diff --git a/test/recipes/15-test_ec.t b/test/recipes/15-test_ec.t index acd1b3960d..354c360362 100644 --- a/test/recipes/15-test_ec.t +++ b/test/recipes/15-test_ec.t @@ -18,7 +18,9 @@ setup("test_ec"); plan skip_all => 'EC is not supported in this build' if disabled('ec'); -plan tests => 14; +plan tests => 15; + +my $no_fips = disabled('fips') || ($ENV{NO_FIPS} // 0); require_ok(srctop_file('test','recipes','tconversion.pl')); @@ -85,3 +87,25 @@ subtest 'Ed448 conversions -- public key' => sub { -in => srctop_file("test", "tested448pub.pem"), -args => ["pkey", "-pubin", "-pubout"] ); }; + +subtest 'Check loading of fips and non-fips keys' => sub { + plan skip_all => "FIPS is disabled" + if $no_fips; + + plan tests => 2; + + my $fipsconf = srctop_file("test", "fips-and-base.cnf"); + $ENV{OPENSSL_CONF} = $fipsconf; + + ok(!run(app(['openssl', 'pkey', + '-check', '-in', srctop_file("test", "testec-p112r1.pem")])), + "Checking non-fips curve key fails in FIPS provider"); + + ok(run(app(['openssl', 'pkey', + '-provider', 'default', + '-propquery', '?fips!=yes', + '-check', '-in', srctop_file("test", "testec-p112r1.pem")])), + "Checking non-fips curve key succeeds with non-fips property query"); + + delete $ENV{OPENSSL_CONF}; +} diff --git a/test/testec-p112r1.pem b/test/testec-p112r1.pem new file mode 100644 index 0000000000..c81398e7d7 --- /dev/null +++ b/test/testec-p112r1.pem @@ -0,0 +1,7 @@ +-----BEGIN EC PARAMETERS----- +BgUrgQQABg== +-----END EC PARAMETERS----- +-----BEGIN EC PRIVATE KEY----- +MD4CAQEEDqpz3/ZgfdnaauL3MgNsoAcGBSuBBAAGoSADHgAErmlghD+XSf6spLhs +7CqP1x1K6h2kfELB84SYKg== +-----END EC PRIVATE KEY-----