Latest update

test/certs/server-ecdsa-brainpoolP256r1-cert.pem

@@ -0,0 +1,16 @@
+-----BEGIN CERTIFICATE-----
+MIICgzCCAWugAwIBAgIBAjANBgkqhkiG9w0BAQsFADASMRAwDgYDVQQDDAdSb290
+IENBMCAXDTE4MTAyNDEzNDUwOFoYDzIxMTgxMDI1MTM0NTA4WjAsMSowKAYDVQQD
+DCFTZXJ2ZXIgRUNEU0EgYnJhaW5wb29sUDI1NnIxIGNlcnQwWjAUBgcqhkjOPQIB
+BgkrJAMDAggBAQcDQgAETYDLIgpvvoxSBJxB5apcNrTZ0vYpVyG18hDEOplqkyln
+W7kekN9a83WtIwPRoSwhczgFg/MhvLZ/BHQJW2SU3qOBkTCBjjAdBgNVHQ4EFgQU
+it8K0UIpDYE264JfNmQ/44H1WMUwHwYDVR0jBBgwFoAUcH8uroNoWZgEIyrN6z4X
+zSTdAUkwCQYDVR0TBAIwADATBgNVHSUEDDAKBggrBgEFBQcDATAsBgNVHREEJTAj
+giFTZXJ2ZXIgRUNEU0EgYnJhaW5wb29sUDI1NnIxIGNlcnQwDQYJKoZIhvcNAQEL
+BQADggEBAKCEUMQlB+M6crHe2zfGmQJnsEGzY4fJUFYdFfOM359dXR8Xs+JHF2XP
+0BHJ64BHLzy+3eoa9w/B+/i6OVJo3VhCoCChcP+gnGzQVQy5Maxq55DlsVdpellS
+Tml/BnLcqcZFAP63qEpcuZuC4CytZcHYCU+NLI/3JGzH1/xHxk4UgRTa2B7OhjXt
+Ptl3vLaSqJXEmVeCP0hibhhiszs0zR14fJqmVn0V5MKC7twmG8CBlW03ksLjzzvn
+m7WAy7q5WcFcAcrFR3zAPqcx4UQSS9FiwJ+OOZGqIasMk9i9zxqh0ic5M5ls7Qaf
+roudyLLkkvDFkcb88RwYGKrdVFGDgF0=
+-----END CERTIFICATE-----

test/certs/server-ecdsa-brainpoolP256r1-key.pem

@@ -0,0 +1,5 @@
+-----BEGIN PRIVATE KEY-----
+MIGIAgEAMBQGByqGSM49AgEGCSskAwMCCAEBBwRtMGsCAQEEIKZSRhbD6lGhKbIm
+5JVgxnN8MHGB0whroUsSf0zmsAz+oUQDQgAETYDLIgpvvoxSBJxB5apcNrTZ0vYp
+VyG18hDEOplqkylnW7kekN9a83WtIwPRoSwhczgFg/MhvLZ/BHQJW2SU3g==
+-----END PRIVATE KEY-----

test/certs/setup.sh

@@ -365,3 +365,7 @@ REQMASK=MASK:0x800 ./mkcert.sh req badalt7-key "O = Bad NC Test Certificate 7" \
 # SHA256
 ./mkcert.sh genee PSS-SHA256 ee-key ee-pss-sha256-cert ca-key ca-cert \
     -sha256 -sigopt rsa_padding_mode:pss -sigopt rsa_pss_saltlen:digest
+
+OPENSSL_KEYALG=ec OPENSSL_KEYBITS=brainpoolP256r1 ./mkcert.sh genee \
+    "Server ECDSA brainpoolP256r1 cert" server-ecdsa-brainpoolP256r1-key \
+    server-ecdsa-brainpoolP256r1-cert rootkey rootcert

test/evp_test.c

@@ -847,6 +847,8 @@ typedef struct mac_data_st {
     /* Expected output */
     unsigned char *output;
     size_t output_len;
+    unsigned char *custom;
+    size_t custom_len;
     /* Collection of controls */
     STACK_OF(OPENSSL_STRING) *controls;
 } MAC_DATA;
@@ -929,6 +931,7 @@ static void mac_test_cleanup(EVP_TEST *t)
     OPENSSL_free(mdat->alg);
     OPENSSL_free(mdat->key);
     OPENSSL_free(mdat->iv);
+    OPENSSL_free(mdat->custom);
     OPENSSL_free(mdat->input);
     OPENSSL_free(mdat->output);
 }
@@ -942,6 +945,8 @@ static int mac_test_parse(EVP_TEST *t,
         return parse_bin(value, &mdata->key, &mdata->key_len);
     if (strcmp(keyword, "IV") == 0)
         return parse_bin(value, &mdata->iv, &mdata->iv_len);
+    if (strcmp(keyword, "Custom") == 0)
+        return parse_bin(value, &mdata->custom, &mdata->custom_len);
     if (strcmp(keyword, "Algorithm") == 0) {
         mdata->alg = OPENSSL_strdup(value);
         if (!mdata->alg)
@@ -1124,6 +1129,17 @@ static int mac_test_run_mac(EVP_TEST *t)
         t->err = "MAC_CTRL_ERROR";
         goto err;
     }
+    if (expected->custom != NULL) {
+        rv = EVP_MAC_ctrl(ctx, EVP_MAC_CTRL_SET_CUSTOM,
+                          expected->custom, expected->custom_len);
+        if (rv == -2) {
+            t->err = "MAC_CTRL_INVALID";
+            goto err;
+        } else if (rv <= 0) {
+            t->err = "MAC_CTRL_ERROR";
+            goto err;
+        }
+    }
 
     if (expected->iv != NULL) {
         rv = EVP_MAC_ctrl(ctx, EVP_MAC_CTRL_SET_IV,

test/handshake_helper.c

@@ -1673,7 +1673,7 @@ static HANDSHAKE_RESULT *do_handshake_internal(
             *serv_sess_out = SSL_SESSION_dup(tmp);
     }
 
-    if (SSL_get_server_tmp_key(client.ssl, &tmp_key)) {
+    if (SSL_get_peer_tmp_key(client.ssl, &tmp_key)) {
         ret->tmp_key_type = pkey_type(tmp_key);
         EVP_PKEY_free(tmp_key);
     }

test/recipes/30-test_evp_data/evpmac.txt

@@ -134,7 +134,7 @@ MAC = SipHash
 Ctrl = digestsize:8
 Key = 000102030405060708090A0B0C0D0E0F
 Input = 000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E
-Output = B96AB0B9D449A78A
+Output = 724506EB4C328A95
 
 # SIPHASH - default values: 2,4 rounds, explicit 16-byte mac
 
@@ -455,6 +455,92 @@ Input = 68F2E77696CE7AE8E2CA4EC588E541002E58495C08000F101112131415161718191A1B1C
 Output = 00BDA1B7E87608BCBF470F12157F4C07
 
 
+Title = KMAC Tests (From NIST)
+MAC = KMAC128
+Key = 404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F
+Input = 00010203
+Custom = ""
+Output = E5780B0D3EA6F7D3A429C5706AA43A00FADBD7D49628839E3187243F456EE14E
+Ctrl = xof:0
+
+MAC = KMAC128
+Key = 404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F
+Input = 00010203
+Custom = "My Tagged Application"
+Output = 3B1FBA963CD8B0B59E8C1A6D71888B7143651AF8BA0A7070C0979E2811324AA5
+
+MAC = KMAC128
+Key = 404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F
+Input = 000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F808182838485868788898A8B8C8D8E8F909192939495969798999A9B9C9D9E9FA0A1A2A3A4A5A6A7A8A9AAABACADAEAFB0B1B2B3B4B5B6B7B8B9BABBBCBDBEBFC0C1C2C3C4C5C6C7
+Custom = "My Tagged Application"
+Output = 1F5B4E6CCA02209E0DCB5CA635B89A15E271ECC760071DFD805FAA38F9729230
+Ctrl = outlen:32
+
+MAC = KMAC256
+Key = 404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F
+Input = 00010203
+Custom = "My Tagged Application"
+Output = 20C570C31346F703C9AC36C61C03CB64C3970D0CFC787E9B79599D273A68D2F7F69D4CC3DE9D104A351689F27CF6F5951F0103F33F4F24871024D9C27773A8DD
+
+MAC = KMAC256
+Key = 404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F
+Input = 000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F808182838485868788898A8B8C8D8E8F909192939495969798999A9B9C9D9E9FA0A1A2A3A4A5A6A7A8A9AAABACADAEAFB0B1B2B3B4B5B6B7B8B9BABBBCBDBEBFC0C1C2C3C4C5C6C7
+Custom = ""
+Output = 75358CF39E41494E949707927CEE0AF20A3FF553904C86B08F21CC414BCFD691589D27CF5E15369CBBFF8B9A4C2EB17800855D0235FF635DA82533EC6B759B69
+
+MAC = KMAC256
+Key = 404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F
+Input = 000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F808182838485868788898A8B8C8D8E8F909192939495969798999A9B9C9D9E9FA0A1A2A3A4A5A6A7A8A9AAABACADAEAFB0B1B2B3B4B5B6B7B8B9BABBBCBDBEBFC0C1C2C3C4C5C6C7
+Custom = "My Tagged Application"
+Output = B58618F71F92E1D56C1B8C55DDD7CD188B97B4CA4D99831EB2699A837DA2E4D970FBACFDE50033AEA585F1A2708510C32D07880801BD182898FE476876FC8965
+Ctrl = outlen:64
+
+Title = KMAC XOF Tests (From NIST)
+
+MAC = KMAC128
+Key = 404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F
+Input = 00010203
+Output = CD83740BBD92CCC8CF032B1481A0F4460E7CA9DD12B08A0C4031178BACD6EC35
+Ctrl = xof:1
+
+MAC = KMAC128
+Key = 404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F
+Input = 00010203
+Custom = "My Tagged Application"
+Output = 31A44527B4ED9F5C6101D11DE6D26F0620AA5C341DEF41299657FE9DF1A3B16C
+Ctrl = xof:1
+
+MAC = KMAC128
+Key = 404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F
+Input = 000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F808182838485868788898A8B8C8D8E8F909192939495969798999A9B9C9D9E9FA0A1A2A3A4A5A6A7A8A9AAABACADAEAFB0B1B2B3B4B5B6B7B8B9BABBBCBDBEBFC0C1C2C3C4C5C6C7
+Custom = "My Tagged Application"
+Output = 47026C7CD793084AA0283C253EF658490C0DB61438B8326FE9BDDF281B83AE0F
+Ctrl = xof:1
+Ctrl = outlen:32
+
+MAC = KMAC256
+Key = 404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F
+Input = 00010203
+Custom = "My Tagged Application"
+Output = 1755133F1534752AAD0748F2C706FB5C784512CAB835CD15676B16C0C6647FA96FAA7AF634A0BF8FF6DF39374FA00FAD9A39E322A7C92065A64EB1FB0801EB2B
+Ctrl = xof:1
+
+MAC = KMAC256
+Key = 404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F
+Input = 000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F808182838485868788898A8B8C8D8E8F909192939495969798999A9B9C9D9E9FA0A1A2A3A4A5A6A7A8A9AAABACADAEAFB0B1B2B3B4B5B6B7B8B9BABBBCBDBEBFC0C1C2C3C4C5C6C7
+Custom = ""
+Output = FF7B171F1E8A2B24683EED37830EE797538BA8DC563F6DA1E667391A75EDC02CA633079F81CE12A25F45615EC89972031D18337331D24CEB8F8CA8E6A19FD98B
+Ctrl = xof:1
+
+MAC = KMAC256
+Key = 404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F
+Input = 000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F808182838485868788898A8B8C8D8E8F909192939495969798999A9B9C9D9E9FA0A1A2A3A4A5A6A7A8A9AAABACADAEAFB0B1B2B3B4B5B6B7B8B9BABBBCBDBEBFC0C1C2C3C4C5C6C7
+Custom = "My Tagged Application"
+Output = D5BE731C954ED7732846BB59DBE3A8E30F83E77A4BFF4459F2F1C2B4ECEBB8CE67BA01C62E8AB8578D2D499BD1BB276768781190020A306A97DE281DCC30305D
+Ctrl = outlen:64
+Ctrl = xof:1
+
+
 Title = Poly1305 Tests (from RFC 7539 and others)
 
 MAC = Poly1305

test/recipes/90-test_shlibload.t

@@ -6,8 +6,7 @@
 # in the file LICENSE in the source distribution or at
 # https://www.openssl.org/source/license.html
 
-
-use OpenSSL::Test qw/:DEFAULT bldtop_dir/;
+use OpenSSL::Test qw/:DEFAULT bldtop_dir bldtop_file/;
 use OpenSSL::Test::Utils;
 
 #Load configdata.pm
@@ -23,12 +22,13 @@ plan skip_all => "Test is disabled on AIX" if config('target') =~ m|^aix|;
 
 plan tests => 4;
 
-my $libcrypto_idx = $unified_info{rename}->{libcrypto} // "libcrypto";
-my $libssl_idx = $unified_info{rename}->{libssl} // "libssl";
-my $libcrypto =
-    $unified_info{sharednames}->{$libcrypto_idx}.$target{shared_extension_simple};
-my $libssl =
-    $unified_info{sharednames}->{$libssl_idx}.$target{shared_extension_simple};
+# When libssl and libcrypto are compiled on Linux with "-rpath", but not
+# "--enable-new-dtags", the RPATH takes precedence over LD_LIBRARY_PATH,
+# and we end up running with the wrong libraries.  This is resolved by
+# using paths to the shared objects, not just the names.
+
+my $libcrypto = bldtop_file(shlib('libcrypto'));
+my $libssl = bldtop_file(shlib('libssl'));
 
 ok(run(test(["shlibloadtest", "-crypto_first", $libcrypto, $libssl])),
    "running shlibloadtest -crypto_first");
@@ -39,3 +39,14 @@ ok(run(test(["shlibloadtest", "-just_crypto", $libcrypto, $libssl])),
 ok(run(test(["shlibloadtest", "-dso_ref", $libcrypto, $libssl])),
    "running shlibloadtest -dso_ref");
 
+sub shlib {
+    my $lib = shift;
+    $lib = $unified_info{rename}->{$lib}
+        if defined $unified_info{rename}->{$lib};
+    $lib = $unified_info{sharednames}->{$lib}
+        . ($target{shlib_variant} || "")
+        . ($target{shared_extension} || ".so");
+    $lib =~ s|\.\$\(SHLIB_VERSION_NUMBER\)
+             |.$config{shlib_version_number}|x;
+    return $lib;
+}

test/ssl-tests/20-cert-select.conf

@@ -1,56 +1,58 @@
 # Generated with generate_ssl_tests.pl
 
-num_tests = 49
+num_tests = 51
 
 test-0 = 0-ECDSA CipherString Selection
 test-1 = 1-ECDSA CipherString Selection
 test-2 = 2-ECDSA CipherString Selection
 test-3 = 3-Ed25519 CipherString and Signature Algorithm Selection
 test-4 = 4-Ed448 CipherString and Signature Algorithm Selection
-test-5 = 5-RSA CipherString Selection
-test-6 = 6-RSA-PSS Certificate CipherString Selection
-test-7 = 7-P-256 CipherString and Signature Algorithm Selection
-test-8 = 8-Ed25519 CipherString and Curves Selection
-test-9 = 9-Ed448 CipherString and Curves Selection
-test-10 = 10-ECDSA CipherString Selection, no ECDSA certificate
-test-11 = 11-ECDSA Signature Algorithm Selection
-test-12 = 12-ECDSA Signature Algorithm Selection SHA384
-test-13 = 13-ECDSA Signature Algorithm Selection SHA1
-test-14 = 14-ECDSA Signature Algorithm Selection compressed point
-test-15 = 15-ECDSA Signature Algorithm Selection, no ECDSA certificate
-test-16 = 16-RSA Signature Algorithm Selection
-test-17 = 17-RSA-PSS Signature Algorithm Selection
-test-18 = 18-RSA-PSS Certificate Legacy Signature Algorithm Selection
-test-19 = 19-RSA-PSS Certificate Unified Signature Algorithm Selection
-test-20 = 20-Only RSA-PSS Certificate
-test-21 = 21-RSA-PSS Certificate, no PSS signature algorithms
-test-22 = 22-RSA key exchange with all RSA certificate types
-test-23 = 23-RSA key exchange with only RSA-PSS certificate
-test-24 = 24-Suite B P-256 Hash Algorithm Selection
-test-25 = 25-Suite B P-384 Hash Algorithm Selection
-test-26 = 26-TLS 1.2 Ed25519 Client Auth
-test-27 = 27-TLS 1.2 Ed448 Client Auth
-test-28 = 28-Only RSA-PSS Certificate, TLS v1.1
-test-29 = 29-TLS 1.3 ECDSA Signature Algorithm Selection
-test-30 = 30-TLS 1.3 ECDSA Signature Algorithm Selection compressed point
-test-31 = 31-TLS 1.3 ECDSA Signature Algorithm Selection SHA1
-test-32 = 32-TLS 1.3 ECDSA Signature Algorithm Selection with PSS
-test-33 = 33-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS
-test-34 = 34-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate
-test-35 = 35-TLS 1.3 RSA Signature Algorithm Selection, no PSS
-test-36 = 36-TLS 1.3 RSA-PSS Signature Algorithm Selection
-test-37 = 37-TLS 1.3 Ed25519 Signature Algorithm Selection
-test-38 = 38-TLS 1.3 Ed448 Signature Algorithm Selection
-test-39 = 39-TLS 1.3 Ed25519 CipherString and Groups Selection
-test-40 = 40-TLS 1.3 Ed448 CipherString and Groups Selection
-test-41 = 41-TLS 1.3 RSA Client Auth Signature Algorithm Selection
-test-42 = 42-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names
-test-43 = 43-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection
-test-44 = 44-TLS 1.3 Ed25519 Client Auth
-test-45 = 45-TLS 1.3 Ed448 Client Auth
-test-46 = 46-TLS 1.2 DSA Certificate Test
-test-47 = 47-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms
-test-48 = 48-TLS 1.3 DSA Certificate Test
+test-5 = 5-ECDSA with brainpool
+test-6 = 6-RSA CipherString Selection
+test-7 = 7-RSA-PSS Certificate CipherString Selection
+test-8 = 8-P-256 CipherString and Signature Algorithm Selection
+test-9 = 9-Ed25519 CipherString and Curves Selection
+test-10 = 10-Ed448 CipherString and Curves Selection
+test-11 = 11-ECDSA CipherString Selection, no ECDSA certificate
+test-12 = 12-ECDSA Signature Algorithm Selection
+test-13 = 13-ECDSA Signature Algorithm Selection SHA384
+test-14 = 14-ECDSA Signature Algorithm Selection SHA1
+test-15 = 15-ECDSA Signature Algorithm Selection compressed point
+test-16 = 16-ECDSA Signature Algorithm Selection, no ECDSA certificate
+test-17 = 17-RSA Signature Algorithm Selection
+test-18 = 18-RSA-PSS Signature Algorithm Selection
+test-19 = 19-RSA-PSS Certificate Legacy Signature Algorithm Selection
+test-20 = 20-RSA-PSS Certificate Unified Signature Algorithm Selection
+test-21 = 21-Only RSA-PSS Certificate
+test-22 = 22-RSA-PSS Certificate, no PSS signature algorithms
+test-23 = 23-RSA key exchange with all RSA certificate types
+test-24 = 24-RSA key exchange with only RSA-PSS certificate
+test-25 = 25-Suite B P-256 Hash Algorithm Selection
+test-26 = 26-Suite B P-384 Hash Algorithm Selection
+test-27 = 27-TLS 1.2 Ed25519 Client Auth
+test-28 = 28-TLS 1.2 Ed448 Client Auth
+test-29 = 29-Only RSA-PSS Certificate, TLS v1.1
+test-30 = 30-TLS 1.3 ECDSA Signature Algorithm Selection
+test-31 = 31-TLS 1.3 ECDSA Signature Algorithm Selection compressed point
+test-32 = 32-TLS 1.3 ECDSA Signature Algorithm Selection SHA1
+test-33 = 33-TLS 1.3 ECDSA Signature Algorithm Selection with PSS
+test-34 = 34-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS
+test-35 = 35-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate
+test-36 = 36-TLS 1.3 RSA Signature Algorithm Selection, no PSS
+test-37 = 37-TLS 1.3 RSA-PSS Signature Algorithm Selection
+test-38 = 38-TLS 1.3 Ed25519 Signature Algorithm Selection
+test-39 = 39-TLS 1.3 Ed448 Signature Algorithm Selection
+test-40 = 40-TLS 1.3 Ed25519 CipherString and Groups Selection
+test-41 = 41-TLS 1.3 Ed448 CipherString and Groups Selection
+test-42 = 42-TLS 1.3 RSA Client Auth Signature Algorithm Selection
+test-43 = 43-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names
+test-44 = 44-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection
+test-45 = 45-TLS 1.3 Ed25519 Client Auth
+test-46 = 46-TLS 1.3 Ed448 Client Auth
+test-47 = 47-TLS 1.3 ECDSA with brainpool
+test-48 = 48-TLS 1.2 DSA Certificate Test
+test-49 = 49-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms
+test-50 = 50-TLS 1.3 DSA Certificate Test
 # ===========================================================
 
 [0-ECDSA CipherString Selection]
@@ -223,14 +225,43 @@ ExpectedServerSignType = Ed448
 
 # ===========================================================
 
-[5-RSA CipherString Selection]
-ssl_conf = 5-RSA CipherString Selection-ssl
+[5-ECDSA with brainpool]
+ssl_conf = 5-ECDSA with brainpool-ssl
 
-[5-RSA CipherString Selection-ssl]
-server = 5-RSA CipherString Selection-server
-client = 5-RSA CipherString Selection-client
+[5-ECDSA with brainpool-ssl]
+server = 5-ECDSA with brainpool-server
+client = 5-ECDSA with brainpool-client
 
-[5-RSA CipherString Selection-server]
+[5-ECDSA with brainpool-server]
+Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-brainpoolP256r1-cert.pem
+CipherString = DEFAULT
+Groups = brainpoolP256r1
+PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-brainpoolP256r1-key.pem
+
+[5-ECDSA with brainpool-client]
+CipherString = aECDSA
+Groups = brainpoolP256r1
+RequestCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
+VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
+VerifyMode = Peer
+
+[test-5]
+ExpectedResult = Success
+ExpectedServerCANames = empty
+ExpectedServerCertType = brainpoolP256r1
+ExpectedServerSignType = EC
+
+
+# ===========================================================
+
+[6-RSA CipherString Selection]
+ssl_conf = 6-RSA CipherString Selection-ssl
+
+[6-RSA CipherString Selection-ssl]
+server = 6-RSA CipherString Selection-server
+client = 6-RSA CipherString Selection-client
+
+[6-RSA CipherString Selection-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT
 ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
@@ -242,13 +273,13 @@ Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
 MaxProtocol = TLSv1.2
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
 
-[5-RSA CipherString Selection-client]
+[6-RSA CipherString Selection-client]
 CipherString = aRSA
 MaxProtocol = TLSv1.2
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer
 
-[test-5]
+[test-6]
 ExpectedResult = Success
 ExpectedServerCertType = RSA
 ExpectedServerSignType = RSA-PSS
@@ -256,14 +287,14 @@ ExpectedServerSignType = RSA-PSS
 
 # ===========================================================
 
-[6-RSA-PSS Certificate CipherString Selection]
-ssl_conf = 6-RSA-PSS Certificate CipherString Selection-ssl
+[7-RSA-PSS Certificate CipherString Selection]
+ssl_conf = 7-RSA-PSS Certificate CipherString Selection-ssl
 
-[6-RSA-PSS Certificate CipherString Selection-ssl]
-server = 6-RSA-PSS Certificate CipherString Selection-server
-client = 6-RSA-PSS Certificate CipherString Selection-client
+[7-RSA-PSS Certificate CipherString Selection-ssl]
+server = 7-RSA-PSS Certificate CipherString Selection-server
+client = 7-RSA-PSS Certificate CipherString Selection-client
 
-[6-RSA-PSS Certificate CipherString Selection-server]
+[7-RSA-PSS Certificate CipherString Selection-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT
 ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
@@ -277,13 +308,13 @@ PSS.Certificate = ${ENV::TEST_CERTS_DIR}/server-pss-cert.pem
 PSS.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-pss-key.pem
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
 
-[6-RSA-PSS Certificate CipherString Selection-client]
+[7-RSA-PSS Certificate CipherString Selection-client]
 CipherString = aRSA
 MaxProtocol = TLSv1.2
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer
 
-[test-6]
+[test-7]
 ExpectedResult = Success
 ExpectedServerCertType = RSA-PSS
 ExpectedServerSignType = RSA-PSS
@@ -291,14 +322,14 @@ ExpectedServerSignType = RSA-PSS
 
 # ===========================================================
 
-[7-P-256 CipherString and Signature Algorithm Selection]
-ssl_conf = 7-P-256 CipherString and Signature Algorithm Selection-ssl
+[8-P-256 CipherString and Signature Algorithm Selection]
+ssl_conf = 8-P-256 CipherString and Signature Algorithm Selection-ssl
 
-[7-P-256 CipherString and Signature Algorithm Selection-ssl]
-server = 7-P-256 CipherString and Signature Algorithm Selection-server
-client = 7-P-256 CipherString and Signature Algorithm Selection-client
+[8-P-256 CipherString and Signature Algorithm Selection-ssl]
+server = 8-P-256 CipherString and Signature Algorithm Selection-server
+client = 8-P-256 CipherString and Signature Algorithm Selection-client
 
-[7-P-256 CipherString and Signature Algorithm Selection-server]
+[8-P-256 CipherString and Signature Algorithm Selection-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT
 ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
@@ -310,65 +341,30 @@ Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
 MaxProtocol = TLSv1.2
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
 
-[7-P-256 CipherString and Signature Algorithm Selection-client]
+[8-P-256 CipherString and Signature Algorithm Selection-client]
 CipherString = aECDSA
 MaxProtocol = TLSv1.2
 SignatureAlgorithms = ECDSA+SHA256:ed25519
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer
 
-[test-7]
-ExpectedResult = Success
-ExpectedServerCertType = P-256
-ExpectedServerSignHash = SHA256
-ExpectedServerSignType = EC
-
-
-# ===========================================================
-
-[8-Ed25519 CipherString and Curves Selection]
-ssl_conf = 8-Ed25519 CipherString and Curves Selection-ssl
-
-[8-Ed25519 CipherString and Curves Selection-ssl]
-server = 8-Ed25519 CipherString and Curves Selection-server
-client = 8-Ed25519 CipherString and Curves Selection-client
-
-[8-Ed25519 CipherString and Curves Selection-server]
-Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
-CipherString = DEFAULT
-ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
-ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
-Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
-Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
-Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem
-Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
-MaxProtocol = TLSv1.2
-PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
-
-[8-Ed25519 CipherString and Curves Selection-client]
-CipherString = aECDSA
-Curves = X25519
-MaxProtocol = TLSv1.2
-SignatureAlgorithms = ECDSA+SHA256:ed25519
-VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
-VerifyMode = Peer
-
 [test-8]
 ExpectedResult = Success
-ExpectedServerCertType = Ed25519
-ExpectedServerSignType = Ed25519
+ExpectedServerCertType = P-256
+ExpectedServerSignHash = SHA256
+ExpectedServerSignType = EC
 
 
 # ===========================================================
 
-[9-Ed448 CipherString and Curves Selection]
-ssl_conf = 9-Ed448 CipherString and Curves Selection-ssl
+[9-Ed25519 CipherString and Curves Selection]
+ssl_conf = 9-Ed25519 CipherString and Curves Selection-ssl
 
-[9-Ed448 CipherString and Curves Selection-ssl]
-server = 9-Ed448 CipherString and Curves Selection-server
-client = 9-Ed448 CipherString and Curves Selection-client
+[9-Ed25519 CipherString and Curves Selection-ssl]
+server = 9-Ed25519 CipherString and Curves Selection-server
+client = 9-Ed25519 CipherString and Curves Selection-client
 
-[9-Ed448 CipherString and Curves Selection-server]
+[9-Ed25519 CipherString and Curves Selection-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT
 ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
@@ -380,7 +376,42 @@ Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
 MaxProtocol = TLSv1.2
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
 
-[9-Ed448 CipherString and Curves Selection-client]
+[9-Ed25519 CipherString and Curves Selection-client]
+CipherString = aECDSA
+Curves = X25519
+MaxProtocol = TLSv1.2
+SignatureAlgorithms = ECDSA+SHA256:ed25519
+VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
+VerifyMode = Peer
+
+[test-9]
+ExpectedResult = Success
+ExpectedServerCertType = Ed25519
+ExpectedServerSignType = Ed25519
+
+
+# ===========================================================
+
+[10-Ed448 CipherString and Curves Selection]
+ssl_conf = 10-Ed448 CipherString and Curves Selection-ssl
+
+[10-Ed448 CipherString and Curves Selection-ssl]
+server = 10-Ed448 CipherString and Curves Selection-server
+client = 10-Ed448 CipherString and Curves Selection-client
+
+[10-Ed448 CipherString and Curves Selection-server]
+Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
+CipherString = DEFAULT
+ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
+ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
+Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
+Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
+Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem
+Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
+MaxProtocol = TLSv1.2
+PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
+
+[10-Ed448 CipherString and Curves Selection-client]
 CipherString = aECDSA
 Curves = X448
 MaxProtocol = TLSv1.2
@@ -388,7 +419,7 @@ SignatureAlgorithms = ECDSA+SHA256:ed448
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer
 
-[test-9]
+[test-10]
 ExpectedResult = Success
 ExpectedServerCertType = Ed448
 ExpectedServerSignType = Ed448
@@ -396,39 +427,39 @@ ExpectedServerSignType = Ed448
 
 # ===========================================================
 
-[10-ECDSA CipherString Selection, no ECDSA certificate]
-ssl_conf = 10-ECDSA CipherString Selection, no ECDSA certificate-ssl
+[11-ECDSA CipherString Selection, no ECDSA certificate]
+ssl_conf = 11-ECDSA CipherString Selection, no ECDSA certificate-ssl
 
-[10-ECDSA CipherString Selection, no ECDSA certificate-ssl]
-server = 10-ECDSA CipherString Selection, no ECDSA certificate-server
-client = 10-ECDSA CipherString Selection, no ECDSA certificate-client
+[11-ECDSA CipherString Selection, no ECDSA certificate-ssl]
+server = 11-ECDSA CipherString Selection, no ECDSA certificate-server
+client = 11-ECDSA CipherString Selection, no ECDSA certificate-client
 
-[10-ECDSA CipherString Selection, no ECDSA certificate-server]
+[11-ECDSA CipherString Selection, no ECDSA certificate-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT
 MaxProtocol = TLSv1.2
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
 
-[10-ECDSA CipherString Selection, no ECDSA certificate-client]
+[11-ECDSA CipherString Selection, no ECDSA certificate-client]
 CipherString = aECDSA
 MaxProtocol = TLSv1.2
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer
 
-[test-10]
+[test-11]
 ExpectedResult = ServerFail
 
 
 # ===========================================================
 
-[11-ECDSA Signature Algorithm Selection]
-ssl_conf = 11-ECDSA Signature Algorithm Selection-ssl
+[12-ECDSA Signature Algorithm Selection]
+ssl_conf = 12-ECDSA Signature Algorithm Selection-ssl
 
-[11-ECDSA Signature Algorithm Selection-ssl]
-server = 11-ECDSA Signature Algorithm Selection-server
-client = 11-ECDSA Signature Algorithm Selection-client
+[12-ECDSA Signature Algorithm Selection-ssl]
+server = 12-ECDSA Signature Algorithm Selection-server
+client = 12-ECDSA Signature Algorithm Selection-client
 
-[11-ECDSA Signature Algorithm Selection-server]
+[12-ECDSA Signature Algorithm Selection-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT
 ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
@@ -440,13 +471,13 @@ Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
 MaxProtocol = TLSv1.2
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
 
-[11-ECDSA Signature Algorithm Selection-client]
+[12-ECDSA Signature Algorithm Selection-client]
 CipherString = DEFAULT
 SignatureAlgorithms = ECDSA+SHA256
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer
 
-[test-11]
+[test-12]
 ExpectedResult = Success
 ExpectedServerCertType = P-256
 ExpectedServerSignHash = SHA256
@@ -455,14 +486,14 @@ ExpectedServerSignType = EC
 
 # ===========================================================
 
-[12-ECDSA Signature Algorithm Selection SHA384]
-ssl_conf = 12-ECDSA Signature Algorithm Selection SHA384-ssl
+[13-ECDSA Signature Algorithm Selection SHA384]
+ssl_conf = 13-ECDSA Signature Algorithm Selection SHA384-ssl
 
-[12-ECDSA Signature Algorithm Selection SHA384-ssl]
-server = 12-ECDSA Signature Algorithm Selection SHA384-server
-client = 12-ECDSA Signature Algorithm Selection SHA384-client
+[13-ECDSA Signature Algorithm Selection SHA384-ssl]
+server = 13-ECDSA Signature Algorithm Selection SHA384-server
+client = 13-ECDSA Signature Algorithm Selection SHA384-client
 
-[12-ECDSA Signature Algorithm Selection SHA384-server]
+[13-ECDSA Signature Algorithm Selection SHA384-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT
 ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
@@ -474,13 +505,13 @@ Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
 MaxProtocol = TLSv1.2
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
 
-[12-ECDSA Signature Algorithm Selection SHA384-client]
+[13-ECDSA Signature Algorithm Selection SHA384-client]
 CipherString = DEFAULT
 SignatureAlgorithms = ECDSA+SHA384
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer
 
-[test-12]
+[test-13]
 ExpectedResult = Success
 ExpectedServerCertType = P-256
 ExpectedServerSignHash = SHA384
@@ -489,14 +520,14 @@ ExpectedServerSignType = EC
 
 # ===========================================================
 
-[13-ECDSA Signature Algorithm Selection SHA1]
-ssl_conf = 13-ECDSA Signature Algorithm Selection SHA1-ssl
+[14-ECDSA Signature Algorithm Selection SHA1]
+ssl_conf = 14-ECDSA Signature Algorithm Selection SHA1-ssl
 
-[13-ECDSA Signature Algorithm Selection SHA1-ssl]
-server = 13-ECDSA Signature Algorithm Selection SHA1-server
-client = 13-ECDSA Signature Algorithm Selection SHA1-client
+[14-ECDSA Signature Algorithm Selection SHA1-ssl]
+server = 14-ECDSA Signature Algorithm Selection SHA1-server
+client = 14-ECDSA Signature Algorithm Selection SHA1-client
 
-[13-ECDSA Signature Algorithm Selection SHA1-server]
+[14-ECDSA Signature Algorithm Selection SHA1-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT
 ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
@@ -508,13 +539,13 @@ Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
 MaxProtocol = TLSv1.2
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
 
-[13-ECDSA Signature Algorithm Selection SHA1-client]
+[14-ECDSA Signature Algorithm Selection SHA1-client]
 CipherString = DEFAULT
 SignatureAlgorithms = ECDSA+SHA1
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer
 
-[test-13]
+[test-14]
 ExpectedResult = Success
 ExpectedServerCertType = P-256
 ExpectedServerSignHash = SHA1
@@ -523,14 +554,14 @@ ExpectedServerSignType = EC
 
 # ===========================================================
 
-[14-ECDSA Signature Algorithm Selection compressed point]
-ssl_conf = 14-ECDSA Signature Algorithm Selection compressed point-ssl
+[15-ECDSA Signature Algorithm Selection compressed point]
+ssl_conf = 15-ECDSA Signature Algorithm Selection compressed point-ssl
 
-[14-ECDSA Signature Algorithm Selection compressed point-ssl]
-server = 14-ECDSA Signature Algorithm Selection compressed point-server
-client = 14-ECDSA Signature Algorithm Selection compressed point-client
+[15-ECDSA Signature Algorithm Selection compressed point-ssl]
+server = 15-ECDSA Signature Algorithm Selection compressed point-server
+client = 15-ECDSA Signature Algorithm Selection compressed point-client
 
-[14-ECDSA Signature Algorithm Selection compressed point-server]
+[15-ECDSA Signature Algorithm Selection compressed point-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT
 ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-cecdsa-cert.pem
@@ -538,13 +569,13 @@ ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-cecdsa-key.pem
 MaxProtocol = TLSv1.2
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
 
-[14-ECDSA Signature Algorithm Selection compressed point-client]
+[15-ECDSA Signature Algorithm Selection compressed point-client]
 CipherString = DEFAULT
 SignatureAlgorithms = ECDSA+SHA256
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer
 
-[test-14]
+[test-15]
 ExpectedResult = Success
 ExpectedServerCertType = P-256
 ExpectedServerSignHash = SHA256
@@ -553,39 +584,39 @@ ExpectedServerSignType = EC
 
 # ===========================================================
 
-[15-ECDSA Signature Algorithm Selection, no ECDSA certificate]
-ssl_conf = 15-ECDSA Signature Algorithm Selection, no ECDSA certificate-ssl
+[16-ECDSA Signature Algorithm Selection, no ECDSA certificate]
+ssl_conf = 16-ECDSA Signature Algorithm Selection, no ECDSA certificate-ssl
 
-[15-ECDSA Signature Algorithm Selection, no ECDSA certificate-ssl]
-server = 15-ECDSA Signature Algorithm Selection, no ECDSA certificate-server
-client = 15-ECDSA Signature Algorithm Selection, no ECDSA certificate-client
+[16-ECDSA Signature Algorithm Selection, no ECDSA certificate-ssl]
+server = 16-ECDSA Signature Algorithm Selection, no ECDSA certificate-server
+client = 16-ECDSA Signature Algorithm Selection, no ECDSA certificate-client
 
-[15-ECDSA Signature Algorithm Selection, no ECDSA certificate-server]
+[16-ECDSA Signature Algorithm Selection, no ECDSA certificate-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT
 MaxProtocol = TLSv1.2
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
 
-[15-ECDSA Signature Algorithm Selection, no ECDSA certificate-client]
+[16-ECDSA Signature Algorithm Selection, no ECDSA certificate-client]
 CipherString = DEFAULT
 SignatureAlgorithms = ECDSA+SHA256
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer
 
-[test-15]
+[test-16]
 ExpectedResult = ServerFail
 
 
 # ===========================================================
 
-[16-RSA Signature Algorithm Selection]
-ssl_conf = 16-RSA Signature Algorithm Selection-ssl
+[17-RSA Signature Algorithm Selection]
+ssl_conf = 17-RSA Signature Algorithm Selection-ssl
 
-[16-RSA Signature Algorithm Selection-ssl]
-server = 16-RSA Signature Algorithm Selection-server
-client = 16-RSA Signature Algorithm Selection-client
+[17-RSA Signature Algorithm Selection-ssl]
+server = 17-RSA Signature Algorithm Selection-server
+client = 17-RSA Signature Algorithm Selection-client
 
-[16-RSA Signature Algorithm Selection-server]
+[17-RSA Signature Algorithm Selection-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT
 ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
@@ -597,13 +628,13 @@ Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
 MaxProtocol = TLSv1.2
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
 
-[16-RSA Signature Algorithm Selection-client]
+[17-RSA Signature Algorithm Selection-client]
 CipherString = DEFAULT
 SignatureAlgorithms = RSA+SHA256
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer
 
-[test-16]
+[test-17]
 ExpectedResult = Success
 ExpectedServerCertType = RSA
 ExpectedServerSignHash = SHA256
@@ -612,14 +643,14 @@ ExpectedServerSignType = RSA
 
 # ===========================================================
 
-[17-RSA-PSS Signature Algorithm Selection]
-ssl_conf = 17-RSA-PSS Signature Algorithm Selection-ssl
+[18-RSA-PSS Signature Algorithm Selection]
+ssl_conf = 18-RSA-PSS Signature Algorithm Selection-ssl
 
-[17-RSA-PSS Signature Algorithm Selection-ssl]
-server = 17-RSA-PSS Signature Algorithm Selection-server
-client = 17-RSA-PSS Signature Algorithm Selection-client
+[18-RSA-PSS Signature Algorithm Selection-ssl]
+server = 18-RSA-PSS Signature Algorithm Selection-server
+client = 18-RSA-PSS Signature Algorithm Selection-client
 
-[17-RSA-PSS Signature Algorithm Selection-server]
+[18-RSA-PSS Signature Algorithm Selection-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT
 ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
@@ -631,43 +662,7 @@ Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
 MaxProtocol = TLSv1.2
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
 
-[17-RSA-PSS Signature Algorithm Selection-client]
-CipherString = DEFAULT
-SignatureAlgorithms = RSA-PSS+SHA256
-VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
-VerifyMode = Peer
-
-[test-17]
-ExpectedResult = Success
-ExpectedServerCertType = RSA
-ExpectedServerSignHash = SHA256
-ExpectedServerSignType = RSA-PSS
-
-
-# ===========================================================
-
-[18-RSA-PSS Certificate Legacy Signature Algorithm Selection]
-ssl_conf = 18-RSA-PSS Certificate Legacy Signature Algorithm Selection-ssl
-
-[18-RSA-PSS Certificate Legacy Signature Algorithm Selection-ssl]
-server = 18-RSA-PSS Certificate Legacy Signature Algorithm Selection-server
-client = 18-RSA-PSS Certificate Legacy Signature Algorithm Selection-client
-
-[18-RSA-PSS Certificate Legacy Signature Algorithm Selection-server]
-Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
-CipherString = DEFAULT
-ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
-ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
-Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
-Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
-Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem
-Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
-MaxProtocol = TLSv1.2
-PSS.Certificate = ${ENV::TEST_CERTS_DIR}/server-pss-cert.pem
-PSS.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-pss-key.pem
-PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
-
-[18-RSA-PSS Certificate Legacy Signature Algorithm Selection-client]
+[18-RSA-PSS Signature Algorithm Selection-client]
 CipherString = DEFAULT
 SignatureAlgorithms = RSA-PSS+SHA256
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
@@ -682,14 +677,14 @@ ExpectedServerSignType = RSA-PSS
 
 # ===========================================================
 
-[19-RSA-PSS Certificate Unified Signature Algorithm Selection]
-ssl_conf = 19-RSA-PSS Certificate Unified Signature Algorithm Selection-ssl
+[19-RSA-PSS Certificate Legacy Signature Algorithm Selection]
+ssl_conf = 19-RSA-PSS Certificate Legacy Signature Algorithm Selection-ssl
 
-[19-RSA-PSS Certificate Unified Signature Algorithm Selection-ssl]
-server = 19-RSA-PSS Certificate Unified Signature Algorithm Selection-server
-client = 19-RSA-PSS Certificate Unified Signature Algorithm Selection-client
+[19-RSA-PSS Certificate Legacy Signature Algorithm Selection-ssl]
+server = 19-RSA-PSS Certificate Legacy Signature Algorithm Selection-server
+client = 19-RSA-PSS Certificate Legacy Signature Algorithm Selection-client
 
-[19-RSA-PSS Certificate Unified Signature Algorithm Selection-server]
+[19-RSA-PSS Certificate Legacy Signature Algorithm Selection-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT
 ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
@@ -703,35 +698,45 @@ PSS.Certificate = ${ENV::TEST_CERTS_DIR}/server-pss-cert.pem
 PSS.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-pss-key.pem
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
 
-[19-RSA-PSS Certificate Unified Signature Algorithm Selection-client]
+[19-RSA-PSS Certificate Legacy Signature Algorithm Selection-client]
 CipherString = DEFAULT
-SignatureAlgorithms = rsa_pss_pss_sha256
+SignatureAlgorithms = RSA-PSS+SHA256
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer
 
 [test-19]
 ExpectedResult = Success
-ExpectedServerCertType = RSA-PSS
+ExpectedServerCertType = RSA
 ExpectedServerSignHash = SHA256
 ExpectedServerSignType = RSA-PSS
 
 
 # ===========================================================
 
-[20-Only RSA-PSS Certificate]
-ssl_conf = 20-Only RSA-PSS Certificate-ssl
+[20-RSA-PSS Certificate Unified Signature Algorithm Selection]
+ssl_conf = 20-RSA-PSS Certificate Unified Signature Algorithm Selection-ssl
 
-[20-Only RSA-PSS Certificate-ssl]
-server = 20-Only RSA-PSS Certificate-server
-client = 20-Only RSA-PSS Certificate-client
+[20-RSA-PSS Certificate Unified Signature Algorithm Selection-ssl]
+server = 20-RSA-PSS Certificate Unified Signature Algorithm Selection-server
+client = 20-RSA-PSS Certificate Unified Signature Algorithm Selection-client
 
-[20-Only RSA-PSS Certificate-server]
-Certificate = ${ENV::TEST_CERTS_DIR}/server-pss-cert.pem
+[20-RSA-PSS Certificate Unified Signature Algorithm Selection-server]
+Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT
-PrivateKey = ${ENV::TEST_CERTS_DIR}/server-pss-key.pem
+ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
+ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
+Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
+Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
+Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem
+Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
+MaxProtocol = TLSv1.2
+PSS.Certificate = ${ENV::TEST_CERTS_DIR}/server-pss-cert.pem
+PSS.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-pss-key.pem
+PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
 
-[20-Only RSA-PSS Certificate-client]
+[20-RSA-PSS Certificate Unified Signature Algorithm Selection-client]
 CipherString = DEFAULT
+SignatureAlgorithms = rsa_pss_pss_sha256
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer
 
@@ -744,89 +749,115 @@ ExpectedServerSignType = RSA-PSS
 
 # ===========================================================
 
-[21-RSA-PSS Certificate, no PSS signature algorithms]
-ssl_conf = 21-RSA-PSS Certificate, no PSS signature algorithms-ssl
+[21-Only RSA-PSS Certificate]
+ssl_conf = 21-Only RSA-PSS Certificate-ssl
 
-[21-RSA-PSS Certificate, no PSS signature algorithms-ssl]
-server = 21-RSA-PSS Certificate, no PSS signature algorithms-server
-client = 21-RSA-PSS Certificate, no PSS signature algorithms-client
+[21-Only RSA-PSS Certificate-ssl]
+server = 21-Only RSA-PSS Certificate-server
+client = 21-Only RSA-PSS Certificate-client
 
-[21-RSA-PSS Certificate, no PSS signature algorithms-server]
+[21-Only RSA-PSS Certificate-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/server-pss-cert.pem
 CipherString = DEFAULT
 PrivateKey = ${ENV::TEST_CERTS_DIR}/server-pss-key.pem
 
-[21-RSA-PSS Certificate, no PSS signature algorithms-client]
+[21-Only RSA-PSS Certificate-client]
+CipherString = DEFAULT
+VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
+VerifyMode = Peer
+
+[test-21]
+ExpectedResult = Success
+ExpectedServerCertType = RSA-PSS
+ExpectedServerSignHash = SHA256
+ExpectedServerSignType = RSA-PSS
+
+
+# ===========================================================
+
+[22-RSA-PSS Certificate, no PSS signature algorithms]
+ssl_conf = 22-RSA-PSS Certificate, no PSS signature algorithms-ssl
+
+[22-RSA-PSS Certificate, no PSS signature algorithms-ssl]
+server = 22-RSA-PSS Certificate, no PSS signature algorithms-server
+client = 22-RSA-PSS Certificate, no PSS signature algorithms-client
+
+[22-RSA-PSS Certificate, no PSS signature algorithms-server]
+Certificate = ${ENV::TEST_CERTS_DIR}/server-pss-cert.pem
+CipherString = DEFAULT
+PrivateKey = ${ENV::TEST_CERTS_DIR}/server-pss-key.pem
+
+[22-RSA-PSS Certificate, no PSS signature algorithms-client]
 CipherString = DEFAULT
 SignatureAlgorithms = RSA+SHA256
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer
 
-[test-21]
+[test-22]
 ExpectedResult = ServerFail
 
 
 # ===========================================================
 
-[22-RSA key exchange with all RSA certificate types]
-ssl_conf = 22-RSA key exchange with all RSA certificate types-ssl
+[23-RSA key exchange with all RSA certificate types]
+ssl_conf = 23-RSA key exchange with all RSA certificate types-ssl
 
-[22-RSA key exchange with all RSA certificate types-ssl]
-server = 22-RSA key exchange with all RSA certificate types-server
-client = 22-RSA key exchange with all RSA certificate types-client
+[23-RSA key exchange with all RSA certificate types-ssl]
+server = 23-RSA key exchange with all RSA certificate types-server
+client = 23-RSA key exchange with all RSA certificate types-client
 
-[22-RSA key exchange with all RSA certificate types-server]
+[23-RSA key exchange with all RSA certificate types-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT
 PSS.Certificate = ${ENV::TEST_CERTS_DIR}/server-pss-cert.pem
 PSS.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-pss-key.pem
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
 
-[22-RSA key exchange with all RSA certificate types-client]
-CipherString = kRSA
-MaxProtocol = TLSv1.2
-VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
-VerifyMode = Peer
-
-[test-22]
-ExpectedResult = Success
-ExpectedServerCertType = RSA
-
-
-# ===========================================================
-
-[23-RSA key exchange with only RSA-PSS certificate]
-ssl_conf = 23-RSA key exchange with only RSA-PSS certificate-ssl
-
-[23-RSA key exchange with only RSA-PSS certificate-ssl]
-server = 23-RSA key exchange with only RSA-PSS certificate-server
-client = 23-RSA key exchange with only RSA-PSS certificate-client
-
-[23-RSA key exchange with only RSA-PSS certificate-server]
-Certificate = ${ENV::TEST_CERTS_DIR}/server-pss-cert.pem
-CipherString = DEFAULT
-PrivateKey = ${ENV::TEST_CERTS_DIR}/server-pss-key.pem
-
-[23-RSA key exchange with only RSA-PSS certificate-client]
+[23-RSA key exchange with all RSA certificate types-client]
 CipherString = kRSA
 MaxProtocol = TLSv1.2
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer
 
 [test-23]
+ExpectedResult = Success
+ExpectedServerCertType = RSA
+
+
+# ===========================================================
+
+[24-RSA key exchange with only RSA-PSS certificate]
+ssl_conf = 24-RSA key exchange with only RSA-PSS certificate-ssl
+
+[24-RSA key exchange with only RSA-PSS certificate-ssl]
+server = 24-RSA key exchange with only RSA-PSS certificate-server
+client = 24-RSA key exchange with only RSA-PSS certificate-client
+
+[24-RSA key exchange with only RSA-PSS certificate-server]
+Certificate = ${ENV::TEST_CERTS_DIR}/server-pss-cert.pem
+CipherString = DEFAULT
+PrivateKey = ${ENV::TEST_CERTS_DIR}/server-pss-key.pem
+
+[24-RSA key exchange with only RSA-PSS certificate-client]
+CipherString = kRSA
+MaxProtocol = TLSv1.2
+VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
+VerifyMode = Peer
+
+[test-24]
 ExpectedResult = ServerFail
 
 
 # ===========================================================
 
-[24-Suite B P-256 Hash Algorithm Selection]
-ssl_conf = 24-Suite B P-256 Hash Algorithm Selection-ssl
+[25-Suite B P-256 Hash Algorithm Selection]
+ssl_conf = 25-Suite B P-256 Hash Algorithm Selection-ssl
 
-[24-Suite B P-256 Hash Algorithm Selection-ssl]
-server = 24-Suite B P-256 Hash Algorithm Selection-server
-client = 24-Suite B P-256 Hash Algorithm Selection-client
+[25-Suite B P-256 Hash Algorithm Selection-ssl]
+server = 25-Suite B P-256 Hash Algorithm Selection-server
+client = 25-Suite B P-256 Hash Algorithm Selection-client
 
-[24-Suite B P-256 Hash Algorithm Selection-server]
+[25-Suite B P-256 Hash Algorithm Selection-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = SUITEB128
 ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/p256-server-cert.pem
@@ -834,13 +865,13 @@ ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/p256-server-key.pem
 MaxProtocol = TLSv1.2
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
 
-[24-Suite B P-256 Hash Algorithm Selection-client]
+[25-Suite B P-256 Hash Algorithm Selection-client]
 CipherString = DEFAULT
 SignatureAlgorithms = ECDSA+SHA384:ECDSA+SHA256
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/p384-root.pem
 VerifyMode = Peer
 
-[test-24]
+[test-25]
 ExpectedResult = Success
 ExpectedServerCertType = P-256
 ExpectedServerSignHash = SHA256
@@ -849,14 +880,14 @@ ExpectedServerSignType = EC
 
 # ===========================================================
 
-[25-Suite B P-384 Hash Algorithm Selection]
-ssl_conf = 25-Suite B P-384 Hash Algorithm Selection-ssl
+[26-Suite B P-384 Hash Algorithm Selection]
+ssl_conf = 26-Suite B P-384 Hash Algorithm Selection-ssl
 
-[25-Suite B P-384 Hash Algorithm Selection-ssl]
-server = 25-Suite B P-384 Hash Algorithm Selection-server
-client = 25-Suite B P-384 Hash Algorithm Selection-client
+[26-Suite B P-384 Hash Algorithm Selection-ssl]
+server = 26-Suite B P-384 Hash Algorithm Selection-server
+client = 26-Suite B P-384 Hash Algorithm Selection-client
 
-[25-Suite B P-384 Hash Algorithm Selection-server]
+[26-Suite B P-384 Hash Algorithm Selection-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = SUITEB128
 ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/p384-server-cert.pem
@@ -864,13 +895,13 @@ ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/p384-server-key.pem
 MaxProtocol = TLSv1.2
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
 
-[25-Suite B P-384 Hash Algorithm Selection-client]
+[26-Suite B P-384 Hash Algorithm Selection-client]
 CipherString = DEFAULT
 SignatureAlgorithms = ECDSA+SHA256:ECDSA+SHA384
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/p384-root.pem
 VerifyMode = Peer
 
-[test-25]
+[test-26]
 ExpectedResult = Success
 ExpectedServerCertType = P-384
 ExpectedServerSignHash = SHA384
@@ -879,21 +910,21 @@ ExpectedServerSignType = EC
 
 # ===========================================================
 
-[26-TLS 1.2 Ed25519 Client Auth]
-ssl_conf = 26-TLS 1.2 Ed25519 Client Auth-ssl
+[27-TLS 1.2 Ed25519 Client Auth]
+ssl_conf = 27-TLS 1.2 Ed25519 Client Auth-ssl
 
-[26-TLS 1.2 Ed25519 Client Auth-ssl]
-server = 26-TLS 1.2 Ed25519 Client Auth-server
-client = 26-TLS 1.2 Ed25519 Client Auth-client
+[27-TLS 1.2 Ed25519 Client Auth-ssl]
+server = 27-TLS 1.2 Ed25519 Client Auth-server
+client = 27-TLS 1.2 Ed25519 Client Auth-client
 
-[26-TLS 1.2 Ed25519 Client Auth-server]
+[27-TLS 1.2 Ed25519 Client Auth-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
 VerifyMode = Require
 
-[26-TLS 1.2 Ed25519 Client Auth-client]
+[27-TLS 1.2 Ed25519 Client Auth-client]
 CipherString = DEFAULT
 Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/client-ed25519-cert.pem
 Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/client-ed25519-key.pem
@@ -902,7 +933,7 @@ MinProtocol = TLSv1.2
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer
 
-[test-26]
+[test-27]
 ExpectedClientCertType = Ed25519
 ExpectedClientSignType = Ed25519
 ExpectedResult = Success
@@ -910,21 +941,21 @@ ExpectedResult = Success
 
 # ===========================================================
 
-[27-TLS 1.2 Ed448 Client Auth]
-ssl_conf = 27-TLS 1.2 Ed448 Client Auth-ssl
+[28-TLS 1.2 Ed448 Client Auth]
+ssl_conf = 28-TLS 1.2 Ed448 Client Auth-ssl
 
-[27-TLS 1.2 Ed448 Client Auth-ssl]
-server = 27-TLS 1.2 Ed448 Client Auth-server
-client = 27-TLS 1.2 Ed448 Client Auth-client
+[28-TLS 1.2 Ed448 Client Auth-ssl]
+server = 28-TLS 1.2 Ed448 Client Auth-server
+client = 28-TLS 1.2 Ed448 Client Auth-client
 
-[27-TLS 1.2 Ed448 Client Auth-server]
+[28-TLS 1.2 Ed448 Client Auth-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
 VerifyMode = Require
 
-[27-TLS 1.2 Ed448 Client Auth-client]
+[28-TLS 1.2 Ed448 Client Auth-client]
 CipherString = DEFAULT
 Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/client-ed448-cert.pem
 Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/client-ed448-key.pem
@@ -933,7 +964,7 @@ MinProtocol = TLSv1.2
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer
 
-[test-27]
+[test-28]
 ExpectedClientCertType = Ed448
 ExpectedClientSignType = Ed448
 ExpectedResult = Success
@@ -941,38 +972,38 @@ ExpectedResult = Success
 
 # ===========================================================
 
-[28-Only RSA-PSS Certificate, TLS v1.1]
-ssl_conf = 28-Only RSA-PSS Certificate, TLS v1.1-ssl
+[29-Only RSA-PSS Certificate, TLS v1.1]
+ssl_conf = 29-Only RSA-PSS Certificate, TLS v1.1-ssl
 
-[28-Only RSA-PSS Certificate, TLS v1.1-ssl]
-server = 28-Only RSA-PSS Certificate, TLS v1.1-server
-client = 28-Only RSA-PSS Certificate, TLS v1.1-client
+[29-Only RSA-PSS Certificate, TLS v1.1-ssl]
+server = 29-Only RSA-PSS Certificate, TLS v1.1-server
+client = 29-Only RSA-PSS Certificate, TLS v1.1-client
 
-[28-Only RSA-PSS Certificate, TLS v1.1-server]
+[29-Only RSA-PSS Certificate, TLS v1.1-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/server-pss-cert.pem
 CipherString = DEFAULT
 PrivateKey = ${ENV::TEST_CERTS_DIR}/server-pss-key.pem
 
-[28-Only RSA-PSS Certificate, TLS v1.1-client]
+[29-Only RSA-PSS Certificate, TLS v1.1-client]
 CipherString = DEFAULT
 MaxProtocol = TLSv1.1
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer
 
-[test-28]
+[test-29]
 ExpectedResult = ServerFail
 
 
 # ===========================================================
 
-[29-TLS 1.3 ECDSA Signature Algorithm Selection]
-ssl_conf = 29-TLS 1.3 ECDSA Signature Algorithm Selection-ssl
+[30-TLS 1.3 ECDSA Signature Algorithm Selection]
+ssl_conf = 30-TLS 1.3 ECDSA Signature Algorithm Selection-ssl
 
-[29-TLS 1.3 ECDSA Signature Algorithm Selection-ssl]
-server = 29-TLS 1.3 ECDSA Signature Algorithm Selection-server
-client = 29-TLS 1.3 ECDSA Signature Algorithm Selection-client
+[30-TLS 1.3 ECDSA Signature Algorithm Selection-ssl]
+server = 30-TLS 1.3 ECDSA Signature Algorithm Selection-server
+client = 30-TLS 1.3 ECDSA Signature Algorithm Selection-client
 
-[29-TLS 1.3 ECDSA Signature Algorithm Selection-server]
+[30-TLS 1.3 ECDSA Signature Algorithm Selection-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT
 ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
@@ -985,39 +1016,7 @@ MaxProtocol = TLSv1.3
 MinProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
 
-[29-TLS 1.3 ECDSA Signature Algorithm Selection-client]
-CipherString = DEFAULT
-SignatureAlgorithms = ECDSA+SHA256
-VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
-VerifyMode = Peer
-
-[test-29]
-ExpectedResult = Success
-ExpectedServerCANames = empty
-ExpectedServerCertType = P-256
-ExpectedServerSignHash = SHA256
-ExpectedServerSignType = EC
-
-
-# ===========================================================
-
-[30-TLS 1.3 ECDSA Signature Algorithm Selection compressed point]
-ssl_conf = 30-TLS 1.3 ECDSA Signature Algorithm Selection compressed point-ssl
-
-[30-TLS 1.3 ECDSA Signature Algorithm Selection compressed point-ssl]
-server = 30-TLS 1.3 ECDSA Signature Algorithm Selection compressed point-server
-client = 30-TLS 1.3 ECDSA Signature Algorithm Selection compressed point-client
-
-[30-TLS 1.3 ECDSA Signature Algorithm Selection compressed point-server]
-Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
-CipherString = DEFAULT
-ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-cecdsa-cert.pem
-ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-cecdsa-key.pem
-MaxProtocol = TLSv1.3
-MinProtocol = TLSv1.3
-PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
-
-[30-TLS 1.3 ECDSA Signature Algorithm Selection compressed point-client]
+[30-TLS 1.3 ECDSA Signature Algorithm Selection-client]
 CipherString = DEFAULT
 SignatureAlgorithms = ECDSA+SHA256
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
@@ -1033,14 +1032,46 @@ ExpectedServerSignType = EC
 
 # ===========================================================
 
-[31-TLS 1.3 ECDSA Signature Algorithm Selection SHA1]
-ssl_conf = 31-TLS 1.3 ECDSA Signature Algorithm Selection SHA1-ssl
+[31-TLS 1.3 ECDSA Signature Algorithm Selection compressed point]
+ssl_conf = 31-TLS 1.3 ECDSA Signature Algorithm Selection compressed point-ssl
 
-[31-TLS 1.3 ECDSA Signature Algorithm Selection SHA1-ssl]
-server = 31-TLS 1.3 ECDSA Signature Algorithm Selection SHA1-server
-client = 31-TLS 1.3 ECDSA Signature Algorithm Selection SHA1-client
+[31-TLS 1.3 ECDSA Signature Algorithm Selection compressed point-ssl]
+server = 31-TLS 1.3 ECDSA Signature Algorithm Selection compressed point-server
+client = 31-TLS 1.3 ECDSA Signature Algorithm Selection compressed point-client
 
-[31-TLS 1.3 ECDSA Signature Algorithm Selection SHA1-server]
+[31-TLS 1.3 ECDSA Signature Algorithm Selection compressed point-server]
+Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
+CipherString = DEFAULT
+ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-cecdsa-cert.pem
+ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-cecdsa-key.pem
+MaxProtocol = TLSv1.3
+MinProtocol = TLSv1.3
+PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
+
+[31-TLS 1.3 ECDSA Signature Algorithm Selection compressed point-client]
+CipherString = DEFAULT
+SignatureAlgorithms = ECDSA+SHA256
+VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
+VerifyMode = Peer
+
+[test-31]
+ExpectedResult = Success
+ExpectedServerCANames = empty
+ExpectedServerCertType = P-256
+ExpectedServerSignHash = SHA256
+ExpectedServerSignType = EC
+
+
+# ===========================================================
+
+[32-TLS 1.3 ECDSA Signature Algorithm Selection SHA1]
+ssl_conf = 32-TLS 1.3 ECDSA Signature Algorithm Selection SHA1-ssl
+
+[32-TLS 1.3 ECDSA Signature Algorithm Selection SHA1-ssl]
+server = 32-TLS 1.3 ECDSA Signature Algorithm Selection SHA1-server
+client = 32-TLS 1.3 ECDSA Signature Algorithm Selection SHA1-client
+
+[32-TLS 1.3 ECDSA Signature Algorithm Selection SHA1-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT
 ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
@@ -1053,26 +1084,26 @@ MaxProtocol = TLSv1.3
 MinProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
 
-[31-TLS 1.3 ECDSA Signature Algorithm Selection SHA1-client]
+[32-TLS 1.3 ECDSA Signature Algorithm Selection SHA1-client]
 CipherString = DEFAULT
 SignatureAlgorithms = ECDSA+SHA1
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer
 
-[test-31]
+[test-32]
 ExpectedResult = ServerFail
 
 
 # ===========================================================
 
-[32-TLS 1.3 ECDSA Signature Algorithm Selection with PSS]
-ssl_conf = 32-TLS 1.3 ECDSA Signature Algorithm Selection with PSS-ssl
+[33-TLS 1.3 ECDSA Signature Algorithm Selection with PSS]
+ssl_conf = 33-TLS 1.3 ECDSA Signature Algorithm Selection with PSS-ssl
 
-[32-TLS 1.3 ECDSA Signature Algorithm Selection with PSS-ssl]
-server = 32-TLS 1.3 ECDSA Signature Algorithm Selection with PSS-server
-client = 32-TLS 1.3 ECDSA Signature Algorithm Selection with PSS-client
+[33-TLS 1.3 ECDSA Signature Algorithm Selection with PSS-ssl]
+server = 33-TLS 1.3 ECDSA Signature Algorithm Selection with PSS-server
+client = 33-TLS 1.3 ECDSA Signature Algorithm Selection with PSS-client
 
-[32-TLS 1.3 ECDSA Signature Algorithm Selection with PSS-server]
+[33-TLS 1.3 ECDSA Signature Algorithm Selection with PSS-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT
 ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
@@ -1085,14 +1116,14 @@ MaxProtocol = TLSv1.3
 MinProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
 
-[32-TLS 1.3 ECDSA Signature Algorithm Selection with PSS-client]
+[33-TLS 1.3 ECDSA Signature Algorithm Selection with PSS-client]
 CipherString = DEFAULT
 RequestCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
 SignatureAlgorithms = ECDSA+SHA256:RSA-PSS+SHA256
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer
 
-[test-32]
+[test-33]
 ExpectedResult = Success
 ExpectedServerCANames = ${ENV::TEST_CERTS_DIR}/root-cert.pem
 ExpectedServerCertType = P-256
@@ -1102,14 +1133,14 @@ ExpectedServerSignType = EC
 
 # ===========================================================
 
-[33-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS]
-ssl_conf = 33-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS-ssl
+[34-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS]
+ssl_conf = 34-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS-ssl
 
-[33-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS-ssl]
-server = 33-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS-server
-client = 33-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS-client
+[34-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS-ssl]
+server = 34-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS-server
+client = 34-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS-client
 
-[33-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS-server]
+[34-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT
 ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
@@ -1122,13 +1153,13 @@ MaxProtocol = TLSv1.3
 MinProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
 
-[33-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS-client]
+[34-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS-client]
 CipherString = DEFAULT
 SignatureAlgorithms = ECDSA+SHA384:RSA-PSS+SHA384
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer
 
-[test-33]
+[test-34]
 ExpectedResult = Success
 ExpectedServerCertType = RSA
 ExpectedServerSignHash = SHA384
@@ -1137,72 +1168,40 @@ ExpectedServerSignType = RSA-PSS
 
 # ===========================================================
 
-[34-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate]
-ssl_conf = 34-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate-ssl
+[35-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate]
+ssl_conf = 35-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate-ssl
 
-[34-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate-ssl]
-server = 34-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate-server
-client = 34-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate-client
+[35-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate-ssl]
+server = 35-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate-server
+client = 35-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate-client
 
-[34-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate-server]
+[35-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT
 MaxProtocol = TLSv1.3
 MinProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
 
-[34-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate-client]
+[35-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate-client]
 CipherString = DEFAULT
 SignatureAlgorithms = ECDSA+SHA256
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer
 
-[test-34]
-ExpectedResult = ServerFail
-
-
-# ===========================================================
-
-[35-TLS 1.3 RSA Signature Algorithm Selection, no PSS]
-ssl_conf = 35-TLS 1.3 RSA Signature Algorithm Selection, no PSS-ssl
-
-[35-TLS 1.3 RSA Signature Algorithm Selection, no PSS-ssl]
-server = 35-TLS 1.3 RSA Signature Algorithm Selection, no PSS-server
-client = 35-TLS 1.3 RSA Signature Algorithm Selection, no PSS-client
-
-[35-TLS 1.3 RSA Signature Algorithm Selection, no PSS-server]
-Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
-CipherString = DEFAULT
-ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
-ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
-Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
-Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
-Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem
-Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
-MaxProtocol = TLSv1.3
-MinProtocol = TLSv1.3
-PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
-
-[35-TLS 1.3 RSA Signature Algorithm Selection, no PSS-client]
-CipherString = DEFAULT
-SignatureAlgorithms = RSA+SHA256
-VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
-VerifyMode = Peer
-
 [test-35]
 ExpectedResult = ServerFail
 
 
 # ===========================================================
 
-[36-TLS 1.3 RSA-PSS Signature Algorithm Selection]
-ssl_conf = 36-TLS 1.3 RSA-PSS Signature Algorithm Selection-ssl
+[36-TLS 1.3 RSA Signature Algorithm Selection, no PSS]
+ssl_conf = 36-TLS 1.3 RSA Signature Algorithm Selection, no PSS-ssl
 
-[36-TLS 1.3 RSA-PSS Signature Algorithm Selection-ssl]
-server = 36-TLS 1.3 RSA-PSS Signature Algorithm Selection-server
-client = 36-TLS 1.3 RSA-PSS Signature Algorithm Selection-client
+[36-TLS 1.3 RSA Signature Algorithm Selection, no PSS-ssl]
+server = 36-TLS 1.3 RSA Signature Algorithm Selection, no PSS-server
+client = 36-TLS 1.3 RSA Signature Algorithm Selection, no PSS-client
 
-[36-TLS 1.3 RSA-PSS Signature Algorithm Selection-server]
+[36-TLS 1.3 RSA Signature Algorithm Selection, no PSS-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT
 ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
@@ -1215,13 +1214,45 @@ MaxProtocol = TLSv1.3
 MinProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
 
-[36-TLS 1.3 RSA-PSS Signature Algorithm Selection-client]
+[36-TLS 1.3 RSA Signature Algorithm Selection, no PSS-client]
+CipherString = DEFAULT
+SignatureAlgorithms = RSA+SHA256
+VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
+VerifyMode = Peer
+
+[test-36]
+ExpectedResult = ServerFail
+
+
+# ===========================================================
+
+[37-TLS 1.3 RSA-PSS Signature Algorithm Selection]
+ssl_conf = 37-TLS 1.3 RSA-PSS Signature Algorithm Selection-ssl
+
+[37-TLS 1.3 RSA-PSS Signature Algorithm Selection-ssl]
+server = 37-TLS 1.3 RSA-PSS Signature Algorithm Selection-server
+client = 37-TLS 1.3 RSA-PSS Signature Algorithm Selection-client
+
+[37-TLS 1.3 RSA-PSS Signature Algorithm Selection-server]
+Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
+CipherString = DEFAULT
+ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
+ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
+Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
+Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
+Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem
+Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
+MaxProtocol = TLSv1.3
+MinProtocol = TLSv1.3
+PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
+
+[37-TLS 1.3 RSA-PSS Signature Algorithm Selection-client]
 CipherString = DEFAULT
 SignatureAlgorithms = RSA-PSS+SHA256
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer
 
-[test-36]
+[test-37]
 ExpectedResult = Success
 ExpectedServerCertType = RSA
 ExpectedServerSignHash = SHA256
@@ -1230,14 +1261,14 @@ ExpectedServerSignType = RSA-PSS
 
 # ===========================================================
 
-[37-TLS 1.3 Ed25519 Signature Algorithm Selection]
-ssl_conf = 37-TLS 1.3 Ed25519 Signature Algorithm Selection-ssl
+[38-TLS 1.3 Ed25519 Signature Algorithm Selection]
+ssl_conf = 38-TLS 1.3 Ed25519 Signature Algorithm Selection-ssl
 
-[37-TLS 1.3 Ed25519 Signature Algorithm Selection-ssl]
-server = 37-TLS 1.3 Ed25519 Signature Algorithm Selection-server
-client = 37-TLS 1.3 Ed25519 Signature Algorithm Selection-client
+[38-TLS 1.3 Ed25519 Signature Algorithm Selection-ssl]
+server = 38-TLS 1.3 Ed25519 Signature Algorithm Selection-server
+client = 38-TLS 1.3 Ed25519 Signature Algorithm Selection-client
 
-[37-TLS 1.3 Ed25519 Signature Algorithm Selection-server]
+[38-TLS 1.3 Ed25519 Signature Algorithm Selection-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT
 ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
@@ -1250,13 +1281,13 @@ MaxProtocol = TLSv1.3
 MinProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
 
-[37-TLS 1.3 Ed25519 Signature Algorithm Selection-client]
+[38-TLS 1.3 Ed25519 Signature Algorithm Selection-client]
 CipherString = DEFAULT
 SignatureAlgorithms = ed25519
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer
 
-[test-37]
+[test-38]
 ExpectedResult = Success
 ExpectedServerCertType = Ed25519
 ExpectedServerSignType = Ed25519
@@ -1264,14 +1295,14 @@ ExpectedServerSignType = Ed25519
 
 # ===========================================================
 
-[38-TLS 1.3 Ed448 Signature Algorithm Selection]
-ssl_conf = 38-TLS 1.3 Ed448 Signature Algorithm Selection-ssl
+[39-TLS 1.3 Ed448 Signature Algorithm Selection]
+ssl_conf = 39-TLS 1.3 Ed448 Signature Algorithm Selection-ssl
 
-[38-TLS 1.3 Ed448 Signature Algorithm Selection-ssl]
-server = 38-TLS 1.3 Ed448 Signature Algorithm Selection-server
-client = 38-TLS 1.3 Ed448 Signature Algorithm Selection-client
+[39-TLS 1.3 Ed448 Signature Algorithm Selection-ssl]
+server = 39-TLS 1.3 Ed448 Signature Algorithm Selection-server
+client = 39-TLS 1.3 Ed448 Signature Algorithm Selection-client
 
-[38-TLS 1.3 Ed448 Signature Algorithm Selection-server]
+[39-TLS 1.3 Ed448 Signature Algorithm Selection-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT
 ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
@@ -1284,13 +1315,13 @@ MaxProtocol = TLSv1.3
 MinProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
 
-[38-TLS 1.3 Ed448 Signature Algorithm Selection-client]
+[39-TLS 1.3 Ed448 Signature Algorithm Selection-client]
 CipherString = DEFAULT
 SignatureAlgorithms = ed448
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer
 
-[test-38]
+[test-39]
 ExpectedResult = Success
 ExpectedServerCertType = Ed448
 ExpectedServerSignType = Ed448
@@ -1298,14 +1329,14 @@ ExpectedServerSignType = Ed448
 
 # ===========================================================
 
-[39-TLS 1.3 Ed25519 CipherString and Groups Selection]
-ssl_conf = 39-TLS 1.3 Ed25519 CipherString and Groups Selection-ssl
+[40-TLS 1.3 Ed25519 CipherString and Groups Selection]
+ssl_conf = 40-TLS 1.3 Ed25519 CipherString and Groups Selection-ssl
 
-[39-TLS 1.3 Ed25519 CipherString and Groups Selection-ssl]
-server = 39-TLS 1.3 Ed25519 CipherString and Groups Selection-server
-client = 39-TLS 1.3 Ed25519 CipherString and Groups Selection-client
+[40-TLS 1.3 Ed25519 CipherString and Groups Selection-ssl]
+server = 40-TLS 1.3 Ed25519 CipherString and Groups Selection-server
+client = 40-TLS 1.3 Ed25519 CipherString and Groups Selection-client
 
-[39-TLS 1.3 Ed25519 CipherString and Groups Selection-server]
+[40-TLS 1.3 Ed25519 CipherString and Groups Selection-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT
 ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
@@ -1318,48 +1349,13 @@ MaxProtocol = TLSv1.3
 MinProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
 
-[39-TLS 1.3 Ed25519 CipherString and Groups Selection-client]
+[40-TLS 1.3 Ed25519 CipherString and Groups Selection-client]
 CipherString = DEFAULT
 Groups = X25519
 SignatureAlgorithms = ECDSA+SHA256:ed25519
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer
 
-[test-39]
-ExpectedResult = Success
-ExpectedServerCertType = P-256
-ExpectedServerSignType = EC
-
-
-# ===========================================================
-
-[40-TLS 1.3 Ed448 CipherString and Groups Selection]
-ssl_conf = 40-TLS 1.3 Ed448 CipherString and Groups Selection-ssl
-
-[40-TLS 1.3 Ed448 CipherString and Groups Selection-ssl]
-server = 40-TLS 1.3 Ed448 CipherString and Groups Selection-server
-client = 40-TLS 1.3 Ed448 CipherString and Groups Selection-client
-
-[40-TLS 1.3 Ed448 CipherString and Groups Selection-server]
-Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
-CipherString = DEFAULT
-ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
-ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
-Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
-Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
-Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem
-Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
-MaxProtocol = TLSv1.3
-MinProtocol = TLSv1.3
-PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
-
-[40-TLS 1.3 Ed448 CipherString and Groups Selection-client]
-CipherString = DEFAULT
-Groups = X448
-SignatureAlgorithms = ECDSA+SHA256:ed448
-VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
-VerifyMode = Peer
-
 [test-40]
 ExpectedResult = Success
 ExpectedServerCertType = P-256
@@ -1368,59 +1364,57 @@ ExpectedServerSignType = EC
 
 # ===========================================================
 
-[41-TLS 1.3 RSA Client Auth Signature Algorithm Selection]
-ssl_conf = 41-TLS 1.3 RSA Client Auth Signature Algorithm Selection-ssl
+[41-TLS 1.3 Ed448 CipherString and Groups Selection]
+ssl_conf = 41-TLS 1.3 Ed448 CipherString and Groups Selection-ssl
 
-[41-TLS 1.3 RSA Client Auth Signature Algorithm Selection-ssl]
-server = 41-TLS 1.3 RSA Client Auth Signature Algorithm Selection-server
-client = 41-TLS 1.3 RSA Client Auth Signature Algorithm Selection-client
+[41-TLS 1.3 Ed448 CipherString and Groups Selection-ssl]
+server = 41-TLS 1.3 Ed448 CipherString and Groups Selection-server
+client = 41-TLS 1.3 Ed448 CipherString and Groups Selection-client
 
-[41-TLS 1.3 RSA Client Auth Signature Algorithm Selection-server]
+[41-TLS 1.3 Ed448 CipherString and Groups Selection-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT
-ClientSignatureAlgorithms = PSS+SHA256
-PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
-VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
-VerifyMode = Require
-
-[41-TLS 1.3 RSA Client Auth Signature Algorithm Selection-client]
-CipherString = DEFAULT
-ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/ee-ecdsa-client-chain.pem
-ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/ee-ecdsa-key.pem
+ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
+ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
+Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
+Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
+Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem
+Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
 MaxProtocol = TLSv1.3
 MinProtocol = TLSv1.3
-RSA.Certificate = ${ENV::TEST_CERTS_DIR}/ee-client-chain.pem
-RSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/ee-key.pem
+PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
+
+[41-TLS 1.3 Ed448 CipherString and Groups Selection-client]
+CipherString = DEFAULT
+Groups = X448
+SignatureAlgorithms = ECDSA+SHA256:ed448
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer
 
 [test-41]
-ExpectedClientCANames = empty
-ExpectedClientCertType = RSA
-ExpectedClientSignHash = SHA256
-ExpectedClientSignType = RSA-PSS
 ExpectedResult = Success
+ExpectedServerCertType = P-256
+ExpectedServerSignType = EC
 
 
 # ===========================================================
 
-[42-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names]
-ssl_conf = 42-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names-ssl
+[42-TLS 1.3 RSA Client Auth Signature Algorithm Selection]
+ssl_conf = 42-TLS 1.3 RSA Client Auth Signature Algorithm Selection-ssl
 
-[42-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names-ssl]
-server = 42-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names-server
-client = 42-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names-client
+[42-TLS 1.3 RSA Client Auth Signature Algorithm Selection-ssl]
+server = 42-TLS 1.3 RSA Client Auth Signature Algorithm Selection-server
+client = 42-TLS 1.3 RSA Client Auth Signature Algorithm Selection-client
 
-[42-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names-server]
+[42-TLS 1.3 RSA Client Auth Signature Algorithm Selection-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT
 ClientSignatureAlgorithms = PSS+SHA256
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
-RequestCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
 VerifyMode = Require
 
-[42-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names-client]
+[42-TLS 1.3 RSA Client Auth Signature Algorithm Selection-client]
 CipherString = DEFAULT
 ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/ee-ecdsa-client-chain.pem
 ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/ee-ecdsa-key.pem
@@ -1432,7 +1426,7 @@ VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer
 
 [test-42]
-ExpectedClientCANames = ${ENV::TEST_CERTS_DIR}/root-cert.pem
+ExpectedClientCANames = empty
 ExpectedClientCertType = RSA
 ExpectedClientSignHash = SHA256
 ExpectedClientSignType = RSA-PSS
@@ -1441,22 +1435,23 @@ ExpectedResult = Success
 
 # ===========================================================
 
-[43-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection]
-ssl_conf = 43-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection-ssl
+[43-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names]
+ssl_conf = 43-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names-ssl
 
-[43-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection-ssl]
-server = 43-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection-server
-client = 43-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection-client
+[43-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names-ssl]
+server = 43-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names-server
+client = 43-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names-client
 
-[43-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection-server]
+[43-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT
-ClientSignatureAlgorithms = ECDSA+SHA256
+ClientSignatureAlgorithms = PSS+SHA256
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
+RequestCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
 VerifyMode = Require
 
-[43-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection-client]
+[43-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names-client]
 CipherString = DEFAULT
 ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/ee-ecdsa-client-chain.pem
 ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/ee-ecdsa-key.pem
@@ -1468,6 +1463,42 @@ VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer
 
 [test-43]
+ExpectedClientCANames = ${ENV::TEST_CERTS_DIR}/root-cert.pem
+ExpectedClientCertType = RSA
+ExpectedClientSignHash = SHA256
+ExpectedClientSignType = RSA-PSS
+ExpectedResult = Success
+
+
+# ===========================================================
+
+[44-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection]
+ssl_conf = 44-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection-ssl
+
+[44-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection-ssl]
+server = 44-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection-server
+client = 44-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection-client
+
+[44-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection-server]
+Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
+CipherString = DEFAULT
+ClientSignatureAlgorithms = ECDSA+SHA256
+PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
+VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
+VerifyMode = Require
+
+[44-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection-client]
+CipherString = DEFAULT
+ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/ee-ecdsa-client-chain.pem
+ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/ee-ecdsa-key.pem
+MaxProtocol = TLSv1.3
+MinProtocol = TLSv1.3
+RSA.Certificate = ${ENV::TEST_CERTS_DIR}/ee-client-chain.pem
+RSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/ee-key.pem
+VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
+VerifyMode = Peer
+
+[test-44]
 ExpectedClientCertType = P-256
 ExpectedClientSignHash = SHA256
 ExpectedClientSignType = EC
@@ -1476,21 +1507,21 @@ ExpectedResult = Success
 
 # ===========================================================
 
-[44-TLS 1.3 Ed25519 Client Auth]
-ssl_conf = 44-TLS 1.3 Ed25519 Client Auth-ssl
+[45-TLS 1.3 Ed25519 Client Auth]
+ssl_conf = 45-TLS 1.3 Ed25519 Client Auth-ssl
 
-[44-TLS 1.3 Ed25519 Client Auth-ssl]
-server = 44-TLS 1.3 Ed25519 Client Auth-server
-client = 44-TLS 1.3 Ed25519 Client Auth-client
+[45-TLS 1.3 Ed25519 Client Auth-ssl]
+server = 45-TLS 1.3 Ed25519 Client Auth-server
+client = 45-TLS 1.3 Ed25519 Client Auth-client
 
-[44-TLS 1.3 Ed25519 Client Auth-server]
+[45-TLS 1.3 Ed25519 Client Auth-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
 VerifyMode = Require
 
-[44-TLS 1.3 Ed25519 Client Auth-client]
+[45-TLS 1.3 Ed25519 Client Auth-client]
 CipherString = DEFAULT
 EdDSA.Certificate = ${ENV::TEST_CERTS_DIR}/client-ed25519-cert.pem
 EdDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/client-ed25519-key.pem
@@ -1499,7 +1530,7 @@ MinProtocol = TLSv1.3
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer
 
-[test-44]
+[test-45]
 ExpectedClientCertType = Ed25519
 ExpectedClientSignType = Ed25519
 ExpectedResult = Success
@@ -1507,21 +1538,21 @@ ExpectedResult = Success
 
 # ===========================================================
 
-[45-TLS 1.3 Ed448 Client Auth]
-ssl_conf = 45-TLS 1.3 Ed448 Client Auth-ssl
+[46-TLS 1.3 Ed448 Client Auth]
+ssl_conf = 46-TLS 1.3 Ed448 Client Auth-ssl
 
-[45-TLS 1.3 Ed448 Client Auth-ssl]
-server = 45-TLS 1.3 Ed448 Client Auth-server
-client = 45-TLS 1.3 Ed448 Client Auth-client
+[46-TLS 1.3 Ed448 Client Auth-ssl]
+server = 46-TLS 1.3 Ed448 Client Auth-server
+client = 46-TLS 1.3 Ed448 Client Auth-client
 
-[45-TLS 1.3 Ed448 Client Auth-server]
+[46-TLS 1.3 Ed448 Client Auth-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
 VerifyMode = Require
 
-[45-TLS 1.3 Ed448 Client Auth-client]
+[46-TLS 1.3 Ed448 Client Auth-client]
 CipherString = DEFAULT
 EdDSA.Certificate = ${ENV::TEST_CERTS_DIR}/client-ed448-cert.pem
 EdDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/client-ed448-key.pem
@@ -1530,7 +1561,7 @@ MinProtocol = TLSv1.3
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer
 
-[test-45]
+[test-46]
 ExpectedClientCertType = Ed448
 ExpectedClientSignType = Ed448
 ExpectedResult = Success
@@ -1538,52 +1569,25 @@ ExpectedResult = Success
 
 # ===========================================================
 
-[46-TLS 1.2 DSA Certificate Test]
-ssl_conf = 46-TLS 1.2 DSA Certificate Test-ssl
+[47-TLS 1.3 ECDSA with brainpool]
+ssl_conf = 47-TLS 1.3 ECDSA with brainpool-ssl
 
-[46-TLS 1.2 DSA Certificate Test-ssl]
-server = 46-TLS 1.2 DSA Certificate Test-server
-client = 46-TLS 1.2 DSA Certificate Test-client
+[47-TLS 1.3 ECDSA with brainpool-ssl]
+server = 47-TLS 1.3 ECDSA with brainpool-server
+client = 47-TLS 1.3 ECDSA with brainpool-client
 
-[46-TLS 1.2 DSA Certificate Test-server]
-Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
-CipherString = ALL
-DHParameters = ${ENV::TEST_CERTS_DIR}/dhp2048.pem
-DSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-dsa-cert.pem
-DSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-dsa-key.pem
-MaxProtocol = TLSv1.2
-MinProtocol = TLSv1.2
-PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
-
-[46-TLS 1.2 DSA Certificate Test-client]
-CipherString = ALL
-SignatureAlgorithms = DSA+SHA256:DSA+SHA1
-VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
-VerifyMode = Peer
-
-[test-46]
-ExpectedResult = Success
-
-
-# ===========================================================
-
-[47-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms]
-ssl_conf = 47-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms-ssl
-
-[47-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms-ssl]
-server = 47-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms-server
-client = 47-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms-client
-
-[47-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms-server]
-Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
+[47-TLS 1.3 ECDSA with brainpool-server]
+Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-brainpoolP256r1-cert.pem
 CipherString = DEFAULT
-ClientSignatureAlgorithms = ECDSA+SHA1:DSA+SHA256:RSA+SHA256
-PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
-VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
-VerifyMode = Request
+Groups = brainpoolP256r1
+PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-brainpoolP256r1-key.pem
 
-[47-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms-client]
+[47-TLS 1.3 ECDSA with brainpool-client]
 CipherString = DEFAULT
+Groups = brainpoolP256r1
+MaxProtocol = TLSv1.3
+MinProtocol = TLSv1.3
+RequestCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer
 
@@ -1593,14 +1597,69 @@ ExpectedResult = ServerFail
 
 # ===========================================================
 
-[48-TLS 1.3 DSA Certificate Test]
-ssl_conf = 48-TLS 1.3 DSA Certificate Test-ssl
+[48-TLS 1.2 DSA Certificate Test]
+ssl_conf = 48-TLS 1.2 DSA Certificate Test-ssl
 
-[48-TLS 1.3 DSA Certificate Test-ssl]
-server = 48-TLS 1.3 DSA Certificate Test-server
-client = 48-TLS 1.3 DSA Certificate Test-client
+[48-TLS 1.2 DSA Certificate Test-ssl]
+server = 48-TLS 1.2 DSA Certificate Test-server
+client = 48-TLS 1.2 DSA Certificate Test-client
 
-[48-TLS 1.3 DSA Certificate Test-server]
+[48-TLS 1.2 DSA Certificate Test-server]
+Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
+CipherString = ALL
+DHParameters = ${ENV::TEST_CERTS_DIR}/dhp2048.pem
+DSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-dsa-cert.pem
+DSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-dsa-key.pem
+MaxProtocol = TLSv1.2
+MinProtocol = TLSv1.2
+PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
+
+[48-TLS 1.2 DSA Certificate Test-client]
+CipherString = ALL
+SignatureAlgorithms = DSA+SHA256:DSA+SHA1
+VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
+VerifyMode = Peer
+
+[test-48]
+ExpectedResult = Success
+
+
+# ===========================================================
+
+[49-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms]
+ssl_conf = 49-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms-ssl
+
+[49-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms-ssl]
+server = 49-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms-server
+client = 49-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms-client
+
+[49-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms-server]
+Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
+CipherString = DEFAULT
+ClientSignatureAlgorithms = ECDSA+SHA1:DSA+SHA256:RSA+SHA256
+PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
+VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
+VerifyMode = Request
+
+[49-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms-client]
+CipherString = DEFAULT
+VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
+VerifyMode = Peer
+
+[test-49]
+ExpectedResult = ServerFail
+
+
+# ===========================================================
+
+[50-TLS 1.3 DSA Certificate Test]
+ssl_conf = 50-TLS 1.3 DSA Certificate Test-ssl
+
+[50-TLS 1.3 DSA Certificate Test-ssl]
+server = 50-TLS 1.3 DSA Certificate Test-server
+client = 50-TLS 1.3 DSA Certificate Test-client
+
+[50-TLS 1.3 DSA Certificate Test-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = ALL
 DSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-dsa-cert.pem
@@ -1609,13 +1668,13 @@ MaxProtocol = TLSv1.3
 MinProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
 
-[48-TLS 1.3 DSA Certificate Test-client]
+[50-TLS 1.3 DSA Certificate Test-client]
 CipherString = ALL
 SignatureAlgorithms = DSA+SHA1:DSA+SHA256:ECDSA+SHA256
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer
 
-[test-48]
+[test-50]
 ExpectedResult = ServerFail
 
 

test/ssl-tests/20-cert-select.conf.in

@@ -138,6 +138,28 @@ our @tests = (
             "ExpectedResult" => "Success"
         },
     },
+    {
+        name => "ECDSA with brainpool",
+        server =>  {
+            "Certificate" => test_pem("server-ecdsa-brainpoolP256r1-cert.pem"),
+            "PrivateKey" => test_pem("server-ecdsa-brainpoolP256r1-key.pem"),
+            "Groups" => "brainpoolP256r1",
+        },
+        client => {
+            #We don't restrict this to TLSv1.2, although use of brainpool
+            #should force this anyway so that this should succeed
+            "CipherString" => "aECDSA",
+            "RequestCAFile" => test_pem("root-cert.pem"),
+            "Groups" => "brainpoolP256r1",
+        },
+        test   => {
+            "ExpectedServerCertType" =>, "brainpoolP256r1",
+            "ExpectedServerSignType" =>, "EC",
+            # Note: certificate_authorities not sent for TLS < 1.3
+            "ExpectedServerCANames" =>, "empty",
+            "ExpectedResult" => "Success"
+        },
+    },
     {
         name => "RSA CipherString Selection",
         server => $server,
@@ -762,6 +784,23 @@ my @tests_tls_1_3 = (
             "ExpectedResult" => "Success"
         },
     },
+    {
+        name => "TLS 1.3 ECDSA with brainpool",
+        server =>  {
+            "Certificate" => test_pem("server-ecdsa-brainpoolP256r1-cert.pem"),
+            "PrivateKey" => test_pem("server-ecdsa-brainpoolP256r1-key.pem"),
+            "Groups" => "brainpoolP256r1",
+        },
+        client => {
+            "RequestCAFile" => test_pem("root-cert.pem"),
+            "Groups" => "brainpoolP256r1",
+            "MinProtocol" => "TLSv1.3",
+            "MaxProtocol" => "TLSv1.3"
+        },
+        test   => {
+            "ExpectedResult" => "ServerFail"
+        },
+    },
 );
 
 push @tests, @tests_tls_1_3 unless disabled("tls1_3");

test/sslapitest.c

@@ -5669,6 +5669,7 @@ static int test_client_cert_cb(int tst)
     SSL_CTX_set_verify(sctx,
                        SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT,
                        verify_cb);
+
     if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
                                       NULL, NULL))
             || !TEST_true(create_ssl_connection(serverssl, clientssl,
@@ -5686,6 +5687,140 @@ static int test_client_cert_cb(int tst)
     return testresult;
 }
 
+#if !defined(OPENSSL_NO_TLS1_2) || !defined(OPENSSL_NO_TLS1_3)
+/*
+ * Test setting certificate authorities on both client and server.
+ *
+ * Test 0: SSL_CTX_set0_CA_list() only
+ * Test 1: Both SSL_CTX_set0_CA_list() and SSL_CTX_set_client_CA_list()
+ * Test 2: Only SSL_CTX_set_client_CA_list()
+ */
+static int test_ca_names_int(int prot, int tst)
+{
+    SSL_CTX *cctx = NULL, *sctx = NULL;
+    SSL *clientssl = NULL, *serverssl = NULL;
+    int testresult = 0;
+    size_t i;
+    X509_NAME *name[] = { NULL, NULL, NULL, NULL };
+    char *strnames[] = { "Jack", "Jill", "John", "Joanne" };
+    STACK_OF(X509_NAME) *sk1 = NULL, *sk2 = NULL;
+    const STACK_OF(X509_NAME) *sktmp = NULL;
+
+    for (i = 0; i < OSSL_NELEM(name); i++) {
+        name[i] = X509_NAME_new();
+        if (!TEST_ptr(name[i])
+                || !TEST_true(X509_NAME_add_entry_by_txt(name[i], "CN",
+                                                         MBSTRING_ASC,
+                                                         (unsigned char *)
+                                                         strnames[i],
+                                                         -1, -1, 0)))
+            goto end;
+    }
+
+    if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(),
+                                       TLS_client_method(),
+                                       TLS1_VERSION,
+                                       prot,
+                                       &sctx, &cctx, cert, privkey)))
+        goto end;
+
+    SSL_CTX_set_verify(sctx, SSL_VERIFY_PEER, NULL);
+
+    if (tst == 0 || tst == 1) {
+        if (!TEST_ptr(sk1 = sk_X509_NAME_new_null())
+                || !TEST_true(sk_X509_NAME_push(sk1, X509_NAME_dup(name[0])))
+                || !TEST_true(sk_X509_NAME_push(sk1, X509_NAME_dup(name[1])))
+                || !TEST_ptr(sk2 = sk_X509_NAME_new_null())
+                || !TEST_true(sk_X509_NAME_push(sk2, X509_NAME_dup(name[0])))
+                || !TEST_true(sk_X509_NAME_push(sk2, X509_NAME_dup(name[1]))))
+            goto end;
+
+        SSL_CTX_set0_CA_list(sctx, sk1);
+        SSL_CTX_set0_CA_list(cctx, sk2);
+        sk1 = sk2 = NULL;
+    }
+    if (tst == 1 || tst == 2) {
+        if (!TEST_ptr(sk1 = sk_X509_NAME_new_null())
+                || !TEST_true(sk_X509_NAME_push(sk1, X509_NAME_dup(name[2])))
+                || !TEST_true(sk_X509_NAME_push(sk1, X509_NAME_dup(name[3])))
+                || !TEST_ptr(sk2 = sk_X509_NAME_new_null())
+                || !TEST_true(sk_X509_NAME_push(sk2, X509_NAME_dup(name[2])))
+                || !TEST_true(sk_X509_NAME_push(sk2, X509_NAME_dup(name[3]))))
+            goto end;
+
+        SSL_CTX_set_client_CA_list(sctx, sk1);
+        SSL_CTX_set_client_CA_list(cctx, sk2);
+        sk1 = sk2 = NULL;
+    }
+
+    if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
+                                      NULL, NULL))
+            || !TEST_true(create_ssl_connection(serverssl, clientssl,
+                                                SSL_ERROR_NONE)))
+        goto end;
+
+    /*
+     * We only expect certificate authorities to have been sent to the server
+     * if we are using TLSv1.3 and SSL_set0_CA_list() was used
+     */
+    sktmp = SSL_get0_peer_CA_list(serverssl);
+    if (prot == TLS1_3_VERSION
+            && (tst == 0 || tst == 1)) {
+        if (!TEST_ptr(sktmp)
+                || !TEST_int_eq(sk_X509_NAME_num(sktmp), 2)
+                || !TEST_int_eq(X509_NAME_cmp(sk_X509_NAME_value(sktmp, 0),
+                                              name[0]), 0)
+                || !TEST_int_eq(X509_NAME_cmp(sk_X509_NAME_value(sktmp, 1),
+                                              name[1]), 0))
+            goto end;
+    } else if (!TEST_ptr_null(sktmp)) {
+        goto end;
+    }
+
+    /*
+     * In all tests we expect certificate authorities to have been sent to the
+     * client. However, SSL_set_client_CA_list() should override
+     * SSL_set0_CA_list()
+     */
+    sktmp = SSL_get0_peer_CA_list(clientssl);
+    if (!TEST_ptr(sktmp)
+            || !TEST_int_eq(sk_X509_NAME_num(sktmp), 2)
+            || !TEST_int_eq(X509_NAME_cmp(sk_X509_NAME_value(sktmp, 0),
+                                          name[tst == 0 ? 0 : 2]), 0)
+            || !TEST_int_eq(X509_NAME_cmp(sk_X509_NAME_value(sktmp, 1),
+                                          name[tst == 0 ? 1 : 3]), 0))
+        goto end;
+
+    testresult = 1;
+
+ end:
+    SSL_free(serverssl);
+    SSL_free(clientssl);
+    SSL_CTX_free(sctx);
+    SSL_CTX_free(cctx);
+    for (i = 0; i < OSSL_NELEM(name); i++)
+        X509_NAME_free(name[i]);
+    sk_X509_NAME_pop_free(sk1, X509_NAME_free);
+    sk_X509_NAME_pop_free(sk2, X509_NAME_free);
+
+    return testresult;
+}
+#endif
+
+static int test_ca_names(int tst)
+{
+    int testresult = 1;
+
+#ifndef OPENSSL_NO_TLS1_2
+    testresult &= test_ca_names_int(TLS1_2_VERSION, tst);
+#endif
+#ifndef OPENSSL_NO_TLS1_3
+    testresult &= test_ca_names_int(TLS1_3_VERSION, tst);
+#endif
+
+    return testresult;
+}
+
 int setup_tests(void)
 {
     if (!TEST_ptr(cert = test_get_argument(0))
@@ -5790,6 +5925,7 @@ int setup_tests(void)
     ADD_ALL_TESTS(test_shutdown, 7);
     ADD_ALL_TESTS(test_cert_cb, 3);
     ADD_ALL_TESTS(test_client_cert_cb, 2);
+    ADD_ALL_TESTS(test_ca_names, 3);
     return 1;
 }
 

test/ssltest_old.c

@@ -779,7 +779,7 @@ static void print_details(SSL *c_ssl, const char *prefix)
         }
         X509_free(cert);
     }
-    if (SSL_get_server_tmp_key(c_ssl, &pkey)) {
+    if (SSL_get_peer_tmp_key(c_ssl, &pkey)) {
         BIO_puts(bio_stdout, ", temp key: ");
         print_key_details(bio_stdout, pkey);
         EVP_PKEY_free(pkey);