From 6e9854df711a526e8c40a39e786569cbf63dfc2b Mon Sep 17 00:00:00 2001 From: David Cooper Date: Mon, 23 Mar 2026 13:57:04 -0700 Subject: [PATCH] OpenSSL 4 compatibility This commit addresses two issues created by changes in certificate printing in OpenSSL 4 (based on testing with OpenSSL 4.0.0-alpha1). With OpenSSL 4, the public key type for ML-DSA keys is now shown with a string (e.g., ML-DSA-44) rather than an OID. The first change in this commit ensures that the public key size is set correctly in this case. Second, different information is printed about the size of elliptic curve public keys. All previous versions of OpenSSL (and LibreSSL) just provided the size of the public key: Public-Key: (256 bit) OpenSSL 4.0.0-alpha includes additional information: Public-Key: (256 bit field, 128 bit security level) The second change in this commit removes this additional information. --- testssl.sh | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/testssl.sh b/testssl.sh index 78702d9..2bc59fa 100755 --- a/testssl.sh +++ b/testssl.sh @@ -9206,9 +9206,9 @@ certificate_info() { case "$cert_key_algo" in 1.3.101.112|E[Dd]25519) cert_key_algo="Ed25519"; cert_keysize=253 ;; 1.3.101.113|E[Dd]448) cert_key_algo="Ed448"; cert_keysize=456 ;; - 2.16.840.1.101.3.4.3.17) cert_key_algo="ML-DSA-44"; cert_keysize=2560 ;; - 2.16.840.1.101.3.4.3.18) cert_key_algo="ML-DSA-65"; cert_keysize=4032 ;; - 2.16.840.1.101.3.4.3.19) cert_key_algo="ML-DSA-87"; cert_keysize=4896 ;; + 2.16.840.1.101.3.4.3.17|ML-DSA-44) cert_key_algo="ML-DSA-44"; cert_keysize=2560 ;; + 2.16.840.1.101.3.4.3.18|ML-DSA-65) cert_key_algo="ML-DSA-65"; cert_keysize=4032 ;; + 2.16.840.1.101.3.4.3.19|ML-DSA-87) cert_key_algo="ML-DSA-87"; cert_keysize=4896 ;; esac out "$indent" ; pr_bold " Signature Algorithm " @@ -12300,6 +12300,7 @@ get_pub_key_size() { if [[ -n $pubkeybits ]]; then # remainder e.g. "256 bit)" pubkeybits="${pubkeybits//\)/}" + pubkeybits="${pubkeybits%% field, *}" echo "Server public key is $pubkeybits" >> $TMPFILE else # This extracts the public key for DSA, DH, and GOST