Merge pull request #1546 from minosgalanakis/merge-development-restricted

Merge restricted/development into development/restricted
2026-09-21 09:37:23 +00:00 · 2026-04-02 11:19:02 +01:00
parent fc317141fe 0cfd96499d
commit f7e0f0e22e
66 changed files with 1092 additions and 2690 deletions
@@ -11,6 +11,7 @@ At any point in time, we have a number of maintained branches, currently consist
 - One or more long-time support (LTS) branches: these only get bug fixes and
  security fixes. Currently, the supported LTS branches are:
 - [`mbedtls-3.6`](https://github.com/Mbed-TLS/mbedtls/tree/mbedtls-3.6).
+- [`mbedtls-4.1`](https://github.com/Mbed-TLS/mbedtls/tree/mbedtls-4.1).

 We retain a number of historical branches, whose names are prefixed by `archive/`,
 such as [`archive/mbedtls-2.7`](https://github.com/Mbed-TLS/mbedtls/tree/archive/mbedtls-2.7).
@@ -22,11 +23,11 @@ the API of 4.(x+1) is backward compatible with 4.x). We only break API
 compatibility on major version changes (e.g. from 3.x to 4.0). We also maintain
 ABI compatibility within LTS branches; see the next section for details.

-We will make regular LTS releases on an 18-month cycle, each of which will have
-a 3 year support lifetime. On this basis, 3.6 LTS (released March 2024) will be
-supported until March 2027. The next LTS release will be a 4.x release. Due to
-the size and scope of the 4.0 release, the release date of the first 4.x LTS is
-yet to be determined.
+We plan to make regular LTS releases on an 18-month cycle, each with a support
+lifetime of three years.On this basis, Mbed TLS 3.6 LTS (released in March 2024)
+will be supported until March 2027. Due to the size and scope of the 4.0 release,
+the first 4.x LTS, version 4.1, was released two years after 3.6, in March 2026,
+and will be supported until March 2029.

 ## Backwards Compatibility for application code

@@ -87,6 +88,9 @@ The following branches are currently maintained:
 - [`development`](https://github.com/Mbed-TLS/mbedtls/)
 - [`mbedtls-3.6`](https://github.com/Mbed-TLS/mbedtls/tree/mbedtls-3.6)
 maintained until March 2027, see
-  <https://github.com/Mbed-TLS/mbedtls/releases/tag/v3.6.4>.
+  <https://github.com/Mbed-TLS/mbedtls/releases/tag/v3.6.6>.
+- [`mbedtls-4.1`](https://github.com/Mbed-TLS/mbedtls/tree/mbedtls-4.1)
+ maintained until March 2029, see
+  <https://github.com/Mbed-TLS/mbedtls/releases/tag/v4.1.0>.

 Users are urged to always use the latest version of a maintained branch.
@@ -37,10 +37,10 @@ cmake_policy(SET CMP0011 NEW)
 # is deprecated and will be removed in future versions.
 cmake_policy(SET CMP0012 NEW)

-set(MBEDTLS_VERSION 4.0.0)
-set(MBEDTLS_CRYPTO_SOVERSION 17)
-set(MBEDTLS_X509_SOVERSION 8)
-set(MBEDTLS_TLS_SOVERSION 22)
+set(MBEDTLS_VERSION 4.1.0)
+set(MBEDTLS_CRYPTO_SOVERSION 18)
+set(MBEDTLS_X509_SOVERSION 9)
+set(MBEDTLS_TLS_SOVERSION 23)

 if(TEST_CPP)
    project("Mbed TLS"
@@ -122,7 +122,7 @@ endif()
 # We now potentially need to link all executables against PThreads, if available
 set(CMAKE_THREAD_PREFER_PTHREAD TRUE)
 set(THREADS_PREFER_PTHREAD_FLAG TRUE)
-find_package(Threads)
+find_package(Threads QUIET)

 # If this is the root project add longer list of available CMAKE_BUILD_TYPE values
 if(NOT MBEDTLS_AS_SUBPROJECT)
@@ -1,5 +1,82 @@
 Mbed TLS ChangeLog (Sorted per branch, date)

+= Mbed TLS 4.1.0 branch released 2026-03-31
+
+API changes
+   * MBEDTLS_TIMING_C now requires MBEDTLS_HAVE_TIME to be enabled in the
+     TF-PSA-Crypto configuration, unless MBEDTLS_TIMING_ALT is enabled.
+     As a benefit, platforms where the default implementation is not
+     supported now only need to implement MBEDTLS_PLATFORM_MS_TIME_ALT.
+   * When MBEDTLS_TIMING_ALT is enabled, the function
+     mbedtls_timing_get_timer() now returns unsigned long long instead
+     of unsigned long.
+
+Features
+   * Add the function mbedtls_ssl_get_fatal_alert(), which returns the type of
+     the last received fatal alert. This allows callers to retrieve more
+     detailed information when mbedtls_ssl_handshake(),
+     mbedtls_ssl_handshake_step(), or mbedtls_ssl_read() returns the generic
+     MBEDTLS_ERR_SSL_FATAL_ALERT_MESSAGE error code.
+   * Function mbedtls_ssl_get_supported_group_list() is added to return the list
+     of supported groups IDs (curves and finite fields).
+   * MBEDTLS_SSL_IANA_TLS_GROUPS_INFO is added to allow defining the list of
+     mbedtls_ssl_iana_tls_group_info_t items which represent known TLS groups
+     with corresponding informations.
+     If MBEDTLS_DEBUG_C is also enabled then mbedtls_ssl_iana_tls_group_info is
+     also available as implementation of such list.
+
+Security
+   * The documentation of mbedtls_ssl_session_save(),
+     mbedtls_ssl_session_load(), mbedtls_ssl_context_save(), and
+     mbedtls_ssl_context_load() has been updated to clarify the responsibility
+     of the application to preserve the confidentiality and integrity of
+     serialized data, mitigating the risk of misuse of these APIs.
+     Credit to Haruto Kimura (Stella) and Eva Crystal (0xiviel) for
+     highlighting risks associated with tampered serialized data.
+   * Fix a NULL pointer dereference in mbedtls_x509_string_to_names() when
+     mbedtls_calloc() fails to allocate memory. This was caused by failing to
+     check whether mbedtls_calloc() returned NULL. Found and reported by
+     Haruto Kimura (Stella).
+   * Fix a limited buffer underflow in x509_inet_pton_ipv6(). In rare cases
+     (e.g. on platforms with memory protection when the overread crosses page
+     boundary) this could lead to DoS. Found and reported by Haruto Kimura
+     (Stella). CVE-2026-25833
+   * Fix a bug in the TLS 1.2 client's signature algorithm check, which caused
+     the client to accept server key exchange messages signed with a signature
+     algorithm explicitly disallowed by the client. Found and reported by
+     EFR-GmbH and M. Heuft of Security-Research-Consulting GmbH. CVE-2026-25834
+   * Fixed an issue in TLS 1.3 server handling of the second ClientHello, after
+     sending a HelloRetryRequest message. A man-in-the-middle attacker could
+     force a TLS 1.3 session resumption using a ticket to fall back to an
+     unintended TLS 1.2 session resumption with an all-zero master secret.
+     This could result in client authentication being bypassed and allow client
+     impersonation.
+     Found and reported by Jaehun Lee, Pohang University of Science and
+     Technology (POSTECH).
+
+Bugfix
+   * CMake now installs headers to `CMAKE_INSTALL_INCLUDEDIR` instead of the
+     hard-coded `include` directory.
+   * Fix CMake failure on Windows because of a native directory separator.
+     Fixes #10502.
+   * mbedtls_timing_get_delay() now correctly treats a timer as expired
+     after more than 2^32 ms (about 49 days) on platforms where long is
+     a 32-bit type. Fixes #10613.
+   * Support re-assembly of fragmented DTLS 1.2 ClientHello in Mbed TLS server.
+   * Support re-assembly of fragmented TLS 1.2 ClientHello in Mbed TLS server
+     even if TLS 1.3 support is disabled. This removes the main limitation on
+     support for re-assembly of fragmented handshake messages in TLS 1.2.
+
+Changes
+   * Add casts to some Enums to remove compiler errors thrown by IAR 6.5.
+     Removes Warning "mixed ENUM with other type".
+   * Tweak the detection of Unix-like platforms, which makes more system
+     interfaces (timing, threading) available on Haiku, QNX and Midipix.
+   * Harden mbedtls_ssl_get_verify_result() against misuse.
+     If the handshake has not yet been attempted, return -1u to indicate
+     that the result is not available. Previously the result of verification
+     was zero-initialized so the function would return 0 (indicating success).
+
 = Mbed TLS 4.0.0 branch released 2025-10-15

 API changes
@@ -1,6 +0,0 @@
-Features
-   * Add the function mbedtls_ssl_get_fatal_alert(), which returns the type of
-     the last received fatal alert. This allows callers to retrieve more
-     detailed information when mbedtls_ssl_handshake(),
-     mbedtls_ssl_handshake_step(), or mbedtls_ssl_read() returns the generic
-     MBEDTLS_ERR_SSL_FATAL_ALERT_MESSAGE error code.
@@ -1,3 +0,0 @@
-Bugfix
-   * Fix CMake failure on Windows because of a native directory separator.
-     Fixes #10502.
@@ -1,8 +0,0 @@
-Security
-   * The documentation of mbedtls_ssl_session_save(),
-     mbedtls_ssl_session_load(), mbedtls_ssl_context_save(), and
-     mbedtls_ssl_context_load() has been updated to clarify the responsibility
-     of the application to preserve the confidentiality and integrity of
-     serialized data, mitigating the risk of misuse of these APIs.
-     Credit to Haruto Kimura (Stella) and Eva Crystal (0xiviel) for
-     highlighting risks associated with tampered serialized data.
@@ -1,5 +0,0 @@
-Bugfix
-   * Support re-assembly of fragmented DTLS 1.2 ClientHello in Mbed TLS server.
-   * Support re-assembly of fragmented TLS 1.2 ClientHello in Mbed TLS server
-     even if TLS 1.3 support is disabled. This removes the main limitation on
-     support for re-assembly of fragmented handshake messages in TLS 1.2.
@@ -1,5 +0,0 @@
-Security
-   * Fix a NULL pointer dereference in mbedtls_x509_string_to_names() when
-     mbedtls_calloc() fails to allocate memory. This was caused by failing to
-     check whether mbedtls_calloc() returned NULL. Found and reported by
-     Haruto Kimura (Stella).
@@ -1,3 +0,0 @@
-Bugfix
-   * CMake now installs headers to `CMAKE_INSTALL_INCLUDEDIR` instead of the
-     hard-coded `include` directory.
@@ -1,3 +0,0 @@
-Changes
-   * Add casts to some Enums to remove compiler errors thrown by IAR 6.5.
-     Removes Warning "mixed ENUM with other type".
@@ -1,5 +0,0 @@
-Security
-   * Fix a limited buffer underflow in x509_inet_pton_ipv6(). In rare cases
-     (e.g. on platforms with memory protection when the overread crosses page
-     boundary) this could lead to DoS. Found and reported by Haruto Kimura
-     (Stella). CVE-2026-25833
@@ -1,8 +0,0 @@
-Features
-   * Function mbedtls_ssl_get_supported_group_list() is added to return the list
-     of supported groups IDs (curves and finite fields).
-   * MBEDTLS_SSL_IANA_TLS_GROUPS_INFO is added to allow defining the list of
-     mbedtls_ssl_iana_tls_group_info_t items which represent known TLS groups
-     with corresponding informations.
-     If MBEDTLS_DEBUG_C is also enabled then mbedtls_ssl_iana_tls_group_info is
-     also available as implementation of such list.
@@ -1,5 +0,0 @@
-Security
-   * Fix a bug in the TLS 1.2 client's signature algorithm check, which caused
-     the client to accept server key exchange messages signed with a signature
-     algorithm explicitly disallowed by the client. Found and reported by
-     EFR-GmbH and M. Heuft of Security-Research-Consulting GmbH. CVE-2026-25834
@@ -1,13 +0,0 @@
-API changes
-   * MBEDTLS_TIMING_C now requires MBEDTLS_HAVE_TIME to be enabled in the
-     TF-PSA-Crypto configuration, unless MBEDTLS_TIMING_ALT is enabled.
-     As a benefit, platforms where the default implementation is not
-     supported now only need to implement MBEDTLS_PLATFORM_MS_TIME_ALT.
-   * When MBEDTLS_TIMING_ALT is enabled, the function
-     mbedtls_timing_get_timer() now returns unsigned long long instead
-     of unsigned long.
-
-Bugfix
-   * mbedtls_timing_get_delay() now correctly treats a timer as expired
-     after more than 2^32 ms (about 49 days) on platforms where long is
-     a 32-bit type. Fixes #10613.
@@ -1,9 +0,0 @@
-Security
-   * Fixed an issue in TLS 1.3 server handling of the second ClientHello, after
-     sending a HelloRetryRequest message. A man-in-the-middle attacker could
-     force a TLS 1.3 session resumption using a ticket to fall back to an
-     unintended TLS 1.2 session resumption with an all-zero master secret.
-     This could result in client authentication being bypassed and allow client
-     impersonation.
-     Found and reported by Jaehun Lee, Pohang University of Science and
-     Technology (POSTECH).
@@ -1,3 +0,0 @@
-Changes
-   * Tweak the detection of Unix-like platforms, which makes more system
-     interfaces (timing, threading) available on Haiku, QNX and Midipix.
@@ -10,7 +10,7 @@
 */

 /**
- * @mainpage Mbed TLS v4.0.0 API Documentation
+ * @mainpage Mbed TLS v4.1.0 API Documentation
 *
 * This documentation describes the application programming interface (API)
 * of Mbed TLS.
@@ -1,4 +1,4 @@
-PROJECT_NAME           = "Mbed TLS v4.0.0"
+PROJECT_NAME           = "Mbed TLS v4.1.0"
 OUTPUT_DIRECTORY       = ../apidoc/
 FULL_PATH_NAMES        = NO
 OPTIMIZE_OUTPUT_FOR_C  = YES
@@ -27,7 +27,7 @@
 * Major, Minor, Patchlevel
 */
 #define MBEDTLS_VERSION_MAJOR  4
-#define MBEDTLS_VERSION_MINOR  0
+#define MBEDTLS_VERSION_MINOR  1
 #define MBEDTLS_VERSION_PATCH  0

 /**
@@ -35,9 +35,9 @@
 *    MMNNPP00
 *    Major version | Minor version | Patch version
 */
-#define MBEDTLS_VERSION_NUMBER         0x04000000
-#define MBEDTLS_VERSION_STRING         "4.0.0"
-#define MBEDTLS_VERSION_STRING_FULL    "Mbed TLS 4.0.0"
+#define MBEDTLS_VERSION_NUMBER         0x04010000
+#define MBEDTLS_VERSION_STRING         "4.1.0"
+#define MBEDTLS_VERSION_STRING_FULL    "Mbed TLS 4.1.0"

 #if defined(MBEDTLS_CONFIG_FILES_READ)
 #error "Something went wrong: MBEDTLS_CONFIG_FILES_READ defined before reading the config files!"
@@ -1239,6 +1239,12 @@ struct mbedtls_ssl_session {
 #if defined(MBEDTLS_SSL_PROTO_TLS1_3)
    mbedtls_ssl_tls13_application_secrets MBEDTLS_PRIVATE(app_secrets);
 #endif
+
+    /* Unused field reserved for future use */
+    union {
+        size_t number;
+        void *ptr;
+    } MBEDTLS_PRIVATE(unused);
 };

 /*
@@ -1565,6 +1571,12 @@ struct mbedtls_ssl_config {
 #if defined(MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED)
    const mbedtls_x509_crt *MBEDTLS_PRIVATE(dn_hints);/*!< acceptable client cert issuers    */
 #endif
+
+    /* Unused field reserved for future use */
+    union {
+        size_t number;
+        void *ptr;
+    } MBEDTLS_PRIVATE(unused);
 };

 struct mbedtls_ssl_context {
@@ -1848,6 +1860,12 @@ struct mbedtls_ssl_context {
     *          does not currently restore the user data.
     */
    mbedtls_ssl_user_data_t MBEDTLS_PRIVATE(user_data);
+
+    /* Unused field reserved for future use */
+    union {
+        size_t number;
+        void *ptr;
+    } MBEDTLS_PRIVATE(unused);
 };

 /**
@@ -82,6 +82,12 @@ typedef struct mbedtls_x509_crt {
    mbedtls_md_type_t MBEDTLS_PRIVATE(sig_md);           /**< Internal representation of the MD algorithm of the signature algorithm, e.g. MBEDTLS_MD_SHA256 */
    mbedtls_pk_sigalg_t MBEDTLS_PRIVATE(sig_pk);           /**< Internal representation of the Public Key algorithm of the signature algorithm, e.g. MBEDTLS_PK_RSA */

+    /* Unused field reserved for future use */
+    union {
+        size_t number;
+        void *ptr;
+    } MBEDTLS_PRIVATE(unused);
+
    /** Next certificate in the linked list that constitutes the CA chain.
     * \p NULL indicates the end of the list.
     * Do not modify this field directly. */
@@ -72,9 +72,9 @@ LOCAL_CFLAGS += -fPIC -fpic
 endif
 endif

-SOEXT_TLS?=so.21
-SOEXT_X509?=so.8
-SOEXT_CRYPTO?=so.16
+SOEXT_TLS?=so.23
+SOEXT_X509?=so.9
+SOEXT_CRYPTO?=so.18

 ARFLAGS = $(AR_DASH)src
 ifdef APPLE_BUILD
@@ -2468,7 +2468,7 @@ static inline int mbedtls_ssl_tls12_sig_alg_is_supported(
    }

    switch (sig) {
-#if defined(MBEDTLS_RSA_C)
+#if defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC)
        case MBEDTLS_SSL_SIG_RSA:
            break;
 #endif
@@ -962,6 +962,8 @@ void mbedtls_ssl_transform_init(mbedtls_ssl_transform *transform)
 void mbedtls_ssl_session_init(mbedtls_ssl_session *session)
 {
    memset(session, 0, sizeof(mbedtls_ssl_session));
+    /* Set verify_result to -1u to indicate 'result not available'. */
+    session->verify_result = 0xFFFFFFFF;
 }

 MBEDTLS_CHECK_RETURN_CRITICAL
@@ -4570,6 +4572,9 @@ void mbedtls_ssl_session_free(mbedtls_ssl_session *session)
 #endif

    mbedtls_platform_zeroize(session, sizeof(mbedtls_ssl_session));
+
+    /* Set verify_result to -1u to indicate 'result not available'. */
+    session->verify_result = 0xFFFFFFFF;
 }

 #if defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION)
@@ -5271,17 +5276,17 @@ static const uint16_t ssl_preset_default_sig_algs[] = {
    MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA256,
 #endif

-#if defined(MBEDTLS_RSA_C) && defined(PSA_WANT_ALG_SHA_512)
+#if defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC) && defined(PSA_WANT_ALG_SHA_512)
    MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA512,
-#endif /* MBEDTLS_RSA_C && PSA_WANT_ALG_SHA_512 */
+#endif /* PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC && PSA_WANT_ALG_SHA_512 */

-#if defined(MBEDTLS_RSA_C) && defined(PSA_WANT_ALG_SHA_384)
+#if defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC) && defined(PSA_WANT_ALG_SHA_384)
    MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA384,
-#endif /* MBEDTLS_RSA_C && PSA_WANT_ALG_SHA_384 */
+#endif /* PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC && PSA_WANT_ALG_SHA_384 */

-#if defined(MBEDTLS_RSA_C) && defined(PSA_WANT_ALG_SHA_256)
+#if defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC) && defined(PSA_WANT_ALG_SHA_256)
    MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA256,
-#endif /* MBEDTLS_RSA_C && PSA_WANT_ALG_SHA_256 */
+#endif /* PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC && PSA_WANT_ALG_SHA_256 */

    MBEDTLS_TLS_SIG_NONE
 };
@@ -5297,7 +5302,7 @@ static const uint16_t ssl_tls12_preset_default_sig_algs[] = {
 #if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT)
    MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA512,
 #endif
-#if defined(MBEDTLS_RSA_C)
+#if defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC)
    MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG(MBEDTLS_SSL_SIG_RSA, MBEDTLS_SSL_HASH_SHA512),
 #endif
 #endif /* PSA_WANT_ALG_SHA_512 */
@@ -5309,7 +5314,7 @@ static const uint16_t ssl_tls12_preset_default_sig_algs[] = {
 #if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT)
    MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA384,
 #endif
-#if defined(MBEDTLS_RSA_C)
+#if defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC)
    MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG(MBEDTLS_SSL_SIG_RSA, MBEDTLS_SSL_HASH_SHA384),
 #endif
 #endif /* PSA_WANT_ALG_SHA_384 */
@@ -5321,7 +5326,7 @@ static const uint16_t ssl_tls12_preset_default_sig_algs[] = {
 #if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT)
    MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA256,
 #endif
-#if defined(MBEDTLS_RSA_C)
+#if defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC)
    MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG(MBEDTLS_SSL_SIG_RSA, MBEDTLS_SSL_HASH_SHA256),
 #endif
 #endif /* PSA_WANT_ALG_SHA_256 */
@@ -5615,7 +5620,8 @@ void mbedtls_ssl_config_free(mbedtls_ssl_config *conf)
 }

 #if defined(MBEDTLS_PK_C) && \
-    (defined(MBEDTLS_RSA_C) || defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ANY_ALLOWED_ENABLED))
+    (defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC) || \
+    defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ANY_ALLOWED_ENABLED))
 /*
 * Convert between MBEDTLS_PK_XXX and SSL_SIG_XXX
 */
@@ -5623,7 +5629,7 @@ unsigned char mbedtls_ssl_sig_from_pk(mbedtls_pk_context *pk)
 {
    psa_key_type_t key_type = mbedtls_pk_get_key_type(pk);

-#if defined(MBEDTLS_RSA_C)
+#if defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC)
    if (PSA_KEY_TYPE_IS_RSA(key_type)) {
        return MBEDTLS_SSL_SIG_RSA;
    }
@@ -5651,7 +5657,7 @@ unsigned char mbedtls_ssl_sig_from_pk_alg(mbedtls_pk_sigalg_t type)
 mbedtls_pk_sigalg_t mbedtls_ssl_pk_sig_alg_from_sig(unsigned char sig)
 {
    switch (sig) {
-#if defined(MBEDTLS_RSA_C)
+#if defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC)
        case MBEDTLS_SSL_SIG_RSA:
            return MBEDTLS_PK_SIGALG_RSA_PKCS1V15;
 #endif
@@ -5664,7 +5670,7 @@ mbedtls_pk_sigalg_t mbedtls_ssl_pk_sig_alg_from_sig(unsigned char sig)
    }
 }
 #endif /* MBEDTLS_PK_C &&
-          ( MBEDTLS_RSA_C || MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ANY_ALLOWED_ENABLED ) */
+          ( PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC || MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ANY_ALLOWED_ENABLED ) */

 /*
 * Convert from MBEDTLS_SSL_HASH_XXX to MBEDTLS_MD_XXX
@@ -6976,6 +6982,7 @@ static int ssl_parse_certificate_coordinate(mbedtls_ssl_context *ssl,
        ssl->handshake->ciphersuite_info;

    if (!mbedtls_ssl_ciphersuite_uses_srv_cert(ciphersuite_info)) {
+        ssl->session_negotiate->verify_result = MBEDTLS_X509_BADCERT_SKIP_VERIFY;
        return SSL_CERTIFICATE_SKIP;
    }

@@ -8691,6 +8698,7 @@ int mbedtls_ssl_verify_certificate(mbedtls_ssl_context *ssl,
                                   void *rs_ctx)
 {
    if (authmode == MBEDTLS_SSL_VERIFY_NONE) {
+        ssl->session_negotiate->verify_result = MBEDTLS_X509_BADCERT_SKIP_VERIFY;
        return 0;
    }

@@ -1332,7 +1332,7 @@ static int ssl_parse_client_hello(mbedtls_ssl_context *ssl)
            MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG(MBEDTLS_SSL_SIG_ECDSA,
                                               MBEDTLS_SSL_HASH_SHA1),
 #endif
-#if defined(MBEDTLS_RSA_C)
+#if defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC)
            MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG(MBEDTLS_SSL_SIG_RSA,
                                               MBEDTLS_SSL_HASH_SHA1),
 #endif
@@ -2279,7 +2279,7 @@ static int ssl_write_certificate_request(mbedtls_ssl_context *ssl)
     */
    ct_len = 0;

-#if defined(MBEDTLS_RSA_C)
+#if defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC)
    p[1 + ct_len++] = MBEDTLS_SSL_CERT_TYPE_RSA_SIGN;
 #endif
 #if defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ALLOWED_ENABLED)
@@ -2264,6 +2264,9 @@ static int ssl_tls13_process_encrypted_extensions(mbedtls_ssl_context *ssl)
 #if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED)
    if (mbedtls_ssl_tls13_key_exchange_mode_with_psk(ssl)) {
        mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_SERVER_FINISHED);
+
+        /* Since we're not using a certificate, set verify_result to skipped */
+        ssl->session_negotiate->verify_result = MBEDTLS_X509_BADCERT_SKIP_VERIFY;
    } else {
        mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_CERTIFICATE_REQUEST);
    }
@@ -2624,6 +2624,9 @@ static int ssl_tls13_write_encrypted_extensions(mbedtls_ssl_context *ssl)
 #if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED)
    if (mbedtls_ssl_tls13_key_exchange_mode_with_psk(ssl)) {
        mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_SERVER_FINISHED);
+
+        /* Since we're not using a certificate, set verify_result to skipped */
+        ssl->session_negotiate->verify_result = MBEDTLS_X509_BADCERT_SKIP_VERIFY;
    } else {
        mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_CERTIFICATE_REQUEST);
    }
@@ -118,7 +118,7 @@ const mbedtls_x509_crt_profile mbedtls_x509_crt_profile_next =
    MBEDTLS_X509_ID_FLAG(MBEDTLS_MD_SHA384) |
    MBEDTLS_X509_ID_FLAG(MBEDTLS_MD_SHA512),
    0xFFFFFFF, /* Any PK alg    */
-#if defined(MBEDTLS_ECP_C)
+#if defined(PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY)
    /* Curves at or above 128-bit security level. */
    MBEDTLS_X509_ID_FLAG(MBEDTLS_ECP_DP_SECP256R1) |
    MBEDTLS_X509_ID_FLAG(MBEDTLS_ECP_DP_SECP384R1) |
@@ -210,7 +210,7 @@ static int x509_profile_check_key(const mbedtls_x509_crt_profile *profile,
 {
    const mbedtls_pk_type_t pk_alg = mbedtls_pk_get_type(pk);

-#if defined(MBEDTLS_RSA_C)
+#if defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC)
    if (pk_alg == MBEDTLS_PK_RSA || pk_alg == MBEDTLS_PK_RSASSA_PSS) {
        if (mbedtls_pk_get_bitlen(pk) >= profile->rsa_min_bitlen) {
            return 0;
@@ -218,7 +218,7 @@ static int x509_profile_check_key(const mbedtls_x509_crt_profile *profile,

        return -1;
    }
-#endif /* MBEDTLS_RSA_C */
+#endif /* PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC */

 #if defined(PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY)
    if (pk_alg == MBEDTLS_PK_ECDSA ||
@@ -386,7 +386,7 @@ typedef struct {

 static const oid_sig_alg_t oid_sig_alg[] =
 {
-#if defined(MBEDTLS_RSA_C)
+#if defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC)
 #if defined(PSA_WANT_ALG_MD5)
    {
        OID_DESCRIPTOR(MBEDTLS_OID_PKCS1_MD5,        "md5WithRSAEncryption",     "RSA with MD5"),
@@ -433,7 +433,7 @@ static const oid_sig_alg_t oid_sig_alg[] =
        MBEDTLS_MD_SHA1,     MBEDTLS_PK_SIGALG_RSA_PKCS1V15,
    },
 #endif /* PSA_WANT_ALG_SHA_1 */
-#endif /* MBEDTLS_RSA_C */
+#endif /* PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC */
 #if defined(PSA_HAVE_ALG_SOME_ECDSA)
 #if defined(PSA_WANT_ALG_SHA_1)
    {
@@ -466,12 +466,12 @@ static const oid_sig_alg_t oid_sig_alg[] =
    },
 #endif /* PSA_WANT_ALG_SHA_512 */
 #endif /* PSA_HAVE_ALG_SOME_ECDSA */
-#if defined(MBEDTLS_RSA_C)
+#if defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC)
    {
        OID_DESCRIPTOR(MBEDTLS_OID_RSASSA_PSS,        "RSASSA-PSS",           "RSASSA-PSS"),
        MBEDTLS_MD_NONE,     MBEDTLS_PK_SIGALG_RSA_PSS,
    },
-#endif /* MBEDTLS_RSA_C */
+#endif /* PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC */
    {
        NULL_OID_DESCRIPTOR,
        MBEDTLS_MD_NONE, MBEDTLS_PK_SIGALG_NONE,
@@ -8,9 +8,6 @@ else
 DLOPEN_LDFLAGS ?=
 endif

-ifdef RECORD_PSA_STATUS_COVERAGE_LOG
-LOCAL_CFLAGS += -Werror -DRECORD_PSA_STATUS_COVERAGE_LOG
-endif
 DEP=${MBEDLIBS} ${MBEDTLS_TEST_OBJS}

 # Only build the dlopen test in shared library builds, and not when building
@@ -1,6 +1,7 @@
 # Python package requirements for Mbed TLS testing.

 -r driver.requirements.txt
+-r ../framework/scripts/ci.requirements.txt

 # The dependencies below are only used in scripts that we run on the Linux CI.

@@ -17,12 +18,8 @@ pylint == 2.4.4; platform_system == 'Linux'
 # mypy 0.942 is the version in Ubuntu 22.04.
 mypy == 0.942; platform_system == 'Linux'

-# At the time of writing, only needed for tests/scripts/audit-validity-dates.py.
-# It needs >=35.0.0 for correct operation, and that requires Python >=3.6.
-# >=35.0.0 also requires Rust to build from source, which we are forced to do on
-# FreeBSD, since PyPI doesn't carry binary wheels for the BSDs.
-cryptography >= 35.0.0; platform_system == 'Linux'
-
-# For building `framework/data_files/server9-bad-saltlen.crt` and check python
-# files.
-asn1crypto; platform_system == 'Linux'
+# More requirements for scripts in the framework that might not work in
+# older versions of Python. Note that requirements that are not available
+# in the oldest version of Python on our CI must be annodated with
+# "python >= ...".
+-r ../framework/util/requirements.txt
@@ -1,237 +0,0 @@
-#!/usr/bin/env python3
-"""
-Purpose
-
-This script dumps comb table of ec curve. When you add a new ec curve, you
-can use this script to generate codes to define `<curve>_T` in ecp_curves.c
-"""
-
-# Copyright The Mbed TLS Contributors
-# SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
-
-import os
-import subprocess
-import sys
-import tempfile
-
-HOW_TO_ADD_NEW_CURVE = """
-If you are trying to add new curve, you can follow these steps:
-
-1. Define curve parameters (<curve>_p, <curve>_gx, etc...) in ecp_curves.c.
-2. Add a macro to define <curve>_T to NULL following these parameters.
-3. Build mbedcrypto
-4. Run this script with an argument of new curve
-5. Copy the output of this script into ecp_curves.c and replace the macro added
-   in Step 2
-6. Rebuild and test if everything is ok
-
-Replace the <curve> in the above with the name of the curve you want to add."""
-
-CC = os.getenv('CC', 'cc')
-MBEDTLS_LIBRARY_PATH = os.getenv('MBEDTLS_LIBRARY_PATH', "library")
-
-SRC_DUMP_COMB_TABLE = r'''
-#include <stdio.h>
-#include <stdlib.h>
-#include "mbedtls/ecp.h"
-#include "mbedtls/error.h"
-
-static void dump_mpi_initialize( const char *name, const mbedtls_mpi *d )
-{
-    uint8_t buf[128] = {0};
-    size_t olen;
-    uint8_t *p;
-
-    olen = mbedtls_mpi_size( d );
-    mbedtls_mpi_write_binary_le( d, buf, olen );
-    printf("static const mbedtls_mpi_uint %s[] = {\n", name);
-    for (p = buf; p < buf + olen; p += 8) {
-        printf( "    BYTES_TO_T_UINT_8( 0x%02X, 0x%02X, 0x%02X, 0x%02X, 0x%02X, 0x%02X, 0x%02X, 0x%02X ),\n",
-                p[0], p[1], p[2], p[3], p[4], p[5], p[6], p[7] );
-    }
-    printf("};\n");
-}
-
-static void dump_T( const mbedtls_ecp_group *grp )
-{
-    char name[128];
-
-    printf( "#if MBEDTLS_ECP_FIXED_POINT_OPTIM == 1\n" );
-
-    for (size_t i = 0; i < grp->T_size; ++i) {
-        snprintf( name, sizeof(name), "%s_T_%zu_X", CURVE_NAME, i );
-        dump_mpi_initialize( name, &grp->T[i].X );
-
-        snprintf( name, sizeof(name), "%s_T_%zu_Y", CURVE_NAME, i );
-        dump_mpi_initialize( name, &grp->T[i].Y );
-    }
-    printf( "static const mbedtls_ecp_point %s_T[%zu] = {\n", CURVE_NAME, grp->T_size );
-    size_t olen;
-    for (size_t i = 0; i < grp->T_size; ++i) {
-        int z;
-        if ( mbedtls_mpi_cmp_int(&grp->T[i].Z, 0) == 0 ) {
-            z = 0;
-        } else if ( mbedtls_mpi_cmp_int(&grp->T[i].Z, 1) == 0 ) {
-            z = 1;
-        } else {
-            fprintf( stderr, "Unexpected value of Z (i = %d)\n", (int)i );
-            exit( 1 );
-        }
-        printf( "    ECP_POINT_INIT_XY_Z%d(%s_T_%zu_X, %s_T_%zu_Y),\n",
-                z,
-                CURVE_NAME, i,
-                CURVE_NAME, i
-        );
-    }
-    printf("};\n#endif\n\n");
-}
-
-int main()
-{
-    int rc;
-    mbedtls_mpi m;
-    mbedtls_ecp_point R;
-    mbedtls_ecp_group grp;
-
-    mbedtls_ecp_group_init( &grp );
-    rc = mbedtls_ecp_group_load( &grp, CURVE_ID );
-    if (rc != 0) {
-        char buf[100];
-        mbedtls_strerror( rc, buf, sizeof(buf) );
-        fprintf( stderr, "mbedtls_ecp_group_load: %s (-0x%x)\n", buf, -rc );
-        return 1;
-    }
-    grp.T = NULL;
-    mbedtls_ecp_point_init( &R );
-    mbedtls_mpi_init( &m);
-    mbedtls_mpi_lset( &m, 1 );
-    rc = mbedtls_ecp_mul( &grp, &R, &m, &grp.G, NULL, NULL );
-    if ( rc != 0 ) {
-        char buf[100];
-        mbedtls_strerror( rc, buf, sizeof(buf) );
-        fprintf( stderr, "mbedtls_ecp_mul: %s (-0x%x)\n", buf, -rc );
-        return 1;
-    }
-    if ( grp.T == NULL ) {
-        fprintf( stderr, "grp.T is not generated. Please make sure"
-                         "MBEDTLS_ECP_FIXED_POINT_OPTIM is enabled in mbedtls_config.h\n" );
-        return 1;
-    }
-    dump_T( &grp );
-    return 0;
-}
-'''
-
-SRC_DUMP_KNOWN_CURVE = r'''
-#include <stdio.h>
-#include <stdlib.h>
-#include "mbedtls/ecp.h"
-
-int main() {
-    const mbedtls_ecp_curve_info *info = mbedtls_ecp_curve_list();
-    mbedtls_ecp_group grp;
-
-    mbedtls_ecp_group_init( &grp );
-    while ( info->name != NULL ) {
-        mbedtls_ecp_group_load( &grp, info->grp_id );
-        if ( mbedtls_ecp_get_type(&grp) == MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS ) {
-            printf( " %s", info->name );
-        }
-        info++;
-    }
-    printf( "\n" );
-    return 0;
-}
-'''
-
-
-def join_src_path(*args):
-    return os.path.normpath(os.path.join(os.path.dirname(__file__), "..", *args))
-
-
-def run_c_source(src, cflags):
-    """
-    Compile and run C source code
-    :param src: the c language code to run
-    :param cflags: additional cflags passing to compiler
-    :return:
-    """
-    binname = tempfile.mktemp(prefix="mbedtls")
-    fd, srcname = tempfile.mkstemp(prefix="mbedtls", suffix=".c")
-    srcfile = os.fdopen(fd, mode="w")
-    srcfile.write(src)
-    srcfile.close()
-    args = [CC,
-            *cflags,
-            '-I' + join_src_path("include"),
-            "-o", binname,
-            '-L' + MBEDTLS_LIBRARY_PATH,
-            srcname,
-            '-lmbedcrypto']
-
-    p = subprocess.run(args=args, check=False)
-    if p.returncode != 0:
-        return False
-    p = subprocess.run(args=[binname], check=False, env={
-        'LD_LIBRARY_PATH': MBEDTLS_LIBRARY_PATH
-    })
-    if p.returncode != 0:
-        return False
-    os.unlink(srcname)
-    os.unlink(binname)
-    return True
-
-
-def compute_curve(curve):
-    """compute comb table for curve"""
-    r = run_c_source(
-        SRC_DUMP_COMB_TABLE,
-        [
-            '-g',
-            '-DCURVE_ID=MBEDTLS_ECP_DP_%s' % curve.upper(),
-            '-DCURVE_NAME="%s"' % curve.lower(),
-        ])
-    if not r:
-        print("""\
-Unable to compile and run utility.""", file=sys.stderr)
-        sys.exit(1)
-
-
-def usage():
-    print("""
-Usage: python %s <curve>...
-
-Arguments:
-    curve       Specify one or more curve names (e.g secp256r1)
-
-All possible curves: """ % sys.argv[0])
-    run_c_source(SRC_DUMP_KNOWN_CURVE, [])
-    print("""
-Environment Variable:
-    CC          Specify which c compile to use to compile utility.
-    MBEDTLS_LIBRARY_PATH
-                Specify the path to mbedcrypto library. (e.g. build/library/)
-
-How to add a new curve: %s""" % HOW_TO_ADD_NEW_CURVE)
-
-
-def run_main():
-    shared_lib_path = os.path.normpath(os.path.join(MBEDTLS_LIBRARY_PATH, "libmbedcrypto.so"))
-    static_lib_path = os.path.normpath(os.path.join(MBEDTLS_LIBRARY_PATH, "libmbedcrypto.a"))
-    if not os.path.exists(shared_lib_path) and not os.path.exists(static_lib_path):
-        print("Warning: both '%s' and '%s' are not exists. This script will use "
-              "the library from your system instead of the library compiled by "
-              "this source directory.\n"
-              "You can specify library path using environment variable "
-              "'MBEDTLS_LIBRARY_PATH'." % (shared_lib_path, static_lib_path),
-              file=sys.stderr)
-
-    if len(sys.argv) <= 1:
-        usage()
-    else:
-        for curve in sys.argv[1:]:
-            compute_curve(curve)
-
-
-if __name__ == '__main__':
-    run_main()
@@ -1,36 +0,0 @@
-#!/usr/bin/env perl
-
-# Parse a massif.out.xxx file and output peak total memory usage
-#
-# Copyright The Mbed TLS Contributors
-# SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
-
-use warnings;
-use strict;
-
-use utf8;
-use open qw(:std utf8);
-
-die unless @ARGV == 1;
-
-my @snaps;
-open my $fh, '<', $ARGV[0] or die;
-{ local $/ = 'snapshot='; @snaps = <$fh>; }
-close $fh or die;
-
-my ($max, $max_heap, $max_he, $max_stack) = (0, 0, 0, 0);
-for (@snaps)
-{
-    my ($heap, $heap_extra, $stack) = m{
-        mem_heap_B=(\d+)\n
-        mem_heap_extra_B=(\d+)\n
-        mem_stacks_B=(\d+)
-    }xm;
-    next unless defined $heap;
-    my $total = $heap + $heap_extra + $stack;
-    if( $total > $max ) {
-        ($max, $max_heap, $max_he, $max_stack) = ($total, $heap, $heap_extra, $stack);
-    }
-}
-
-printf "$max (heap $max_heap+$max_he, stack $max_stack)\n";
@@ -90,7 +90,7 @@ do_config()
    kill $SRV_PID
    wait $SRV_PID

-    scripts/massif_max.pl massif.out.*
+    framework/scripts/massif_max.pl massif.out.*
    mv massif.out.* massif-$NAME.$$
 }

@@ -19,10 +19,6 @@ LOCAL_CFLAGS += $(TF_PSA_CRYPTO_LIBRARY_PRIVATE_INCLUDE)
 # on non-POSIX platforms.
 LOCAL_CFLAGS += -D_POSIX_C_SOURCE=200809L

-ifdef RECORD_PSA_STATUS_COVERAGE_LOG
-LOCAL_CFLAGS += -Werror -DRECORD_PSA_STATUS_COVERAGE_LOG
-endif
-
 GENERATED_MBEDTLS_CONFIG_DATA_FILES := $(patsubst tests/%,%,$(shell \
 	$(PYTHON) ../framework/scripts/generate_config_tests.py --list || \
 	echo FAILED \
@@ -110,12 +106,6 @@ include/test/test_keys.h: ../framework/scripts/generate_test_keys.py
 	$(PYTHON) ../framework/scripts/generate_test_keys.py --output $@

 TEST_OBJS_DEPS = $(wildcard include/test/*.h include/test/*/*.h)
-ifdef RECORD_PSA_STATUS_COVERAGE_LOG
-# Explicitly depend on this header because on a clean copy of the source tree,
-# it doesn't exist yet and must be generated as part of the build, and
-# therefore the wildcard enumeration above doesn't include it.
-TEST_OBJS_DEPS += ../framework/tests/include/test/instrument_record_status.h
-endif
 TEST_OBJS_DEPS += include/test/test_certs.h include/test/test_keys.h \
                  ../tf-psa-crypto/tests/include/test/test_keys.h

@@ -311,9 +301,3 @@ libtestdriver1.a:
 	fi
 	$(MAKE) -C ./libtestdriver1/library CFLAGS="-I../../ $(CFLAGS)" LDFLAGS="$(LDFLAGS)" libmbedcrypto.a
 	cp ./libtestdriver1/library/libmbedcrypto.a ../library/libtestdriver1.a
-
-ifdef RECORD_PSA_STATUS_COVERAGE_LOG
-../framework/tests/include/test/instrument_record_status.h: ../tf-psa-crypto/include/psa/crypto.h Makefile
-	echo "  Gen  $@"
-	sed <../tf-psa-crypto/include/psa/crypto.h >$@ -n 's/^psa_status_t \([A-Za-z0-9_]*\)(.*/#define \1(...) RECORD_STATUS("\1", \1(__VA_ARGS__))/p'
-endif
@@ -482,7 +482,8 @@ run_test    "TLS 1.3: G->m: ephemeral_all/ephemeral_all, good" \
            -S "No usable PSK or ticket" \
            -S "key exchange mode: psk$"  \
            -s "key exchange mode: psk_ephemeral"  \
-            -S "key exchange mode: ephemeral"
+            -S "key exchange mode: ephemeral" \
+            -s "! Certificate verification was skipped"

 requires_gnutls_tls1_3
 requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
@@ -503,7 +504,8 @@ run_test    "TLS 1.3: G->m: ephemeral_all/ephemeral_all, good, key id mismatch,
            -s "No usable PSK or ticket" \
            -S "key exchange mode: psk$"  \
            -S "key exchange mode: psk_ephemeral"  \
-            -s "key exchange mode: ephemeral"
+            -s "key exchange mode: ephemeral" \
+            -s "! Certificate verification was skipped"

 requires_gnutls_tls1_3
 requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
@@ -546,7 +548,8 @@ run_test    "TLS 1.3: G->m: all/ephemeral_all, good" \
            -S "No usable PSK or ticket" \
            -S "key exchange mode: psk$"  \
            -s "key exchange mode: psk_ephemeral"  \
-            -S "key exchange mode: ephemeral"
+            -S "key exchange mode: ephemeral" \
+            -s "! Certificate verification was skipped"

 requires_gnutls_tls1_3
 requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
@@ -567,7 +570,8 @@ run_test    "TLS 1.3: G->m: all/ephemeral_all, good, key id mismatch, dhe." \
            -s "No usable PSK or ticket" \
            -S "key exchange mode: psk$"  \
            -S "key exchange mode: psk_ephemeral"  \
-            -s "key exchange mode: ephemeral"
+            -s "key exchange mode: ephemeral" \
+            -s "! Certificate verification was skipped"

 requires_gnutls_tls1_3
 requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
@@ -611,7 +615,8 @@ run_test    "TLS 1.3: G->m: psk_or_ephemeral/ephemeral_all, good" \
            -s "No usable PSK or ticket" \
            -S "key exchange mode: psk$"  \
            -S "key exchange mode: psk_ephemeral"  \
-            -s "key exchange mode: ephemeral"
+            -s "key exchange mode: ephemeral" \
+            -s "! Certificate verification was skipped"

 requires_gnutls_tls1_3
 requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
@@ -634,7 +639,8 @@ run_test    "TLS 1.3: G->m: ephemeral_all/all, good" \
            -S "No usable PSK or ticket" \
            -S "key exchange mode: psk$"  \
            -s "key exchange mode: psk_ephemeral"  \
-            -S "key exchange mode: ephemeral"
+            -S "key exchange mode: ephemeral" \
+            -s "! Certificate verification was skipped"

 requires_gnutls_tls1_3
 requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
@@ -656,7 +662,8 @@ run_test    "TLS 1.3: G->m: ephemeral_all/all, good, key id mismatch, dhe." \
            -s "No usable PSK or ticket" \
            -S "key exchange mode: psk$"  \
            -S "key exchange mode: psk_ephemeral"  \
-            -s "key exchange mode: ephemeral"
+            -s "key exchange mode: ephemeral" \
+            -s "! Certificate verification was skipped"

 requires_gnutls_tls1_3
 requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
@@ -701,7 +708,8 @@ run_test    "TLS 1.3: G->m: all/all, good" \
            -S "No usable PSK or ticket" \
            -S "key exchange mode: psk$"  \
            -s "key exchange mode: psk_ephemeral"  \
-            -S "key exchange mode: ephemeral"
+            -S "key exchange mode: ephemeral" \
+            -s "! Certificate verification was skipped"

 requires_gnutls_tls1_3
 requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
@@ -723,7 +731,8 @@ run_test    "TLS 1.3: G->m: all/all, good, key id mismatch, dhe." \
            -s "No usable PSK or ticket" \
            -S "key exchange mode: psk$"  \
            -S "key exchange mode: psk_ephemeral"  \
-            -s "key exchange mode: ephemeral"
+            -s "key exchange mode: ephemeral" \
+            -s "! Certificate verification was skipped"

 requires_gnutls_tls1_3
 requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
@@ -768,7 +777,8 @@ run_test    "TLS 1.3: G->m: psk_or_ephemeral/all, good" \
            -S "No usable PSK or ticket" \
            -S "key exchange mode: psk$"  \
            -S "key exchange mode: psk_ephemeral"  \
-            -s "key exchange mode: ephemeral"
+            -s "key exchange mode: ephemeral" \
+            -s "! Certificate verification was skipped"

 requires_gnutls_tls1_3
 requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
@@ -813,7 +823,8 @@ run_test    "TLS 1.3: G->m: ephemeral_all/psk_or_ephemeral, good" \
            -s "No usable PSK or ticket" \
            -S "key exchange mode: psk$"  \
            -S "key exchange mode: psk_ephemeral"  \
-            -s "key exchange mode: ephemeral"
+            -s "key exchange mode: ephemeral" \
+            -s "! Certificate verification was skipped"

 requires_gnutls_tls1_3
 requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
@@ -835,7 +846,8 @@ run_test    "TLS 1.3: G->m: all/psk_or_ephemeral, good" \
            -S "No usable PSK or ticket" \
            -S "key exchange mode: psk$"  \
            -S "key exchange mode: psk_ephemeral"  \
-            -s "key exchange mode: ephemeral"
+            -s "key exchange mode: ephemeral" \
+            -s "! Certificate verification was skipped"

 requires_gnutls_tls1_3
 requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
@@ -878,7 +890,8 @@ run_test    "TLS 1.3: G->m: psk_or_ephemeral/psk_or_ephemeral, good" \
            -S "No usable PSK or ticket" \
            -S "key exchange mode: psk$"  \
            -S "key exchange mode: psk_ephemeral"  \
-            -s "key exchange mode: ephemeral"
+            -s "key exchange mode: ephemeral" \
+            -s "! Certificate verification was skipped"

 requires_gnutls_tls1_3
 requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
@@ -1319,7 +1332,8 @@ run_test    "TLS 1.3: O->m: ephemeral_all/ephemeral_all, good" \
            -S "No usable PSK or ticket" \
            -S "key exchange mode: psk$"  \
            -s "key exchange mode: psk_ephemeral"  \
-            -S "key exchange mode: ephemeral"
+            -S "key exchange mode: ephemeral" \
+            -s "! Certificate verification was skipped"

 requires_openssl_tls1_3_with_compatible_ephemeral
 requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
@@ -1339,7 +1353,8 @@ run_test    "TLS 1.3: O->m: ephemeral_all/ephemeral_all, good, key id mismatch,
            -s "No usable PSK or ticket" \
            -S "key exchange mode: psk$"  \
            -S "key exchange mode: psk_ephemeral"  \
-            -s "key exchange mode: ephemeral"
+            -s "key exchange mode: ephemeral" \
+            -s "! Certificate verification was skipped"

 requires_openssl_tls1_3_with_compatible_ephemeral
 requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
@@ -1380,7 +1395,8 @@ run_test    "TLS 1.3: O->m: all/ephemeral_all, good" \
            -S "No usable PSK or ticket" \
            -S "key exchange mode: psk$"  \
            -s "key exchange mode: psk_ephemeral"  \
-            -S "key exchange mode: ephemeral"
+            -S "key exchange mode: ephemeral" \
+            -s "! Certificate verification was skipped"

 requires_openssl_tls1_3_with_compatible_ephemeral
 requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
@@ -1400,7 +1416,8 @@ run_test    "TLS 1.3: O->m: all/ephemeral_all, good, key id mismatch, dhe." \
            -s "No usable PSK or ticket" \
            -S "key exchange mode: psk$"  \
            -S "key exchange mode: psk_ephemeral"  \
-            -s "key exchange mode: ephemeral"
+            -s "key exchange mode: ephemeral" \
+            -s "! Certificate verification was skipped"

 requires_openssl_tls1_3_with_compatible_ephemeral
 requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
@@ -1442,7 +1459,8 @@ run_test    "TLS 1.3: O->m: ephemeral_all/all, good" \
            -S "No usable PSK or ticket" \
            -S "key exchange mode: psk$"  \
            -s "key exchange mode: psk_ephemeral"  \
-            -S "key exchange mode: ephemeral"
+            -S "key exchange mode: ephemeral" \
+            -s "! Certificate verification was skipped"

 requires_openssl_tls1_3_with_compatible_ephemeral
 requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
@@ -1463,7 +1481,8 @@ run_test    "TLS 1.3: O->m: ephemeral_all/all, good, key id mismatch, dhe." \
            -s "No usable PSK or ticket" \
            -S "key exchange mode: psk$"  \
            -S "key exchange mode: psk_ephemeral"  \
-            -s "key exchange mode: ephemeral"
+            -s "key exchange mode: ephemeral" \
+            -s "! Certificate verification was skipped"

 requires_openssl_tls1_3_with_compatible_ephemeral
 requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
@@ -1506,7 +1525,8 @@ run_test    "TLS 1.3: O->m: all/all, good" \
            -S "No usable PSK or ticket" \
            -S "key exchange mode: psk$"  \
            -s "key exchange mode: psk_ephemeral"  \
-            -S "key exchange mode: ephemeral"
+            -S "key exchange mode: ephemeral" \
+            -s "! Certificate verification was skipped"

 requires_openssl_tls1_3_with_compatible_ephemeral
 requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
@@ -1527,7 +1547,8 @@ run_test    "TLS 1.3: O->m: all/all, good, key id mismatch, dhe." \
            -s "No usable PSK or ticket" \
            -S "key exchange mode: psk$"  \
            -S "key exchange mode: psk_ephemeral"  \
-            -s "key exchange mode: ephemeral"
+            -s "key exchange mode: ephemeral" \
+            -s "! Certificate verification was skipped"

 requires_openssl_tls1_3_with_compatible_ephemeral
 requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
@@ -1570,7 +1591,8 @@ run_test    "TLS 1.3: O->m: ephemeral_all/psk_or_ephemeral, good" \
            -s "No usable PSK or ticket" \
            -S "key exchange mode: psk$"  \
            -S "key exchange mode: psk_ephemeral"  \
-            -s "key exchange mode: ephemeral"
+            -s "key exchange mode: ephemeral" \
+            -s "! Certificate verification was skipped"

 requires_openssl_tls1_3_with_compatible_ephemeral
 requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
@@ -1591,7 +1613,8 @@ run_test    "TLS 1.3: O->m: all/psk_or_ephemeral, good" \
            -S "No usable PSK or ticket" \
            -S "key exchange mode: psk$"  \
            -S "key exchange mode: psk_ephemeral"  \
-            -s "key exchange mode: ephemeral"
+            -s "key exchange mode: ephemeral" \
+            -s "! Certificate verification was skipped"

 requires_openssl_tls1_3_with_compatible_ephemeral
 requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
@@ -1880,7 +1903,9 @@ run_test    "TLS 1.3: m->m: psk/all, good" \
            -c "client hello, adding psk_key_exchange_modes extension" \
            -c "client hello, adding PSK binder list" \
            -c "Selected key exchange mode: psk$" \
-            -c "HTTP/1.0 200 OK"
+            -c "HTTP/1.0 200 OK" \
+            -c "! Certificate verification was skipped" \
+            -s "! Certificate verification was skipped"

 requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
 requires_config_enabled MBEDTLS_SSL_SRV_C
@@ -1995,7 +2020,9 @@ run_test    "TLS 1.3: m->m: psk_ephemeral/ephemeral_all, good" \
            -c "client hello, adding psk_key_exchange_modes extension" \
            -c "client hello, adding PSK binder list" \
            -c "Selected key exchange mode: psk_ephemeral" \
-            -c "HTTP/1.0 200 OK"
+            -c "HTTP/1.0 200 OK" \
+            -c "! Certificate verification was skipped" \
+            -s "! Certificate verification was skipped"

 requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
 requires_config_enabled MBEDTLS_SSL_SRV_C
@@ -2083,7 +2110,9 @@ run_test    "TLS 1.3: m->m: psk_ephemeral/all, good" \
            -c "client hello, adding psk_key_exchange_modes extension" \
            -c "client hello, adding PSK binder list" \
            -c "Selected key exchange mode: psk_ephemeral" \
-            -c "HTTP/1.0 200 OK"
+            -c "HTTP/1.0 200 OK" \
+            -c "! Certificate verification was skipped" \
+            -s "! Certificate verification was skipped"

 requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
 requires_config_enabled MBEDTLS_SSL_SRV_C
@@ -2215,7 +2244,9 @@ run_test    "TLS 1.3: m->m: ephemeral_all/psk_ephemeral, good" \
            -c "client hello, adding psk_key_exchange_modes extension" \
            -c "client hello, adding PSK binder list" \
            -c "Selected key exchange mode: psk_ephemeral" \
-            -c "HTTP/1.0 200 OK"
+            -c "HTTP/1.0 200 OK" \
+            -c "! Certificate verification was skipped" \
+            -s "! Certificate verification was skipped"

 requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
 requires_config_enabled MBEDTLS_SSL_SRV_C
@@ -2274,7 +2305,9 @@ run_test    "TLS 1.3: m->m: ephemeral_all/ephemeral_all, good" \
            -c "client hello, adding psk_key_exchange_modes extension" \
            -c "client hello, adding PSK binder list" \
            -c "Selected key exchange mode: psk_ephemeral" \
-            -c "HTTP/1.0 200 OK"
+            -c "HTTP/1.0 200 OK" \
+            -c "! Certificate verification was skipped" \
+            -s "! Certificate verification was skipped"

 requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
 requires_config_enabled MBEDTLS_SSL_SRV_C
@@ -2319,7 +2352,9 @@ run_test    "TLS 1.3: m->m: ephemeral_all/psk_all, good" \
            -c "client hello, adding psk_key_exchange_modes extension" \
            -c "client hello, adding PSK binder list" \
            -c "Selected key exchange mode: psk_ephemeral" \
-            -c "HTTP/1.0 200 OK"
+            -c "HTTP/1.0 200 OK" \
+            -c "! Certificate verification was skipped" \
+            -s "! Certificate verification was skipped"

 requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
 requires_config_enabled MBEDTLS_SSL_SRV_C
@@ -2366,7 +2401,9 @@ run_test    "TLS 1.3: m->m: ephemeral_all/all, good" \
            -c "client hello, adding psk_key_exchange_modes extension" \
            -c "client hello, adding PSK binder list" \
            -c "Selected key exchange mode: psk_ephemeral" \
-            -c "HTTP/1.0 200 OK"
+            -c "HTTP/1.0 200 OK" \
+            -c "! Certificate verification was skipped" \
+            -s "! Certificate verification was skipped"

 requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
 requires_config_enabled MBEDTLS_SSL_SRV_C
@@ -2515,7 +2552,9 @@ run_test    "TLS 1.3: m->m: psk_all/ephemeral_all, good" \
            -c "client hello, adding psk_key_exchange_modes extension" \
            -c "client hello, adding PSK binder list" \
            -c "Selected key exchange mode: psk_ephemeral" \
-            -c "HTTP/1.0 200 OK"
+            -c "HTTP/1.0 200 OK" \
+            -c "! Certificate verification was skipped" \
+            -s "! Certificate verification was skipped"

 requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
 requires_config_enabled MBEDTLS_SSL_SRV_C
@@ -2605,7 +2644,9 @@ run_test    "TLS 1.3: m->m: psk_all/all, good" \
            -c "client hello, adding psk_key_exchange_modes extension" \
            -c "client hello, adding PSK binder list" \
            -c "Selected key exchange mode: psk_ephemeral" \
-            -c "HTTP/1.0 200 OK"
+            -c "HTTP/1.0 200 OK" \
+            -c "! Certificate verification was skipped" \
+            -s "! Certificate verification was skipped"

 requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
 requires_config_enabled MBEDTLS_SSL_SRV_C
@@ -2652,7 +2693,9 @@ run_test    "TLS 1.3: m->m: all/psk, good" \
            -c "client hello, adding psk_key_exchange_modes extension" \
            -c "client hello, adding PSK binder list" \
            -c "Selected key exchange mode: psk$" \
-            -c "HTTP/1.0 200 OK"
+            -c "HTTP/1.0 200 OK" \
+            -c "! Certificate verification was skipped" \
+            -s "! Certificate verification was skipped"

 requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
 requires_config_enabled MBEDTLS_SSL_SRV_C
@@ -2699,7 +2742,9 @@ run_test    "TLS 1.3: m->m: all/psk_ephemeral, good" \
            -c "client hello, adding psk_key_exchange_modes extension" \
            -c "client hello, adding PSK binder list" \
            -c "Selected key exchange mode: psk_ephemeral" \
-            -c "HTTP/1.0 200 OK"
+            -c "HTTP/1.0 200 OK" \
+            -c "! Certificate verification was skipped" \
+            -s "! Certificate verification was skipped"

 requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
 requires_config_enabled MBEDTLS_SSL_SRV_C
@@ -2762,7 +2807,9 @@ run_test    "TLS 1.3: m->m: all/ephemeral_all, good" \
            -c "client hello, adding psk_key_exchange_modes extension" \
            -c "client hello, adding PSK binder list" \
            -c "Selected key exchange mode: psk_ephemeral" \
-            -c "HTTP/1.0 200 OK"
+            -c "HTTP/1.0 200 OK" \
+            -c "! Certificate verification was skipped" \
+            -s "! Certificate verification was skipped"

 requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
 requires_config_enabled MBEDTLS_SSL_SRV_C
@@ -2810,7 +2857,9 @@ run_test    "TLS 1.3: m->m: all/psk_all, good" \
            -c "client hello, adding psk_key_exchange_modes extension" \
            -c "client hello, adding PSK binder list" \
            -c "Selected key exchange mode: psk_ephemeral" \
-            -c "HTTP/1.0 200 OK"
+            -c "HTTP/1.0 200 OK" \
+            -c "! Certificate verification was skipped" \
+            -s "! Certificate verification was skipped"

 requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
 requires_config_enabled MBEDTLS_SSL_SRV_C
@@ -2857,7 +2906,9 @@ run_test    "TLS 1.3: m->m: all/all, good" \
            -c "client hello, adding psk_key_exchange_modes extension" \
            -c "client hello, adding PSK binder list" \
            -c "Selected key exchange mode: psk_ephemeral" \
-            -c "HTTP/1.0 200 OK"
+            -c "HTTP/1.0 200 OK" \
+            -c "! Certificate verification was skipped" \
+            -s "! Certificate verification was skipped"

 requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
 requires_config_enabled MBEDTLS_SSL_SRV_C
@@ -3038,7 +3089,8 @@ run_test    "TLS 1.3: m->O: ephemeral_all/all, good" \
            -c "client hello, adding PSK binder list" \
            -c "Selected key exchange mode: psk_ephemeral" \
            -c "<= write client hello" \
-            -c "HTTP/1.0 200 ok"
+            -c "HTTP/1.0 200 ok" \
+            -c "! Certificate verification was skipped"

 requires_openssl_tls1_3_with_compatible_ephemeral
 requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
@@ -3056,7 +3108,8 @@ run_test    "TLS 1.3: m->O: ephemeral_all/ephemeral_all, good" \
            -c "client hello, adding PSK binder list" \
            -c "Selected key exchange mode: psk_ephemeral" \
            -c "<= write client hello" \
-            -c "HTTP/1.0 200 ok"
+            -c "HTTP/1.0 200 ok" \
+            -c "! Certificate verification was skipped"

 #OPENSSL-SERVER all mode
 requires_openssl_tls1_3_with_compatible_ephemeral
@@ -3076,7 +3129,8 @@ run_test    "TLS 1.3: m->O: all/all, good" \
            -c "client hello, adding PSK binder list" \
            -c "Selected key exchange mode: psk_ephemeral" \
            -c "<= write client hello" \
-            -c "HTTP/1.0 200 ok"
+            -c "HTTP/1.0 200 ok" \
+            -c "! Certificate verification was skipped"

 requires_openssl_tls1_3_with_compatible_ephemeral
 requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
@@ -3095,7 +3149,8 @@ run_test    "TLS 1.3: m->O: all/ephemeral_all, good" \
            -c "client hello, adding PSK binder list" \
            -c "Selected key exchange mode: psk_ephemeral" \
            -c "<= write client hello" \
-            -c "HTTP/1.0 200 ok"
+            -c "HTTP/1.0 200 ok" \
+            -c "! Certificate verification was skipped"

 #GNUTLS-SERVER psk mode
 requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
@@ -3259,7 +3314,8 @@ run_test    "TLS 1.3: m->G: ephemeral_all/all, good" \
            -s "Parsing extension 'Pre Shared Key/41'" \
            -c "<= write client hello" \
            -c "Selected key exchange mode: psk_ephemeral" \
-            -c "HTTP/1.0 200 OK"
+            -c "HTTP/1.0 200 OK" \
+            -c "! Certificate verification was skipped"

 requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
 requires_gnutls_tls1_3
@@ -3279,7 +3335,8 @@ run_test    "TLS 1.3: m->G: ephemeral_all/ephemeral_all, good" \
            -s "Parsing extension 'Pre Shared Key/41'" \
            -c "<= write client hello" \
            -c "Selected key exchange mode: psk_ephemeral" \
-            -c "HTTP/1.0 200 OK"
+            -c "HTTP/1.0 200 OK" \
+            -c "! Certificate verification was skipped"

 #GNUTLS-SERVER all mode
 requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
@@ -3301,7 +3358,8 @@ run_test    "TLS 1.3: m->G: all/all, good" \
            -s "Parsing extension 'Pre Shared Key/41'" \
            -c "<= write client hello" \
            -c "Selected key exchange mode: psk_ephemeral" \
-            -c "HTTP/1.0 200 OK"
+            -c "HTTP/1.0 200 OK" \
+            -c "! Certificate verification was skipped"

 requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
 requires_gnutls_tls1_3
@@ -3322,4 +3380,5 @@ run_test    "TLS 1.3: m->G: all/ephemeral_all, good" \
            -s "Parsing extension 'Pre Shared Key/41'" \
            -c "<= write client hello" \
            -c "Selected key exchange mode: psk_ephemeral" \
-            -c "HTTP/1.0 200 OK"
+            -c "HTTP/1.0 200 OK" \
+            -c "! Certificate verification was skipped"
@@ -1,469 +0,0 @@
-#!/usr/bin/env python3
-#
-# Copyright The Mbed TLS Contributors
-# SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
-
-"""Audit validity date of X509 crt/crl/csr.
-
-This script is used to audit the validity date of crt/crl/csr used for testing.
-It prints the information about X.509 objects excluding the objects that
-are valid throughout the desired validity period. The data are collected
-from framework/data_files/ and tests/suites/*.data files by default.
-"""
-
-import os
-import re
-import typing
-import argparse
-import datetime
-import glob
-import logging
-import hashlib
-from enum import Enum
-
-# The script requires cryptography >= 35.0.0 which is only available
-# for Python >= 3.6.
-import cryptography
-from cryptography import x509
-
-from generate_test_code import FileWrapper
-
-import scripts_path # pylint: disable=unused-import
-from mbedtls_framework import build_tree
-from mbedtls_framework import logging_util
-
-def check_cryptography_version():
-    match = re.match(r'^[0-9]+', cryptography.__version__)
-    if match is None or int(match.group(0)) < 35:
-        raise Exception("audit-validity-dates requires cryptography >= 35.0.0"
-                        + "({} is too old)".format(cryptography.__version__))
-
-class DataType(Enum):
-    CRT = 1 # Certificate
-    CRL = 2 # Certificate Revocation List
-    CSR = 3 # Certificate Signing Request
-
-
-class DataFormat(Enum):
-    PEM = 1 # Privacy-Enhanced Mail
-    DER = 2 # Distinguished Encoding Rules
-
-
-class AuditData:
-    """Store data location, type and validity period of X.509 objects."""
-    #pylint: disable=too-few-public-methods
-    def __init__(self, data_type: DataType, x509_obj):
-        self.data_type = data_type
-        # the locations that the x509 object could be found
-        self.locations = [] # type: typing.List[str]
-        self.fill_validity_duration(x509_obj)
-        self._obj = x509_obj
-        encoding = cryptography.hazmat.primitives.serialization.Encoding.DER
-        self._identifier = hashlib.sha1(self._obj.public_bytes(encoding)).hexdigest()
-
-    @property
-    def identifier(self):
-        """
-        Identifier of the underlying X.509 object, which is consistent across
-        different runs.
-        """
-        return self._identifier
-
-    def fill_validity_duration(self, x509_obj):
-        """Read validity period from an X.509 object."""
-        # Certificate expires after "not_valid_after"
-        # Certificate is invalid before "not_valid_before"
-        if self.data_type == DataType.CRT:
-            self.not_valid_after = x509_obj.not_valid_after
-            self.not_valid_before = x509_obj.not_valid_before
-        # CertificateRevocationList expires after "next_update"
-        # CertificateRevocationList is invalid before "last_update"
-        elif self.data_type == DataType.CRL:
-            self.not_valid_after = x509_obj.next_update
-            self.not_valid_before = x509_obj.last_update
-        # CertificateSigningRequest is always valid.
-        elif self.data_type == DataType.CSR:
-            self.not_valid_after = datetime.datetime.max
-            self.not_valid_before = datetime.datetime.min
-        else:
-            raise ValueError("Unsupported file_type: {}".format(self.data_type))
-
-
-class X509Parser:
-    """A parser class to parse crt/crl/csr file or data in PEM/DER format."""
-    PEM_REGEX = br'-{5}BEGIN (?P<type>.*?)-{5}(?P<data>.*?)-{5}END (?P=type)-{5}'
-    PEM_TAG_REGEX = br'-{5}BEGIN (?P<type>.*?)-{5}\n'
-    PEM_TAGS = {
-        DataType.CRT: 'CERTIFICATE',
-        DataType.CRL: 'X509 CRL',
-        DataType.CSR: 'CERTIFICATE REQUEST'
-    }
-
-    def __init__(self,
-                 backends:
-                 typing.Dict[DataType,
-                             typing.Dict[DataFormat,
-                                         typing.Callable[[bytes], object]]]) \
-    -> None:
-        self.backends = backends
-        self.__generate_parsers()
-
-    def __generate_parser(self, data_type: DataType):
-        """Parser generator for a specific DataType"""
-        tag = self.PEM_TAGS[data_type]
-        pem_loader = self.backends[data_type][DataFormat.PEM]
-        der_loader = self.backends[data_type][DataFormat.DER]
-        def wrapper(data: bytes):
-            pem_type = X509Parser.pem_data_type(data)
-            # It is in PEM format with target tag
-            if pem_type == tag:
-                return pem_loader(data)
-            # It is in PEM format without target tag
-            if pem_type:
-                return None
-            # It might be in DER format
-            try:
-                result = der_loader(data)
-            except ValueError:
-                result = None
-            return result
-        wrapper.__name__ = "{}.parser[{}]".format(type(self).__name__, tag)
-        return wrapper
-
-    def __generate_parsers(self):
-        """Generate parsers for all support DataType"""
-        self.parsers = {}
-        for data_type, _ in self.PEM_TAGS.items():
-            self.parsers[data_type] = self.__generate_parser(data_type)
-
-    def __getitem__(self, item):
-        return self.parsers[item]
-
-    @staticmethod
-    def pem_data_type(data: bytes) -> typing.Optional[str]:
-        """Get the tag from the data in PEM format
-
-        :param data: data to be checked in binary mode.
-        :return: PEM tag or "" when no tag detected.
-        """
-        m = re.search(X509Parser.PEM_TAG_REGEX, data)
-        if m is not None:
-            return m.group('type').decode('UTF-8')
-        else:
-            return None
-
-    @staticmethod
-    def check_hex_string(hex_str: str) -> bool:
-        """Check if the hex string is possibly DER data."""
-        hex_len = len(hex_str)
-        # At least 6 hex char for 3 bytes: Type + Length + Content
-        if hex_len < 6:
-            return False
-        # Check if Type (1 byte) is SEQUENCE.
-        if hex_str[0:2] != '30':
-            return False
-        # Check LENGTH (1 byte) value
-        content_len = int(hex_str[2:4], base=16)
-        consumed = 4
-        if content_len in (128, 255):
-            # Indefinite or Reserved
-            return False
-        elif content_len > 127:
-            # Definite, Long
-            length_len = (content_len - 128) * 2
-            content_len = int(hex_str[consumed:consumed+length_len], base=16)
-            consumed += length_len
-        # Check LENGTH
-        if hex_len != content_len * 2 + consumed:
-            return False
-        return True
-
-
-class Auditor:
-    """
-    A base class that uses X509Parser to parse files to a list of AuditData.
-
-    A subclass must implement the following methods:
-      - collect_default_files: Return a list of file names that are defaultly
-        used for parsing (auditing). The list will be stored in
-        Auditor.default_files.
-      - parse_file: Method that parses a single file to a list of AuditData.
-
-    A subclass may override the following methods:
-      - parse_bytes: Defaultly, it parses `bytes` that contains only one valid
-        X.509 data(DER/PEM format) to an X.509 object.
-      - walk_all: Defaultly, it iterates over all the files in the provided
-        file name list, calls `parse_file` for each file and stores the results
-        by extending the `results` passed to the function.
-    """
-    def __init__(self, logger):
-        self.logger = logger
-        self.default_files = self.collect_default_files()
-        self.parser = X509Parser({
-            DataType.CRT: {
-                DataFormat.PEM: x509.load_pem_x509_certificate,
-                DataFormat.DER: x509.load_der_x509_certificate
-            },
-            DataType.CRL: {
-                DataFormat.PEM: x509.load_pem_x509_crl,
-                DataFormat.DER: x509.load_der_x509_crl
-            },
-            DataType.CSR: {
-                DataFormat.PEM: x509.load_pem_x509_csr,
-                DataFormat.DER: x509.load_der_x509_csr
-            },
-        })
-
-    def collect_default_files(self) -> typing.List[str]:
-        """Collect the default files for parsing."""
-        raise NotImplementedError
-
-    def parse_file(self, filename: str) -> typing.List[AuditData]:
-        """
-        Parse a list of AuditData from file.
-
-        :param filename: name of the file to parse.
-        :return list of AuditData parsed from the file.
-        """
-        raise NotImplementedError
-
-    def parse_bytes(self, data: bytes):
-        """Parse AuditData from bytes."""
-        for data_type in list(DataType):
-            try:
-                result = self.parser[data_type](data)
-            except ValueError as val_error:
-                result = None
-                self.logger.warning(val_error)
-            if result is not None:
-                audit_data = AuditData(data_type, result)
-                return audit_data
-        return None
-
-    def walk_all(self,
-                 results: typing.Dict[str, AuditData],
-                 file_list: typing.Optional[typing.List[str]] = None) \
-        -> None:
-        """
-        Iterate over all the files in the list and get audit data. The
-        results will be written to `results` passed to this function.
-
-        :param results: The dictionary used to store the parsed
-                        AuditData. The keys of this dictionary should
-                        be the identifier of the AuditData.
-        """
-        if file_list is None:
-            file_list = self.default_files
-        for filename in file_list:
-            data_list = self.parse_file(filename)
-            for d in data_list:
-                if d.identifier in results:
-                    results[d.identifier].locations.extend(d.locations)
-                else:
-                    results[d.identifier] = d
-
-    @staticmethod
-    def find_test_dir():
-        """Get the relative path for the Mbed TLS test directory."""
-        return os.path.relpath(build_tree.guess_mbedtls_root() + '/tests')
-
-
-class TestDataAuditor(Auditor):
-    """Class for auditing files in `framework/data_files/`"""
-
-    def collect_default_files(self):
-        """Collect all files in `framework/data_files/`"""
-        test_data_glob = os.path.join(build_tree.guess_mbedtls_root(),
-                                      'framework', 'data_files/**')
-        data_files = [f for f in glob.glob(test_data_glob, recursive=True)
-                      if os.path.isfile(f)]
-        return data_files
-
-    def parse_file(self, filename: str) -> typing.List[AuditData]:
-        """
-        Parse a list of AuditData from data file.
-
-        :param filename: name of the file to parse.
-        :return list of AuditData parsed from the file.
-        """
-        with open(filename, 'rb') as f:
-            data = f.read()
-
-        results = []
-        # Try to parse all PEM blocks.
-        is_pem = False
-        for idx, m in enumerate(re.finditer(X509Parser.PEM_REGEX, data, flags=re.S), 1):
-            is_pem = True
-            result = self.parse_bytes(data[m.start():m.end()])
-            if result is not None:
-                result.locations.append("{}#{}".format(filename, idx))
-                results.append(result)
-
-        # Might be DER format.
-        if not is_pem:
-            result = self.parse_bytes(data)
-            if result is not None:
-                result.locations.append("{}".format(filename))
-                results.append(result)
-
-        return results
-
-
-def parse_suite_data(data_f):
-    """
-    Parses .data file for test arguments that possiblly have a
-    valid X.509 data. If you need a more precise parser, please
-    use generate_test_code.parse_test_data instead.
-
-    :param data_f: file object of the data file.
-    :return: Generator that yields test function argument list.
-    """
-    for line in data_f:
-        line = line.strip()
-        # Skip comments
-        if line.startswith('#'):
-            continue
-
-        # Check parameters line
-        match = re.search(r'\A\w+(.*:)?\"', line)
-        if match:
-            # Read test vectors
-            parts = re.split(r'(?<!\\):', line)
-            parts = [x for x in parts if x]
-            args = parts[1:]
-            yield args
-
-
-class SuiteDataAuditor(Auditor):
-    """Class for auditing files in `tests/suites/*.data`"""
-
-    def collect_default_files(self):
-        """Collect all files in `tests/suites/*.data`"""
-        test_dir = self.find_test_dir()
-        suites_data_folder = os.path.join(test_dir, 'suites')
-        data_files = glob.glob(os.path.join(suites_data_folder, '*.data'))
-        return data_files
-
-    def parse_file(self, filename: str):
-        """
-        Parse a list of AuditData from test suite data file.
-
-        :param filename: name of the file to parse.
-        :return list of AuditData parsed from the file.
-        """
-        audit_data_list = []
-        data_f = FileWrapper(filename)
-        for test_args in parse_suite_data(data_f):
-            for idx, test_arg in enumerate(test_args):
-                match = re.match(r'"(?P<data>[0-9a-fA-F]+)"', test_arg)
-                if not match:
-                    continue
-                if not X509Parser.check_hex_string(match.group('data')):
-                    continue
-                audit_data = self.parse_bytes(bytes.fromhex(match.group('data')))
-                if audit_data is None:
-                    continue
-                audit_data.locations.append("{}:{}:#{}".format(filename,
-                                                               data_f.line_no,
-                                                               idx + 1))
-                audit_data_list.append(audit_data)
-
-        return audit_data_list
-
-
-def list_all(audit_data: AuditData):
-    for loc in audit_data.locations:
-        print("{}\t{:20}\t{:20}\t{:3}\t{}".format(
-            audit_data.identifier,
-            audit_data.not_valid_before.isoformat(timespec='seconds'),
-            audit_data.not_valid_after.isoformat(timespec='seconds'),
-            audit_data.data_type.name,
-            loc))
-
-
-def main():
-    """
-    Perform argument parsing.
-    """
-    parser = argparse.ArgumentParser(description=__doc__)
-
-    parser.add_argument('-a', '--all',
-                        action='store_true',
-                        help='list the information of all the files')
-    parser.add_argument('-v', '--verbose',
-                        action='store_true', dest='verbose',
-                        help='show logs')
-    parser.add_argument('--from', dest='start_date',
-                        help=('Start of desired validity period (UTC, YYYY-MM-DD). '
-                              'Default: today'),
-                        metavar='DATE')
-    parser.add_argument('--to', dest='end_date',
-                        help=('End of desired validity period (UTC, YYYY-MM-DD). '
-                              'Default: --from'),
-                        metavar='DATE')
-    parser.add_argument('--data-files', action='append', nargs='*',
-                        help='data files to audit',
-                        metavar='FILE')
-    parser.add_argument('--suite-data-files', action='append', nargs='*',
-                        help='suite data files to audit',
-                        metavar='FILE')
-
-    args = parser.parse_args()
-
-    # start main routine
-    # setup logger
-    logger = logging.getLogger()
-    logging_util.configure_logger(logger)
-    logger.setLevel(logging.DEBUG if args.verbose else logging.ERROR)
-
-    td_auditor = TestDataAuditor(logger)
-    sd_auditor = SuiteDataAuditor(logger)
-
-    data_files = []
-    suite_data_files = []
-    if args.data_files is None and args.suite_data_files is None:
-        data_files = td_auditor.default_files
-        suite_data_files = sd_auditor.default_files
-    else:
-        if args.data_files is not None:
-            data_files = [x for l in args.data_files for x in l]
-        if args.suite_data_files is not None:
-            suite_data_files = [x for l in args.suite_data_files for x in l]
-
-    # validity period start date
-    if args.start_date:
-        start_date = datetime.datetime.fromisoformat(args.start_date)
-    else:
-        start_date = datetime.datetime.today()
-    # validity period end date
-    if args.end_date:
-        end_date = datetime.datetime.fromisoformat(args.end_date)
-    else:
-        end_date = start_date
-
-    # go through all the files
-    audit_results = {}
-    td_auditor.walk_all(audit_results, data_files)
-    sd_auditor.walk_all(audit_results, suite_data_files)
-
-    logger.info("Total: {} objects found!".format(len(audit_results)))
-
-    # we filter out the files whose validity duration covers the provided
-    # duration.
-    filter_func = lambda d: (start_date < d.not_valid_before) or \
-                            (d.not_valid_after < end_date)
-
-    sortby_end = lambda d: d.not_valid_after
-
-    if args.all:
-        filter_func = None
-
-    # filter and output the results
-    for d in sorted(filter(filter_func, audit_results.values()), key=sortby_end):
-        list_all(d)
-
-    logger.debug("Done!")
-
-check_cryptography_version()
-if __name__ == "__main__":
-    main()
@@ -0,0 +1,20 @@
+#!/usr/bin/env python3
+
+"""
+Check that TF-PSA-Crypto files that can be regenerated are up-to-date, or update them.
+"""
+
+# Copyright The Mbed TLS Contributors
+# SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
+
+import scripts_path # pylint: disable=unused-import
+from mbedtls_framework import config_macros
+from mbedtls_framework import generate_files_helper
+
+GENERATORS = [
+    config_macros.Current(shadow_missing_ok=True),
+]
+
+if __name__ == '__main__':
+    generate_files_helper.main(generators=GENERATORS,
+                               description=__doc__)
@@ -1,46 +0,0 @@
-#!/usr/bin/env python3
-
-"""
-Check that files with lists of config options are up-to-date, or update them.
-
-This script checks the following file:
-scripts/data_files/config-options-current.txt
-"""
-
-# Copyright The Mbed TLS Contributors
-# SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
-
-import argparse
-import sys
-
-import scripts_path # pylint: disable=unused-import
-from mbedtls_framework import config_macros
-
-
-def main():
-    parser = argparse.ArgumentParser(description=__doc__)
-    # For now this script only acts on one target file.
-    # If we check/update more files, we should add a way to select which
-    # file(s) to operate on.
-    parser.add_argument('--always-update', '-U',
-                        action='store_true',
-                        help=('Update target files unconditionally '
-                              '(overrides --update)'))
-    parser.add_argument('--update', '-u',
-                        action='store_true',
-                        help='Update target files if needed')
-    args = parser.parse_args()
-    data = config_macros.Current(shadow_missing_ok=True)
-    if args.update or args.always_update:
-        data.update_shadow_file(args.always_update)
-    else:
-        up_to_date = True
-        if not data.is_shadow_file_up_to_date():
-            print(f'{data.shadow_file_path()} is out of date')
-            print(f'After adding or removing a config option, you need to run')
-            print(f'{sys.argv[0]} -u and commit the result.')
-            up_to_date = False
-        sys.exit(0 if up_to_date else 1)
-
-if __name__ == "__main__":
-    main()
@@ -45,9 +45,21 @@ component_check_generated_files () {

    # This component ends with the generated files present in the source tree.
    # This is necessary for subsequent components!
+}

+support_check_committed_generated_files () {
+    # Add requirements on the Python installation here for
+    # the sake of check_committed_generated_files.py in mbedtls.
+    #
+    # Check the Python version, not the presence of the package,
+    # because the CI runs `all.sh --list-components` outside of the
+    # venv that has our desired packages.
+    :
+}
+
+component_check_committed_generated_files () {
    msg "Check committed generated files"
-    tests/scripts/check_option_lists.py
+    tests/scripts/check_committed_generated_files.py
 }

 component_check_doxy_blocks () {
@@ -462,7 +462,7 @@ component_test_everest () {
    make test

    msg "test: metatests (clang, ASan)"
-    tests/scripts/run-metatests.sh any asan poison
+    framework/scripts/run-metatests.sh any asan poison

    msg "test: Everest ECDH context - ECDH-related part of ssl-opt.sh (ASan build)" # ~ 5s
    tests/ssl-opt.sh -f ECDH
@@ -493,15 +493,6 @@ component_test_everest_curve25519_only () {
    ctest
 }

-component_test_psa_collect_statuses () {
-  msg "build+test: psa_collect_statuses" # ~30s
-  scripts/config.py full
-  tests/scripts/psa_collect_statuses.py
-  # Check that psa_crypto_init() succeeded at least once
-  grep -q '^0:psa_crypto_init:' tests/statuses.log
-  rm -f tests/statuses.log
-}
-
 # Check that the specified libraries exist and are empty.
 are_empty_libraries () {
  nm "$@" >/dev/null 2>/dev/null
@@ -22,7 +22,7 @@ component_test_default_out_of_box () {
    programs/test/selftest

    msg "program demos: make, default config (out-of-box)" # ~10s
-    tests/scripts/run_demos.py
+    framework/scripts/run_demos.py
 }

 component_test_default_cmake_gcc_asan () {
@@ -34,13 +34,13 @@ component_test_default_cmake_gcc_asan () {
    make test

    msg "program demos (ASan build)" # ~10s
-    tests/scripts/run_demos.py
+    framework/scripts/run_demos.py

    msg "test: selftest (ASan build)" # ~ 10s
    programs/test/selftest

    msg "test: metatests (GCC, ASan build)"
-    tests/scripts/run-metatests.sh any asan poison
+    framework/scripts/run-metatests.sh any asan poison

    msg "test: ssl-opt.sh (ASan build)" # ~ 1 min
    tests/ssl-opt.sh
@@ -143,10 +143,10 @@ component_test_full_cmake_clang () {
    programs/test/cpp_dummy_build

    msg "test: metatests (clang)"
-    tests/scripts/run-metatests.sh any pthread
+    framework/scripts/run-metatests.sh any pthread

    msg "program demos (full config, clang)" # ~10s
-    tests/scripts/run_demos.py
+    framework/scripts/run_demos.py

    msg "test: psa_constant_names (full config, clang)" # ~ 1s
    $FRAMEWORK/scripts/test_psa_constant_names.py
@@ -214,7 +214,7 @@ component_test_full_deprecated_warning () {
    $MAKE_COMMAND test

    msg "program demos: full config + MBEDTLS_TEST_DEPRECATED" # ~10s
-    tests/scripts/run_demos.py
+    framework/scripts/run_demos.py
 }

 component_build_baremetal () {
@@ -330,7 +330,7 @@ component_test_arm_linux_gnueabi_gcc_arm5vte () {
    programs/test/selftest

    msg "program demos: make, default config (out-of-box)" # ~0s
-    tests/scripts/run_demos.py
+    framework/scripts/run_demos.py
 }

 support_test_arm_linux_gnueabi_gcc_arm5vte () {
@@ -350,7 +350,7 @@ component_test_arm_linux_gnueabi_gcc_thumb_1_opt_0 () {
    programs/test/selftest

    msg "program demos: make, default config (out-of-box)" # ~0s
-    tests/scripts/run_demos.py
+    framework/scripts/run_demos.py
 }

 support_test_arm_linux_gnueabi_gcc_thumb_1_opt_0 () {
@@ -368,7 +368,7 @@ component_test_arm_linux_gnueabi_gcc_thumb_1_opt_s () {
    programs/test/selftest

    msg "program demos: make, default config (out-of-box)" # ~0s
-    tests/scripts/run_demos.py
+    framework/scripts/run_demos.py
 }

 support_test_arm_linux_gnueabi_gcc_thumb_1_opt_s () {
@@ -386,7 +386,7 @@ component_test_arm_linux_gnueabihf_gcc_armv7 () {
    programs/test/selftest

    msg "program demos: make, default config (out-of-box)" # ~0s
-    tests/scripts/run_demos.py
+    framework/scripts/run_demos.py
 }

 support_test_arm_linux_gnueabihf_gcc_armv7 () {
@@ -404,7 +404,7 @@ component_test_arm_linux_gnueabihf_gcc_thumb_2 () {
    programs/test/selftest

    msg "program demos: make, default config (out-of-box)" # ~0s
-    tests/scripts/run_demos.py
+    framework/scripts/run_demos.py
 }

 support_test_arm_linux_gnueabihf_gcc_thumb_2 () {
@@ -422,7 +422,7 @@ component_test_aarch64_linux_gnu_gcc () {
    programs/test/selftest

    msg "program demos: make, default config (out-of-box)" # ~0s
-    tests/scripts/run_demos.py
+    framework/scripts/run_demos.py
 }

 support_test_aarch64_linux_gnu_gcc () {
@@ -132,10 +132,10 @@ component_test_memsan () {
    make test

    msg "test: metatests (MSan)"
-    tests/scripts/run-metatests.sh any msan
+    framework/scripts/run-metatests.sh any msan

    msg "program demos (MSan)" # ~20s
-    tests/scripts/run_demos.py
+    framework/scripts/run_demos.py

    msg "test: ssl-opt.sh (MSan)" # ~ 1 min
    tests/ssl-opt.sh
@@ -1,96 +0,0 @@
-#!/usr/bin/env perl
-#
-# Based on NIST CTR_DRBG.rsp validation file
-# Only uses AES-256-CTR cases that use a Derivation function
-# and concats nonce and personalization for initialization.
-#
-# Copyright The Mbed TLS Contributors
-# SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
-
-use strict;
-
-my $file = shift;
-
-open(TEST_DATA, "$file") or die "Opening test cases '$file': $!";
-
-sub get_suite_val($)
-{
-    my $name = shift;
-    my $val = "";
-
-    my $line = <TEST_DATA>;
-    ($val) = ($line =~ /\[$name\s\=\s(\w+)\]/);
-
-    return $val;
-}
-
-sub get_val($)
-{
-    my $name = shift;
-    my $val = "";
-    my $line;
-
-    while($line = <TEST_DATA>)
-    {
-        next if($line !~ /=/);
-        last;
-    }
-
-    ($val) = ($line =~ /^$name = (\w+)/);
-
-    return $val;
-}
-
-my $cnt = 1;;
-while (my $line = <TEST_DATA>)
-{
-    next if ($line !~ /^\[AES-256 use df/);
-
-    my $PredictionResistanceStr = get_suite_val("PredictionResistance");
-    my $PredictionResistance = 0;
-    $PredictionResistance = 1 if ($PredictionResistanceStr eq 'True');
-    my $EntropyInputLen = get_suite_val("EntropyInputLen");
-    my $NonceLen = get_suite_val("NonceLen");
-    my $PersonalizationStringLen = get_suite_val("PersonalizationStringLen");
-    my $AdditionalInputLen = get_suite_val("AdditionalInputLen");
-
-    for ($cnt = 0; $cnt < 15; $cnt++)
-    {
-        my $Count = get_val("COUNT");
-        my $EntropyInput = get_val("EntropyInput");
-        my $Nonce = get_val("Nonce");
-        my $PersonalizationString = get_val("PersonalizationString");
-        my $AdditionalInput1 = get_val("AdditionalInput");
-        my $EntropyInputPR1 = get_val("EntropyInputPR") if ($PredictionResistance == 1);
-        my $EntropyInputReseed = get_val("EntropyInputReseed") if ($PredictionResistance == 0);
-        my $AdditionalInputReseed = get_val("AdditionalInputReseed") if ($PredictionResistance == 0);
-        my $AdditionalInput2 = get_val("AdditionalInput");
-        my $EntropyInputPR2 = get_val("EntropyInputPR") if ($PredictionResistance == 1);
-        my $ReturnedBits = get_val("ReturnedBits");
-
-        if ($PredictionResistance == 1)
-        {
-            print("CTR_DRBG NIST Validation (AES-256 use df,$PredictionResistanceStr,$EntropyInputLen,$NonceLen,$PersonalizationStringLen,$AdditionalInputLen) #$Count\n");
-            print("ctr_drbg_validate_pr");
-            print(":\"$Nonce$PersonalizationString\"");
-            print(":\"$EntropyInput$EntropyInputPR1$EntropyInputPR2\"");
-            print(":\"$AdditionalInput1\"");
-            print(":\"$AdditionalInput2\"");
-            print(":\"$ReturnedBits\"");
-            print("\n\n");
-        }
-        else
-        {
-            print("CTR_DRBG NIST Validation (AES-256 use df,$PredictionResistanceStr,$EntropyInputLen,$NonceLen,$PersonalizationStringLen,$AdditionalInputLen) #$Count\n");
-            print("ctr_drbg_validate_nopr");
-            print(":\"$Nonce$PersonalizationString\"");
-            print(":\"$EntropyInput$EntropyInputReseed\"");
-            print(":\"$AdditionalInput1\"");
-            print(":\"$AdditionalInputReseed\"");
-            print(":\"$AdditionalInput2\"");
-            print(":\"$ReturnedBits\"");
-            print("\n\n");
-        }
-    }
-}
-close(TEST_DATA);
@@ -1,101 +0,0 @@
-#!/usr/bin/env perl
-#
-# Based on NIST gcmDecryptxxx.rsp validation files
-# Only first 3 of every set used for compile time saving
-#
-# Copyright The Mbed TLS Contributors
-# SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
-
-use strict;
-
-my $file = shift;
-
-open(TEST_DATA, "$file") or die "Opening test cases '$file': $!";
-
-sub get_suite_val($)
-{
-    my $name = shift;
-    my $val = "";
-
-    while(my $line = <TEST_DATA>)
-    {
-        next if ($line !~ /^\[/);
-        ($val) = ($line =~ /\[$name\s\=\s(\w+)\]/);
-        last;
-    }
-
-    return $val;
-}
-
-sub get_val($)
-{
-    my $name = shift;
-    my $val = "";
-    my $line;
-
-    while($line = <TEST_DATA>)
-    {
-        next if($line !~ /=/);
-        last;
-    }
-
-    ($val) = ($line =~ /^$name = (\w+)/);
-
-    return $val;
-}
-
-sub get_val_or_fail($)
-{
-    my $name = shift;
-    my $val = "FAIL";
-    my $line;
-
-    while($line = <TEST_DATA>)
-    {
-        next if($line !~ /=/ && $line !~ /FAIL/);
-        last;
-    }
-
-    ($val) = ($line =~ /^$name = (\w+)/) if ($line =~ /=/);
-
-    return $val;
-}
-
-my $cnt = 1;;
-while (my $line = <TEST_DATA>)
-{
-    my $key_len = get_suite_val("Keylen");
-    next if ($key_len !~ /\d+/);
-    my $iv_len = get_suite_val("IVlen");
-    my $pt_len = get_suite_val("PTlen");
-    my $add_len = get_suite_val("AADlen");
-    my $tag_len = get_suite_val("Taglen");
-
-    for ($cnt = 0; $cnt < 3; $cnt++)
-    {
-        my $Count = get_val("Count");
-        my $key = get_val("Key");
-        my $iv = get_val("IV");
-        my $ct = get_val("CT");
-        my $add = get_val("AAD");
-        my $tag = get_val("Tag");
-        my $pt = get_val_or_fail("PT");
-
-        print("GCM NIST Validation (AES-$key_len,$iv_len,$pt_len,$add_len,$tag_len) #$Count\n");
-        print("gcm_decrypt_and_verify");
-        print(":\"$key\"");
-        print(":\"$ct\"");
-        print(":\"$iv\"");
-        print(":\"$add\"");
-        print(":$tag_len");
-        print(":\"$tag\"");
-        print(":\"$pt\"");
-        print(":0");
-        print("\n\n");
-    }
-}
-
-print("GCM Selftest\n");
-print("gcm_selftest:\n\n");
-
-close(TEST_DATA);
@@ -1,84 +0,0 @@
-#!/usr/bin/env perl
-#
-# Based on NIST gcmEncryptIntIVxxx.rsp validation files
-# Only first 3 of every set used for compile time saving
-#
-# Copyright The Mbed TLS Contributors
-# SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
-
-use strict;
-
-my $file = shift;
-
-open(TEST_DATA, "$file") or die "Opening test cases '$file': $!";
-
-sub get_suite_val($)
-{
-    my $name = shift;
-    my $val = "";
-
-    while(my $line = <TEST_DATA>)
-    {
-        next if ($line !~ /^\[/);
-        ($val) = ($line =~ /\[$name\s\=\s(\w+)\]/);
-        last;
-    }
-
-    return $val;
-}
-
-sub get_val($)
-{
-    my $name = shift;
-    my $val = "";
-    my $line;
-
-    while($line = <TEST_DATA>)
-    {
-        next if($line !~ /=/);
-        last;
-    }
-
-    ($val) = ($line =~ /^$name = (\w+)/);
-
-    return $val;
-}
-
-my $cnt = 1;;
-while (my $line = <TEST_DATA>)
-{
-    my $key_len = get_suite_val("Keylen");
-    next if ($key_len !~ /\d+/);
-    my $iv_len = get_suite_val("IVlen");
-    my $pt_len = get_suite_val("PTlen");
-    my $add_len = get_suite_val("AADlen");
-    my $tag_len = get_suite_val("Taglen");
-
-    for ($cnt = 0; $cnt < 3; $cnt++)
-    {
-        my $Count = get_val("Count");
-        my $key = get_val("Key");
-        my $pt = get_val("PT");
-        my $add = get_val("AAD");
-        my $iv = get_val("IV");
-        my $ct = get_val("CT");
-        my $tag = get_val("Tag");
-
-        print("GCM NIST Validation (AES-$key_len,$iv_len,$pt_len,$add_len,$tag_len) #$Count\n");
-        print("gcm_encrypt_and_tag");
-        print(":\"$key\"");
-        print(":\"$pt\"");
-        print(":\"$iv\"");
-        print(":\"$add\"");
-        print(":\"$ct\"");
-        print(":$tag_len");
-        print(":\"$tag\"");
-        print(":0");
-        print("\n\n");
-    }
-}
-
-print("GCM Selftest\n");
-print("gcm_selftest:\n\n");
-
-close(TEST_DATA);
@@ -1,74 +0,0 @@
-#!/usr/bin/env perl
-#
-# Copyright The Mbed TLS Contributors
-# SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
-
-use strict;
-
-my $file = shift;
-
-open(TEST_DATA, "$file") or die "Opening test cases '$file': $!";
-
-sub get_val($$)
-{
-    my $str = shift;
-    my $name = shift;
-    my $val = "";
-
-    while(my $line = <TEST_DATA>)
-    {
-        next if($line !~ /^# $str/);
-        last;
-    }
-
-    while(my $line = <TEST_DATA>)
-    {
-        last if($line eq "\r\n");
-        $val .= $line;
-    }
-
-    $val =~ s/[ \r\n]//g;
-
-    return $val;
-}
-
-my $state = 0;
-my $val_n = "";
-my $val_e = "";
-my $val_p = "";
-my $val_q = "";
-my $mod = 0;
-my $cnt = 1;
-while (my $line = <TEST_DATA>)
-{
-    next if ($line !~ /^# Example/);
-
-    ( $mod ) = ($line =~ /A (\d+)/);
-    $val_n = get_val("RSA modulus n", "N");
-    $val_e = get_val("RSA public exponent e", "E");
-    $val_p = get_val("Prime p", "P");
-    $val_q = get_val("Prime q", "Q");
-
-    for(my $i = 1; $i <= 6; $i++)
-    {
-        my $val_m = get_val("Message to be", "M");
-        my $val_salt = get_val("Salt", "Salt");
-        my $val_sig = get_val("Signature", "Sig");
-
-        print("RSASSA-PSS Signature Example ${cnt}_${i}\n");
-        print("pkcs1_rsassa_pss_sign:$mod:16:\"$val_p\":16:\"$val_q\":16:\"$val_n\":16:\"$val_e\":SIG_RSA_SHA1:MBEDTLS_MD_SHA1");
-        print(":\"$val_m\"");
-        print(":\"$val_salt\"");
-        print(":\"$val_sig\":0");
-        print("\n\n");
-
-        print("RSASSA-PSS Signature Example ${cnt}_${i} (verify)\n");
-        print("pkcs1_rsassa_pss_verify:$mod:16:\"$val_n\":16:\"$val_e\":SIG_RSA_SHA1:MBEDTLS_MD_SHA1");
-        print(":\"$val_m\"");
-        print(":\"$val_salt\"");
-        print(":\"$val_sig\":0");
-        print("\n\n");
-    }
-    $cnt++;
-}
-close(TEST_DATA);
@@ -1,71 +0,0 @@
-#!/bin/sh
-
-# This script splits the data test files containing the test cases into
-# individual files (one test case per file) suitable for use with afl
-# (American Fuzzy Lop). http://lcamtuf.coredump.cx/afl/
-#
-# Usage: generate-afl-tests.sh <test data file path>
-#  <test data file path> - should be the path to one of the test suite files
-#                          such as 'test_suite_rsa.data'
-#
-# Copyright The Mbed TLS Contributors
-# SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
-
-# Abort on errors
-set -e
-
-if [ -z $1 ]
-then
-    echo " [!] No test file specified" >&2
-    echo "Usage: $0 <test data file>" >&2
-    exit 1
-fi
-
-SRC_FILEPATH=$(dirname $1)/$(basename $1)
-TESTSUITE=$(basename $1 .data)
-
-THIS_DIR=$(basename $PWD)
-
-if [ -d ../library -a -d ../include -a -d ../tests -a $THIS_DIR == "tests" ];
-then :;
-else
-    echo " [!] Must be run from Mbed TLS tests directory" >&2
-    exit 1
-fi
-
-DEST_TESTCASE_DIR=$TESTSUITE-afl-tests
-DEST_OUTPUT_DIR=$TESTSUITE-afl-out
-
-echo " [+] Creating output directories" >&2
-
-if [ -e $DEST_OUTPUT_DIR/* ];
-then :
-    echo " [!] Test output files already exist." >&2
-    exit 1
-else
-    mkdir -p $DEST_OUTPUT_DIR
-fi
-
-if [ -e $DEST_TESTCASE_DIR/* ];
-then :
-    echo " [!] Test output files already exist." >&2
-else
-    mkdir -p $DEST_TESTCASE_DIR
-fi
-
-echo " [+] Creating test cases" >&2
-cd $DEST_TESTCASE_DIR
-
-split -p '^\s*$' ../$SRC_FILEPATH
-
-for f in *;
-do
-    # Strip out any blank lines (no trim on OS X)
-    sed '/^\s*$/d' $f >testcase_$f
-    rm $f
-done
-
-cd ..
-
-echo " [+] Test cases in $DEST_TESTCASE_DIR" >&2
-
@@ -1,87 +0,0 @@
-#!/usr/bin/env python3
-"""Generate server9-bad-saltlen.crt
-
-Generate a certificate signed with RSA-PSS, with an incorrect salt length.
-"""
-
-# Copyright The Mbed TLS Contributors
-# SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
-
-import subprocess
-import argparse
-from asn1crypto import pem, x509, core #type: ignore #pylint: disable=import-error
-
-OPENSSL_RSA_PSS_CERT_COMMAND = r'''
-openssl x509 -req -CA {ca_name}.crt -CAkey {ca_name}.key -set_serial 24 {ca_password} \
-    {openssl_extfile} -days 3650 -outform DER -in {csr}  \
-    -sigopt rsa_padding_mode:pss -sigopt rsa_pss_saltlen:{anounce_saltlen} \
-    -sigopt rsa_mgf1_md:sha256
-'''
-SIG_OPT = \
-    r'-sigopt rsa_padding_mode:pss -sigopt rsa_pss_saltlen:{saltlen} -sigopt rsa_mgf1_md:sha256'
-OPENSSL_RSA_PSS_DGST_COMMAND = r'''openssl dgst -sign {ca_name}.key {ca_password} \
-    -sigopt rsa_padding_mode:pss -sigopt rsa_pss_saltlen:{actual_saltlen} \
-    -sigopt rsa_mgf1_md:sha256'''
-
-
-def auto_int(x):
-    return int(x, 0)
-
-
-def build_argparser(parser):
-    """Build argument parser"""
-    parser.description = __doc__
-    parser.add_argument('--ca-name', type=str, required=True,
-                        help='Basename of CA files')
-    parser.add_argument('--ca-password', type=str,
-                        required=True, help='CA key file password')
-    parser.add_argument('--csr', type=str, required=True,
-                        help='CSR file for generating certificate')
-    parser.add_argument('--openssl-extfile', type=str,
-                        required=True, help='X905 v3 extension config file')
-    parser.add_argument('--anounce_saltlen', type=auto_int,
-                        required=True, help='Announced salt length')
-    parser.add_argument('--actual_saltlen', type=auto_int,
-                        required=True, help='Actual salt length')
-    parser.add_argument('--output', type=str, required=True)
-
-
-def main():
-    parser = argparse.ArgumentParser()
-    build_argparser(parser)
-    args = parser.parse_args()
-
-    return generate(**vars(args))
-
-def generate(**kwargs):
-    """Generate different salt length certificate file."""
-    ca_password = kwargs.get('ca_password', '')
-    if ca_password:
-        kwargs['ca_password'] = r'-passin "pass:{ca_password}"'.format(
-            **kwargs)
-    else:
-        kwargs['ca_password'] = ''
-    extfile = kwargs.get('openssl_extfile', '')
-    if extfile:
-        kwargs['openssl_extfile'] = '-extfile {openssl_extfile}'.format(
-            **kwargs)
-    else:
-        kwargs['openssl_extfile'] = ''
-
-    cmd = OPENSSL_RSA_PSS_CERT_COMMAND.format(**kwargs)
-    der_bytes = subprocess.check_output(cmd, shell=True)
-    target_certificate = x509.Certificate.load(der_bytes)
-
-    cmd = OPENSSL_RSA_PSS_DGST_COMMAND.format(**kwargs)
-    #pylint: disable=unexpected-keyword-arg
-    der_bytes = subprocess.check_output(cmd,
-                                        input=target_certificate['tbs_certificate'].dump(),
-                                        shell=True)
-
-    with open(kwargs.get('output'), 'wb') as f:
-        target_certificate['signature_value'] = core.OctetBitString(der_bytes)
-        f.write(pem.armor('CERTIFICATE', target_certificate.dump()))
-
-
-if __name__ == '__main__':
-    main()
@@ -1,130 +0,0 @@
-#!/usr/bin/env python3
-"""Describe the test coverage of PSA functions in terms of return statuses.
-
-1. Build Mbed TLS with -DRECORD_PSA_STATUS_COVERAGE_LOG
-2. Run psa_collect_statuses.py
-
-The output is a series of line of the form "psa_foo PSA_ERROR_XXX". Each
-function/status combination appears only once.
-
-This script must be run from the top of an Mbed TLS source tree.
-The build command is "make -DRECORD_PSA_STATUS_COVERAGE_LOG", which is
-only supported with make (as opposed to CMake or other build methods).
-"""
-
-# Copyright The Mbed TLS Contributors
-# SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
-
-import argparse
-import os
-import subprocess
-import sys
-
-DEFAULT_STATUS_LOG_FILE = 'tests/statuses.log'
-DEFAULT_PSA_CONSTANT_NAMES = 'tf-psa-crypto/programs/psa/psa_constant_names'
-
-class Statuses:
-    """Information about observed return statues of API functions."""
-
-    def __init__(self):
-        self.functions = {}
-        self.codes = set()
-        self.status_names = {}
-
-    def collect_log(self, log_file_name):
-        """Read logs from RECORD_PSA_STATUS_COVERAGE_LOG.
-
-        Read logs produced by running Mbed TLS test suites built with
-        -DRECORD_PSA_STATUS_COVERAGE_LOG.
-        """
-        with open(log_file_name) as log:
-            for line in log:
-                value, function, tail = line.split(':', 2)
-                if function not in self.functions:
-                    self.functions[function] = {}
-                fdata = self.functions[function]
-                if value not in self.functions[function]:
-                    fdata[value] = []
-                fdata[value].append(tail)
-                self.codes.add(int(value))
-
-    def get_constant_names(self, psa_constant_names):
-        """Run psa_constant_names to obtain names for observed numerical values."""
-        values = [str(value) for value in self.codes]
-        cmd = [psa_constant_names, 'status'] + values
-        output = subprocess.check_output(cmd).decode('ascii')
-        for value, name in zip(values, output.rstrip().split('\n')):
-            self.status_names[value] = name
-
-    def report(self):
-        """Report observed return values for each function.
-
-        The report is a series of line of the form "psa_foo PSA_ERROR_XXX".
-        """
-        for function in sorted(self.functions.keys()):
-            fdata = self.functions[function]
-            names = [self.status_names[value] for value in fdata.keys()]
-            for name in sorted(names):
-                sys.stdout.write('{} {}\n'.format(function, name))
-
-def collect_status_logs(options):
-    """Build and run unit tests and report observed function return statuses.
-
-    Build Mbed TLS with -DRECORD_PSA_STATUS_COVERAGE_LOG, run the
-    test suites and display information about observed return statuses.
-    """
-    rebuilt = False
-    if not options.use_existing_log and os.path.exists(options.log_file):
-        os.remove(options.log_file)
-    if not os.path.exists(options.log_file):
-        if options.clean_before:
-            subprocess.check_call(['make', '-f', 'scripts/legacy.make', 'clean'],
-                                  cwd='tests',
-                                  stdout=sys.stderr)
-        with open(os.devnull, 'w') as devnull:
-            make_q_ret = subprocess.call(['make', '-f', 'scripts/legacy.make',
-                                          '-q', 'lib', 'tests'],
-                                         stdout=devnull, stderr=devnull)
-        if make_q_ret != 0:
-            subprocess.check_call(['make', '-f', 'scripts/legacy.make',
-                                   'RECORD_PSA_STATUS_COVERAGE_LOG=1'],
-                                  stdout=sys.stderr)
-            rebuilt = True
-        subprocess.check_call(['make', '-f', 'scripts/legacy.make', 'test'],
-                              stdout=sys.stderr)
-    data = Statuses()
-    data.collect_log(options.log_file)
-    data.get_constant_names(options.psa_constant_names)
-    if rebuilt and options.clean_after:
-        subprocess.check_call(['make', '-f', 'scripts/legacy.make', 'clean'],
-                              cwd='tests',
-                              stdout=sys.stderr)
-    return data
-
-def main():
-    parser = argparse.ArgumentParser(description=globals()['__doc__'])
-    parser.add_argument('--clean-after',
-                        action='store_true',
-                        help='Run "make clean" after rebuilding')
-    parser.add_argument('--clean-before',
-                        action='store_true',
-                        help='Run "make clean" before regenerating the log file)')
-    parser.add_argument('--log-file', metavar='FILE',
-                        default=DEFAULT_STATUS_LOG_FILE,
-                        help='Log file location (default: {})'.format(
-                            DEFAULT_STATUS_LOG_FILE
-                        ))
-    parser.add_argument('--psa-constant-names', metavar='PROGRAM',
-                        default=DEFAULT_PSA_CONSTANT_NAMES,
-                        help='Path to psa_constant_names (default: {})'.format(
-                            DEFAULT_PSA_CONSTANT_NAMES
-                        ))
-    parser.add_argument('--use-existing-log', '-e',
-                        action='store_true',
-                        help='Don\'t regenerate the log file if it exists')
-    options = parser.parse_args()
-    data = collect_status_logs(options)
-    data.report()
-
-if __name__ == '__main__':
-    main()
@@ -1,89 +0,0 @@
-#!/bin/sh
-
-help () {
-    cat <<EOF
-Usage: $0 [OPTION] [PLATFORM]...
-Run all the metatests whose platform matches any of the given PLATFORM.
-A PLATFORM can contain shell wildcards.
-
-Expected output: a lot of scary-looking error messages, since each
-metatest is expected to report a failure. The final line should be
-"Ran N metatests, all good."
-
-If something goes wrong: the final line should be
-"Ran N metatests, X unexpected successes". Look for "Unexpected success"
-in the logs above.
-
-  -l  List the available metatests, don't run them.
-EOF
-}
-
-# Copyright The Mbed TLS Contributors
-# SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
-
-set -e -u
-
-if [ -d programs ]; then
-    METATEST_PROGRAM=programs/test/metatest
-elif [ -d ../programs ]; then
-    METATEST_PROGRAM=../programs/test/metatest
-elif [ -d ../../programs ]; then
-    METATEST_PROGRAM=../../programs/test/metatest
-else
-    echo >&2 "$0: FATAL: programs/test/metatest not found"
-    exit 120
-fi
-
-LIST_ONLY=
-while getopts hl OPTLET; do
-    case $OPTLET in
-        h) help; exit;;
-        l) LIST_ONLY=1;;
-        \?) help >&2; exit 120;;
-    esac
-done
-shift $((OPTIND - 1))
-
-list_matches () {
-    while read name platform junk; do
-        for pattern in "$@"; do
-            case $platform in
-                $pattern) echo "$name"; break;;
-            esac
-        done
-    done
-}
-
-count=0
-errors=0
-run_metatest () {
-    ret=0
-    "$METATEST_PROGRAM" "$1" || ret=$?
-    if [ $ret -eq 0 ]; then
-        echo >&2 "$0: Unexpected success: $1"
-        errors=$((errors + 1))
-    fi
-    count=$((count + 1))
-}
-
-# Don't pipe the output of metatest so that if it fails, this script exits
-# immediately with a failure status.
-full_list=$("$METATEST_PROGRAM" list)
-matching_list=$(printf '%s\n' "$full_list" | list_matches "$@")
-
-if [ -n "$LIST_ONLY" ]; then
-    printf '%s\n' $matching_list
-    exit
-fi
-
-for name in $matching_list; do
-    run_metatest "$name"
-done
-
-if [ $errors -eq 0 ]; then
-    echo "Ran $count metatests, all good."
-    exit 0
-else
-    echo "Ran $count metatests, $errors unexpected successes."
-    exit 1
-fi
@@ -1,65 +0,0 @@
-#!/usr/bin/env python3
-"""Run the Mbed TLS demo scripts.
-"""
-import argparse
-import glob
-import subprocess
-import sys
-
-def run_demo(demo, quiet=False):
-    """Run the specified demo script. Return True if it succeeds."""
-    args = {}
-    if quiet:
-        args['stdout'] = subprocess.DEVNULL
-        args['stderr'] = subprocess.DEVNULL
-    returncode = subprocess.call([demo], **args)
-    return returncode == 0
-
-def run_demos(demos, quiet=False):
-    """Run the specified demos and print summary information about failures.
-
-    Return True if all demos passed and False if a demo fails.
-    """
-    failures = []
-    for demo in demos:
-        if not quiet:
-            print('#### {} ####'.format(demo))
-        success = run_demo(demo, quiet=quiet)
-        if not success:
-            failures.append(demo)
-            if not quiet:
-                print('{}: FAIL'.format(demo))
-        if quiet:
-            print('{}: {}'.format(demo, 'PASS' if success else 'FAIL'))
-        else:
-            print('')
-    successes = len(demos) - len(failures)
-    print('{}/{} demos passed'.format(successes, len(demos)))
-    if failures and not quiet:
-        print('Failures:', *failures)
-    return not failures
-
-def run_all_demos(quiet=False):
-    """Run all the available demos.
-
-    Return True if all demos passed and False if a demo fails.
-    """
-    mbedtls_demos = glob.glob('programs/*/*_demo.sh')
-    tf_psa_crypto_demos = glob.glob('tf-psa-crypto/programs/*/*_demo.sh')
-    all_demos = mbedtls_demos + tf_psa_crypto_demos
-    if not all_demos:
-        # Keep the message on one line. pylint: disable=line-too-long
-        raise Exception('No demos found. run_demos needs to operate from the Mbed TLS toplevel directory.')
-    return run_demos(all_demos, quiet=quiet)
-
-def main():
-    parser = argparse.ArgumentParser(description=__doc__)
-    parser.add_argument('--quiet', '-q',
-                        action='store_true',
-                        help="suppress the output of demos")
-    options = parser.parse_args()
-    success = run_all_demos(quiet=options.quiet)
-    sys.exit(0 if success else 1)
-
-if __name__ == '__main__':
-    main()
@@ -1,175 +0,0 @@
-#!/usr/bin/env python3
-
-"""Test helper for the Mbed TLS configuration file tool
-
-Run config.py with various parameters and write the results to files.
-
-This is a harness to help regression testing, not a functional tester.
-Sample usage:
-
-    test_config_script.py -d old
-    ## Modify config.py and/or mbedtls_config.h ##
-    test_config_script.py -d new
-    diff -ru old new
-"""
-
-## Copyright The Mbed TLS Contributors
-## SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
-##
-
-import argparse
-import glob
-import os
-import re
-import shutil
-import subprocess
-
-OUTPUT_FILE_PREFIX = 'config-'
-
-def output_file_name(directory, stem, extension):
-    return os.path.join(directory,
-                        '{}{}.{}'.format(OUTPUT_FILE_PREFIX,
-                                         stem, extension))
-
-def cleanup_directory(directory):
-    """Remove old output files."""
-    for extension in []:
-        pattern = output_file_name(directory, '*', extension)
-        filenames = glob.glob(pattern)
-        for filename in filenames:
-            os.remove(filename)
-
-def prepare_directory(directory):
-    """Create the output directory if it doesn't exist yet.
-
-    If there are old output files, remove them.
-    """
-    if os.path.exists(directory):
-        cleanup_directory(directory)
-    else:
-        os.makedirs(directory)
-
-def guess_presets_from_help(help_text):
-    """Figure out what presets the script supports.
-
-    help_text should be the output from running the script with --help.
-    """
-    # Try the output format from config.py
-    hits = re.findall(r'\{([-\w,]+)\}', help_text)
-    for hit in hits:
-        words = set(hit.split(','))
-        if 'get' in words and 'set' in words and 'unset' in words:
-            words.remove('get')
-            words.remove('set')
-            words.remove('unset')
-            return words
-    # Try the output format from config.pl
-    hits = re.findall(r'\n +([-\w]+) +- ', help_text)
-    if hits:
-        return hits
-    raise Exception("Unable to figure out supported presets. Pass the '-p' option.")
-
-def list_presets(options):
-    """Return the list of presets to test.
-
-    The list is taken from the command line if present, otherwise it is
-    extracted from running the config script with --help.
-    """
-    if options.presets:
-        return re.split(r'[ ,]+', options.presets)
-    else:
-        help_text = subprocess.run([options.script, '--help'],
-                                   check=False, # config.pl --help returns 255
-                                   stdout=subprocess.PIPE,
-                                   stderr=subprocess.STDOUT).stdout
-        return guess_presets_from_help(help_text.decode('ascii'))
-
-def run_one(options, args, stem_prefix='', input_file=None):
-    """Run the config script with the given arguments.
-
-    Take the original content from input_file if specified, defaulting
-    to options.input_file if input_file is None.
-
-    Write the following files, where xxx contains stem_prefix followed by
-    a filename-friendly encoding of args:
-    * config-xxx.h: modified file.
-    * config-xxx.out: standard output.
-    * config-xxx.err: standard output.
-    * config-xxx.status: exit code.
-
-    Return ("xxx+", "path/to/config-xxx.h") which can be used as
-    stem_prefix and input_file to call this function again with new args.
-    """
-    if input_file is None:
-        input_file = options.input_file
-    stem = stem_prefix + '-'.join(args)
-    data_filename = output_file_name(options.output_directory, stem, 'h')
-    stdout_filename = output_file_name(options.output_directory, stem, 'out')
-    stderr_filename = output_file_name(options.output_directory, stem, 'err')
-    status_filename = output_file_name(options.output_directory, stem, 'status')
-    shutil.copy(input_file, data_filename)
-    # Pass only the file basename, not the full path, to avoid getting the
-    # directory name in error messages, which would make comparisons
-    # between output directories more difficult.
-    cmd = [os.path.abspath(options.script),
-           '-f', os.path.basename(data_filename)]
-    with open(stdout_filename, 'wb') as out:
-        with open(stderr_filename, 'wb') as err:
-            status = subprocess.call(cmd + args,
-                                     cwd=options.output_directory,
-                                     stdin=subprocess.DEVNULL,
-                                     stdout=out, stderr=err)
-    with open(status_filename, 'w') as status_file:
-        status_file.write('{}\n'.format(status))
-    return stem + "+", data_filename
-
-### A list of symbols to test with.
-### This script currently tests what happens when you change a symbol from
-### having a value to not having a value or vice versa. This is not
-### necessarily useful behavior, and we may not consider it a bug if
-### config.py stops handling that case correctly.
-TEST_SYMBOLS = [
-    'CUSTOM_SYMBOL', # does not exist
-    'PSA_WANT_KEY_TYPE_AES', # set, no value
-    'MBEDTLS_MPI_MAX_SIZE', # unset, has a value
-    'MBEDTLS_NO_UDBL_DIVISION', # unset, in "System support"
-    'MBEDTLS_PLATFORM_ZEROIZE_ALT', # unset, in "Customisation configuration options"
-]
-
-def run_all(options):
-    """Run all the command lines to test."""
-    presets = list_presets(options)
-    for preset in presets:
-        run_one(options, [preset])
-    for symbol in TEST_SYMBOLS:
-        run_one(options, ['get', symbol])
-        (stem, filename) = run_one(options, ['set', symbol])
-        run_one(options, ['get', symbol], stem_prefix=stem, input_file=filename)
-        run_one(options, ['--force', 'set', symbol])
-        (stem, filename) = run_one(options, ['set', symbol, 'value'])
-        run_one(options, ['get', symbol], stem_prefix=stem, input_file=filename)
-        run_one(options, ['--force', 'set', symbol, 'value'])
-        run_one(options, ['unset', symbol])
-
-def main():
-    """Command line entry point."""
-    parser = argparse.ArgumentParser(description=__doc__,
-                                     formatter_class=argparse.RawDescriptionHelpFormatter)
-    parser.add_argument('-d', metavar='DIR',
-                        dest='output_directory', required=True,
-                        help="""Output directory.""")
-    parser.add_argument('-f', metavar='FILE',
-                        dest='input_file', default='include/mbedtls/mbedtls_config.h',
-                        help="""Config file (default: %(default)s).""")
-    parser.add_argument('-p', metavar='PRESET,...',
-                        dest='presets',
-                        help="""Presets to test (default: guessed from --help).""")
-    parser.add_argument('-s', metavar='FILE',
-                        dest='script', default='scripts/config.py',
-                        help="""Configuration script (default: %(default)s).""")
-    options = parser.parse_args()
-    prepare_directory(options.output_directory)
-    run_all(options)
-
-if __name__ == '__main__':
-    main()
@@ -5772,6 +5772,7 @@ run_test    "Authentication: server badcert, client none" \
             key_file=$DATA_FILES_PATH/server5.key" \
            "$P_CLI debug_level=3 auth_mode=none" \
            0 \
+            -c "! Certificate verification was skipped" \
            -C "x509_verify_cert() returned" \
            -C "! The certificate is not correctly signed by the trusted CA" \
            -C "! mbedtls_ssl_handshake returned" \
@@ -5783,12 +5784,14 @@ run_test    "Authentication: server badcert, client none (1.2)" \
             key_file=$DATA_FILES_PATH/server5.key" \
            "$P_CLI force_version=tls12 debug_level=3 auth_mode=none" \
            0 \
+            -c "! Certificate verification was skipped" \
            -C "x509_verify_cert() returned" \
            -C "! The certificate is not correctly signed by the trusted CA" \
            -C "! mbedtls_ssl_handshake returned" \
            -C "send alert level=2 message=48" \
            -C "X509 - Certificate verification failed"

+
 run_test    "Authentication: server goodcert, client required, no trusted CA" \
            "$P_SRV" \
            "$P_CLI debug_level=3 auth_mode=required ca_file=none ca_path=none" \
@@ -5837,6 +5840,7 @@ run_test    "Authentication: server goodcert, client none, no trusted CA" \
            "$P_SRV" \
            "$P_CLI debug_level=3 auth_mode=none ca_file=none ca_path=none" \
            0 \
+            -c "! Certificate verification was skipped" \
            -C "x509_verify_cert() returned" \
            -C "! The certificate is not correctly signed by the trusted CA" \
            -C "! Certificate verification flags"\
@@ -5844,11 +5848,13 @@ run_test    "Authentication: server goodcert, client none, no trusted CA" \
            -C "X509 - Certificate verification failed" \
            -C "SSL - No CA Chain is set, but required to operate"

+
 requires_any_configs_enabled $TLS1_2_KEY_EXCHANGES_WITH_CERT
 run_test    "Authentication: server goodcert, client none, no trusted CA (1.2)" \
            "$P_SRV" \
            "$P_CLI force_version=tls12 debug_level=3 auth_mode=none ca_file=none ca_path=none" \
            0 \
+            -c "! Certificate verification was skipped" \
            -C "x509_verify_cert() returned" \
            -C "! The certificate is not correctly signed by the trusted CA" \
            -C "! Certificate verification flags"\
@@ -5856,6 +5862,7 @@ run_test    "Authentication: server goodcert, client none, no trusted CA (1.2)"
            -C "X509 - Certificate verification failed" \
            -C "SSL - No CA Chain is set, but required to operate"

+
 # The next few tests check what happens if the server has a valid certificate
 # that does not match its name (impersonation).

@@ -5939,12 +5946,14 @@ run_test "Authentication: hostname mismatch, client none" \
         "$P_SRV" \
         "$P_CLI auth_mode=none server_name=wrong-name debug_level=2" \
         0 \
+         -c "! Certificate verification was skipped" \
         -C "does not match with the expected CN" \
         -C "Certificate verification without having set hostname" \
         -C "Certificate verification without CN verification" \
         -C "x509_verify_cert() returned -" \
         -C "X509 - Certificate verification failed"

+
 run_test "Authentication: hostname null, client required" \
         "$P_SRV" \
         "$P_CLI auth_mode=required set_hostname=NULL debug_level=2" \
@@ -5970,12 +5979,14 @@ run_test "Authentication: hostname null, client none" \
         "$P_SRV" \
         "$P_CLI auth_mode=none set_hostname=NULL debug_level=2" \
         0 \
+         -c "! Certificate verification was skipped" \
         -C "does not match with the expected CN" \
         -C "Certificate verification without having set hostname" \
         -C "Certificate verification without CN verification" \
         -C "x509_verify_cert() returned -" \
         -C "X509 - Certificate verification failed"

+
 run_test "Authentication: hostname unset, client required" \
         "$P_SRV" \
         "$P_CLI auth_mode=required set_hostname=no debug_level=2" \
@@ -6015,6 +6026,7 @@ run_test "Authentication: hostname unset, client none" \
         "$P_SRV" \
         "$P_CLI auth_mode=none set_hostname=no debug_level=2" \
         0 \
+         -c "! Certificate verification was skipped" \
         -C "does not match with the expected CN" \
         -C "Certificate verification without having set hostname" \
         -C "Certificate verification without CN verification" \
@@ -6173,6 +6185,7 @@ run_test    "Authentication: client badcert, server none" \
            "$P_CLI debug_level=3 crt_file=$DATA_FILES_PATH/server5-badsign.crt \
             key_file=$DATA_FILES_PATH/server5.key" \
            0 \
+            -s "! Certificate verification was skipped" \
            -s "skip write certificate request" \
            -C "skip parse certificate request" \
            -c "got no certificate request" \
@@ -6280,6 +6293,7 @@ run_test    "Authentication: server max_int+1 chain, client none" \
            "$P_CLI force_version=tls12 server_name=CA10 ca_file=$DATA_FILES_PATH/dir-maxpath/00.crt \
                    auth_mode=none" \
            0 \
+            -c "! Certificate verification was skipped" \
            -C "X509 - A fatal error occurred"

 requires_config_value_equals "MBEDTLS_X509_MAX_INTERMEDIATE_CA" $MAX_IM_CA
@@ -81,12 +81,12 @@ Debug print buffer #5
 mbedtls_debug_print_buf:"MyFile":999:"Test return value":"000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F30":"MyFile(0999)\: dumping 'Test return value' (49 bytes)\nMyFile(0999)\: 0000\:  00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f  ................\nMyFile(0999)\: 0010\:  10 11 12 13 14 15 16 17 18 19 1a 1b 1c 1d 1e 1f  ................\nMyFile(0999)\: 0020\:  20 21 22 23 24 25 26 27 28 29 2a 2b 2c 2d 2e 2f   !"#$%&'()*+,-./\nMyFile(0999)\: 0030\:  30                                               0\n"

 Debug print certificate #1 (RSA)
-depends_on:MBEDTLS_PEM_PARSE_C:MBEDTLS_BASE64_C:MBEDTLS_RSA_C:PSA_WANT_ALG_SHA_1:!MBEDTLS_X509_REMOVE_INFO:MBEDTLS_PK_WRITE_C
+depends_on:MBEDTLS_PEM_PARSE_C:MBEDTLS_BASE64_C:PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY:PSA_WANT_ALG_SHA_1:!MBEDTLS_X509_REMOVE_INFO:MBEDTLS_PK_WRITE_C
 mbedtls_debug_print_crt:"../framework/data_files/server1.crt":"MyFile":999:"PREFIX_":"MyFile(0999)\: PREFIX_ #1\:\nMyFile(0999)\: cert. version     \: 3\nMyFile(0999)\: serial number     \: 01\nMyFile(0999)\: issuer name       \: C=NL, O=PolarSSL, CN=PolarSSL Test CA\nMyFile(0999)\: subject name      \: C=NL, O=PolarSSL, CN=PolarSSL Server 1\nMyFile(0999)\: issued  on        \: 2019-02-10 14\:44\:06\nMyFile(0999)\: expires on        \: 2029-02-10 14\:44\:06\nMyFile(0999)\: signed using      \: RSA with SHA1\nMyFile(0999)\: RSA key size      \: 2048 bits\nMyFile(0999)\: basic constraints \: CA=false\nMyFile(0999)\: dumping 'crt->PK' (270 bytes)\nMyFile(0999)\: 0000\:  30 82 01 0a 02 82 01 01 00 a9 02 1f 3d 40 6a d5\nMyFile(0999)\: 0010\:  55 53 8b fd 36 ee 82 65 2e 15 61 5e 89 bf b8 e8\nMyFile(0999)\: 0020\:  45 90 db ee 88 16 52 d3 f1 43 50 47 96 12 59 64\nMyFile(0999)\: 0030\:  87 6b fd 2b e0 46 f9 73 be dd cf 92 e1 91 5b ed\nMyFile(0999)\: 0040\:  66 a0 6f 89 29 79 45 80 d0 83 6a d5 41 43 77 5f\nMyFile(0999)\: 0050\:  39 7c 09 04 47 82 b0 57 39 70 ed a3 ec 15 19 1e\nMyFile(0999)\: 0060\:  a8 33 08 47 c1 05 42 a9 fd 4c c3 b4 df dd 06 1f\nMyFile(0999)\: 0070\:  4d 10 51 40 67 73 13 0f 40 f8 6d 81 25 5f 0a b1\nMyFile(0999)\: 0080\:  53 c6 30 7e 15 39 ac f9 5a ee 7f 92 9e a6 05 5b\nMyFile(0999)\: 0090\:  e7 13 97 85 b5 23 92 d9 d4 24 06 d5 09 25 89 75\nMyFile(0999)\: 00a0\:  07 dd a6 1a 8f 3f 09 19 be ad 65 2c 64 eb 95 9b\nMyFile(0999)\: 00b0\:  dc fe 41 5e 17 a6 da 6c 5b 69 cc 02 ba 14 2c 16\nMyFile(0999)\: 00c0\:  24 9c 4a dc cd d0 f7 52 67 73 f1 2d a0 23 fd 7e\nMyFile(0999)\: 00d0\:  f4 31 ca 2d 70 ca 89 0b 04 db 2e a6 4f 70 6e 9e\nMyFile(0999)\: 00e0\:  ce bd 58 89 e2 53 59 9e 6e 5a 92 65 e2 88 3f 0c\nMyFile(0999)\: 00f0\:  94 19 a3 dd e5 e8 9d 95 13 ed 29 db ab 70 12 dc\nMyFile(0999)\: 0100\:  5a ca 6b 17 ab 52 82 54 b1 02 03 01 00 01      \n"

 # Same as above, but with !MBEDTLS_PK_WRITE_C
 Debug print certificate #1.1 (RSA)
-depends_on:MBEDTLS_PEM_PARSE_C:MBEDTLS_BASE64_C:MBEDTLS_RSA_C:PSA_WANT_ALG_SHA_1:!MBEDTLS_X509_REMOVE_INFO:!MBEDTLS_PK_WRITE_C
+depends_on:MBEDTLS_PEM_PARSE_C:MBEDTLS_BASE64_C:PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY:PSA_WANT_ALG_SHA_1:!MBEDTLS_X509_REMOVE_INFO:!MBEDTLS_PK_WRITE_C
 mbedtls_debug_print_crt:"../framework/data_files/server1.crt":"MyFile":999:"PREFIX_":"MyFile(0999)\: PREFIX_ #1\:\nMyFile(0999)\: cert. version     \: 3\nMyFile(0999)\: serial number     \: 01\nMyFile(0999)\: issuer name       \: C=NL, O=PolarSSL, CN=PolarSSL Test CA\nMyFile(0999)\: subject name      \: C=NL, O=PolarSSL, CN=PolarSSL Server 1\nMyFile(0999)\: issued  on        \: 2019-02-10 14\:44\:06\nMyFile(0999)\: expires on        \: 2029-02-10 14\:44\:06\nMyFile(0999)\: signed using      \: RSA with SHA1\nMyFile(0999)\: RSA key size      \: 2048 bits\nMyFile(0999)\: basic constraints \: CA=false\n"

 Debug print certificate #2 (EC)
@@ -3,7 +3,7 @@ depends_on:MBEDTLS_AES_C
 error_strerror:-0x0020:"AES - Invalid key length"

 Single high error
-depends_on:PSA_WANT_ALG_SHA_256:MBEDTLS_RSA_C:MBEDTLS_X509_CRT_PARSE_C
+depends_on:PSA_WANT_ALG_SHA_256:PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY:MBEDTLS_X509_CRT_PARSE_C
 error_strerror:-0x2280:"X509 - The serial tag or value is invalid"

 Non existing high error
@@ -14,4 +14,3 @@ error_strerror:-0x007F:"UNKNOWN ERROR CODE (007F)"

 Non existing low and high error
 error_strerror:-0x88FF:"UNKNOWN ERROR CODE (8880) \: UNKNOWN ERROR CODE (007F)"
-
@@ -1,9 +1,9 @@
 PKCS7 Signed Data Parse Pass SHA256 #1
-depends_on:PSA_WANT_ALG_SHA_256:MBEDTLS_RSA_C
+depends_on:PSA_WANT_ALG_SHA_256:PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY
 pkcs7_parse:"../framework/data_files/pkcs7_data_cert_signed_sha256.der":MBEDTLS_PKCS7_SIGNED_DATA

 PKCS7 Signed Data Parse Pass SHA1 #2
-depends_on:PSA_WANT_ALG_SHA_1:PSA_WANT_ALG_SHA_256:MBEDTLS_RSA_C
+depends_on:PSA_WANT_ALG_SHA_1:PSA_WANT_ALG_SHA_256:PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY
 pkcs7_parse:"../framework/data_files/pkcs7_data_cert_signed_sha1.der":MBEDTLS_PKCS7_SIGNED_DATA

 PKCS7 Signed Data Parse Pass Without CERT #3
@@ -15,51 +15,51 @@ depends_on:PSA_WANT_ALG_SHA_256
 pkcs7_parse:"../framework/data_files/pkcs7_data_no_signers.der":MBEDTLS_PKCS7_SIGNED_DATA

 PKCS7 Signed Data Parse Fail with multiple certs #4
-depends_on:PSA_WANT_ALG_SHA_256:MBEDTLS_RSA_C
+depends_on:PSA_WANT_ALG_SHA_256:PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY
 pkcs7_parse:"../framework/data_files/pkcs7_data_multiple_certs_signed.der":MBEDTLS_ERR_PKCS7_FEATURE_UNAVAILABLE

 PKCS7 Signed Data Parse Fail with corrupted cert #5.0
-depends_on:PSA_WANT_ALG_SHA_256:MBEDTLS_RSA_C
+depends_on:PSA_WANT_ALG_SHA_256:PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY
 pkcs7_parse:"../framework/data_files/pkcs7_data_signed_badcert.der":MBEDTLS_ERR_PKCS7_INVALID_CERT

 PKCS7 Signed Data Parse Fail with disabled alg #5.1
-depends_on:MBEDTLS_RSA_C:!PSA_WANT_ALG_SHA_512
+depends_on:PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY:!PSA_WANT_ALG_SHA_512
 pkcs7_parse:"../framework/data_files/pkcs7_data_cert_signed_sha512.der":MBEDTLS_ERR_PKCS7_INVALID_ALG

 PKCS7 Parse Fail with Inlined Content Info #5.2
-depends_on:PSA_WANT_ALG_SHA_256:MBEDTLS_RSA_C
+depends_on:PSA_WANT_ALG_SHA_256:PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY
 pkcs7_parse:"../framework/data_files/pkcs7_data_with_signature.der":MBEDTLS_ERR_PKCS7_FEATURE_UNAVAILABLE

 PKCS7 Signed Data Parse Fail with no RSA #5.3
-depends_on:PSA_WANT_ALG_SHA_256:!MBEDTLS_RSA_C
+depends_on:PSA_WANT_ALG_SHA_256:!PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY
 pkcs7_parse:"../framework/data_files/pkcs7_data_cert_signed_sha256.der":MBEDTLS_ERR_PKCS7_INVALID_CERT

 PKCS7 Signed Data Parse Fail with corrupted signer info #6
-depends_on:PSA_WANT_ALG_SHA_256:MBEDTLS_RSA_C
+depends_on:PSA_WANT_ALG_SHA_256:PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY
 pkcs7_parse:"../framework/data_files/pkcs7_data_signed_badsigner.der":MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PKCS7_INVALID_SIGNER_INFO,MBEDTLS_ERR_ASN1_UNEXPECTED_TAG)

 PKCS7 Signed Data Parse Fail with corrupted signer info[1] invalid size #6.1
-depends_on:PSA_WANT_ALG_SHA_256:MBEDTLS_RSA_C
+depends_on:PSA_WANT_ALG_SHA_256:PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY
 pkcs7_parse:"../framework/data_files/pkcs7_data_signed_badsigner1_badsize.der":MBEDTLS_ERR_PKCS7_INVALID_SIGNER_INFO

 PKCS7 Signed Data Parse Fail with corrupted signer info[2] invalid size #6.2
-depends_on:PSA_WANT_ALG_SHA_256:MBEDTLS_RSA_C
+depends_on:PSA_WANT_ALG_SHA_256:PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY
 pkcs7_parse:"../framework/data_files/pkcs7_data_signed_badsigner2_badsize.der":MBEDTLS_ERR_PKCS7_INVALID_SIGNER_INFO

 PKCS7 Signed Data Parse Fail with corrupted signer info[1] unexpected tag #6.3
-depends_on:PSA_WANT_ALG_SHA_256:MBEDTLS_RSA_C
+depends_on:PSA_WANT_ALG_SHA_256:PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY
 pkcs7_parse:"../framework/data_files/pkcs7_data_signed_badsigner1_badtag.der":MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PKCS7_INVALID_SIGNER_INFO,MBEDTLS_ERR_ASN1_UNEXPECTED_TAG)

 PKCS7 Signed Data Parse Fail with corrupted signer info[2] unexpected tag #6.4
-depends_on:PSA_WANT_ALG_SHA_256:MBEDTLS_RSA_C
+depends_on:PSA_WANT_ALG_SHA_256:PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY
 pkcs7_parse:"../framework/data_files/pkcs7_data_signed_badsigner2_badtag.der":MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PKCS7_INVALID_SIGNER_INFO,MBEDTLS_ERR_ASN1_UNEXPECTED_TAG)

 PKCS7 Signed Data Parse Fail with corrupted signer info[1] fuzz bad #6.5
-depends_on:PSA_WANT_ALG_SHA_256:MBEDTLS_RSA_C
+depends_on:PSA_WANT_ALG_SHA_256:PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY
 pkcs7_parse:"../framework/data_files/pkcs7_data_signed_badsigner1_fuzzbad.der":MBEDTLS_ERR_PKCS7_INVALID_SIGNER_INFO

 PKCS7 Signed Data Parse Fail with corrupted signer info[2] fuzz bad #6.6
-depends_on:PSA_WANT_ALG_SHA_256:MBEDTLS_RSA_C
+depends_on:PSA_WANT_ALG_SHA_256:PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY
 pkcs7_parse:"../framework/data_files/pkcs7_data_signed_badsigner2_fuzzbad.der":MBEDTLS_ERR_PKCS7_INVALID_SIGNER_INFO

 PKCS7 Signed Data Parse Fail Version other than 1 #7
@@ -71,43 +71,43 @@ depends_on:PSA_WANT_ALG_SHA_256
 pkcs7_parse:"../framework/data_files/pkcs7_data_cert_encrypted.der":MBEDTLS_ERR_PKCS7_FEATURE_UNAVAILABLE

 PKCS7 Signed Data Verification Pass zero-len data
-depends_on:PSA_WANT_ALG_SHA_1:PSA_WANT_ALG_SHA_256
+depends_on:PSA_WANT_ALG_SHA_1:PSA_WANT_ALG_SHA_256:PSA_HAVE_ALG_RSA_PKCS1V15_VERIFY
 pkcs7_verify:"../framework/data_files/pkcs7_zerolendata_detached.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_zerolendata.bin":0:0

 PKCS7 Signed Data Verification Fail zero-len data
-depends_on:PSA_WANT_ALG_SHA_1:PSA_WANT_ALG_SHA_256:MBEDTLS_RSA_C
+depends_on:PSA_WANT_ALG_SHA_1:PSA_WANT_ALG_SHA_256:PSA_HAVE_ALG_RSA_PKCS1V15_VERIFY
 pkcs7_verify:"../framework/data_files/pkcs7_zerolendata_detached.der":"../framework/data_files/pkcs7-rsa-sha256-2.der":"../framework/data_files/pkcs7_zerolendata.bin":0:MBEDTLS_ERR_RSA_VERIFY_FAILED

 PKCS7 Signed Data Verification Pass SHA256 #9
-depends_on:PSA_WANT_ALG_SHA_256
+depends_on:PSA_WANT_ALG_SHA_256:PSA_HAVE_ALG_RSA_PKCS1V15_VERIFY
 pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_sha256.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":0:0

 PKCS7 Signed Data Verification Pass SHA256 #9.1
-depends_on:PSA_WANT_ALG_SHA_256
+depends_on:PSA_WANT_ALG_SHA_256:PSA_HAVE_ALG_RSA_PKCS1V15_VERIFY
 pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_sha256.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":MBEDTLS_MD_SHA256:0

 PKCS7 Signed Data Verification Pass SHA1 #10
-depends_on:PSA_WANT_ALG_SHA_1:PSA_WANT_ALG_SHA_256
+depends_on:PSA_WANT_ALG_SHA_1:PSA_WANT_ALG_SHA_256:PSA_HAVE_ALG_RSA_PKCS1V15_VERIFY
 pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_sha1.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":0:0

 PKCS7 Signed Data Verification Pass SHA512 #11
-depends_on:PSA_WANT_ALG_SHA_512:PSA_WANT_ALG_SHA_256
+depends_on:PSA_WANT_ALG_SHA_512:PSA_WANT_ALG_SHA_256:PSA_HAVE_ALG_RSA_PKCS1V15_VERIFY
 pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_sha512.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":0:0

 PKCS7 Signed Data Verification Fail because of different certificate #12
-depends_on:PSA_WANT_ALG_SHA_256:MBEDTLS_RSA_C
+depends_on:PSA_WANT_ALG_SHA_256:PSA_HAVE_ALG_RSA_PKCS1V15_VERIFY
 pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_sha256.der":"../framework/data_files/pkcs7-rsa-sha256-2.der":"../framework/data_files/pkcs7_data.bin":0:MBEDTLS_ERR_RSA_VERIFY_FAILED

 PKCS7 Signed Data Verification Fail because of different data hash #13
-depends_on:PSA_WANT_ALG_SHA_256:MBEDTLS_RSA_C
+depends_on:PSA_WANT_ALG_SHA_256:PSA_HAVE_ALG_RSA_PKCS1V15_VERIFY
 pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_sha256.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data_1.bin":0:MBEDTLS_ERR_RSA_VERIFY_FAILED

 PKCS7 Signed Data Parse Failure Corrupt signerInfo.issuer #15.1
-depends_on:PSA_WANT_ALG_SHA_256:MBEDTLS_RSA_C
+depends_on:PSA_WANT_ALG_SHA_256:PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY
 pkcs7_parse:"../framework/data_files/pkcs7_signerInfo_issuer_invalid_size.der":MBEDTLS_ERR_PKCS7_INVALID_SIGNER_INFO

 PKCS7 Signed Data Parse Failure Corrupt signerInfo.serial #15.2
-depends_on:PSA_WANT_ALG_SHA_256:MBEDTLS_RSA_C
+depends_on:PSA_WANT_ALG_SHA_256:PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY
 pkcs7_parse:"../framework/data_files/pkcs7_signerInfo_serial_invalid_size.der":MBEDTLS_ERR_PKCS7_INVALID_SIGNER_INFO

 PKCS7 Signed Data Parse Fail Corrupt signerInfos[2] (6213931373035520)
@@ -119,19 +119,19 @@ depends_on:PSA_WANT_ALG_SHA_256
 pkcs7_parse:"../framework/data_files/pkcs7_signerInfo_1_serial_invalid_tag_after_long_name.der":MBEDTLS_ERR_PKCS7_INVALID_SIGNER_INFO

 PKCS7 Only Signed Data Parse Pass #15
-depends_on:PSA_WANT_ALG_SHA_256:MBEDTLS_RSA_C
+depends_on:PSA_WANT_ALG_SHA_256:PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY
 pkcs7_parse:"../framework/data_files/pkcs7_data_cert_signeddata_sha256.der":MBEDTLS_PKCS7_SIGNED_DATA

 PKCS7 Signed Data Verify with multiple(2) signers #16.0
-depends_on:PSA_WANT_ALG_SHA_256
+depends_on:PSA_WANT_ALG_SHA_256:PSA_HAVE_ALG_RSA_PKCS1V15_VERIFY
 pkcs7_verify:"../framework/data_files/pkcs7_data_multiple_signed.der":"../framework/data_files/pkcs7-rsa-sha256-1.crt ../framework/data_files/pkcs7-rsa-sha256-2.crt":"../framework/data_files/pkcs7_data.bin":0:0

 PKCS7 Signed Data Verify with multiple(3) signers #16.1
-depends_on:PSA_WANT_ALG_SHA_256:!MBEDTLS_MEMORY_BUFFER_ALLOC_C
+depends_on:PSA_WANT_ALG_SHA_256:!MBEDTLS_MEMORY_BUFFER_ALLOC_C:PSA_HAVE_ALG_RSA_PKCS1V15_VERIFY
 pkcs7_verify:"../framework/data_files/pkcs7_data_3_signed.der":"../framework/data_files/pkcs7-rsa-sha256-1.crt ../framework/data_files/pkcs7-rsa-sha256-2.crt ../framework/data_files/pkcs7-rsa-sha256-3.crt":"../framework/data_files/pkcs7_data.bin":0:0

 PKCS7 Signed Data Hash Verify with multiple signers #17
-depends_on:PSA_WANT_ALG_SHA_256
+depends_on:PSA_WANT_ALG_SHA_256:PSA_HAVE_ALG_RSA_PKCS1V15_VERIFY
 pkcs7_verify:"../framework/data_files/pkcs7_data_multiple_signed.der":"../framework/data_files/pkcs7-rsa-sha256-1.crt ../framework/data_files/pkcs7-rsa-sha256-2.crt":"../framework/data_files/pkcs7_data.bin":MBEDTLS_MD_SHA256:0

 PKCS7 Signed Data Hash Verify Fail with multiple signers #18
@@ -147,11 +147,11 @@ depends_on:PSA_WANT_ALG_SHA_256:MBEDTLS_HAVE_TIME_DATE
 pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_sha256.der":"../framework/data_files/pkcs7-rsa-expired.crt":"../framework/data_files/pkcs7_data.bin":0:MBEDTLS_ERR_PKCS7_CERT_DATE_INVALID

 PKCS7 Signed Data Verify Fail Expired Cert #19 no DATE_TIME 1
-depends_on:PSA_WANT_ALG_SHA_256:!MBEDTLS_HAVE_TIME_DATE:MBEDTLS_RSA_C
+depends_on:PSA_WANT_ALG_SHA_256:!MBEDTLS_HAVE_TIME_DATE:PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY
 pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_sha256.der":"../framework/data_files/pkcs7-rsa-expired.crt":"../framework/data_files/pkcs7_data.bin":0:MBEDTLS_ERR_RSA_VERIFY_FAILED

 PKCS7 Signed Data Verify Fail Expired Cert #19 no TIME_DATE 2
-depends_on:PSA_WANT_ALG_SHA_256:!MBEDTLS_HAVE_TIME_DATE:MBEDTLS_RSA_C
+depends_on:PSA_WANT_ALG_SHA_256:!MBEDTLS_HAVE_TIME_DATE:PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY
 pkcs7_verify:"../framework/data_files/pkcs7_data_rsa_expired.der":"../framework/data_files/pkcs7-rsa-expired.crt":"../framework/data_files/pkcs7_data_1.bin":0:MBEDTLS_ERR_RSA_VERIFY_FAILED

 PKCS7 Parse Failure Invalid ASN1: Add null byte to start #20.0
@@ -71,7 +71,7 @@ exit:
 }
 /* END_CASE */

-/* BEGIN_CASE depends_on:MBEDTLS_FS_IO:MBEDTLS_X509_CRT_PARSE_C:MBEDTLS_PKCS1_V15:MBEDTLS_RSA_C */
+/* BEGIN_CASE depends_on:MBEDTLS_FS_IO:MBEDTLS_X509_CRT_PARSE_C:PSA_HAVE_ALG_SOME_RSA_VERIFY */
 void pkcs7_verify(char *pkcs7_file,
                  char *crt_files,
                  char *filetobesigned,
@@ -193,39 +193,39 @@ depends_on:MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_TEST_AT_LEAST_ONE_TLS1_3_CIPHERSUITE
 move_handshake_to_state:MBEDTLS_SSL_IS_CLIENT:MBEDTLS_SSL_VERSION_TLS1_3:MBEDTLS_SSL_CERTIFICATE_REQUEST:1

 TLS 1.3:Move client handshake to SERVER_CERTIFICATE
-depends_on:MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_TEST_AT_LEAST_ONE_TLS1_3_CIPHERSUITE:MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED:MBEDTLS_PKCS1_V21:MBEDTLS_X509_RSASSA_PSS_SUPPORT
+depends_on:MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_TEST_AT_LEAST_ONE_TLS1_3_CIPHERSUITE:MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED:PSA_WANT_ALG_RSA_PKCS1V15_SIGN:MBEDTLS_X509_RSASSA_PSS_SUPPORT
 move_handshake_to_state:MBEDTLS_SSL_IS_CLIENT:MBEDTLS_SSL_VERSION_TLS1_3:MBEDTLS_SSL_SERVER_CERTIFICATE:1

 TLS 1.3:Move client handshake to CERTIFICATE_VERIFY
-depends_on:MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_TEST_AT_LEAST_ONE_TLS1_3_CIPHERSUITE:MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED:MBEDTLS_PKCS1_V21:MBEDTLS_X509_RSASSA_PSS_SUPPORT
+depends_on:MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_TEST_AT_LEAST_ONE_TLS1_3_CIPHERSUITE:MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED:PSA_WANT_ALG_RSA_PKCS1V15_SIGN:MBEDTLS_X509_RSASSA_PSS_SUPPORT
 move_handshake_to_state:MBEDTLS_SSL_IS_CLIENT:MBEDTLS_SSL_VERSION_TLS1_3:MBEDTLS_SSL_CERTIFICATE_VERIFY:1

 TLS 1.3:Move client handshake to SERVER_FINISHED
-depends_on:MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_TEST_AT_LEAST_ONE_TLS1_3_CIPHERSUITE:MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED:MBEDTLS_PKCS1_V21:MBEDTLS_X509_RSASSA_PSS_SUPPORT
+depends_on:MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_TEST_AT_LEAST_ONE_TLS1_3_CIPHERSUITE:MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED:PSA_WANT_ALG_RSA_PKCS1V15_SIGN:MBEDTLS_X509_RSASSA_PSS_SUPPORT
 move_handshake_to_state:MBEDTLS_SSL_IS_CLIENT:MBEDTLS_SSL_VERSION_TLS1_3:MBEDTLS_SSL_SERVER_FINISHED:1

 TLS 1.3:Move client handshake to CLIENT_CERTIFICATE
-depends_on:MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_TEST_AT_LEAST_ONE_TLS1_3_CIPHERSUITE:MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED:MBEDTLS_PKCS1_V21:MBEDTLS_X509_RSASSA_PSS_SUPPORT
+depends_on:MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_TEST_AT_LEAST_ONE_TLS1_3_CIPHERSUITE:MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED:PSA_WANT_ALG_RSA_PKCS1V15_SIGN:MBEDTLS_X509_RSASSA_PSS_SUPPORT
 move_handshake_to_state:MBEDTLS_SSL_IS_CLIENT:MBEDTLS_SSL_VERSION_TLS1_3:MBEDTLS_SSL_CLIENT_CERTIFICATE:1

 TLS 1.3:Move client handshake to CLIENT_CERTIFICATE_VERIFY
-depends_on:MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_TEST_AT_LEAST_ONE_TLS1_3_CIPHERSUITE:MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED:MBEDTLS_PKCS1_V21:MBEDTLS_X509_RSASSA_PSS_SUPPORT
+depends_on:MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_TEST_AT_LEAST_ONE_TLS1_3_CIPHERSUITE:MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED:PSA_WANT_ALG_RSA_PKCS1V15_SIGN:MBEDTLS_X509_RSASSA_PSS_SUPPORT
 move_handshake_to_state:MBEDTLS_SSL_IS_CLIENT:MBEDTLS_SSL_VERSION_TLS1_3:MBEDTLS_SSL_CLIENT_CERTIFICATE_VERIFY:1

 TLS 1.3:Move client handshake to CLIENT_FINISHED
-depends_on:MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_TEST_AT_LEAST_ONE_TLS1_3_CIPHERSUITE:MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED:MBEDTLS_PKCS1_V21:MBEDTLS_X509_RSASSA_PSS_SUPPORT
+depends_on:MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_TEST_AT_LEAST_ONE_TLS1_3_CIPHERSUITE:MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED:PSA_WANT_ALG_RSA_PKCS1V15_SIGN:MBEDTLS_X509_RSASSA_PSS_SUPPORT
 move_handshake_to_state:MBEDTLS_SSL_IS_CLIENT:MBEDTLS_SSL_VERSION_TLS1_3:MBEDTLS_SSL_CLIENT_FINISHED:1

 TLS 1.3:Move client handshake to FLUSH_BUFFERS
-depends_on:MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_TEST_AT_LEAST_ONE_TLS1_3_CIPHERSUITE:MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED:MBEDTLS_PKCS1_V21:MBEDTLS_X509_RSASSA_PSS_SUPPORT
+depends_on:MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_TEST_AT_LEAST_ONE_TLS1_3_CIPHERSUITE:MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED:PSA_WANT_ALG_RSA_PKCS1V15_SIGN:MBEDTLS_X509_RSASSA_PSS_SUPPORT
 move_handshake_to_state:MBEDTLS_SSL_IS_CLIENT:MBEDTLS_SSL_VERSION_TLS1_3:MBEDTLS_SSL_FLUSH_BUFFERS:1

 TLS 1.3:Move client handshake to HANDSHAKE_WRAPUP
-depends_on:MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_TEST_AT_LEAST_ONE_TLS1_3_CIPHERSUITE:MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED:MBEDTLS_PKCS1_V21:MBEDTLS_X509_RSASSA_PSS_SUPPORT
+depends_on:MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_TEST_AT_LEAST_ONE_TLS1_3_CIPHERSUITE:MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED:PSA_WANT_ALG_RSA_PKCS1V15_SIGN:MBEDTLS_X509_RSASSA_PSS_SUPPORT
 move_handshake_to_state:MBEDTLS_SSL_IS_CLIENT:MBEDTLS_SSL_VERSION_TLS1_3:MBEDTLS_SSL_HANDSHAKE_WRAPUP:1

 TLS 1.3:Move client handshake to CLIENT_CCS_AFTER_SERVER_FINISHED
-depends_on:MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_TEST_AT_LEAST_ONE_TLS1_3_CIPHERSUITE:MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED:MBEDTLS_PKCS1_V21:MBEDTLS_X509_RSASSA_PSS_SUPPORT:MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE
+depends_on:MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_TEST_AT_LEAST_ONE_TLS1_3_CIPHERSUITE:MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED:PSA_WANT_ALG_RSA_PKCS1V15_SIGN:MBEDTLS_X509_RSASSA_PSS_SUPPORT:MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE
 move_handshake_to_state:MBEDTLS_SSL_IS_CLIENT:MBEDTLS_SSL_VERSION_TLS1_3:MBEDTLS_SSL_CLIENT_CCS_AFTER_SERVER_FINISHED:1

 TLS 1.2:Move server handshake to HELLO_REQUEST
@@ -321,7 +321,7 @@ depends_on:MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_TEST_AT_LEAST_ONE_TLS1_3_CIPHERSUITE
 move_handshake_to_state:MBEDTLS_SSL_IS_SERVER:MBEDTLS_SSL_VERSION_TLS1_3:MBEDTLS_SSL_SERVER_CERTIFICATE:1

 TLS 1.3:Move server handshake to CERTIFICATE_VERIFY
-depends_on:MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_TEST_AT_LEAST_ONE_TLS1_3_CIPHERSUITE:MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED:MBEDTLS_PKCS1_V21:MBEDTLS_X509_RSASSA_PSS_SUPPORT
+depends_on:MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_TEST_AT_LEAST_ONE_TLS1_3_CIPHERSUITE:MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED:PSA_WANT_ALG_RSA_PSS:MBEDTLS_X509_RSASSA_PSS_SUPPORT
 move_handshake_to_state:MBEDTLS_SSL_IS_SERVER:MBEDTLS_SSL_VERSION_TLS1_3:MBEDTLS_SSL_CERTIFICATE_VERIFY:1

 TLS 1.3:Move server handshake to SERVER_CCS_AFTER_SERVER_HELLO
@@ -329,23 +329,23 @@ depends_on:MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_TEST_AT_LEAST_ONE_TLS1_3_CIPHERSUITE
 move_handshake_to_state:MBEDTLS_SSL_IS_SERVER:MBEDTLS_SSL_VERSION_TLS1_3:MBEDTLS_SSL_SERVER_CCS_AFTER_SERVER_HELLO:1

 TLS 1.3:Move server handshake to SERVER_FINISHED
-depends_on:MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_TEST_AT_LEAST_ONE_TLS1_3_CIPHERSUITE:MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED:MBEDTLS_PKCS1_V21:MBEDTLS_X509_RSASSA_PSS_SUPPORT
+depends_on:MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_TEST_AT_LEAST_ONE_TLS1_3_CIPHERSUITE:MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED:PSA_WANT_ALG_RSA_PSS:MBEDTLS_X509_RSASSA_PSS_SUPPORT
 move_handshake_to_state:MBEDTLS_SSL_IS_SERVER:MBEDTLS_SSL_VERSION_TLS1_3:MBEDTLS_SSL_SERVER_FINISHED:1

 TLS 1.3:Move server handshake to CLIENT_FINISHED
-depends_on:MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_TEST_AT_LEAST_ONE_TLS1_3_CIPHERSUITE:MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED:MBEDTLS_PKCS1_V21:MBEDTLS_X509_RSASSA_PSS_SUPPORT
+depends_on:MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_TEST_AT_LEAST_ONE_TLS1_3_CIPHERSUITE:MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED:PSA_WANT_ALG_RSA_PKCS1V15_SIGN:MBEDTLS_X509_RSASSA_PSS_SUPPORT
 move_handshake_to_state:MBEDTLS_SSL_IS_SERVER:MBEDTLS_SSL_VERSION_TLS1_3:MBEDTLS_SSL_CLIENT_FINISHED:1

 TLS 1.3:Move server handshake to HANDSHAKE_WRAPUP
-depends_on:MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_TEST_AT_LEAST_ONE_TLS1_3_CIPHERSUITE:MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED:MBEDTLS_PKCS1_V21:MBEDTLS_X509_RSASSA_PSS_SUPPORT
+depends_on:MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_TEST_AT_LEAST_ONE_TLS1_3_CIPHERSUITE:MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED:PSA_WANT_ALG_RSA_PKCS1V15_SIGN:MBEDTLS_X509_RSASSA_PSS_SUPPORT
 move_handshake_to_state:MBEDTLS_SSL_IS_SERVER:MBEDTLS_SSL_VERSION_TLS1_3:MBEDTLS_SSL_HANDSHAKE_WRAPUP:1

 TLS 1.3:Move server handshake to CLIENT_CERTIFICATE
-depends_on:MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_TEST_AT_LEAST_ONE_TLS1_3_CIPHERSUITE:MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED:MBEDTLS_PKCS1_V21:MBEDTLS_X509_RSASSA_PSS_SUPPORT
+depends_on:MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_TEST_AT_LEAST_ONE_TLS1_3_CIPHERSUITE:MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED:PSA_WANT_ALG_RSA_PKCS1V15_SIGN:MBEDTLS_X509_RSASSA_PSS_SUPPORT
 move_handshake_to_state:MBEDTLS_SSL_IS_SERVER:MBEDTLS_SSL_VERSION_TLS1_3:MBEDTLS_SSL_CLIENT_CERTIFICATE:1

 TLS 1.3:Move server handshake to CLIENT_CERTIFICATE_VERIFY
-depends_on:MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_TEST_AT_LEAST_ONE_TLS1_3_CIPHERSUITE:MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED:MBEDTLS_PKCS1_V21:MBEDTLS_X509_RSASSA_PSS_SUPPORT
+depends_on:MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_TEST_AT_LEAST_ONE_TLS1_3_CIPHERSUITE:MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED:PSA_WANT_ALG_RSA_PKCS1V15_SIGN:MBEDTLS_X509_RSASSA_PSS_SUPPORT
 move_handshake_to_state:MBEDTLS_SSL_IS_SERVER:MBEDTLS_SSL_VERSION_TLS1_3:MBEDTLS_SSL_CLIENT_CERTIFICATE_VERIFY:1

 TLS 1.2:Negative test moving clients ssl to state: VERIFY_REQUEST_SENT
@@ -361,19 +361,19 @@ depends_on:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_CAN_HANDLE_RSA_TEST_KEY
 handshake_version:0:MBEDTLS_SSL_VERSION_TLS1_2:MBEDTLS_SSL_VERSION_TLS1_2:MBEDTLS_SSL_VERSION_TLS1_2:MBEDTLS_SSL_VERSION_TLS1_2:MBEDTLS_SSL_VERSION_TLS1_2

 Handshake, tls1_3
-depends_on:MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_TEST_AT_LEAST_ONE_TLS1_3_CIPHERSUITE:MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED:MBEDTLS_PKCS1_V21:MBEDTLS_X509_RSASSA_PSS_SUPPORT
+depends_on:MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_TEST_AT_LEAST_ONE_TLS1_3_CIPHERSUITE:MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED:PSA_WANT_ALG_RSA_PSS:MBEDTLS_X509_RSASSA_PSS_SUPPORT
 handshake_version:0:MBEDTLS_SSL_VERSION_TLS1_3:MBEDTLS_SSL_VERSION_TLS1_3:MBEDTLS_SSL_VERSION_TLS1_3:MBEDTLS_SSL_VERSION_TLS1_3:MBEDTLS_SSL_VERSION_TLS1_3

 Handshake, ECDHE-RSA-WITH-AES-256-GCM-SHA384
-depends_on:PSA_WANT_ALG_SHA_384:PSA_WANT_KEY_TYPE_AES:PSA_WANT_ALG_GCM:MBEDTLS_RSA_C:PSA_WANT_ECC_SECP_R1_384:MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED:!MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH
+depends_on:PSA_WANT_ALG_SHA_384:PSA_WANT_KEY_TYPE_AES:PSA_WANT_ALG_GCM:PSA_HAVE_ALG_SOME_RSA_SIGN:PSA_WANT_ECC_SECP_R1_384:MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED:!MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH
 handshake_cipher:"TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384":MBEDTLS_PK_RSA:0

 Handshake, ECDHE-RSA-WITH-AES-128-CBC-SHA256
-depends_on:PSA_WANT_KEY_TYPE_AES:PSA_WANT_ALG_CBC_NO_PADDING:PSA_WANT_ALG_SHA_256:MBEDTLS_RSA_C:PSA_WANT_ECC_SECP_R1_384:MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED
+depends_on:PSA_WANT_KEY_TYPE_AES:PSA_WANT_ALG_CBC_NO_PADDING:PSA_WANT_ALG_SHA_256:PSA_HAVE_ALG_SOME_RSA_SIGN:PSA_WANT_ECC_SECP_R1_384:MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED
 handshake_cipher:"TLS-ECDHE-RSA-WITH-AES-128-CBC-SHA256":MBEDTLS_PK_RSA:0

 Handshake, ECDHE-RSA-WITH-AES-256-CBC-SHA384
-depends_on:PSA_WANT_KEY_TYPE_AES:PSA_WANT_ALG_CBC_NO_PADDING:PSA_WANT_ALG_SHA_384:MBEDTLS_RSA_C:PSA_WANT_ECC_SECP_R1_384:MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED:!MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH
+depends_on:PSA_WANT_KEY_TYPE_AES:PSA_WANT_ALG_CBC_NO_PADDING:PSA_WANT_ALG_SHA_384:PSA_HAVE_ALG_SOME_RSA_SIGN:PSA_WANT_ECC_SECP_R1_384:MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED:!MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH
 handshake_cipher:"TLS-ECDHE-RSA-WITH-AES-256-CBC-SHA384":MBEDTLS_PK_RSA:0

 Handshake, ECDHE-ECDSA-WITH-AES-256-CCM
@@ -381,7 +381,7 @@ depends_on:PSA_WANT_KEY_TYPE_AES:PSA_WANT_ALG_CCM:PSA_WANT_ECC_SECP_R1_256:PSA_W
 handshake_cipher:"TLS-ECDHE-ECDSA-WITH-AES-256-CCM":MBEDTLS_PK_ECDSA:0

 Handshake, PSK-WITH-AES-128-CBC-SHA
-depends_on:PSA_WANT_KEY_TYPE_AES:PSA_WANT_ALG_CBC_NO_PADDING:MBEDTLS_RSA_C:PSA_WANT_ECC_SECP_R1_384:PSA_WANT_ALG_SHA_1:MBEDTLS_KEY_EXCHANGE_PSK_ENABLED
+depends_on:PSA_WANT_KEY_TYPE_AES:PSA_WANT_ALG_CBC_NO_PADDING:PSA_HAVE_ALG_SOME_RSA_SIGN:PSA_WANT_ECC_SECP_R1_384:PSA_WANT_ALG_SHA_1:MBEDTLS_KEY_EXCHANGE_PSK_ENABLED
 handshake_psk_cipher:"TLS-PSK-WITH-AES-128-CBC-SHA":MBEDTLS_PK_RSA:"abc123":0

 DTLS Handshake, tls1_2
@@ -389,15 +389,15 @@ depends_on:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_SSL_PROTO_DTLS:MBEDTLS_CAN_HANDLE_RS
 handshake_version:1:MBEDTLS_SSL_VERSION_TLS1_2:MBEDTLS_SSL_VERSION_TLS1_2:MBEDTLS_SSL_VERSION_TLS1_2:MBEDTLS_SSL_VERSION_TLS1_2:MBEDTLS_SSL_VERSION_TLS1_2

 DTLS Handshake, ECDHE-RSA-WITH-AES-256-GCM-SHA384
-depends_on:PSA_WANT_ALG_SHA_384:PSA_WANT_KEY_TYPE_AES:PSA_WANT_ALG_GCM:MBEDTLS_RSA_C:PSA_WANT_ECC_SECP_R1_384:MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED:MBEDTLS_SSL_PROTO_DTLS:!MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH
+depends_on:PSA_WANT_ALG_SHA_384:PSA_WANT_KEY_TYPE_AES:PSA_WANT_ALG_GCM:PSA_HAVE_ALG_SOME_RSA_SIGN:PSA_WANT_ECC_SECP_R1_384:MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED:MBEDTLS_SSL_PROTO_DTLS:!MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH
 handshake_cipher:"TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384":MBEDTLS_PK_RSA:1

 DTLS Handshake, ECDHE-RSA-WITH-AES-128-CBC-SHA256
-depends_on:PSA_WANT_KEY_TYPE_AES:PSA_WANT_ALG_CBC_NO_PADDING:PSA_WANT_ALG_SHA_256:MBEDTLS_RSA_C:PSA_WANT_ECC_SECP_R1_384:MBEDTLS_SSL_PROTO_DTLS:MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED
+depends_on:PSA_WANT_KEY_TYPE_AES:PSA_WANT_ALG_CBC_NO_PADDING:PSA_WANT_ALG_SHA_256:PSA_HAVE_ALG_SOME_RSA_SIGN:PSA_WANT_ECC_SECP_R1_384:MBEDTLS_SSL_PROTO_DTLS:MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED
 handshake_cipher:"TLS-ECDHE-RSA-WITH-AES-128-CBC-SHA256":MBEDTLS_PK_RSA:1

 DTLS Handshake, ECDHE-RSA-WITH-AES-256-CBC-SHA384
-depends_on:PSA_WANT_KEY_TYPE_AES:PSA_WANT_ALG_CBC_NO_PADDING:PSA_WANT_ALG_SHA_384:MBEDTLS_RSA_C:PSA_WANT_ECC_SECP_R1_384:MBEDTLS_SSL_PROTO_DTLS:MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED:!MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH
+depends_on:PSA_WANT_KEY_TYPE_AES:PSA_WANT_ALG_CBC_NO_PADDING:PSA_WANT_ALG_SHA_384:PSA_HAVE_ALG_SOME_RSA_SIGN:PSA_WANT_ECC_SECP_R1_384:MBEDTLS_SSL_PROTO_DTLS:MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED:!MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH
 handshake_cipher:"TLS-ECDHE-RSA-WITH-AES-256-CBC-SHA384":MBEDTLS_PK_RSA:1

 DTLS Handshake, ECDHE-ECDSA-WITH-AES-256-CCM
@@ -405,7 +405,7 @@ depends_on:PSA_WANT_KEY_TYPE_AES:PSA_WANT_ALG_CCM:PSA_WANT_ECC_SECP_R1_256:PSA_W
 handshake_cipher:"TLS-ECDHE-ECDSA-WITH-AES-256-CCM":MBEDTLS_PK_ECDSA:1

 DTLS Handshake, PSK-WITH-AES-128-CBC-SHA
-depends_on:PSA_WANT_KEY_TYPE_AES:PSA_WANT_ALG_CBC_NO_PADDING:MBEDTLS_RSA_C:PSA_WANT_ECC_SECP_R1_384:MBEDTLS_SSL_PROTO_DTLS:PSA_WANT_ALG_SHA_1:MBEDTLS_KEY_EXCHANGE_PSK_ENABLED
+depends_on:PSA_WANT_KEY_TYPE_AES:PSA_WANT_ALG_CBC_NO_PADDING:PSA_HAVE_ALG_SOME_RSA_SIGN:PSA_WANT_ECC_SECP_R1_384:MBEDTLS_SSL_PROTO_DTLS:PSA_WANT_ALG_SHA_1:MBEDTLS_KEY_EXCHANGE_PSK_ENABLED
 handshake_psk_cipher:"TLS-PSK-WITH-AES-128-CBC-SHA":MBEDTLS_PK_RSA:"abc123":1

 DTLS Handshake with serialization, tls1_2
@@ -424,31 +424,31 @@ depends_on:MBEDTLS_SSL_PROTO_TLS1_2:!MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_CAN_HANDLE
 handshake_version:0:MBEDTLS_SSL_VERSION_UNKNOWN:MBEDTLS_SSL_VERSION_UNKNOWN:MBEDTLS_SSL_VERSION_UNKNOWN:MBEDTLS_SSL_VERSION_UNKNOWN:MBEDTLS_SSL_VERSION_TLS1_2

 Handshake min/max version check, all -> 1.3
-depends_on:MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_TEST_AT_LEAST_ONE_TLS1_3_CIPHERSUITE:MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED:MBEDTLS_PKCS1_V21:MBEDTLS_X509_RSASSA_PSS_SUPPORT
+depends_on:MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_TEST_AT_LEAST_ONE_TLS1_3_CIPHERSUITE:MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED:PSA_WANT_ALG_RSA_PSS:MBEDTLS_X509_RSASSA_PSS_SUPPORT
 handshake_version:0:MBEDTLS_SSL_VERSION_UNKNOWN:MBEDTLS_SSL_VERSION_UNKNOWN:MBEDTLS_SSL_VERSION_UNKNOWN:MBEDTLS_SSL_VERSION_UNKNOWN:MBEDTLS_SSL_VERSION_TLS1_3

 Handshake, select ECDHE-RSA-WITH-AES-256-GCM-SHA384, non-opaque
-depends_on:PSA_WANT_ALG_SHA_384:PSA_WANT_KEY_TYPE_AES:PSA_WANT_ALG_GCM:MBEDTLS_RSA_C:PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY:PSA_WANT_ECC_SECP_R1_384:MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED:!MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH
+depends_on:PSA_WANT_ALG_SHA_384:PSA_WANT_KEY_TYPE_AES:PSA_WANT_ALG_GCM:PSA_HAVE_ALG_SOME_RSA_SIGN:PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY:PSA_WANT_ECC_SECP_R1_384:MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED:!MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH
 handshake_ciphersuite_select:"TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384":MBEDTLS_PK_RSA:"":PSA_ALG_NONE:PSA_ALG_NONE:0:0:MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

 Handshake, select ECDHE-RSA-WITH-AES-256-GCM-SHA384, opaque, PSA_ALG_ANY_HASH
-depends_on:PSA_WANT_ALG_SHA_384:PSA_WANT_KEY_TYPE_AES:PSA_WANT_ALG_GCM:MBEDTLS_RSA_C:PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY:PSA_WANT_ECC_SECP_R1_384:MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED:!MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH
+depends_on:PSA_WANT_ALG_SHA_384:PSA_WANT_KEY_TYPE_AES:PSA_WANT_ALG_GCM:PSA_HAVE_ALG_SOME_RSA_SIGN:PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY:PSA_WANT_ECC_SECP_R1_384:MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED:!MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH
 handshake_ciphersuite_select:"TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384":MBEDTLS_PK_RSA:"":PSA_ALG_RSA_PKCS1V15_SIGN(PSA_ALG_ANY_HASH):PSA_ALG_NONE:PSA_KEY_USAGE_SIGN_HASH:0:MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

 Handshake, select ECDHE-RSA-WITH-AES-256-GCM-SHA384, opaque, PSA_ALG_SHA_384
-depends_on:PSA_WANT_ALG_SHA_384:PSA_WANT_KEY_TYPE_AES:PSA_WANT_ALG_GCM:MBEDTLS_RSA_C:PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY:PSA_WANT_ECC_SECP_R1_384:MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED:!MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH
+depends_on:PSA_WANT_ALG_SHA_384:PSA_WANT_KEY_TYPE_AES:PSA_WANT_ALG_GCM:PSA_HAVE_ALG_SOME_RSA_SIGN:PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY:PSA_WANT_ECC_SECP_R1_384:MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED:!MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH
 handshake_ciphersuite_select:"TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384":MBEDTLS_PK_RSA:"":PSA_ALG_RSA_PKCS1V15_SIGN(PSA_ALG_SHA_384):PSA_ALG_NONE:PSA_KEY_USAGE_SIGN_HASH:0:MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

 Handshake, select ECDHE-RSA-WITH-AES-256-GCM-SHA384, opaque, invalid alg
-depends_on:PSA_WANT_ALG_SHA_384:PSA_WANT_KEY_TYPE_AES:PSA_WANT_ALG_GCM:MBEDTLS_RSA_C:PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY:PSA_WANT_ECC_SECP_R1_384:MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED:!MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH
+depends_on:PSA_WANT_ALG_SHA_384:PSA_WANT_KEY_TYPE_AES:PSA_WANT_ALG_GCM:PSA_HAVE_ALG_SOME_RSA_SIGN:PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY:PSA_WANT_ECC_SECP_R1_384:MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED:!MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH
 handshake_ciphersuite_select:"TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384":MBEDTLS_PK_RSA:"":PSA_ALG_RSA_PKCS1V15_SIGN(PSA_ALG_SHA_256):PSA_ALG_NONE:PSA_KEY_USAGE_SIGN_HASH:MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE:0

 Handshake, select ECDHE-RSA-WITH-AES-256-GCM-SHA384, opaque, bad alg
-depends_on:PSA_WANT_ALG_SHA_384:PSA_WANT_KEY_TYPE_AES:PSA_WANT_ALG_GCM:MBEDTLS_RSA_C:PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY:PSA_WANT_ECC_SECP_R1_384:MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED:!MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH
+depends_on:PSA_WANT_ALG_SHA_384:PSA_WANT_KEY_TYPE_AES:PSA_WANT_ALG_GCM:PSA_HAVE_ALG_SOME_RSA_SIGN:PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY:PSA_WANT_ECC_SECP_R1_384:MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED:!MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH
 handshake_ciphersuite_select:"TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384":MBEDTLS_PK_RSA:"":PSA_ALG_RSA_PSS(PSA_ALG_ANY_HASH):PSA_ALG_NONE:PSA_KEY_USAGE_SIGN_HASH:MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE:0

 Handshake, select ECDHE-RSA-WITH-AES-256-GCM-SHA384, opaque, bad usage
-depends_on:PSA_WANT_ALG_SHA_384:PSA_WANT_KEY_TYPE_AES:PSA_WANT_ALG_GCM:MBEDTLS_RSA_C:PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY:PSA_WANT_ECC_SECP_R1_384:MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED:!MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH
+depends_on:PSA_WANT_ALG_SHA_384:PSA_WANT_KEY_TYPE_AES:PSA_WANT_ALG_GCM:PSA_HAVE_ALG_SOME_RSA_SIGN:PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY:PSA_WANT_ECC_SECP_R1_384:MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED:!MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH
 handshake_ciphersuite_select:"TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384":MBEDTLS_PK_RSA:"":PSA_ALG_RSA_PKCS1V15_SIGN(PSA_ALG_ANY_HASH):PSA_ALG_NONE:PSA_KEY_USAGE_DERIVE:MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE:0

 Handshake, select ECDHE-ECDSA-WITH-AES-256-CCM, non-opaque
@@ -569,51 +569,51 @@ DTLS serialization with MFL=4096
 resize_buffers_serialize_mfl:MBEDTLS_SSL_MAX_FRAG_LEN_4096

 DTLS no legacy renegotiation with MFL=512
-depends_on:MBEDTLS_PKCS1_V15:MBEDTLS_CAN_HANDLE_RSA_TEST_KEY
+depends_on:PSA_HAVE_ALG_SOME_RSA_SIGN:MBEDTLS_CAN_HANDLE_RSA_TEST_KEY
 resize_buffers_renegotiate_mfl:MBEDTLS_SSL_MAX_FRAG_LEN_512:MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION:""

 DTLS no legacy renegotiation with MFL=1024
-depends_on:MBEDTLS_PKCS1_V15:MBEDTLS_CAN_HANDLE_RSA_TEST_KEY
+depends_on:PSA_HAVE_ALG_SOME_RSA_SIGN:MBEDTLS_CAN_HANDLE_RSA_TEST_KEY
 resize_buffers_renegotiate_mfl:MBEDTLS_SSL_MAX_FRAG_LEN_1024:MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION:""

 DTLS no legacy renegotiation with MFL=2048
-depends_on:MBEDTLS_PKCS1_V15:MBEDTLS_CAN_HANDLE_RSA_TEST_KEY
+depends_on:PSA_HAVE_ALG_SOME_RSA_SIGN:MBEDTLS_CAN_HANDLE_RSA_TEST_KEY
 resize_buffers_renegotiate_mfl:MBEDTLS_SSL_MAX_FRAG_LEN_2048:MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION:""

 DTLS no legacy renegotiation with MFL=4096
-depends_on:MBEDTLS_PKCS1_V15:MBEDTLS_CAN_HANDLE_RSA_TEST_KEY
+depends_on:PSA_HAVE_ALG_SOME_RSA_SIGN:MBEDTLS_CAN_HANDLE_RSA_TEST_KEY
 resize_buffers_renegotiate_mfl:MBEDTLS_SSL_MAX_FRAG_LEN_4096:MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION:""

 DTLS legacy allow renegotiation with MFL=512
-depends_on:MBEDTLS_PKCS1_V15:MBEDTLS_CAN_HANDLE_RSA_TEST_KEY
+depends_on:PSA_HAVE_ALG_SOME_RSA_SIGN:MBEDTLS_CAN_HANDLE_RSA_TEST_KEY
 resize_buffers_renegotiate_mfl:MBEDTLS_SSL_MAX_FRAG_LEN_512:MBEDTLS_SSL_LEGACY_ALLOW_RENEGOTIATION:""

 DTLS legacy allow renegotiation with MFL=1024
-depends_on:MBEDTLS_PKCS1_V15:MBEDTLS_CAN_HANDLE_RSA_TEST_KEY
+depends_on:PSA_HAVE_ALG_SOME_RSA_SIGN:MBEDTLS_CAN_HANDLE_RSA_TEST_KEY
 resize_buffers_renegotiate_mfl:MBEDTLS_SSL_MAX_FRAG_LEN_1024:MBEDTLS_SSL_LEGACY_ALLOW_RENEGOTIATION:""

 DTLS legacy allow renegotiation with MFL=2048
-depends_on:MBEDTLS_PKCS1_V15:MBEDTLS_CAN_HANDLE_RSA_TEST_KEY
+depends_on:PSA_HAVE_ALG_SOME_RSA_SIGN:MBEDTLS_CAN_HANDLE_RSA_TEST_KEY
 resize_buffers_renegotiate_mfl:MBEDTLS_SSL_MAX_FRAG_LEN_2048:MBEDTLS_SSL_LEGACY_ALLOW_RENEGOTIATION:""

 DTLS legacy allow renegotiation with MFL=4096
-depends_on:MBEDTLS_PKCS1_V15:MBEDTLS_CAN_HANDLE_RSA_TEST_KEY
+depends_on:PSA_HAVE_ALG_SOME_RSA_SIGN:MBEDTLS_CAN_HANDLE_RSA_TEST_KEY
 resize_buffers_renegotiate_mfl:MBEDTLS_SSL_MAX_FRAG_LEN_4096:MBEDTLS_SSL_LEGACY_ALLOW_RENEGOTIATION:""

 DTLS legacy break handshake renegotiation with MFL=512
-depends_on:MBEDTLS_PKCS1_V15:MBEDTLS_CAN_HANDLE_RSA_TEST_KEY
+depends_on:PSA_HAVE_ALG_SOME_RSA_SIGN:MBEDTLS_CAN_HANDLE_RSA_TEST_KEY
 resize_buffers_renegotiate_mfl:MBEDTLS_SSL_MAX_FRAG_LEN_512:MBEDTLS_SSL_LEGACY_BREAK_HANDSHAKE:""

 DTLS legacy break handshake renegotiation with MFL=1024
-depends_on:MBEDTLS_PKCS1_V15:MBEDTLS_CAN_HANDLE_RSA_TEST_KEY
+depends_on:PSA_HAVE_ALG_SOME_RSA_SIGN:MBEDTLS_CAN_HANDLE_RSA_TEST_KEY
 resize_buffers_renegotiate_mfl:MBEDTLS_SSL_MAX_FRAG_LEN_1024:MBEDTLS_SSL_LEGACY_BREAK_HANDSHAKE:""

 DTLS legacy break handshake renegotiation with MFL=2048
-depends_on:MBEDTLS_PKCS1_V15:MBEDTLS_CAN_HANDLE_RSA_TEST_KEY
+depends_on:PSA_HAVE_ALG_SOME_RSA_SIGN:MBEDTLS_CAN_HANDLE_RSA_TEST_KEY
 resize_buffers_renegotiate_mfl:MBEDTLS_SSL_MAX_FRAG_LEN_2048:MBEDTLS_SSL_LEGACY_BREAK_HANDSHAKE:""

 DTLS legacy break handshake renegotiation with MFL=4096
-depends_on:MBEDTLS_PKCS1_V15:MBEDTLS_CAN_HANDLE_RSA_TEST_KEY
+depends_on:PSA_HAVE_ALG_SOME_RSA_SIGN:MBEDTLS_CAN_HANDLE_RSA_TEST_KEY
 resize_buffers_renegotiate_mfl:MBEDTLS_SSL_MAX_FRAG_LEN_4096:MBEDTLS_SSL_LEGACY_BREAK_HANDSHAKE:""

 DTLS no legacy renegotiation with MFL=512, ECDHE-RSA-WITH-AES-256-GCM-SHA384
@@ -3528,6 +3528,9 @@ ssl_tls_exporter_too_early:MBEDTLS_SSL_VERSION_TLS1_3:1:MBEDTLS_SSL_SERVER_CERTI
 TLS fatal alert getter
 ssl_get_alert_after_fatal

+Default verify_result before doing a handshake
+verify_result_without_handshake
+
 TLS 1.3 - HRR then TLS 1.2 second ClientHello
 tls13_hrr_then_tls12_second_client_hello

@@ -2870,7 +2870,7 @@ exit:
 }
 /* END_CASE */

-/* BEGIN_CASE depends_on:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED:MBEDTLS_RSA_C:PSA_WANT_ECC_SECP_R1_384:!MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_PKCS1_V15:PSA_WANT_ALG_SHA_256 */
+/* BEGIN_CASE depends_on:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED:PSA_HAVE_ALG_SOME_RSA_SIGN:PSA_WANT_ECC_SECP_R1_384:!MBEDTLS_SSL_PROTO_TLS1_3:PSA_WANT_ALG_SHA_256 */
 void mbedtls_endpoint_sanity(int endpoint_type)
 {
    enum { BUFFSIZE = 1024 };
@@ -2900,7 +2900,7 @@ exit:
 }
 /* END_CASE */

-/* BEGIN_CASE depends_on:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED:MBEDTLS_RSA_C:PSA_WANT_ECC_SECP_R1_384:MBEDTLS_PKCS1_V15:PSA_WANT_ALG_SHA_256:PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY */
+/* BEGIN_CASE depends_on:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED:PSA_HAVE_ALG_SOME_RSA_SIGN:PSA_WANT_ECC_SECP_R1_384:PSA_WANT_ALG_SHA_256:PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY */
 void move_handshake_to_state(int endpoint_type, int tls_version, int state, int need_pass)
 {
    enum { BUFFSIZE = 1024 };
@@ -2972,7 +2972,7 @@ exit:
 }
 /* END_CASE */

-/* BEGIN_CASE depends_on:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED:MBEDTLS_PKCS1_V15:MBEDTLS_RSA_C:PSA_WANT_ECC_SECP_R1_384:PSA_WANT_ALG_SHA_256:PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY:MBEDTLS_CAN_HANDLE_RSA_TEST_KEY */
+/* BEGIN_CASE depends_on:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED:PSA_HAVE_ALG_SOME_RSA_SIGN:PSA_WANT_ECC_SECP_R1_384:PSA_WANT_ALG_SHA_256:PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY:MBEDTLS_CAN_HANDLE_RSA_TEST_KEY */
 void handshake_version(int dtls, int client_min_version, int client_max_version,
                       int server_min_version, int server_max_version,
                       int expected_negotiated_version)
@@ -2997,7 +2997,7 @@ exit:
 }
 /* END_CASE */

-/* BEGIN_CASE depends_on:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED:MBEDTLS_PKCS1_V15:MBEDTLS_SSL_PROTO_TLS1_2:PSA_WANT_ALG_SHA_256 */
+/* BEGIN_CASE depends_on:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED:MBEDTLS_SSL_PROTO_TLS1_2:PSA_WANT_ALG_SHA_256 */
 void handshake_psk_cipher(char *cipher, int pk_alg, data_t *psk_str, int dtls)
 {
    mbedtls_test_handshake_test_options options;
@@ -3022,7 +3022,7 @@ exit:
 }
 /* END_CASE */

-/* BEGIN_CASE depends_on:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED:MBEDTLS_PKCS1_V15:MBEDTLS_SSL_PROTO_TLS1_2:PSA_WANT_ALG_SHA_256 */
+/* BEGIN_CASE depends_on:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED:PSA_HAVE_ALG_SOME_RSA_SIGN:MBEDTLS_SSL_PROTO_TLS1_2:PSA_WANT_ALG_SHA_256 */
 void handshake_cipher(char *cipher, int pk_alg, int dtls)
 {
    test_handshake_psk_cipher(cipher, pk_alg, NULL, dtls);
@@ -3032,7 +3032,7 @@ void handshake_cipher(char *cipher, int pk_alg, int dtls)
 }
 /* END_CASE */

-/* BEGIN_CASE depends_on:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED:MBEDTLS_PKCS1_V15:MBEDTLS_SSL_PROTO_TLS1_2:PSA_WANT_ALG_SHA_256 */
+/* BEGIN_CASE depends_on:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED:PSA_HAVE_ALG_SOME_RSA_SIGN:MBEDTLS_SSL_PROTO_TLS1_2:PSA_WANT_ALG_SHA_256 */
 void handshake_ciphersuite_select(char *cipher, int pk_alg, data_t *psk_str,
                                  int psa_alg, int psa_alg2, int psa_usage,
                                  int expected_handshake_result,
@@ -3065,7 +3065,7 @@ exit:
 }
 /* END_CASE */

-/* BEGIN_CASE depends_on:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED:MBEDTLS_PKCS1_V15:MBEDTLS_RSA_C:PSA_WANT_ECC_SECP_R1_384:PSA_WANT_ALG_SHA_256 */
+/* BEGIN_CASE depends_on:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED:PSA_HAVE_ALG_SOME_RSA_SIGN:PSA_WANT_ECC_SECP_R1_384:PSA_WANT_ALG_SHA_256 */
 void app_data(int mfl, int cli_msg_len, int srv_msg_len,
              int expected_cli_fragments,
              int expected_srv_fragments, int dtls)
@@ -3094,7 +3094,7 @@ exit:
 }
 /* END_CASE */

-/* BEGIN_CASE depends_on:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED:MBEDTLS_PKCS1_V15:MBEDTLS_RSA_C:PSA_WANT_ECC_SECP_R1_384:PSA_WANT_ALG_SHA_256:PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY:MBEDTLS_CAN_HANDLE_RSA_TEST_KEY */
+/* BEGIN_CASE depends_on:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED:PSA_HAVE_ALG_SOME_RSA_SIGN:PSA_WANT_ECC_SECP_R1_384:PSA_WANT_ALG_SHA_256:PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY:MBEDTLS_CAN_HANDLE_RSA_TEST_KEY */
 void app_data_tls(int mfl, int cli_msg_len, int srv_msg_len,
                  int expected_cli_fragments,
                  int expected_srv_fragments)
@@ -3106,7 +3106,7 @@ void app_data_tls(int mfl, int cli_msg_len, int srv_msg_len,
 }
 /* END_CASE */

-/* BEGIN_CASE depends_on:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED:!MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_PKCS1_V15:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_RSA_C:PSA_WANT_ECC_SECP_R1_384:MBEDTLS_SSL_PROTO_DTLS:PSA_WANT_ALG_SHA_256:MBEDTLS_CAN_HANDLE_RSA_TEST_KEY */
+/* BEGIN_CASE depends_on:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED:!MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_SSL_PROTO_TLS1_2:PSA_HAVE_ALG_SOME_RSA_SIGN:PSA_WANT_ECC_SECP_R1_384:MBEDTLS_SSL_PROTO_DTLS:PSA_WANT_ALG_SHA_256:MBEDTLS_CAN_HANDLE_RSA_TEST_KEY */
 void app_data_dtls(int mfl, int cli_msg_len, int srv_msg_len,
                   int expected_cli_fragments,
                   int expected_srv_fragments)
@@ -3118,7 +3118,7 @@ void app_data_dtls(int mfl, int cli_msg_len, int srv_msg_len,
 }
 /* END_CASE */

-/* BEGIN_CASE depends_on:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED:MBEDTLS_PKCS1_V15:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_RSA_C:PSA_WANT_ECC_SECP_R1_384:MBEDTLS_SSL_PROTO_DTLS:MBEDTLS_SSL_RENEGOTIATION:MBEDTLS_SSL_CONTEXT_SERIALIZATION:PSA_WANT_ALG_SHA_256:MBEDTLS_CAN_HANDLE_RSA_TEST_KEY:TEST_GCM_OR_CHACHAPOLY_ENABLED */
+/* BEGIN_CASE depends_on:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED:MBEDTLS_SSL_PROTO_TLS1_2:PSA_HAVE_ALG_SOME_RSA_SIGN:PSA_WANT_ECC_SECP_R1_384:MBEDTLS_SSL_PROTO_DTLS:MBEDTLS_SSL_RENEGOTIATION:MBEDTLS_SSL_CONTEXT_SERIALIZATION:PSA_WANT_ALG_SHA_256:MBEDTLS_CAN_HANDLE_RSA_TEST_KEY:TEST_GCM_OR_CHACHAPOLY_ENABLED */
 void handshake_serialization()
 {
    mbedtls_test_handshake_test_options options;
@@ -3135,7 +3135,7 @@ exit:
 }
 /* END_CASE */

-/* BEGIN_CASE depends_on:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED:!MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_PKCS1_V15:MBEDTLS_RSA_C:PSA_WANT_KEY_TYPE_AES:PSA_WANT_ECC_SECP_R1_384:MBEDTLS_DEBUG_C:MBEDTLS_SSL_MAX_FRAGMENT_LENGTH:PSA_WANT_ALG_CBC_NO_PADDING:PSA_WANT_ALG_SHA_384:MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED */
+/* BEGIN_CASE depends_on:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED:!MBEDTLS_SSL_PROTO_TLS1_3:PSA_HAVE_ALG_SOME_RSA_SIGN:PSA_WANT_KEY_TYPE_AES:PSA_WANT_ECC_SECP_R1_384:MBEDTLS_DEBUG_C:MBEDTLS_SSL_MAX_FRAGMENT_LENGTH:PSA_WANT_ALG_CBC_NO_PADDING:PSA_WANT_ALG_SHA_384:MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED */
 void handshake_fragmentation(int mfl,
                             int expected_srv_hs_fragmentation,
                             int expected_cli_hs_fragmentation)
@@ -3332,7 +3332,7 @@ exit:
 }
 /* END_CASE */

-/* BEGIN_CASE depends_on:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED:!MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_PKCS1_V15:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_RSA_C:PSA_WANT_ECC_SECP_R1_384:MBEDTLS_SSL_PROTO_DTLS:MBEDTLS_SSL_RENEGOTIATION:PSA_WANT_ALG_SHA_256:MBEDTLS_CAN_HANDLE_RSA_TEST_KEY */
+/* BEGIN_CASE depends_on:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED:!MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_SSL_PROTO_TLS1_2:PSA_HAVE_ALG_SOME_RSA_SIGN:PSA_WANT_ECC_SECP_R1_384:MBEDTLS_SSL_PROTO_DTLS:MBEDTLS_SSL_RENEGOTIATION:PSA_WANT_ALG_SHA_256:MBEDTLS_CAN_HANDLE_RSA_TEST_KEY */
 void renegotiation(int legacy_renegotiation)
 {
    mbedtls_test_handshake_test_options options;
@@ -3633,7 +3633,7 @@ exit:;
 }
 /* END_CASE */

-/* BEGIN_CASE depends_on:MBEDTLS_SSL_SRV_C:MBEDTLS_SSL_CACHE_C:!MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_DEBUG_C:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED:MBEDTLS_RSA_C:PSA_WANT_ECC_SECP_R1_384:MBEDTLS_PKCS1_V15:PSA_WANT_ALG_SHA_256 */
+/* BEGIN_CASE depends_on:MBEDTLS_SSL_SRV_C:MBEDTLS_SSL_CACHE_C:!MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_DEBUG_C:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED:PSA_HAVE_ALG_SOME_RSA_SIGN:PSA_WANT_ECC_SECP_R1_384:PSA_WANT_ALG_SHA_256 */
 void force_bad_session_id_len()
 {
    enum { BUFFSIZE = 1024 };
@@ -3827,7 +3827,7 @@ exit:
 }
 /* END_CASE */

-/* BEGIN_CASE depends_on:MBEDTLS_PSA_CRYPTO_C:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED:MBEDTLS_PKCS1_V15:MBEDTLS_SSL_PROTO_TLS1_2:PSA_WANT_ECC_SECP_R1_256:MBEDTLS_RSA_C:PSA_WANT_ECC_SECP_R1_384:PSA_HAVE_ALG_SOME_ECDSA:PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_IMPORT */
+/* BEGIN_CASE depends_on:MBEDTLS_PSA_CRYPTO_C:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED:MBEDTLS_SSL_PROTO_TLS1_2:PSA_WANT_ECC_SECP_R1_256:PSA_HAVE_ALG_SOME_RSA_SIGN:PSA_WANT_ECC_SECP_R1_384:PSA_HAVE_ALG_SOME_ECDSA:PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_IMPORT */
 void raw_key_agreement_fail(int bad_server_ecdhe_key)
 {
    enum { BUFFSIZE = 17000 };
@@ -6169,6 +6169,49 @@ exit:
 }
 /* END_CASE */

+/* BEGIN_CASE depends_on:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED */
+void verify_result_without_handshake(void)
+{
+    /* Test the result of verification before we perform a handshake. */
+    mbedtls_ssl_context ssl;
+    mbedtls_ssl_config conf;
+
+    PSA_INIT();
+
+    mbedtls_ssl_init(&ssl);
+    mbedtls_ssl_config_init(&conf);
+
+    TEST_EQUAL(mbedtls_ssl_config_defaults(&conf,
+                                           MBEDTLS_SSL_IS_CLIENT,
+                                           MBEDTLS_SSL_TRANSPORT_STREAM,
+                                           MBEDTLS_SSL_PRESET_DEFAULT), 0);
+
+    mbedtls_ssl_conf_authmode(&conf, MBEDTLS_SSL_VERIFY_OPTIONAL);
+    mbedtls_ssl_conf_ca_chain(&conf, NULL, NULL);
+
+    TEST_EQUAL(mbedtls_ssl_setup(&ssl, &conf), 0);
+
+    uint32_t verify_result = mbedtls_ssl_get_verify_result(&ssl);
+
+    TEST_EQUAL(verify_result, 0xFFFFFFFF);
+
+    /* Set the verify result manually and check that session_free resets it. */
+
+    /* Set the verify result to 0. */
+    ssl.session_negotiate->verify_result = 0;
+
+    mbedtls_ssl_session_free(ssl.session_negotiate);
+
+    verify_result = mbedtls_ssl_get_verify_result(&ssl);
+    TEST_EQUAL(verify_result, 0xFFFFFFFF);
+
+exit:
+    mbedtls_ssl_config_free(&conf);
+    mbedtls_ssl_free(&ssl);
+    PSA_DONE();
+}
+/* END_CASE */
+
 /* BEGIN_CASE depends_on:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_SSL_CLI_C:MBEDTLS_SSL_SRV_C:MBEDTLS_TEST_HAS_TLS1_3_CHACHA20_POLY1305_SHA256:MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED:MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED:PSA_WANT_ALG_SHA_256:PSA_WANT_ECC_SECP_R1_256:PSA_WANT_ECC_SECP_R1_384:PSA_HAVE_ALG_ECDSA_VERIFY:MBEDTLS_SSL_SESSION_TICKETS:MBEDTLS_DEBUG_C */
 void tls13_hrr_then_tls12_second_client_hello()
 {
@@ -1,8 +1,8 @@
 Check compile time library version
-check_compiletime_version:"4.0.0"
+check_compiletime_version:"4.1.0"

 Check runtime library version
-check_runtime_version:"4.0.0"
+check_runtime_version:"4.1.0"

 Check for MBEDTLS_VERSION_C
 check_feature:"MBEDTLS_VERSION_C":0
@@ -1,49 +1,49 @@
 Certificate Request check Server1 SHA1
-depends_on:PSA_WANT_ALG_SHA_1:MBEDTLS_RSA_C:MBEDTLS_PKCS1_V15
+depends_on:PSA_WANT_ALG_SHA_1:PSA_HAVE_ALG_RSA_PKCS1V15_SIGN
 x509_csr_check:"../framework/data_files/server1.key":"../framework/data_files/server1.req.sha1":MBEDTLS_MD_SHA1:0:0:0:0:0

 Certificate Request check Server1 SHA224
-depends_on:PSA_WANT_ALG_SHA_224:MBEDTLS_RSA_C:MBEDTLS_PKCS1_V15
+depends_on:PSA_WANT_ALG_SHA_224:PSA_HAVE_ALG_RSA_PKCS1V15_SIGN
 x509_csr_check:"../framework/data_files/server1.key":"../framework/data_files/server1.req.sha224":MBEDTLS_MD_SHA224:0:0:0:0:0

 Certificate Request check Server1 SHA256
-depends_on:PSA_WANT_ALG_SHA_256:MBEDTLS_RSA_C:MBEDTLS_PKCS1_V15
+depends_on:PSA_WANT_ALG_SHA_256:PSA_HAVE_ALG_RSA_PKCS1V15_SIGN
 x509_csr_check:"../framework/data_files/server1.key":"../framework/data_files/server1.req.sha256":MBEDTLS_MD_SHA256:0:0:0:0:0

 Certificate Request check Server1 SHA384
-depends_on:PSA_WANT_ALG_SHA_384:MBEDTLS_RSA_C:MBEDTLS_PKCS1_V15
+depends_on:PSA_WANT_ALG_SHA_384:PSA_HAVE_ALG_RSA_PKCS1V15_SIGN
 x509_csr_check:"../framework/data_files/server1.key":"../framework/data_files/server1.req.sha384":MBEDTLS_MD_SHA384:0:0:0:0:0

 Certificate Request check Server1 SHA512
-depends_on:PSA_WANT_ALG_SHA_512:MBEDTLS_RSA_C:MBEDTLS_PKCS1_V15
+depends_on:PSA_WANT_ALG_SHA_512:PSA_HAVE_ALG_RSA_PKCS1V15_SIGN
 x509_csr_check:"../framework/data_files/server1.key":"../framework/data_files/server1.req.sha512":MBEDTLS_MD_SHA512:0:0:0:0:0

 Certificate Request check Server1 MD5
-depends_on:PSA_WANT_ALG_MD5:MBEDTLS_RSA_C:MBEDTLS_PKCS1_V15
+depends_on:PSA_WANT_ALG_MD5:PSA_HAVE_ALG_RSA_PKCS1V15_SIGN
 x509_csr_check:"../framework/data_files/server1.key":"../framework/data_files/server1.req.md5":MBEDTLS_MD_MD5:0:0:0:0:0

 Certificate Request check Server1 key_usage
-depends_on:PSA_WANT_ALG_SHA_1:MBEDTLS_RSA_C:MBEDTLS_PKCS1_V15
+depends_on:PSA_WANT_ALG_SHA_1:PSA_HAVE_ALG_RSA_PKCS1V15_SIGN
 x509_csr_check:"../framework/data_files/server1.key":"../framework/data_files/server1.req.key_usage":MBEDTLS_MD_SHA1:MBEDTLS_X509_KU_DIGITAL_SIGNATURE | MBEDTLS_X509_KU_NON_REPUDIATION | MBEDTLS_X509_KU_KEY_ENCIPHERMENT:1:0:0:0

 Certificate Request check opaque Server1 key_usage
-depends_on:PSA_WANT_ALG_SHA_1:MBEDTLS_RSA_C:MBEDTLS_PKCS1_V15
+depends_on:PSA_WANT_ALG_SHA_1:PSA_HAVE_ALG_RSA_PKCS1V15_SIGN
 x509_csr_check_opaque:"../framework/data_files/server1.key":MBEDTLS_MD_SHA1:MBEDTLS_X509_KU_DIGITAL_SIGNATURE | MBEDTLS_X509_KU_NON_REPUDIATION:0

 Certificate Request check Server1 key_usage empty
-depends_on:PSA_WANT_ALG_SHA_1:MBEDTLS_RSA_C:MBEDTLS_PKCS1_V15
+depends_on:PSA_WANT_ALG_SHA_1:PSA_HAVE_ALG_RSA_PKCS1V15_SIGN
 x509_csr_check:"../framework/data_files/server1.key":"../framework/data_files/server1.req.key_usage_empty":MBEDTLS_MD_SHA1:0:1:0:0:0

 Certificate Request check Server1 ns_cert_type
-depends_on:PSA_WANT_ALG_SHA_1:MBEDTLS_RSA_C:MBEDTLS_PKCS1_V15
+depends_on:PSA_WANT_ALG_SHA_1:PSA_HAVE_ALG_RSA_PKCS1V15_SIGN
 x509_csr_check:"../framework/data_files/server1.key":"../framework/data_files/server1.req.cert_type":MBEDTLS_MD_SHA1:0:0:MBEDTLS_X509_NS_CERT_TYPE_SSL_SERVER:1:0

 Certificate Request check Server1 ns_cert_type empty
-depends_on:PSA_WANT_ALG_SHA_1:MBEDTLS_RSA_C:MBEDTLS_PKCS1_V15
+depends_on:PSA_WANT_ALG_SHA_1:PSA_HAVE_ALG_RSA_PKCS1V15_SIGN
 x509_csr_check:"../framework/data_files/server1.key":"../framework/data_files/server1.req.cert_type_empty":MBEDTLS_MD_SHA1:0:0:0:1:0

 Certificate Request check Server1 key_usage + ns_cert_type
-depends_on:PSA_WANT_ALG_SHA_1:MBEDTLS_RSA_C:MBEDTLS_PKCS1_V15
+depends_on:PSA_WANT_ALG_SHA_1:PSA_HAVE_ALG_RSA_PKCS1V15_SIGN
 x509_csr_check:"../framework/data_files/server1.key":"../framework/data_files/server1.req.ku-ct":MBEDTLS_MD_SHA1:MBEDTLS_X509_KU_DIGITAL_SIGNATURE | MBEDTLS_X509_KU_NON_REPUDIATION | MBEDTLS_X509_KU_KEY_ENCIPHERMENT:1:MBEDTLS_X509_NS_CERT_TYPE_SSL_SERVER:1:0

 Certificate Request check Server5 ECDSA, key_usage
@@ -51,7 +51,7 @@ depends_on:PSA_WANT_ALG_SHA_1:PSA_HAVE_ALG_ECDSA_SIGN:PSA_WANT_ALG_DETERMINISTIC
 x509_csr_check:"../framework/data_files/server5.key":"../framework/data_files/server5.req.ku.sha1":MBEDTLS_MD_SHA1:MBEDTLS_X509_KU_DIGITAL_SIGNATURE | MBEDTLS_X509_KU_NON_REPUDIATION:1:0:0:0

 Certificate Request check Server1, set_extension
-depends_on:PSA_WANT_ALG_SHA_256:MBEDTLS_RSA_C:MBEDTLS_PKCS1_V15
+depends_on:PSA_WANT_ALG_SHA_256:PSA_HAVE_ALG_RSA_PKCS1V15_SIGN
 x509_csr_check:"../framework/data_files/server1.key":"../framework/data_files/server1.req.sha256.ext":MBEDTLS_MD_SHA256:0:0:0:0:1

 Certificate Request check opaque Server5 ECDSA, key_usage
@@ -59,99 +59,99 @@ depends_on:PSA_WANT_ALG_SHA_256:PSA_HAVE_ALG_ECDSA_SIGN:PSA_WANT_ECC_SECP_R1_256
 x509_csr_check_opaque:"../framework/data_files/server5.key":MBEDTLS_MD_SHA256:MBEDTLS_X509_KU_DIGITAL_SIGNATURE | MBEDTLS_X509_KU_NON_REPUDIATION:0

 Certificate write check Server1 SHA1
-depends_on:MBEDTLS_RSA_C:MBEDTLS_PKCS1_V15:PSA_WANT_ALG_MD5
+depends_on:PSA_HAVE_ALG_RSA_PKCS1V15_SIGN:PSA_WANT_ALG_MD5
 x509_crt_check:"../framework/data_files/server1.key":"":"C=NL,O=PolarSSL,CN=PolarSSL Server 1":"../framework/data_files/test-ca_unenc.key":"PolarSSLTest":"C=NL,O=PolarSSL,CN=PolarSSL Test CA":"01":"20190210144406":"20290210144406":MBEDTLS_MD_SHA1:0:0:"NULL":0:0:1:-1:"../framework/data_files/server1.crt":0:0:"../framework/data_files/test-ca.crt":0

 Certificate write check Server1 SHA1, not before 1970
-depends_on:MBEDTLS_RSA_C:MBEDTLS_PKCS1_V15:PSA_WANT_ALG_MD5
+depends_on:PSA_HAVE_ALG_RSA_PKCS1V15_SIGN:PSA_WANT_ALG_MD5
 x509_crt_check:"../framework/data_files/server1.key":"":"C=NL,O=PolarSSL,CN=PolarSSL Server 1":"../framework/data_files/test-ca_unenc.key":"PolarSSLTest":"C=NL,O=PolarSSL,CN=PolarSSL Test CA":"01":"19700210144406":"20290210144406":MBEDTLS_MD_SHA1:0:0:"NULL":0:0:1:-1:"":0:0:"../framework/data_files/test-ca.crt":0

 Certificate write check Server1 SHA1, not after 2050
-depends_on:MBEDTLS_RSA_C:MBEDTLS_PKCS1_V15:PSA_WANT_ALG_MD5
+depends_on:PSA_HAVE_ALG_RSA_PKCS1V15_SIGN:PSA_WANT_ALG_MD5
 x509_crt_check:"../framework/data_files/server1.key":"":"C=NL,O=PolarSSL,CN=PolarSSL Server 1":"../framework/data_files/test-ca_unenc.key":"PolarSSLTest":"C=NL,O=PolarSSL,CN=PolarSSL Test CA":"01":"20190210144406":"20500210144406":MBEDTLS_MD_SHA1:0:0:"NULL":0:0:1:-1:"":0:0:"../framework/data_files/test-ca.crt":0

 Certificate write check Server1 SHA1, not before 1970, not after 2050
-depends_on:MBEDTLS_RSA_C:MBEDTLS_PKCS1_V15:PSA_WANT_ALG_MD5
+depends_on:PSA_HAVE_ALG_RSA_PKCS1V15_SIGN:PSA_WANT_ALG_MD5
 x509_crt_check:"../framework/data_files/server1.key":"":"C=NL,O=PolarSSL,CN=PolarSSL Server 1":"../framework/data_files/test-ca_unenc.key":"PolarSSLTest":"C=NL,O=PolarSSL,CN=PolarSSL Test CA":"01":"19700210144406":"20500210144406":MBEDTLS_MD_SHA1:0:0:"NULL":0:0:1:-1:"":0:0:"../framework/data_files/test-ca.crt":0

 Certificate write check Server1 SHA1, not before 2050, not after 2059
-depends_on:MBEDTLS_RSA_C:MBEDTLS_PKCS1_V15:PSA_WANT_ALG_MD5
+depends_on:PSA_HAVE_ALG_RSA_PKCS1V15_SIGN:PSA_WANT_ALG_MD5
 x509_crt_check:"../framework/data_files/server1.key":"":"C=NL,O=PolarSSL,CN=PolarSSL Server 1":"../framework/data_files/test-ca_unenc.key":"PolarSSLTest":"C=NL,O=PolarSSL,CN=PolarSSL Test CA":"01":"20500210144406":"20590210144406":MBEDTLS_MD_SHA1:0:0:"NULL":0:0:1:-1:"":0:0:"../framework/data_files/test-ca.crt":0

 Certificate write check Server1 SHA1, key_usage
-depends_on:MBEDTLS_RSA_C:MBEDTLS_PKCS1_V15:PSA_WANT_ALG_MD5
+depends_on:PSA_HAVE_ALG_RSA_PKCS1V15_SIGN:PSA_WANT_ALG_MD5
 x509_crt_check:"../framework/data_files/server1.key":"":"C=NL,O=PolarSSL,CN=PolarSSL Server 1":"../framework/data_files/test-ca_unenc.key":"PolarSSLTest":"C=NL,O=PolarSSL,CN=PolarSSL Test CA":"01":"20190210144406":"20290210144406":MBEDTLS_MD_SHA1:MBEDTLS_X509_KU_DIGITAL_SIGNATURE | MBEDTLS_X509_KU_NON_REPUDIATION | MBEDTLS_X509_KU_KEY_ENCIPHERMENT:1:"NULL":0:0:1:-1:"../framework/data_files/server1.key_usage.crt":0:0:"../framework/data_files/test-ca.crt":0

 Certificate write check Server1 SHA1, one ext_key_usage
-depends_on:MBEDTLS_RSA_C:MBEDTLS_PKCS1_V15:PSA_WANT_ALG_MD5
+depends_on:PSA_HAVE_ALG_RSA_PKCS1V15_SIGN:PSA_WANT_ALG_MD5
 x509_crt_check:"../framework/data_files/server1.key":"":"C=NL,O=PolarSSL,CN=PolarSSL Server 1":"../framework/data_files/test-ca_unenc.key":"PolarSSLTest":"C=NL,O=PolarSSL,CN=PolarSSL Test CA":"01":"20110212144406":"20210212144406":MBEDTLS_MD_SHA1:0:0:"serverAuth":0:0:1:-1:"../framework/data_files/server1.key_ext_usage.crt":0:0:"../framework/data_files/test-ca.crt":0

 Certificate write check Server1 SHA1, two ext_key_usages
-depends_on:MBEDTLS_RSA_C:MBEDTLS_PKCS1_V15:PSA_WANT_ALG_MD5
+depends_on:PSA_HAVE_ALG_RSA_PKCS1V15_SIGN:PSA_WANT_ALG_MD5
 x509_crt_check:"../framework/data_files/server1.key":"":"C=NL,O=PolarSSL,CN=PolarSSL Server 1":"../framework/data_files/test-ca_unenc.key":"PolarSSLTest":"C=NL,O=PolarSSL,CN=PolarSSL Test CA":"01":"20110212144406":"20210212144406":MBEDTLS_MD_SHA1:0:0:"codeSigning,timeStamping":0:0:1:-1:"../framework/data_files/server1.key_ext_usages.crt":0:0:"../framework/data_files/test-ca.crt":0

 Certificate write check Server1 SHA1, ns_cert_type
-depends_on:MBEDTLS_RSA_C:MBEDTLS_PKCS1_V15:PSA_WANT_ALG_MD5
+depends_on:PSA_HAVE_ALG_RSA_PKCS1V15_SIGN:PSA_WANT_ALG_MD5
 x509_crt_check:"../framework/data_files/server1.key":"":"C=NL,O=PolarSSL,CN=PolarSSL Server 1":"../framework/data_files/test-ca_unenc.key":"PolarSSLTest":"C=NL,O=PolarSSL,CN=PolarSSL Test CA":"01":"20190210144406":"20290210144406":MBEDTLS_MD_SHA1:0:0:"NULL":MBEDTLS_X509_NS_CERT_TYPE_SSL_SERVER:1:1:-1:"../framework/data_files/server1.cert_type.crt":0:0:"../framework/data_files/test-ca.crt":0

 Certificate write check Server1 SHA1, version 1
-depends_on:MBEDTLS_RSA_C:MBEDTLS_PKCS1_V15:PSA_WANT_ALG_MD5
+depends_on:PSA_HAVE_ALG_RSA_PKCS1V15_SIGN:PSA_WANT_ALG_MD5
 x509_crt_check:"../framework/data_files/server1.key":"":"C=NL,O=PolarSSL,CN=PolarSSL Server 1":"../framework/data_files/test-ca_unenc.key":"PolarSSLTest":"C=NL,O=PolarSSL,CN=PolarSSL Test CA":"01":"20190210144406":"20290210144406":MBEDTLS_MD_SHA1:0:0:"NULL":0:0:1:MBEDTLS_X509_CRT_VERSION_1:"../framework/data_files/server1.v1.crt":0:0:"../framework/data_files/test-ca.crt":0

 Certificate write check Server1 SHA1, CA
-depends_on:MBEDTLS_RSA_C:MBEDTLS_PKCS1_V15:PSA_WANT_ALG_MD5
+depends_on:PSA_HAVE_ALG_RSA_PKCS1V15_SIGN:PSA_WANT_ALG_MD5
 x509_crt_check:"../framework/data_files/server1.key":"":"C=NL,O=PolarSSL,CN=PolarSSL Server 1":"../framework/data_files/test-ca_unenc.key":"PolarSSLTest":"C=NL,O=PolarSSL,CN=PolarSSL Test CA":"01":"20190210144406":"20290210144406":MBEDTLS_MD_SHA1:0:0:"NULL":0:0:1:-1:"../framework/data_files/server1.ca.crt":0:1:"../framework/data_files/test-ca.crt":0

 Certificate write check Server1 SHA1, RSA_ALT
-depends_on:MBEDTLS_RSA_C:MBEDTLS_PKCS1_V15:PSA_WANT_ALG_MD5
+depends_on:PSA_HAVE_ALG_RSA_PKCS1V15_SIGN:PSA_WANT_ALG_MD5
 x509_crt_check:"../framework/data_files/server1.key":"":"C=NL,O=PolarSSL,CN=PolarSSL Server 1":"../framework/data_files/test-ca_unenc.key":"PolarSSLTest":"C=NL,O=PolarSSL,CN=PolarSSL Test CA":"01":"20190210144406":"20290210144406":MBEDTLS_MD_SHA1:0:0:"NULL":0:0:0:-1:"../framework/data_files/server1.noauthid.crt":1:0:"../framework/data_files/test-ca.crt":0

 Certificate write check Server1 SHA1, RSA_ALT, key_usage
-depends_on:MBEDTLS_RSA_C:MBEDTLS_PKCS1_V15:PSA_WANT_ALG_MD5
+depends_on:PSA_HAVE_ALG_RSA_PKCS1V15_SIGN:PSA_WANT_ALG_MD5
 x509_crt_check:"../framework/data_files/server1.key":"":"C=NL,O=PolarSSL,CN=PolarSSL Server 1":"../framework/data_files/test-ca_unenc.key":"PolarSSLTest":"C=NL,O=PolarSSL,CN=PolarSSL Test CA":"01":"20190210144406":"20290210144406":MBEDTLS_MD_SHA1:MBEDTLS_X509_KU_DIGITAL_SIGNATURE | MBEDTLS_X509_KU_NON_REPUDIATION | MBEDTLS_X509_KU_KEY_ENCIPHERMENT:1:"NULL":0:0:0:-1:"../framework/data_files/server1.key_usage_noauthid.crt":1:0:"../framework/data_files/test-ca.crt":0

 Certificate write check Server1 SHA1, RSA_ALT, ns_cert_type
-depends_on:MBEDTLS_RSA_C:MBEDTLS_PKCS1_V15:PSA_WANT_ALG_MD5
+depends_on:PSA_HAVE_ALG_RSA_PKCS1V15_SIGN:PSA_WANT_ALG_MD5
 x509_crt_check:"../framework/data_files/server1.key":"":"C=NL,O=PolarSSL,CN=PolarSSL Server 1":"../framework/data_files/test-ca_unenc.key":"PolarSSLTest":"C=NL,O=PolarSSL,CN=PolarSSL Test CA":"01":"20190210144406":"20290210144406":MBEDTLS_MD_SHA1:0:0:"NULL":MBEDTLS_X509_NS_CERT_TYPE_SSL_SERVER:1:0:-1:"../framework/data_files/server1.cert_type_noauthid.crt":1:0:"../framework/data_files/test-ca.crt":0

 Certificate write check Server1 SHA1, RSA_ALT, version 1
-depends_on:MBEDTLS_RSA_C:MBEDTLS_PKCS1_V15:PSA_WANT_ALG_MD5
+depends_on:PSA_HAVE_ALG_RSA_PKCS1V15_SIGN:PSA_WANT_ALG_MD5
 x509_crt_check:"../framework/data_files/server1.key":"":"C=NL,O=PolarSSL,CN=PolarSSL Server 1":"../framework/data_files/test-ca_unenc.key":"PolarSSLTest":"C=NL,O=PolarSSL,CN=PolarSSL Test CA":"01":"20190210144406":"20290210144406":MBEDTLS_MD_SHA1:0:0:"NULL":0:0:0:MBEDTLS_X509_CRT_VERSION_1:"../framework/data_files/server1.v1.crt":1:0:"../framework/data_files/test-ca.crt":0

 Certificate write check Server1 SHA1, RSA_ALT, CA
-depends_on:MBEDTLS_RSA_C:MBEDTLS_PKCS1_V15:PSA_WANT_ALG_MD5
+depends_on:PSA_HAVE_ALG_RSA_PKCS1V15_SIGN:PSA_WANT_ALG_MD5
 x509_crt_check:"../framework/data_files/server1.key":"":"C=NL,O=PolarSSL,CN=PolarSSL Server 1":"../framework/data_files/test-ca_unenc.key":"PolarSSLTest":"C=NL,O=PolarSSL,CN=PolarSSL Test CA":"01":"20190210144406":"20290210144406":MBEDTLS_MD_SHA1:0:0:"NULL":0:0:0:-1:"../framework/data_files/server1.ca_noauthid.crt":1:1:"../framework/data_files/test-ca.crt":0

 Certificate write check Server1 SHA1, Opaque
-depends_on:MBEDTLS_RSA_C:MBEDTLS_PKCS1_V15:PSA_WANT_ALG_MD5
+depends_on:PSA_HAVE_ALG_RSA_PKCS1V15_SIGN:PSA_WANT_ALG_MD5
 x509_crt_check:"../framework/data_files/server1.key":"":"C=NL,O=PolarSSL,CN=PolarSSL Server 1":"../framework/data_files/test-ca_unenc.key":"PolarSSLTest":"C=NL,O=PolarSSL,CN=PolarSSL Test CA":"01":"20190210144406":"20290210144406":MBEDTLS_MD_SHA1:0:0:"NULL":0:0:1:-1:"../framework/data_files/server1.crt":2:0:"../framework/data_files/test-ca.crt":0

 Certificate write check Server1 SHA1, Opaque, key_usage
-depends_on:MBEDTLS_RSA_C:MBEDTLS_PKCS1_V15:PSA_WANT_ALG_MD5
+depends_on:PSA_HAVE_ALG_RSA_PKCS1V15_SIGN:PSA_WANT_ALG_MD5
 x509_crt_check:"../framework/data_files/server1.key":"":"C=NL,O=PolarSSL,CN=PolarSSL Server 1":"../framework/data_files/test-ca_unenc.key":"PolarSSLTest":"C=NL,O=PolarSSL,CN=PolarSSL Test CA":"01":"20190210144406":"20290210144406":MBEDTLS_MD_SHA1:MBEDTLS_X509_KU_DIGITAL_SIGNATURE | MBEDTLS_X509_KU_NON_REPUDIATION | MBEDTLS_X509_KU_KEY_ENCIPHERMENT:1:"NULL":0:0:1:-1:"../framework/data_files/server1.key_usage.crt":2:0:"../framework/data_files/test-ca.crt":0

 Certificate write check Server1 SHA1, Opaque, ns_cert_type
-depends_on:MBEDTLS_RSA_C:MBEDTLS_PKCS1_V15:PSA_WANT_ALG_MD5
+depends_on:PSA_HAVE_ALG_RSA_PKCS1V15_SIGN:PSA_WANT_ALG_MD5
 x509_crt_check:"../framework/data_files/server1.key":"":"C=NL,O=PolarSSL,CN=PolarSSL Server 1":"../framework/data_files/test-ca_unenc.key":"PolarSSLTest":"C=NL,O=PolarSSL,CN=PolarSSL Test CA":"01":"20190210144406":"20290210144406":MBEDTLS_MD_SHA1:0:0:"NULL":MBEDTLS_X509_NS_CERT_TYPE_SSL_SERVER:1:1:-1:"../framework/data_files/server1.cert_type.crt":2:0:"../framework/data_files/test-ca.crt":0

 Certificate write check Server1 SHA1, Opaque, version 1
-depends_on:MBEDTLS_RSA_C:MBEDTLS_PKCS1_V15:PSA_WANT_ALG_MD5
+depends_on:PSA_HAVE_ALG_RSA_PKCS1V15_SIGN:PSA_WANT_ALG_MD5
 x509_crt_check:"../framework/data_files/server1.key":"":"C=NL,O=PolarSSL,CN=PolarSSL Server 1":"../framework/data_files/test-ca_unenc.key":"PolarSSLTest":"C=NL,O=PolarSSL,CN=PolarSSL Test CA":"01":"20190210144406":"20290210144406":MBEDTLS_MD_SHA1:0:0:"NULL":0:0:1:MBEDTLS_X509_CRT_VERSION_1:"../framework/data_files/server1.v1.crt":2:0:"../framework/data_files/test-ca.crt":0

 Certificate write check Server1 SHA1, Opaque, CA
-depends_on:MBEDTLS_RSA_C:MBEDTLS_PKCS1_V15:PSA_WANT_ALG_MD5
+depends_on:PSA_HAVE_ALG_RSA_PKCS1V15_SIGN:PSA_WANT_ALG_MD5
 x509_crt_check:"../framework/data_files/server1.key":"":"C=NL,O=PolarSSL,CN=PolarSSL Server 1":"../framework/data_files/test-ca_unenc.key":"PolarSSLTest":"C=NL,O=PolarSSL,CN=PolarSSL Test CA":"01":"20190210144406":"20290210144406":MBEDTLS_MD_SHA1:0:0:"NULL":0:0:1:-1:"../framework/data_files/server1.ca.crt":2:1:"../framework/data_files/test-ca.crt":0

 Certificate write check Server1 SHA1, Full length serial
-depends_on:MBEDTLS_RSA_C:MBEDTLS_PKCS1_V15:PSA_WANT_ALG_MD5
+depends_on:PSA_HAVE_ALG_RSA_PKCS1V15_SIGN:PSA_WANT_ALG_MD5
 x509_crt_check:"../framework/data_files/server1.key":"":"C=NL,O=PolarSSL,CN=PolarSSL Server 1":"../framework/data_files/test-ca_unenc.key":"PolarSSLTest":"C=NL,O=PolarSSL,CN=PolarSSL Test CA":"112233445566778899aabbccddeeff0011223344":"20190210144406":"20290210144406":MBEDTLS_MD_SHA1:0:0:"NULL":0:0:1:-1:"../framework/data_files/server1.long_serial.crt":0:0:"../framework/data_files/test-ca.crt":0

 Certificate write check Server1 SHA1, Serial starting with 0x80
-depends_on:MBEDTLS_RSA_C:MBEDTLS_PKCS1_V15:PSA_WANT_ALG_MD5
+depends_on:PSA_HAVE_ALG_RSA_PKCS1V15_SIGN:PSA_WANT_ALG_MD5
 x509_crt_check:"../framework/data_files/server1.key":"":"C=NL,O=PolarSSL,CN=PolarSSL Server 1":"../framework/data_files/test-ca_unenc.key":"PolarSSLTest":"C=NL,O=PolarSSL,CN=PolarSSL Test CA":"8011223344":"20190210144406":"20290210144406":MBEDTLS_MD_SHA1:0:0:"NULL":0:0:1:-1:"../framework/data_files/server1.80serial.crt":0:0:"../framework/data_files/test-ca.crt":0

 Certificate write check Server1 SHA1, All 0xFF full length serial
-depends_on:MBEDTLS_RSA_C:MBEDTLS_PKCS1_V15:PSA_WANT_ALG_MD5
+depends_on:PSA_HAVE_ALG_RSA_PKCS1V15_SIGN:PSA_WANT_ALG_MD5
 x509_crt_check:"../framework/data_files/server1.key":"":"C=NL,O=PolarSSL,CN=PolarSSL Server 1":"../framework/data_files/test-ca_unenc.key":"PolarSSLTest":"C=NL,O=PolarSSL,CN=PolarSSL Test CA":"ffffffffffffffffffffffffffffffff":"20190210144406":"20290210144406":MBEDTLS_MD_SHA1:0:0:"NULL":0:0:1:-1:"../framework/data_files/server1.long_serial_FF.crt":0:0:"../framework/data_files/test-ca.crt":0

 Certificate write check Server5 ECDSA
@@ -163,7 +163,7 @@ depends_on:PSA_WANT_ALG_SHA_256:PSA_HAVE_ALG_ECDSA_SIGN:PSA_WANT_ALG_DETERMINIST
 x509_crt_check:"../framework/data_files/server5.key":"":"C=NL,O=PolarSSL,CN=PolarSSL Server 1":"../framework/data_files/test-ca2.key":"PolarSSLTest":"C=NL,O=PolarSSL,CN=Polarssl Test EC CA":"01":"20190210144406":"20290210144406":MBEDTLS_MD_SHA256:0:0:"NULL":0:0:1:-1:"":2:0:"../framework/data_files/test-ca2.crt":0

 Certificate write check Server1 SHA1, SubjectAltNames
-depends_on:MBEDTLS_RSA_C:MBEDTLS_PKCS1_V15:PSA_WANT_ALG_MD5
+depends_on:PSA_HAVE_ALG_RSA_PKCS1V15_SIGN:PSA_WANT_ALG_MD5
 x509_crt_check:"../framework/data_files/server1.key":"":"C=NL,O=PolarSSL,CN=PolarSSL Server 1":"../framework/data_files/test-ca_unenc.key":"PolarSSLTest":"C=NL,O=PolarSSL,CN=PolarSSL Test CA":"01":"20190210144406":"20290210144406":MBEDTLS_MD_SHA1:0:0:"NULL":0:0:1:-1:"../framework/data_files/server1.allSubjectAltNames.crt":0:0:"../framework/data_files/test-ca.crt":1

 X509 String to Names #1