From 08138f3cbda0134b356f368c9ce0a08b7cf05e36 Mon Sep 17 00:00:00 2001 From: Filip Skokan Date: Thu, 15 Oct 2026 18:55:40 +0200 Subject: [PATCH] test: account for OpenSSL 4.x changes Skip the client certificate and private key engine addon tests on OpenSSL 4, which no longer supports engines. Account for OpenSSL 4.1 no longer checking the subject CN by default in X509Certificate.checkHost(). Keep explicit subject matching and TLS CN fallback expectations unchanged. Signed-off-by: Filip Skokan Assisted-by: Codex --- test/addons/openssl-client-cert-engine/test.js | 5 +++++ test/addons/openssl-key-engine/test.js | 5 +++++ test/parallel/test-x509-escaping.js | 7 +++---- 3 files changed, 13 insertions(+), 4 deletions(-) diff --git a/test/addons/openssl-client-cert-engine/test.js b/test/addons/openssl-client-cert-engine/test.js index 4f7c7d7ac0f1..bad751202ca0 100644 --- a/test/addons/openssl-client-cert-engine/test.js +++ b/test/addons/openssl-client-cert-engine/test.js @@ -5,6 +5,11 @@ const fixture = require('../../common/fixtures'); if (!common.hasCrypto) common.skip('missing crypto'); +const { hasOpenSSL } = require('../../common/crypto'); + +if (hasOpenSSL(4)) + common.skip('OpenSSL 4 does not support engines'); + const fs = require('fs'); const path = require('path'); diff --git a/test/addons/openssl-key-engine/test.js b/test/addons/openssl-key-engine/test.js index 92b7bb558ad7..db05b6cea62b 100644 --- a/test/addons/openssl-key-engine/test.js +++ b/test/addons/openssl-key-engine/test.js @@ -5,6 +5,11 @@ const fixture = require('../../common/fixtures'); if (!common.hasCrypto) common.skip('missing crypto'); +const { hasOpenSSL } = require('../../common/crypto'); + +if (hasOpenSSL(4)) + common.skip('OpenSSL 4 does not support engines'); + const fs = require('fs'); const path = require('path'); diff --git a/test/parallel/test-x509-escaping.js b/test/parallel/test-x509-escaping.js index 47901140cac0..daa51e28191a 100644 --- a/test/parallel/test-x509-escaping.js +++ b/test/parallel/test-x509-escaping.js @@ -472,7 +472,7 @@ const { hasOpenSSL, isBoringSSL } = require('../common/crypto'); })).unref(); } -// The subject MUST NOT be ignored if no dNSName subject alternative name +// TLS MUST NOT ignore the subject if no dNSName subject alternative name // exists, even if other subject alternative names exist. { const key = fixtures.readKey('irrelevant_san_correct_subject-key.pem'); @@ -485,13 +485,12 @@ const { hasOpenSSL, isBoringSSL } = require('../common/crypto'); assert.strictEqual(certX509.subjectAltName, 'IP Address:1.2.3.4'); // The newer X509Certificate API allows customizing this behavior: - const cnFallback = isBoringSSL ? undefined : - servername; + const cnFallback = isBoringSSL || hasOpenSSL(4, 1) ? undefined : servername; assert.strictEqual(certX509.checkHost(servername), cnFallback); assert.strictEqual(certX509.checkHost(servername, { subject: 'default' }), cnFallback); assert.strictEqual(certX509.checkHost(servername, { subject: 'always' }), - cnFallback); + isBoringSSL ? undefined : servername); assert.strictEqual(certX509.checkHost(servername, { subject: 'never' }), undefined);