[PATCH] Tests: compatibility with OpenSSL 4.1

[Maxim Dounin]

# HG changeset patch
# User Maxim Dounin <mdounin at mdounin.ru>
# Date 1792947499 -10800
#      Sun Oct 25 19:58:19 2026 +0300
# Node ID 7a191a1f819d977261db98271a77219204926a4a
# Parent  84c77c54e70f9740676c678bd46d3650727d77e7
Tests: compatibility with OpenSSL 4.1.

In OpenSSL 4.1, the X509_check_host() function no longer tries to check
CNs in certificates (including when there are no subject alternative
names defined in the certificate), following the changes introduced by
RFC 9525.

Accordingly, relevant certificate verification tests
(proxy_ssl_verify.t, etc.) were updated to expect failures during
verification of certificates with a CN only when using OpenSSL 4.1.
Additionally, grpc_ssl.t was updated to provide the correct subject
alternative name in the certificate being verified, unbreaking the test
with OpenSSL 4.1.

diff --git a/grpc_ssl.t b/grpc_ssl.t
--- a/grpc_ssl.t
+++ b/grpc_ssl.t
@@ -96,12 +96,27 @@ http {
 
 EOF
 
-$t->write_file('openssl.conf', <<EOF);
+$t->write_file('openssl.localhost.conf', <<EOF);
 [ req ]
+prompt = no
+default_bits = 2048
+encrypt_key = no
+distinguished_name = req_distinguished_name
+x509_extensions = v3_req
+[ req_distinguished_name ]
+commonName = localhost
+[ v3_req ]
+subjectAltName = DNS:localhost
+EOF
+
+$t->write_file('openssl.client.conf', <<EOF);
+[ req ]
+prompt = no
 default_bits = 2048
 encrypt_key = no
 distinguished_name = req_distinguished_name
 [ req_distinguished_name ]
+commonName = client
 EOF
 
 my $d = $t->testdir();
@@ -109,7 +124,7 @@ my $tr = `openssl genrsa -help 2>&1` =~ 
 
 foreach my $name ('localhost') {
 	system('openssl req -x509 -new '
-		. "-config $d/openssl.conf -subj /CN=$name/ "
+		. "-config $d/openssl.$name.conf "
 		. "-out $d/$name.crt -keyout $d/$name.key "
 		. ">>$d/openssl.out 2>&1") == 0
 		or die "Can't create certificate for $name: $!\n";
@@ -120,7 +135,7 @@ foreach my $name ('client') {
 		. "-aes128 $tr 2048 >>$d/openssl.out 2>&1") == 0
 		or die "Can't create private key: $!\n";
 	system('openssl req -x509 -new '
-		. "-config $d/openssl.conf -subj /CN=$name/ "
+		. "-config $d/openssl.$name.conf "
 		. "-out $d/$name.crt "
 		. "-key $d/$name.key -passin pass:$name"
 		. ">>$d/openssl.out 2>&1") == 0
diff --git a/proxy_ssl_verify.t b/proxy_ssl_verify.t
--- a/proxy_ssl_verify.t
+++ b/proxy_ssl_verify.t
@@ -185,7 +185,14 @@ like(http_get('/fail'), qr/502 Bad/ms, '
 
 # commonName
 
+TODO: {
+local $TODO = 'rejected by OpenSSL 4.1.0+'
+	if $t->has_feature('openssl:4.1.0');
+
 like(http_get('/cn'), qr/200 OK/ms, 'verify cn');
+
+}
+
 like(http_get('/cn/fail'), qr/502 Bad/ms, 'verify cn fail');
 
 # untrusted
diff --git a/stream_proxy_ssl_verify.t b/stream_proxy_ssl_verify.t
--- a/stream_proxy_ssl_verify.t
+++ b/stream_proxy_ssl_verify.t
@@ -160,7 +160,14 @@ isnt(get(8082), 'OK', 'verify fail');
 
 # commonName
 
+TODO: {
+local $TODO = 'rejected by OpenSSL 4.1.0+'
+	if $t->has_feature('openssl:4.1.0');
+
 is(get(8083), 'OK', 'verify cn');
+
+}
+
 isnt(get(8084), 'OK', 'verify cn fail');
 
 # untrusted
diff --git a/uwsgi_ssl_verify.t b/uwsgi_ssl_verify.t
--- a/uwsgi_ssl_verify.t
+++ b/uwsgi_ssl_verify.t
@@ -177,7 +177,14 @@ like(http_get('/fail'), qr/502 Bad/ms, '
 
 # commonName
 
+TODO: {
+local $TODO = 'rejected by OpenSSL 4.1.0+'
+	if $t->has_feature('openssl:4.1.0');
+
 like(http_get('/cn'), qr/200 OK/ms, 'verify cn');
+
+}
+
 like(http_get('/cn/fail'), qr/502 Bad/ms, 'verify cn fail');
 
 # untrusted