From 95d7acf9945f68a94351c6e1f27c045e780bf354 Mon Sep 17 00:00:00 2001
From: David Cooper <david.cooper@nist.gov>
Date: Wed, 19 Feb 2025 12:49:17 -0800
Subject: [PATCH] Fix check for OpenSSL supported curves
OpenSSL 3.X outputs a different error message than previous versions when $OPENSSL s_client -curves X ... is called with an unsupported curve. This was resulting in the check within find_openssl_binary() adding every curve to $OPENSSL_SUPPORTED_CURVES, even ones that were not supported. This commit changes to check in order to detect the new error message.
---
testssl.sh | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/testssl.sh b/testssl.sh
index 29a2209..3886071 100755
--- a/testssl.sh
+++ b/testssl.sh
@@ -17295,7 +17295,7 @@ find_openssl_binary() {
HAS_CURVES=true
for curve in "${curves_ossl[@]}"; do
# Same as above, we just don't need a port for invalid.
- $OPENSSL s_client -curves $curve -connect $NXCONNECT </dev/null 2>&1 | grep -Eiaq "Error with command|unknown option"
+ $OPENSSL s_client -curves $curve -connect $NXCONNECT </dev/null 2>&1 | grep -Eiaq "Error with command|unknown option|Call to SSL_CONF_cmd(.*) failed"
[[ $? -ne 0 ]] && OSSL_SUPPORTED_CURVES+=" $curve "
done
fi