add support for ML-DSA and TPM2-held keys referenced via handle; OpenSSL 4.0 compat#119
Draft
DDvO wants to merge 27 commits into
Draft
add support for ML-DSA and TPM2-held keys referenced via handle; OpenSSL 4.0 compat#119DDvO wants to merge 27 commits into
DDvO wants to merge 27 commits into
Conversation
There was a problem hiding this comment.
Pull request overview
Adds support needed for newer key types (ML-DSA) and TPM2 handle-referenced keys in the cmpClient workflow by updating how new keys are created and slightly adjusting OpenSSL library detection behavior in the legacy Makefile.
Changes:
- Switch key generation to
KEY_new_ex(..., libctx)to support provider-/libctx-aware algorithms (e.g., ML-DSA) and non-file key references. - Adjust
Makefile_v1behavior whenlibcryptocannot be found by disabling a previously-run diagnostic fallback call.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| src/cmpClient.c | Uses KEY_new_ex() with the app libctx when generating a new key for enrollment flows. |
| Makefile_v1 | Removes (comments out) a fallback call that previously re-ran OpenSSL lib detection to emit diagnostics before failing. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
DDvO
force-pushed
the
extend_KEY_new
branch
3 times, most recently
from
23d630d to
6faf9b2
Compare
DDvO
changed the title
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 12 out of 13 changed files in this pull request and generated 6 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
DDvO
force-pushed
the
extend_KEY_new
branch
3 times, most recently
from
aa867cb to
a6dec70
Compare
DDvO
force-pushed
the
extend_KEY_new
branch
2 times, most recently
from
ccf639a to
62cb823
Compare
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
DDvO
force-pushed
the
extend_KEY_new
branch
2 times, most recently
from
2ca5abf to
374def0
Compare
…s, removing 3.1 .. 3.3 and adding 4.0
…QC credential creation, and 'make' steps
… 'bool maybe_stdin'
…ts what to do when not using it
…iltering of key/signature hex strings
…D for verifying own TLS client cert
…TLS.p12 and use that
…_server-docker-cn.txt, add EJBCA_TLS_SERVCER_CERTS
…_add_nconf_sk() makes empty exts NULL since OpenSSL 4.0
…nt on OpenSSL version or libcmp use
… for local host if -tls_host not given
…st part, not any given -tls_host
…scheme() using it
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
usage examples:
./cmpClient imprint -section EJBCA -newkeytype "ML-DSA-65"./cmpClient imprint -section EJBCA -newkey "tpm2:handle=0x81000001"On this occasion also:
-tls_hostoption and SNI and related documentationgenericCMPClient_util.{c,h}demo_EJBCA80-test_cmp_http.twith latest upstream OpenSSL version of that script, fixing CI hangs for OpenSSL 3.6+