1 files changed, 53 insertions, 0 deletions
diff --git a/tests/pkcs11/tls-neg-pkcs11-key.c b/tests/pkcs11/tls-neg-pkcs11-key.c
index 78bfc6a763..c003e762aa 100644
--- a/tests/pkcs11/tls-neg-pkcs11-key.c
+++ b/tests/pkcs11/tls-neg-pkcs11-key.c
@@ -316,6 +316,59 @@ static const test_st tests[] = {
 	 .cert = &server_ca3_eddsa_cert,
 	 .key = &server_ca3_eddsa_key,
 	 .exp_kx = GNUTLS_KX_ECDHE_RSA,
+	},
+	{.name = "tls1.3: ecc key",
+	 .pk = GNUTLS_PK_ECDSA,
+	 .prio = "NORMAL:-KX-ALL:+ECDHE-RSA:+ECDHE-ECDSA:-VERS-TLS-ALL:+VERS-TLS1.3",
+	 .cert = &server_ca3_localhost_ecc_cert,
+	 .key = &server_ca3_ecc_key,
+	 .exp_kx = GNUTLS_KX_ECDHE_RSA
+	},
+	{.name = "tls1.3: rsa-sign key",
+	 .pk = GNUTLS_PK_RSA,
+	 .prio = "NORMAL:+ECDHE-RSA:+ECDHE-ECDSA:-VERS-TLS-ALL:+VERS-TLS1.3",
+	 .cert = &server_ca3_localhost_cert,
+	 .key = &server_ca3_key,
+	 .exp_kx = GNUTLS_KX_ECDHE_RSA
+	},
+	{.name = "tls1.3: rsa-sign key with rsa-pss sigs prioritized",
+	 .pk = GNUTLS_PK_RSA,
+	 .prio = "NORMAL:-SIGN-ALL:+SIGN-RSA-PSS-SHA256:+SIGN-RSA-PSS-SHA384:+SIGN-RSA-PSS-SHA512:+SIGN-RSA-PSS-RSAE-SHA256:+SIGN-RSA-PSS-RSAE-SHA384:+SIGN-RSA-PSS-RSAE-SHA512:-VERS-TLS-ALL:+VERS-TLS1.3",
+	 .cert = &server_ca3_localhost_cert,
+	 .key = &server_ca3_key,
+	 .exp_kx = GNUTLS_KX_ECDHE_RSA
+	},
+	{.name = "tls1.3: rsa-pss-sign key",
+	 .pk = GNUTLS_PK_RSA_PSS,
+	 .prio = "NORMAL:+ECDHE-RSA:+ECDHE-ECDSA:-VERS-TLS-ALL:+VERS-TLS1.3",
+	 .cert = &server_ca3_rsa_pss2_cert,
+	 .key = &server_ca3_rsa_pss2_key,
+	 .exp_kx = GNUTLS_KX_ECDHE_RSA,
+	 .requires_pkcs11_pss = 1,
+	},
+	{.name = "tls1.3: rsa-pss cert, rsa-sign key",
+	 .pk = GNUTLS_PK_RSA,
+	 .prio = "NORMAL:+ECDHE-RSA:+ECDHE-ECDSA:-VERS-TLS-ALL:+VERS-TLS1.3",
+	 .cert = &server_ca3_rsa_pss_cert,
+	 .key = &server_ca3_rsa_pss_key,
+	 .exp_kx = GNUTLS_KX_ECDHE_RSA,
+	 .requires_pkcs11_pss = 1,
+	},
+	{.name = "tls1.3: rsa-pss cert, rsa-sign key no PSS signatures",
+	 .pk = GNUTLS_PK_RSA,
+	 .prio = "NORMAL:+ECDHE-RSA:+ECDHE-ECDSA:-VERS-TLS-ALL:+VERS-TLS1.3:-SIGN-RSA-PSS-SHA256:-SIGN-RSA-PSS-SHA384:-SIGN-RSA-PSS-SHA512:-SIGN-RSA-PSS-RSAE-SHA256:-SIGN-RSA-PSS-RSAE-SHA384:-SIGN-RSA-PSS-RSAE-SHA512",
+	 .cert = &server_ca3_rsa_pss_cert,
+	 .key = &server_ca3_rsa_pss_key,
+	 .exp_kx = GNUTLS_KX_ECDHE_RSA,
+	 .exp_serv_err = GNUTLS_E_NO_CIPHER_SUITES
+	},
+	{.name = "tls1.3: ed25519 cert, ed25519 key",
+	 .needs_eddsa = 1,
+	 .pk = GNUTLS_PK_EDDSA_ED25519,
+	 .prio = "NORMAL:+ECDHE-RSA:+ECDHE-ECDSA",
+	 .cert = &server_ca3_eddsa_cert,
+	 .key = &server_ca3_eddsa_key,
+	 .exp_kx = GNUTLS_KX_ECDHE_RSA
 	}
 };