Skip to main content
← Back to list
01Issue
BugShippedSwamp CLIPublic
Assigneesskunk-apehammz

Relationships

#2199 TLS tests assume OpenSSL 3.x defaults and fail on macOS LibreSSL, blocking verify-build

Opened by skunk-ape · 9/16/2026· Shipped 9/16/2026

Four tests fail on a stock macOS host because they shell out to openssl and assume OpenSSL 3.x behaviour. macOS ships LibreSSL as /usr/bin/openssl.

src/infrastructure/runtime/tls_cert_validation_test.ts
  hasCaTrue: returns true for default openssl req -x509 cert
  validateEndEntityCert: returns ca-true warning for CA:TRUE cert

integration/tls_trust_test.ts
  tls_trust integration: shim resolves a private-CA chain via SSL_CERT_FILE
  tls_trust ordering: trust configured AFTER an import-time handshake is too late

Observed with LibreSSL 3.3.6 (openssl version, macOS 25.6.0, arm64).

Why

generateCert() runs openssl req -x509 .... Under OpenSSL 3.x this emits a v3 certificate carrying basicConstraints=critical,CA:TRUE by default, which is what the assertions encode. LibreSSL 3.3.6 emits a v1 certificate with no extensions at all, so:

  • hasCaTrue(cert) is false, not true
  • validateEndEntityCert produces no ca-true warning (0 warnings, not 1)
  • the generated cert is rejected at handshake as invalid peer certificate: Other(OtherError(UnsupportedCertVersion)) rather than the expected UnknownIssuer, because a v1 cert has no SAN/extensions

The last point is why the two tls_trust tests fail on an assertion about the error string rather than about trust behaviour — they are asserting on an error that LibreSSL never lets them reach.

Confirmed pre-existing

Reproduced on an unrelated branch, then re-confirmed with that branch's changes reverted via git checkout HEAD~1 -- <files>: same two failures in tls_cert_validation_test.ts either way. Not a regression from any current work.

Impact

deno run test exits 1 on any macOS host using the system openssl, so the run-tests step of verify-build can never go green there. That blocks the attestation, and therefore blocks opening any PR from such a host.

Suggested directions

  1. Pin the extension explicitly in generateCert() — pass -addext basicConstraints=critical,CA:TRUE for the CA:TRUE case rather than relying on the tool's default. That makes the test assert the code under test instead of the local openssl's defaults.
  2. For the tls_trust pair, generate a v3 cert explicitly (or assert on trust outcome rather than on a specific rustls error string).
  3. Alternatively, skip these tests when openssl version reports LibreSSL, but that silently loses coverage on every macOS dev machine — option 1 is preferable.

Per AGENTS.md, tests must run on Linux, macOS, and Windows; today these pass only where the host openssl happens to be OpenSSL 3.x.

02Bog Flow
✓OPEN✓TRIAGED✓IN PROGRESS✓SHIPPED+ 3 MOREASSIGNED+ 2 MOREREVIEW+ 19 MOREPR_MERGED+ 5 MORESESSION_SUMMARIZED

Shipped

9/16/2026, 9:46:05 PM

Click a lifecycle step above to view its details.

03Sludge Pulse
skunk-ape assigned skunk-ape9/16/2026, 7:01:03 PM
hammz assigned hammz9/16/2026, 9:24:10 PM

Sign in to post a ripple.