0eHja2wpcN3QmJzOcpRYE
-xf+QQwJNFqhRi0cZGfd/JfFi/ybJalqClbnYMPcJo7g6S7M3lWbOnEOUWnbM2EBp
-h849mC+kd80vXcRcb7U/3MJKK3Ee72TDye5/kWFf9zcxj2ac0oCiS66JKYobiVJr
-NmbGM0I9U6T6ejXVUu2J3pGUFlcf3RCUYf1aWhkmzEzbm/FGMRJ7vVyCXm/OWIh9
-bqtwH5YfljsCAwEAAaMQMA4wDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQUFAAOC
-AQEAF7tSa9oVan7kPR5/TXB330Ca1xQt5C38afaJbacR9mM8ZkL0HceQTuJGrnAR
-4kK7CaB5iraU6Lxyql7drq8aixz/7TXna6c172J6HxDeFhQMeSt1LAh7XN5Ir6Y6
-iO7XD5I5lw3Xv6qvhoD0ktkNk/WtF7aBw2ZAi+RcDMgWzWjoS4WqMbvWEHw10j9b
-s8R0YG4yi6wb89UNIMfQtC2XviHKcRS9MzIJQHw73r2EY2t6o9TO+5ukHYDB6/Zo
-/CLXu21MzsFvhupHgX6zdptU324tq2za1+4LvmOHSW+D36jEPT22SndXmHo5VmAn
-6bQ52MhBI0rrWwju9aBpVzsUUg==
------END CERTIFICATE-----
diff --git a/test/recipes/65-test_cmp_vfy_data/chain.txt b/test/recipes/65-test_cmp_vfy_data/chain.txt
deleted file mode 100644
index 1b55c25abb..0000000000
--- a/test/recipes/65-test_cmp_vfy_data/chain.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-1 - Root_CA (self-signed)
-1.1 - EndEntity1
-1.2 Intermediate_CA
-1.2.1 EndEntity2