From 38fba1147f670b85bbc870bbdeb450ae1efd0822 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tobias=20Frauenschl=C3=A4ger?= <tobias@wolfssl.com>
Date: Fri, 4 Sep 2026 13:13:10 +0200
Subject: [PATCH] Send SNI in external.test so the peer returns its own
 certificate

scripts/external.test connects to www.wolfssl.com without a server_name
extension, so the CDN in front of that host answers with its own default
certificate rather than the wolfSSL one. That chain currently runs through
the RSA-4096 GlobalSign Root R46, while the intended chain is RSA-2048
throughout, so the test only passes on builds able to verify a 4096-bit
signature.

Two PRB configurations fail on master because of it. The fastmath leg with
FP_MAX_BITS=6144 reports BUFFER_E, and the 32-bit leg reports
ASN_SIG_CONFIRM_E because a build without WOLFSSL_X86_64_BUILD,
WOLFSSL_AARCH64_BUILD or OPENSSL_EXTRA defaults SP_INT_BITS to 3072. Both
are correct refusals to handle a key larger than the build supports, so the
test, not the library, is what needs fixing.

Name the host with -S in both client invocations. The option is a no-op
where the build lacks SNI, so those configurations keep their current
behavior, and the check uses the client's own "-S check" probe to decide.

Verified by building master with CFLAGS=-DSP_INT_BITS=3072, which
reproduces the BUFFER_E failure, and confirming the test passes with this
change in the same build and in an --enable-all build.
---
 scripts/external.test | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/scripts/external.test b/scripts/external.test
index 6263e9cee2..cfc8323d62 100755
--- a/scripts/external.test
+++ b/scripts/external.test
@@ -50,13 +50,21 @@ fi
 
 echo "WOLFSSL_EXTERNAL_TEST set, running test..."
 
+# The CDN in front of $server answers a request without SNI using its own
+# default certificate, whose chain needs a larger RSA key than some builds
+# support, so name the host wherever the build can.
+sni=""
+if ./examples/client/client -S check | grep -q 'SNI is: ON'; then
+    sni="-S $server"
+fi
+
 # is our desired server there?
 "${SCRIPT_DIR}"/ping.test $server 2
 RESULT=$?
 [ $RESULT -ne 0 ] && exit 0
 
 # client test against the server
-$TIMEOUT_KILL_2M ./examples/client/client -X -C -h $server -p 443 -g -A $ca
+$TIMEOUT_KILL_2M ./examples/client/client -X -C -h $server $sni -p 443 -g -A $ca
 RESULT=$?
 [ $RESULT -ne 0 ] && echo -e "\n\nClient connection failed" && exit 1
 
@@ -66,7 +74,7 @@ RESULT=$?
 BUILD_FLAGS="$(./examples/client/client '-#')"
 if echo "$BUILD_FLAGS" | grep -q "WOLFSSL_SYS_CA_CERTS" && ! echo "$BUILD_FLAGS" | grep -q "WOLFSSL_STATIC_MEMORY"; then
     echo -e "\nConnecting using WOLFSSL_SYS_CA_CERTS..."
-    ./examples/client/client -X -C -h $server -p 443 -g --sys-ca-certs
+    ./examples/client/client -X -C -h $server $sni -p 443 -g --sys-ca-certs
     RESULT=$?
     [ $RESULT -ne 0 ] && echo -e "\n\nClient connection failed when using WOLFSSL_SYS_CA_CERTS" && exit 1
 fi