Test failures with OpenSSL 3.2.2

[richardlau]

A number of Node.js tests fail when Node.js is compiled dynamically linked against OpenSSL 3.2 (tested with OpenSSL 3.2.2).
i.e.

./configure --shared-openssl
make -j 4 test-ci

Full tap results: https://gist.github.com/richardlau/ce642daf2ffd581755232a924f9f8f63

Failures:

• out/Release/node /home/nodejs/node/test/parallel/test-crypto-dh.js test: fix OpenSSL version checks #53503
• out/Release/node /home/nodejs/node/test/parallel/test-http2-https-fallback.js Also fails with OpenSSL 3.0.14 test: update tests for OpenSSL 3.0.14 #53373
• out/Release/node /home/nodejs/node/test/parallel/test-http2-server-unknown-protocol.js Also fails with OpenSSL 3.0.14 test: update tests for OpenSSL 3.0.14 #53373
• out/Release/node /home/nodejs/node/test/parallel/test-https-client-checkServerIdentity.js test: increase key size for ca2-cert.pem #54599
• out/Release/node /home/nodejs/node/test/parallel/test-https-strict.js test: increase key size for ca2-cert.pem #54599
• out/Release/node /home/nodejs/node/test/parallel/test-tls-alert-handling.js test: adjust tls test for OpenSSL32 #54909
• out/Release/node /home/nodejs/node/test/parallel/test-tls-cert-regression.js test: update test to support OpenSSL32 #54968
• out/Release/node /home/nodejs/node/test/parallel/test-tls-client-getephemeralkeyinfo.js test: update tls test to support OpenSSL32 #55030
• out/Release/node /home/nodejs/node/test/parallel/test-tls-alpn-server-client.js Also fails with OpenSSL 3.0.14 test: update tests for OpenSSL 3.0.14 #53373
• out/Release/node /home/nodejs/node/test/parallel/test-tls-client-mindhsize.js test: fix test-tls-client-mindhsize for OpenSSL32 #54739
• out/Release/node /home/nodejs/node/test/parallel/test-tls-client-renegotiation-13.js test: increase key size for ca2-cert.pem #54599
• out/Release/node /home/nodejs/node/test/parallel/test-tls-client-auth.js test: fix test-tls-client-auth test for OpenSSL32 #54610
• out/Release/node /home/nodejs/node/test/parallel/test-tls-client-verify.js test: increase key size for ca2-cert.pem #54599
• out/Release/node /home/nodejs/node/test/parallel/test-tls-empty-sni-context.js test: update TLS tests for OpenSSL 3.2 #53384
• out/Release/node --no-warnings /home/nodejs/node/test/parallel/test-tls-dhe.js test: fix test test-tls-dhe for OpenSSL32 #54903
• out/Release/node /home/nodejs/node/test/parallel/test-tls-getcipher.js test: adjust key sizes to support OpenSSL32 #54972
• out/Release/node /home/nodejs/node/test/parallel/test-tls-junk-server.js test: adjust test-tls-junk-server for OpenSSL32 #54926
• out/Release/node /home/nodejs/node/test/parallel/test-tls-multiple-cas-as-string.js test: increase key size for ca2-cert.pem #54599
• out/Release/node /home/nodejs/node/test/parallel/test-tls-peer-certificate-encoding.js test: increase key size for ca2-cert.pem #54599
• out/Release/node /home/nodejs/node/test/parallel/test-tls-multi-key.js test: increase key size for ca2-cert.pem #54599
• out/Release/node /home/nodejs/node/test/parallel/test-tls-psk-circuit.js test: update TLS tests for OpenSSL 3.2 #53384
• out/Release/node /home/nodejs/node/test/parallel/test-tls-sni-server-client.js test: increase key size for ca2-cert.pem #54599
• out/Release/node /home/nodejs/node/test/parallel/test-tls-set-ciphers.js test: adjust tls-set-ciphers for OpenSSL32 #55016
• out/Release/node /home/nodejs/node/test/parallel/test-tls-sni-option.js test: increase key size for ca2-cert.pem #54599
• out/Release/node /home/nodejs/node/test/parallel/test-tls-server-verify.js test: increase key size for ca2-cert.pem #54599
• out/Release/node /home/nodejs/node/test/parallel/test-tls-junk-closes-server.js also reported in Pass node 18.x branch tests when compiled against shared openssl 3.2 #52482 test: fix test-tls-junk-closes-server #55089 (comment)

In our Jenkins CI we currently test in node-test-commit-linux-containered Node.js dynamically linked against OpenSSL 3.0 and 3.1. Addressing the above test failures would be required before we can add testing against OpenSSL 3.2 to the CI.

[richardlau]

FWIW I've added testing against OpenSSl 3.2 to my copy of node-test-commit-linux-containered: richardlau-node-test-commit-linux-containered

e.g. https://ci.nodejs.org/job/richardlau-node-test-commit-linux-containered/nodes=ubuntu2204_sharedlibs_openssl32_x64/26/consoleFull which is showing the current test failures with main when linked against OpenSSL 3.2.2.

[richardlau]

In terms of updating what is included in Node.js, for now we want to stay on the LTS version of OpenSSL (3.0) for as long as possible. OpenSSL have not yet decided/announced what the next LTS version of OpenSSL will be. Making sure Node.js can build and execute tests successfully on later OpenSSL versions should hopefully ease the migration when it is eventually time.

[mhdawson]

For those that want to help move it forward, you can run this job to confirm if you have fixed one of the tests - https://ci.nodejs.org/job/richardlau-node-test-commit-linux-containered/