[junaruga]

I noticed that the rsa-1 is used for certificate (CA) and server in the test/openssl/test_ssl.rb test_pqc_sigalg test, as @ca_key and @ca_cert are created by rsa-1 according to the following logic:

test/openssl/test_ssl.rb

  def setup
...
    @ca_key  = Fixtures.pkey("rsa-1")
    @svr_key = Fixtures.pkey("rsa-2")
    @cli_key = Fixtures.pkey("rsa-3")
...
    @ca_cert  = issue_cert(@ca, @ca_key, 1, @ca_exts, nil, nil)
    @svr_cert = issue_cert(@svr, @svr_key, 2, @ee_exts, @ca_cert, @ca_key)
    @cli_cert = issue_cert(@cli, @cli_key, 3, @ee_exts, @ca_cert, @ca_key)
...
  end

I assume that this may not be intentional. So, I changed the key numbers

---

• Align key numbers with the pattern in test/openssl/utils.rb setup: rsa-1 for
  certificate (CA), rsa-2 for server, rsa-3 for client.
• Use mldsa65-1 for certificate and mldsa65-2 for server.
• Use rsa-2 for server, because rsa-1 is already used for certificate (@ca_key,
  @ca_cert).

Assisted-by: Claude Code

[rhenium]

Sorry, I've missed this PR.

I don't really see what this changes, though. It seems we're checking things as expected with or without this diff?

[junaruga]

I don't really see what this changes, though. It seems we're checking things as expected with or without this diff?

There are 2 issues:

• In test_pqc_sigalg, @ca_key is created by rsa-1 by @ca_key = Fixtures.pkey("rsa-1") in setup in test/openssl/utils.rb. So, on the previous code, the testing key rsa = Fixtures.pkey("rsa-1") in test_pqc_sigalg uses the same key with the testing CA key @ca_key. I added the code comment # rsa-1 is used for @ca_key to clarify my intention. I think that rsa-1 is used for both CA and key is an issue.
  

  openssl/test/openssl/utils.rb

  Lines 174 to 176 in ac3a0b7

  	@ca_key = Fixtures.pkey("rsa-1")
  	@svr_key = Fixtures.pkey("rsa-2")
  	@cli_key = Fixtures.pkey("rsa-3")

• In setup in utils.rb, the rsa-1 is used for CA key, the rsa-2 is used for server key, and rsa-3 is used for client key. So, there is a pattern foo-1 is for CA key, foo-2 is for server key and foo-3 is for client key. This PR's change is to align with this pattern, mldsa65-1 is used for CA key, the mldsa65-2 is used for a key. The point is the CA key should be created first from foo-1, because other (server/client/a) key is created based on foo-2. This helps me read a code easily.

  @ca_key  = Fixtures.pkey("rsa-1")
  @svr_key = Fixtures.pkey("rsa-2")
  @cli_key = Fixtures.pkey("rsa-3")
  

Does it make sense?

[junaruga]

I don't really see what this changes, though. It seems we're checking things as expected with or without this diff?

The current test is not wrong, but this PR is about refactoring the test to make it better.

[rhenium]

Thanks for the explanation. Using the same key shouldn't cause any issues, but I agree this seems inconsistent.

BTW, I don't really like that #setup issues certificates even for quite a few test cases that either can't use them or don't need them. Besides being confusing, this also slows down test runtime. I hope we can refactor this at some point.