Commit f576890160 for openssl.org

commit f576890160af67ddf739920238838da647fcf2c0
Author: Jakub Zelenka <jakub.zelenka@openssl.foundation>
Date:   Tue Sep 1 19:56:45 2026 +0200

    apps: cover the -crlexts option in the ca recipe

    Generate a CRL taking its extensions from a dedicated section of
    the configuration file and check that the CRL is version 2 and
    carries the requested extension.

    Assisted-by: Claude:claude-fable-5
    Reviewed-by: Paul Dale <paul.dale@oracle.com>
    Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
    Merge-date: Mon Sep  7 18:11:17 2026
    Merged-from: https://github.com/openssl/openssl/pull/32632

diff --git a/test/ca-and-certs.cnf b/test/ca-and-certs.cnf
index 30838831be..56219f148d 100644
--- a/test/ca-and-certs.cnf
+++ b/test/ca-and-certs.cnf
@@ -99,6 +99,9 @@ organizationalUnitName	= optional
 commonName		= supplied
 emailAddress		= optional

+[ crl_ext ]
+authorityKeyIdentifier	= keyid:always
+
 [ v3_ca ]
 subjectKeyIdentifier	= hash
 authorityKeyIdentifier	= keyid:nonss,issuer:nonss
diff --git a/test/recipes/80-test_ca.t b/test/recipes/80-test_ca.t
index adb9ff8514..6d00bb351c 100644
--- a/test/recipes/80-test_ca.t
+++ b/test/recipes/80-test_ca.t
@@ -29,7 +29,7 @@ sub src_file {

 rmtree("demoCA", { safe => 0 });

-plan tests => 28;
+plan tests => 31;

 require_ok(srctop_file("test", "recipes", "tconversion.pl"));

@@ -93,6 +93,16 @@ test_extfile('extfile_default', [], qr/Digital Signature/);
 test_extfile('extfile_section', ['-extensions', 'alt_ext'],
              qr/Key Encipherment/);

+# Generate a CRL with extensions from the config section named by -crlexts
+ok(run(app(['openssl', 'ca', '-config', $cnf, '-gencrl', '-crlsec', '60',
+            '-crlexts', 'crl_ext', '-out', 'crlexts-crl.pem'])),
+   'Generate CRL with -crlexts');
+my $crlexts_text = join('',
+    run(app(['openssl', 'crl', '-in', 'crlexts-crl.pem',
+             '-noout', '-text']), capture => 1));
+ok($crlexts_text =~ qr/Version 2/, 'CRL with extensions is version 2');
+ok($crlexts_text =~ qr/Authority Key Identifier/, 'CRL contains AKID');
+
 test_revoke('notimes', {
     should_succeed => 1,
 });