[nginx-tests] Tests: compatibility with OpenSSL 4.1.

[Maxim Dounin]

details:   http://freenginx.org/hg/nginx-tests/rev/7a191a1f819d
branches:  
changeset: 2092:7a191a1f819d
user:      Maxim Dounin <mdounin at mdounin.ru>
date:      Sun Oct 25 19:58:19 2026 +0300
description:
Tests: compatibility with OpenSSL 4.1.

In OpenSSL 4.1, the X509_check_host() function no longer tries to check
CNs in certificates (including when there are no subject alternative
names defined in the certificate), following the changes introduced by
RFC 9525.

Accordingly, relevant certificate verification tests
(proxy_ssl_verify.t, etc.) were updated to expect failures during
verification of certificates with a CN only when using OpenSSL 4.1.
Additionally, grpc_ssl.t was updated to provide the correct subject
alternative name in the certificate being verified, unbreaking the test
with OpenSSL 4.1.

diffstat:

 grpc_ssl.t                |  21 ++++++++++++++++++---
 proxy_ssl_verify.t        |   7 +++++++
 stream_proxy_ssl_verify.t |   7 +++++++
 uwsgi_ssl_verify.t        |   7 +++++++
 4 files changed, 39 insertions(+), 3 deletions(-)

diffs (104 lines):

diff --git a/grpc_ssl.t b/grpc_ssl.t
--- a/grpc_ssl.t
+++ b/grpc_ssl.t
@@ -96,12 +96,27 @@ http {
 
 EOF
 
-$t->write_file('openssl.conf', <<EOF);
+$t->write_file('openssl.localhost.conf', <<EOF);
 [ req ]
+prompt = no
+default_bits = 2048
+encrypt_key = no
+distinguished_name = req_distinguished_name
+x509_extensions = v3_req
+[ req_distinguished_name ]
+commonName = localhost
+[ v3_req ]
+subjectAltName = DNS:localhost
+EOF
+
+$t->write_file('openssl.client.conf', <<EOF);
+[ req ]
+prompt = no
 default_bits = 2048
 encrypt_key = no
 distinguished_name = req_distinguished_name
 [ req_distinguished_name ]
+commonName = client
 EOF
 
 my $d = $t->testdir();
@@ -109,7 +124,7 @@ my $tr = `openssl genrsa -help 2>&1` =~ 
 
 foreach my $name ('localhost') {
 	system('openssl req -x509 -new '
-		. "-config $d/openssl.conf -subj /CN=$name/ "
+		. "-config $d/openssl.$name.conf "
 		. "-out $d/$name.crt -keyout $d/$name.key "
 		. ">>$d/openssl.out 2>&1") == 0
 		or die "Can't create certificate for $name: $!\n";
@@ -120,7 +135,7 @@ foreach my $name ('client') {
 		. "-aes128 $tr 2048 >>$d/openssl.out 2>&1") == 0
 		or die "Can't create private key: $!\n";
 	system('openssl req -x509 -new '
-		. "-config $d/openssl.conf -subj /CN=$name/ "
+		. "-config $d/openssl.$name.conf "
 		. "-out $d/$name.crt "
 		. "-key $d/$name.key -passin pass:$name"
 		. ">>$d/openssl.out 2>&1") == 0
diff --git a/proxy_ssl_verify.t b/proxy_ssl_verify.t
--- a/proxy_ssl_verify.t
+++ b/proxy_ssl_verify.t
@@ -185,7 +185,14 @@ like(http_get('/fail'), qr/502 Bad/ms, '
 
 # commonName
 
+TODO: {
+local $TODO = 'rejected by OpenSSL 4.1.0+'
+	if $t->has_feature('openssl:4.1.0');
+
 like(http_get('/cn'), qr/200 OK/ms, 'verify cn');
+
+}
+
 like(http_get('/cn/fail'), qr/502 Bad/ms, 'verify cn fail');
 
 # untrusted
diff --git a/stream_proxy_ssl_verify.t b/stream_proxy_ssl_verify.t
--- a/stream_proxy_ssl_verify.t
+++ b/stream_proxy_ssl_verify.t
@@ -160,7 +160,14 @@ isnt(get(8082), 'OK', 'verify fail');
 
 # commonName
 
+TODO: {
+local $TODO = 'rejected by OpenSSL 4.1.0+'
+	if $t->has_feature('openssl:4.1.0');
+
 is(get(8083), 'OK', 'verify cn');
+
+}
+
 isnt(get(8084), 'OK', 'verify cn fail');
 
 # untrusted
diff --git a/uwsgi_ssl_verify.t b/uwsgi_ssl_verify.t
--- a/uwsgi_ssl_verify.t
+++ b/uwsgi_ssl_verify.t
@@ -177,7 +177,14 @@ like(http_get('/fail'), qr/502 Bad/ms, '
 
 # commonName
 
+TODO: {
+local $TODO = 'rejected by OpenSSL 4.1.0+'
+	if $t->has_feature('openssl:4.1.0');
+
 like(http_get('/cn'), qr/200 OK/ms, 'verify cn');
+
+}
+
 like(http_get('/cn/fail'), qr/502 Bad/ms, 'verify cn fail');
 
 # untrusted