add support for ML-DSA-* etc., various small fixes; OpenSSL 4.0 compat#119

Draft

DDvO wants to merge 26 commits into

Commits on Jun 15, 2026

Makefile_v1: prevent strange error Makefile_v1:20t: *** missing separator (did you mean TAB instead of 8 spaces?).
DDvO
committed
OpenSSL_version.mk: fix tab -> spaces in one line
DDvO
committed
cmpClient.c: replace use of X509_NAME_get_text_by_NID() deprecated since OpenSSL 4.0
DDvO
committed
cmpossl: fixes for OpenSSL 4.0 compatibility and small other fixes
DDvO
committed
.github/workflows/OpenSSL_versions.yml: update active OpenSSL versions, removing 3.1 .. 3.3 and adding 4.0
DDvO
committed
.github/workflows/OpenSSL_versions.yml: clean up 'cmake', Mock test PQC credential creation, and 'make' steps
DDvO
committed
credential_loading.{c,h}: consistently use 'file_format_t format' and 'bool maybe_stdin'
DDvO
committed
80-test_cmp_http.t: align with latest upstream OpenSSL version of that script
DDvO
committed
80-test_cmp_http.t: drop special cases for Insta Demo CA since it is defunct
DDvO
committed
80-test_cmp_http.t,test_certstatus.csv: (re-)enable certstatus aspect
DDvO
committed
80-test_cmp_http.t: fix Perl code according to Copilot review suggestions
DDvO
committed
README.md: make more clear that using git is not required, adding hints what to do when not using it
DDvO
committed
Makefile_src,CMakeLists.txt: align and strengthen compiler warning options
DDvO
committed
Makefile_v1: fix duplicate display of creds/operational.crt and the filtering of key/signature hex strings
DDvO
committed
config/EJBCA.env: add creds/docker/TLS_ROOTCA.pem to EJBCA_TLS_TRUSTED for verifying own TLS client cert
DDvO
committed
config/EJBCA.env,creds/docker/: add PEM variant of Docker_Playground_TLS.p12 and use that
DDvO
committed
creds/docker/: add PEM variant of Docker_Playground_CMP.p12
DDvO
committed
config/EJBCA.env,Makefile_v1/: rename TLS_ROOTCA-docker-cn.txt to TLS_server-docker-cn.txt, add EJBCA_TLS_SERVCER_CERTS
DDvO
committed
cmpClient.c: adapt (and rename) setup_X509_extensions() as X509V3_EXT_add_nconf_sk() makes empty exts NULL since OpenSSL 4.0
DDvO
committed
cmpClient.c: fix usability of -nonmatched_error_nonces option dependent on OpenSSL version or libcmp use
DDvO
committed
cmpClient.c,CMPclient_setup_HTTP(): make sure to skip host name check for local host if -tls_host not given
DDvO
committed
CMPclient_setup_HTTP(),doc/: fix setting TLS SNI: use just -server host part, not any given -tls_host
DDvO
committed
update doc/OpenSSL_CMP-and-generic_CMP_client_overview.pptx
DDvO
committed
genericCMPClient_util.{c,h}: improve CONN_IS_IP_ADDR()
DDvO
committed
genericCMPClient_util.{c,h}: add UTIL_SKIP_SCHEME() and improve skip_scheme() using it
DDvO
committed
cmpClient.c: add support for ML-DSA-* and potentially further PQC algorithms
DDvO
committed