25-test_verify.t 18 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373
  1. #! /usr/bin/env perl
  2. # Copyright 2015-2018 The OpenSSL Project Authors. All Rights Reserved.
  3. #
  4. # Licensed under the OpenSSL license (the "License"). You may not use
  5. # this file except in compliance with the License. You can obtain a copy
  6. # in the file LICENSE in the source distribution or at
  7. # https://www.openssl.org/source/license.html
  8. use strict;
  9. use warnings;
  10. use File::Spec::Functions qw/canonpath/;
  11. use OpenSSL::Test qw/:DEFAULT srctop_file/;
  12. use OpenSSL::Test::Utils;
  13. setup("test_verify");
  14. sub verify {
  15. my ($cert, $purpose, $trusted, $untrusted, @opts) = @_;
  16. my @args = qw(openssl verify -auth_level 1 -purpose);
  17. my @path = qw(test certs);
  18. push(@args, "$purpose", @opts);
  19. for (@$trusted) { push(@args, "-trusted", srctop_file(@path, "$_.pem")) }
  20. for (@$untrusted) { push(@args, "-untrusted", srctop_file(@path, "$_.pem")) }
  21. push(@args, srctop_file(@path, "$cert.pem"));
  22. run(app([@args]));
  23. }
  24. plan tests => 134;
  25. # Canonical success
  26. ok(verify("ee-cert", "sslserver", ["root-cert"], ["ca-cert"]),
  27. "accept compat trust");
  28. # Root CA variants
  29. ok(!verify("ee-cert", "sslserver", [qw(root-nonca)], [qw(ca-cert)]),
  30. "fail trusted non-ca root");
  31. ok(!verify("ee-cert", "sslserver", [qw(nroot+serverAuth)], [qw(ca-cert)]),
  32. "fail server trust non-ca root");
  33. ok(!verify("ee-cert", "sslserver", [qw(nroot+anyEKU)], [qw(ca-cert)]),
  34. "fail wildcard trust non-ca root");
  35. ok(!verify("ee-cert", "sslserver", [qw(root-cert2)], [qw(ca-cert)]),
  36. "fail wrong root key");
  37. ok(!verify("ee-cert", "sslserver", [qw(root-name2)], [qw(ca-cert)]),
  38. "fail wrong root DN");
  39. # Explicit trust/purpose combinations
  40. #
  41. ok(verify("ee-cert", "sslserver", [qw(sroot-cert)], [qw(ca-cert)]),
  42. "accept server purpose");
  43. ok(!verify("ee-cert", "sslserver", [qw(croot-cert)], [qw(ca-cert)]),
  44. "fail client purpose");
  45. ok(verify("ee-cert", "sslserver", [qw(root+serverAuth)], [qw(ca-cert)]),
  46. "accept server trust");
  47. ok(verify("ee-cert", "sslserver", [qw(sroot+serverAuth)], [qw(ca-cert)]),
  48. "accept server trust with server purpose");
  49. ok(verify("ee-cert", "sslserver", [qw(croot+serverAuth)], [qw(ca-cert)]),
  50. "accept server trust with client purpose");
  51. # Wildcard trust
  52. ok(verify("ee-cert", "sslserver", [qw(root+anyEKU)], [qw(ca-cert)]),
  53. "accept wildcard trust");
  54. ok(verify("ee-cert", "sslserver", [qw(sroot+anyEKU)], [qw(ca-cert)]),
  55. "accept wildcard trust with server purpose");
  56. ok(verify("ee-cert", "sslserver", [qw(croot+anyEKU)], [qw(ca-cert)]),
  57. "accept wildcard trust with client purpose");
  58. # Inapplicable mistrust
  59. ok(verify("ee-cert", "sslserver", [qw(root-clientAuth)], [qw(ca-cert)]),
  60. "accept client mistrust");
  61. ok(verify("ee-cert", "sslserver", [qw(sroot-clientAuth)], [qw(ca-cert)]),
  62. "accept client mistrust with server purpose");
  63. ok(!verify("ee-cert", "sslserver", [qw(croot-clientAuth)], [qw(ca-cert)]),
  64. "fail client mistrust with client purpose");
  65. # Inapplicable trust
  66. ok(!verify("ee-cert", "sslserver", [qw(root+clientAuth)], [qw(ca-cert)]),
  67. "fail client trust");
  68. ok(!verify("ee-cert", "sslserver", [qw(sroot+clientAuth)], [qw(ca-cert)]),
  69. "fail client trust with server purpose");
  70. ok(!verify("ee-cert", "sslserver", [qw(croot+clientAuth)], [qw(ca-cert)]),
  71. "fail client trust with client purpose");
  72. # Server mistrust
  73. ok(!verify("ee-cert", "sslserver", [qw(root-serverAuth)], [qw(ca-cert)]),
  74. "fail rejected EKU");
  75. ok(!verify("ee-cert", "sslserver", [qw(sroot-serverAuth)], [qw(ca-cert)]),
  76. "fail server mistrust with server purpose");
  77. ok(!verify("ee-cert", "sslserver", [qw(croot-serverAuth)], [qw(ca-cert)]),
  78. "fail server mistrust with client purpose");
  79. # Wildcard mistrust
  80. ok(!verify("ee-cert", "sslserver", [qw(root-anyEKU)], [qw(ca-cert)]),
  81. "fail wildcard mistrust");
  82. ok(!verify("ee-cert", "sslserver", [qw(sroot-anyEKU)], [qw(ca-cert)]),
  83. "fail wildcard mistrust with server purpose");
  84. ok(!verify("ee-cert", "sslserver", [qw(croot-anyEKU)], [qw(ca-cert)]),
  85. "fail wildcard mistrust with client purpose");
  86. # Check that trusted-first is on by setting up paths to different roots
  87. # depending on whether the intermediate is the trusted or untrusted one.
  88. #
  89. ok(verify("ee-cert", "sslserver", [qw(root-serverAuth root-cert2 ca-root2)],
  90. [qw(ca-cert)]),
  91. "accept trusted-first path");
  92. ok(verify("ee-cert", "sslserver", [qw(root-cert root2+serverAuth ca-root2)],
  93. [qw(ca-cert)]),
  94. "accept trusted-first path with server trust");
  95. ok(!verify("ee-cert", "sslserver", [qw(root-cert root2-serverAuth ca-root2)],
  96. [qw(ca-cert)]),
  97. "fail trusted-first path with server mistrust");
  98. ok(!verify("ee-cert", "sslserver", [qw(root-cert root2+clientAuth ca-root2)],
  99. [qw(ca-cert)]),
  100. "fail trusted-first path with client trust");
  101. # CA variants
  102. ok(!verify("ee-cert", "sslserver", [qw(root-cert)], [qw(ca-nonca)]),
  103. "fail non-CA untrusted intermediate");
  104. ok(!verify("ee-cert", "sslserver", [qw(root-cert)], [qw(ca-nonbc)]),
  105. "fail non-CA untrusted intermediate");
  106. ok(!verify("ee-cert", "sslserver", [qw(root-cert ca-nonca)], []),
  107. "fail non-CA trust-store intermediate");
  108. ok(!verify("ee-cert", "sslserver", [qw(root-cert ca-nonbc)], []),
  109. "fail non-CA trust-store intermediate");
  110. ok(!verify("ee-cert", "sslserver", [qw(root-cert nca+serverAuth)], []),
  111. "fail non-CA server trust intermediate");
  112. ok(!verify("ee-cert", "sslserver", [qw(root-cert nca+anyEKU)], []),
  113. "fail non-CA wildcard trust intermediate");
  114. ok(!verify("ee-cert", "sslserver", [qw(root-cert)], [qw(ca-cert2)]),
  115. "fail wrong intermediate CA key");
  116. ok(!verify("ee-cert", "sslserver", [qw(root-cert)], [qw(ca-name2)]),
  117. "fail wrong intermediate CA DN");
  118. ok(!verify("ee-cert", "sslserver", [qw(root-cert)], [qw(ca-root2)]),
  119. "fail wrong intermediate CA issuer");
  120. ok(!verify("ee-cert", "sslserver", [], [qw(ca-cert)], "-partial_chain"),
  121. "fail untrusted partial chain");
  122. ok(verify("ee-cert", "sslserver", [qw(ca-cert)], [], "-partial_chain"),
  123. "accept trusted partial chain");
  124. ok(verify("ee-cert", "sslserver", [qw(sca-cert)], [], "-partial_chain"),
  125. "accept partial chain with server purpose");
  126. ok(!verify("ee-cert", "sslserver", [qw(cca-cert)], [], "-partial_chain"),
  127. "fail partial chain with client purpose");
  128. ok(verify("ee-cert", "sslserver", [qw(ca+serverAuth)], [], "-partial_chain"),
  129. "accept server trust partial chain");
  130. ok(verify("ee-cert", "sslserver", [qw(cca+serverAuth)], [], "-partial_chain"),
  131. "accept server trust client purpose partial chain");
  132. ok(verify("ee-cert", "sslserver", [qw(ca-clientAuth)], [], "-partial_chain"),
  133. "accept client mistrust partial chain");
  134. ok(verify("ee-cert", "sslserver", [qw(ca+anyEKU)], [], "-partial_chain"),
  135. "accept wildcard trust partial chain");
  136. ok(!verify("ee-cert", "sslserver", [], [qw(ca+serverAuth)], "-partial_chain"),
  137. "fail untrusted partial issuer with ignored server trust");
  138. ok(!verify("ee-cert", "sslserver", [qw(ca-serverAuth)], [], "-partial_chain"),
  139. "fail server mistrust partial chain");
  140. ok(!verify("ee-cert", "sslserver", [qw(ca+clientAuth)], [], "-partial_chain"),
  141. "fail client trust partial chain");
  142. ok(!verify("ee-cert", "sslserver", [qw(ca-anyEKU)], [], "-partial_chain"),
  143. "fail wildcard mistrust partial chain");
  144. # We now test auxiliary trust even for intermediate trusted certs without
  145. # -partial_chain. Note that "-trusted_first" is now always on and cannot
  146. # be disabled.
  147. ok(verify("ee-cert", "sslserver", [qw(root-cert ca+serverAuth)], [qw(ca-cert)]),
  148. "accept server trust");
  149. ok(verify("ee-cert", "sslserver", [qw(root-cert ca+anyEKU)], [qw(ca-cert)]),
  150. "accept wildcard trust");
  151. ok(verify("ee-cert", "sslserver", [qw(root-cert sca-cert)], [qw(ca-cert)]),
  152. "accept server purpose");
  153. ok(verify("ee-cert", "sslserver", [qw(root-cert sca+serverAuth)], [qw(ca-cert)]),
  154. "accept server trust and purpose");
  155. ok(verify("ee-cert", "sslserver", [qw(root-cert sca+anyEKU)], [qw(ca-cert)]),
  156. "accept wildcard trust and server purpose");
  157. ok(verify("ee-cert", "sslserver", [qw(root-cert sca-clientAuth)], [qw(ca-cert)]),
  158. "accept client mistrust and server purpose");
  159. ok(verify("ee-cert", "sslserver", [qw(root-cert cca+serverAuth)], [qw(ca-cert)]),
  160. "accept server trust and client purpose");
  161. ok(verify("ee-cert", "sslserver", [qw(root-cert cca+anyEKU)], [qw(ca-cert)]),
  162. "accept wildcard trust and client purpose");
  163. ok(!verify("ee-cert", "sslserver", [qw(root-cert cca-cert)], [qw(ca-cert)]),
  164. "fail client purpose");
  165. ok(!verify("ee-cert", "sslserver", [qw(root-cert ca-anyEKU)], [qw(ca-cert)]),
  166. "fail wildcard mistrust");
  167. ok(!verify("ee-cert", "sslserver", [qw(root-cert ca-serverAuth)], [qw(ca-cert)]),
  168. "fail server mistrust");
  169. ok(!verify("ee-cert", "sslserver", [qw(root-cert ca+clientAuth)], [qw(ca-cert)]),
  170. "fail client trust");
  171. ok(!verify("ee-cert", "sslserver", [qw(root-cert sca+clientAuth)], [qw(ca-cert)]),
  172. "fail client trust and server purpose");
  173. ok(!verify("ee-cert", "sslserver", [qw(root-cert cca+clientAuth)], [qw(ca-cert)]),
  174. "fail client trust and client purpose");
  175. ok(!verify("ee-cert", "sslserver", [qw(root-cert cca-serverAuth)], [qw(ca-cert)]),
  176. "fail server mistrust and client purpose");
  177. ok(!verify("ee-cert", "sslserver", [qw(root-cert cca-clientAuth)], [qw(ca-cert)]),
  178. "fail client mistrust and client purpose");
  179. ok(!verify("ee-cert", "sslserver", [qw(root-cert sca-serverAuth)], [qw(ca-cert)]),
  180. "fail server mistrust and server purpose");
  181. ok(!verify("ee-cert", "sslserver", [qw(root-cert sca-anyEKU)], [qw(ca-cert)]),
  182. "fail wildcard mistrust and server purpose");
  183. ok(!verify("ee-cert", "sslserver", [qw(root-cert cca-anyEKU)], [qw(ca-cert)]),
  184. "fail wildcard mistrust and client purpose");
  185. # EE variants
  186. ok(verify("ee-client", "sslclient", [qw(root-cert)], [qw(ca-cert)]),
  187. "accept client chain");
  188. ok(!verify("ee-client", "sslserver", [qw(root-cert)], [qw(ca-cert)]),
  189. "fail server leaf purpose");
  190. ok(!verify("ee-cert", "sslclient", [qw(root-cert)], [qw(ca-cert)]),
  191. "fail client leaf purpose");
  192. ok(!verify("ee-cert2", "sslserver", [qw(root-cert)], [qw(ca-cert)]),
  193. "fail wrong intermediate CA key");
  194. ok(!verify("ee-name2", "sslserver", [qw(root-cert)], [qw(ca-cert)]),
  195. "fail wrong intermediate CA DN");
  196. ok(!verify("ee-expired", "sslserver", [qw(root-cert)], [qw(ca-cert)]),
  197. "fail expired leaf");
  198. ok(verify("ee-cert", "sslserver", [qw(ee-cert)], [], "-partial_chain"),
  199. "accept last-resort direct leaf match");
  200. ok(verify("ee-client", "sslclient", [qw(ee-client)], [], "-partial_chain"),
  201. "accept last-resort direct leaf match");
  202. ok(!verify("ee-cert", "sslserver", [qw(ee-client)], [], "-partial_chain"),
  203. "fail last-resort direct leaf non-match");
  204. ok(verify("ee-cert", "sslserver", [qw(ee+serverAuth)], [], "-partial_chain"),
  205. "accept direct match with server trust");
  206. ok(!verify("ee-cert", "sslserver", [qw(ee-serverAuth)], [], "-partial_chain"),
  207. "fail direct match with server mistrust");
  208. ok(verify("ee-client", "sslclient", [qw(ee+clientAuth)], [], "-partial_chain"),
  209. "accept direct match with client trust");
  210. ok(!verify("ee-client", "sslclient", [qw(ee-clientAuth)], [], "-partial_chain"),
  211. "reject direct match with client mistrust");
  212. # Proxy certificates
  213. ok(!verify("pc1-cert", "sslclient", [qw(root-cert)], [qw(ee-client ca-cert)]),
  214. "fail to accept proxy cert without -allow_proxy_certs");
  215. ok(verify("pc1-cert", "sslclient", [qw(root-cert)], [qw(ee-client ca-cert)],
  216. "-allow_proxy_certs"),
  217. "accept proxy cert 1");
  218. ok(verify("pc2-cert", "sslclient", [qw(root-cert)], [qw(pc1-cert ee-client ca-cert)],
  219. "-allow_proxy_certs"),
  220. "accept proxy cert 2");
  221. ok(!verify("bad-pc3-cert", "sslclient", [qw(root-cert)], [qw(pc1-cert ee-client ca-cert)],
  222. "-allow_proxy_certs"),
  223. "fail proxy cert with incorrect subject");
  224. ok(!verify("bad-pc4-cert", "sslclient", [qw(root-cert)], [qw(pc1-cert ee-client ca-cert)],
  225. "-allow_proxy_certs"),
  226. "fail proxy cert with incorrect pathlen");
  227. ok(verify("pc5-cert", "sslclient", [qw(root-cert)], [qw(pc1-cert ee-client ca-cert)],
  228. "-allow_proxy_certs"),
  229. "accept proxy cert missing proxy policy");
  230. ok(!verify("pc6-cert", "sslclient", [qw(root-cert)], [qw(pc1-cert ee-client ca-cert)],
  231. "-allow_proxy_certs"),
  232. "failed proxy cert where last CN was added as a multivalue RDN component");
  233. # Security level tests
  234. ok(verify("ee-cert", "sslserver", ["root-cert"], ["ca-cert"], "-auth_level", "2"),
  235. "accept RSA 2048 chain at auth level 2");
  236. ok(!verify("ee-cert", "sslserver", ["root-cert"], ["ca-cert"], "-auth_level", "3"),
  237. "reject RSA 2048 root at auth level 3");
  238. ok(verify("ee-cert", "sslserver", ["root-cert-768"], ["ca-cert-768i"], "-auth_level", "0"),
  239. "accept RSA 768 root at auth level 0");
  240. ok(!verify("ee-cert", "sslserver", ["root-cert-768"], ["ca-cert-768i"]),
  241. "reject RSA 768 root at auth level 1");
  242. ok(verify("ee-cert-768i", "sslserver", ["root-cert"], ["ca-cert-768"], "-auth_level", "0"),
  243. "accept RSA 768 intermediate at auth level 0");
  244. ok(!verify("ee-cert-768i", "sslserver", ["root-cert"], ["ca-cert-768"]),
  245. "reject RSA 768 intermediate at auth level 1");
  246. ok(verify("ee-cert-768", "sslserver", ["root-cert"], ["ca-cert"], "-auth_level", "0"),
  247. "accept RSA 768 leaf at auth level 0");
  248. ok(!verify("ee-cert-768", "sslserver", ["root-cert"], ["ca-cert"]),
  249. "reject RSA 768 leaf at auth level 1");
  250. #
  251. ok(verify("ee-cert", "sslserver", ["root-cert-md5"], ["ca-cert"], "-auth_level", "2"),
  252. "accept md5 self-signed TA at auth level 2");
  253. ok(verify("ee-cert", "sslserver", ["ca-cert-md5-any"], [], "-auth_level", "2"),
  254. "accept md5 intermediate TA at auth level 2");
  255. ok(verify("ee-cert", "sslserver", ["root-cert"], ["ca-cert-md5"], "-auth_level", "0"),
  256. "accept md5 intermediate at auth level 0");
  257. ok(!verify("ee-cert", "sslserver", ["root-cert"], ["ca-cert-md5"]),
  258. "reject md5 intermediate at auth level 1");
  259. ok(verify("ee-cert-md5", "sslserver", ["root-cert"], ["ca-cert"], "-auth_level", "0"),
  260. "accept md5 leaf at auth level 0");
  261. ok(!verify("ee-cert-md5", "sslserver", ["root-cert"], ["ca-cert"]),
  262. "reject md5 leaf at auth level 1");
  263. # Depth tests, note the depth limit bounds the number of CA certificates
  264. # between the trust-anchor and the leaf, so, for example, with a root->ca->leaf
  265. # chain, depth = 1 is sufficient, but depth == 0 is not.
  266. #
  267. ok(verify("ee-cert", "sslserver", ["root-cert"], ["ca-cert"], "-verify_depth", "2"),
  268. "accept chain with verify_depth 2");
  269. ok(verify("ee-cert", "sslserver", ["root-cert"], ["ca-cert"], "-verify_depth", "1"),
  270. "accept chain with verify_depth 1");
  271. ok(!verify("ee-cert", "sslserver", ["root-cert"], ["ca-cert"], "-verify_depth", "0"),
  272. "accept chain with verify_depth 0");
  273. ok(verify("ee-cert", "sslserver", ["ca-cert-md5-any"], [], "-verify_depth", "0"),
  274. "accept md5 intermediate TA with verify_depth 0");
  275. # Name Constraints tests.
  276. ok(verify("alt1-cert", "sslserver", ["root-cert"], ["ncca1-cert"], ),
  277. "Name Constraints everything permitted");
  278. ok(verify("alt2-cert", "sslserver", ["root-cert"], ["ncca2-cert"], ),
  279. "Name Constraints nothing excluded");
  280. ok(verify("alt3-cert", "sslserver", ["root-cert"], ["ncca1-cert", "ncca3-cert"], ),
  281. "Name Constraints nested test all permitted");
  282. ok(verify("goodcn1-cert", "sslserver", ["root-cert"], ["ncca1-cert"], ),
  283. "Name Constraints CNs permitted");
  284. ok(!verify("badcn1-cert", "sslserver", ["root-cert"], ["ncca1-cert"], ),
  285. "Name Constraints CNs not permitted");
  286. ok(!verify("badalt1-cert", "sslserver", ["root-cert"], ["ncca1-cert"], ),
  287. "Name Constraints hostname not permitted");
  288. ok(!verify("badalt2-cert", "sslserver", ["root-cert"], ["ncca2-cert"], ),
  289. "Name Constraints hostname excluded");
  290. ok(!verify("badalt3-cert", "sslserver", ["root-cert"], ["ncca1-cert"], ),
  291. "Name Constraints email address not permitted");
  292. ok(!verify("badalt4-cert", "sslserver", ["root-cert"], ["ncca1-cert"], ),
  293. "Name Constraints subject email address not permitted");
  294. ok(!verify("badalt5-cert", "sslserver", ["root-cert"], ["ncca1-cert"], ),
  295. "Name Constraints IP address not permitted");
  296. ok(!verify("badalt6-cert", "sslserver", ["root-cert"], ["ncca1-cert"], ),
  297. "Name Constraints CN hostname not permitted");
  298. ok(!verify("badalt7-cert", "sslserver", ["root-cert"], ["ncca1-cert"], ),
  299. "Name Constraints CN BMPSTRING hostname not permitted");
  300. ok(!verify("badalt8-cert", "sslserver", ["root-cert"], ["ncca1-cert", "ncca3-cert"], ),
  301. "Name constraints nested DNS name not permitted 1");
  302. ok(!verify("badalt9-cert", "sslserver", ["root-cert"], ["ncca1-cert", "ncca3-cert"], ),
  303. "Name constraints nested DNS name not permitted 2");
  304. ok(!verify("badalt10-cert", "sslserver", ["root-cert"], ["ncca1-cert", "ncca3-cert"], ),
  305. "Name constraints nested DNS name excluded");
  306. ok(verify("ee-pss-sha1-cert", "sslserver", ["root-cert"], ["ca-cert"], ),
  307. "Certificate PSS signature using SHA1");
  308. ok(verify("ee-pss-sha256-cert", "sslserver", ["root-cert"], ["ca-cert"], ),
  309. "CA with PSS signature using SHA256");
  310. ok(!verify("ee-pss-sha1-cert", "sslserver", ["root-cert"], ["ca-cert"], "-auth_level", "2"),
  311. "Reject PSS signature using SHA1 and auth level 2");
  312. ok(verify("ee-pss-sha256-cert", "sslserver", ["root-cert"], ["ca-cert"], "-auth_level", "2"),
  313. "PSS signature using SHA256 and auth level 2");
  314. ok(!verify("many-names1", "sslserver", ["many-constraints"], ["many-constraints"], ),
  315. "Too many names and constraints to check (1)");
  316. ok(!verify("many-names2", "sslserver", ["many-constraints"], ["many-constraints"], ),
  317. "Too many names and constraints to check (2)");
  318. ok(!verify("many-names3", "sslserver", ["many-constraints"], ["many-constraints"], ),
  319. "Too many names and constraints to check (3)");
  320. ok(verify("some-names1", "sslserver", ["many-constraints"], ["many-constraints"], ),
  321. "Not too many names and constraints to check (1)");
  322. ok(verify("some-names2", "sslserver", ["many-constraints"], ["many-constraints"], ),
  323. "Not too many names and constraints to check (2)");
  324. ok(verify("some-names2", "sslserver", ["many-constraints"], ["many-constraints"], ),
  325. "Not too many names and constraints to check (3)");
  326. SKIP: {
  327. skip "Ed25519 is not supported by this OpenSSL build", 1
  328. if disabled("ec");
  329. # ED25519 certificate from draft-ietf-curdle-pkix-04
  330. ok(verify("ee-ed25519", "sslserver", ["root-ed25519"], []),
  331. "ED25519 signature");
  332. }