Mbed-TLS · valeriosetti · Nov 27, 2025 · Nov 28, 2025 · Nov 28, 2025 · davidhorstmann-arm
diff --git a/data_files/Makefile b/data_files/Makefile
@@ -469,6 +469,17 @@ server5-selfsigned.crt: server5.key
         -out $@
 all_final += server5-selfsigned.crt
 
+# Create a certificate which is almost identical to "server3.crt", i.e.
+# it contains a public EC key and it is signed with RSA. The main difference
+# compared to "server3.crt" is that in this case we use a secp256r1 key ("server5.key")
+# instead of secp192r1 one that is used in "server3.crt".
+parse_input/server5-rsa-signed.crt server5-rsa-signed.crt: server5.key
+	$(MBEDTLS_CERT_WRITE) subject_key=$< subject_name="C=NL,O=PolarSSL,CN=localhost" serial=13 \
+		issuer_crt=$(test_ca_crt) issuer_key=$(test_ca_key_file_rsa) issuer_pwd=$(test_ca_pwd_rsa) \
+		not_before=20190210144406 not_after=20290210144406 \
+		md=SHA1 version=3 output_file=$@
+all_final += server5-rsa-signed.crt
+
 parse_input/server5-othername.crt.der: server5.key
 	$(OPENSSL) req -x509 -new -subj "/C=UK/O=Mbed TLS/CN=Mbed TLS othername SAN" -set_serial 77 -config $(test_ca_config_file) -extensions othername_san -days 3650 -sha256 -key $< -outform der -out $@
 
@@ -625,6 +636,18 @@ server10_int3_spurious_int-ca2.crt: server10.crt test-int-ca3.crt $(test_ca_int_
 	cat $^ > $@
 all_final += server10_int3_spurious_int-ca2.crt
 
+# server11 *
+
+# This is basically identical to "server5-rsa-signed.crt" but using a secp256k1
+# key instead of secp256r1 one in order not to fall in the list of allowed curves
+# for suite-b profile.
+server11-rsa-signed.crt: server11.key
+	$(MBEDTLS_CERT_WRITE) subject_key=$< subject_name="C=NL,O=PolarSSL,CN=localhost" serial=13 \
+		issuer_crt=$(test_ca_crt) issuer_key=$(test_ca_key_file_rsa) issuer_pwd=$(test_ca_pwd_rsa) \
+		not_before=20190210144406 not_after=20290210144406 \
+		md=SHA1 version=3 output_file=$@
+all_final += server11-rsa-signed.crt
+
 rsa_pkcs1_2048_public.pem: server8.key
 	$(OPENSSL)  rsa -in $< -outform PEM -RSAPublicKey_out -out $@
 all_final += rsa_pkcs1_2048_public.pem

diff --git a/data_files/parse_input/server5-rsa-signed.crt b/data_files/parse_input/server5-rsa-signed.crt
@@ -0,0 +1,15 @@
+-----BEGIN CERTIFICATE-----
+MIICbDCCAVSgAwIBAgIBDTANBgkqhkiG9w0BAQUFADA7MQswCQYDVQQGEwJOTDER
+MA8GA1UECgwIUG9sYXJTU0wxGTAXBgNVBAMMEFBvbGFyU1NMIFRlc3QgQ0EwHhcN
+MTkwMjEwMTQ0NDA2WhcNMjkwMjEwMTQ0NDA2WjA0MQswCQYDVQQGEwJOTDERMA8G
+A1UECgwIUG9sYXJTU0wxEjAQBgNVBAMMCWxvY2FsaG9zdDBZMBMGByqGSM49AgEG
+CCqGSM49AwEHA0IABDfMVtl2CR5acj7HWS3/IG7ufPkGkXTQrRS192giWWKSTuUA
+2CMR/+ov0jRdXRa9iojCa3cNVc2KKg76Aci07f+jTTBLMAkGA1UdEwQCMAAwHQYD
+VR0OBBYEFFBhpY/UB9nXggEM5WV/jGNGpxO+MB8GA1UdIwQYMBaAFLRa5KWz3tJS
+9rnVppUP6z68x/3/MA0GCSqGSIb3DQEBBQUAA4IBAQB+zsQEaDKqrSH0dhpwxOy7
+P5VY4D8ka3Fm4lpjQGMG4bV7XYMmw4epP7ULXnbpka2GUOa8hHS51koZrEwp2XgO
+RG90sWFnxa3bQ1JwZVWMvhQsNLKm8TV/uPrHhHdMDXw0wTwp3e+MwZnrq/KY+rsQ
+J37e86Z+xcgaibkxh0JtCsfvZEieNS2wS1bnZ1n4SsglJuEcNJvXmhWIEYeDkYbB
+6y3MAECU2ZkZJBdROcanUz3F4AuIH7dNTqhlMAPQkdC1SD/sMgE2G3aIowKc0ntV
+UykhWs7kIU96PnApXgu5zLypkZnKMPvmrpDc5o1ddfBdD1aNSNtsIL699AczJgM6
+-----END CERTIFICATE-----
diff --git a/data_files/server11-rsa-signed.crt b/data_files/server11-rsa-signed.crt
@@ -0,0 +1,15 @@
+-----BEGIN CERTIFICATE-----
+MIICaTCCAVGgAwIBAgIBDTANBgkqhkiG9w0BAQUFADA7MQswCQYDVQQGEwJOTDER
+MA8GA1UECgwIUG9sYXJTU0wxGTAXBgNVBAMMEFBvbGFyU1NMIFRlc3QgQ0EwHhcN
+MTkwMjEwMTQ0NDA2WhcNMjkwMjEwMTQ0NDA2WjA0MQswCQYDVQQGEwJOTDERMA8G
+A1UECgwIUG9sYXJTU0wxEjAQBgNVBAMMCWxvY2FsaG9zdDBWMBAGByqGSM49AgEG
+BSuBBAAKA0IABITn/L3s9+4MXRDenn1V/4T4B0igjlPW52BKcl5ZNS5jMqDOOUjl
+zXShWMqz2Izhsa29cxsTOZN8eT4p8BedD6ujTTBLMAkGA1UdEwQCMAAwHQYDVR0O
+BBYEFE8fs/ywDn6xlnYK1tDkG/lCZ0ZmMB8GA1UdIwQYMBaAFLRa5KWz3tJS9rnV
+ppUP6z68x/3/MA0GCSqGSIb3DQEBBQUAA4IBAQAyVbsxPW8wUqo23j0KinXKJIFJ
+KakGvPiQsl7cV+go9W2kJSlUKBtaUcdZQpQsm3FLnDMhz9j1VBSic46/msH2I7Cv
+eUrPlmP9Y1spYCuUo3c/tOyAPhgwVFdNWuYTwPRD+D2yugQMhnggoemaYzu+Mw0z
+FTbY/kXSsW47n8qbHbE5kvo40lGFSPmcbvJDMGwfw1o2adQm43Zce4uxL4WbC6Y6
+8FvkMmyFBRVRKnt1ViIyaeEjlgCVxhfUZO8kvy9So86m2xZtQTuEFHN/Cn7xdRLG
+GILYv5GAbYXNcrzfpz9UyU9VUGLKJIHpmrmKBUl8GsV0z9bSIApiE+wDq+F7
+-----END CERTIFICATE-----
diff --git a/data_files/server11.key b/data_files/server11.key
@@ -0,0 +1,5 @@
+-----BEGIN EC PRIVATE KEY-----
+MHQCAQEEIDzXde5ZiqF4VOJ4mFFJyzLOPz0RHkeJdF9quDdy67oGoAcGBSuBBAAK
+oUQDQgAEhOf8vez37gxdEN6efVX/hPgHSKCOU9bnYEpyXlk1LmMyoM45SOXNdKFY
+yrPYjOGxrb1zGxM5k3x5PinwF50Pqw==
+-----END EC PRIVATE KEY-----
diff --git a/data_files/server5-rsa-signed.crt b/data_files/server5-rsa-signed.crt
@@ -0,0 +1,15 @@
+-----BEGIN CERTIFICATE-----
+MIICbDCCAVSgAwIBAgIBDTANBgkqhkiG9w0BAQUFADA7MQswCQYDVQQGEwJOTDER
+MA8GA1UECgwIUG9sYXJTU0wxGTAXBgNVBAMMEFBvbGFyU1NMIFRlc3QgQ0EwHhcN
+MTkwMjEwMTQ0NDA2WhcNMjkwMjEwMTQ0NDA2WjA0MQswCQYDVQQGEwJOTDERMA8G
+A1UECgwIUG9sYXJTU0wxEjAQBgNVBAMMCWxvY2FsaG9zdDBZMBMGByqGSM49AgEG
+CCqGSM49AwEHA0IABDfMVtl2CR5acj7HWS3/IG7ufPkGkXTQrRS192giWWKSTuUA
+2CMR/+ov0jRdXRa9iojCa3cNVc2KKg76Aci07f+jTTBLMAkGA1UdEwQCMAAwHQYD
+VR0OBBYEFFBhpY/UB9nXggEM5WV/jGNGpxO+MB8GA1UdIwQYMBaAFLRa5KWz3tJS
+9rnVppUP6z68x/3/MA0GCSqGSIb3DQEBBQUAA4IBAQB+zsQEaDKqrSH0dhpwxOy7
+P5VY4D8ka3Fm4lpjQGMG4bV7XYMmw4epP7ULXnbpka2GUOa8hHS51koZrEwp2XgO
+RG90sWFnxa3bQ1JwZVWMvhQsNLKm8TV/uPrHhHdMDXw0wTwp3e+MwZnrq/KY+rsQ
+J37e86Z+xcgaibkxh0JtCsfvZEieNS2wS1bnZ1n4SsglJuEcNJvXmhWIEYeDkYbB
+6y3MAECU2ZkZJBdROcanUz3F4AuIH7dNTqhlMAPQkdC1SD/sMgE2G3aIowKc0ntV
+UykhWs7kIU96PnApXgu5zLypkZnKMPvmrpDc5o1ddfBdD1aNSNtsIL699AczJgM6
+-----END CERTIFICATE-----