Commit 108ced2e23 for openssl.org

commit 108ced2e23df54b8e6cb7062c6ae95fcd9365e28
Author: Viktor Dukhovni <viktor@openssl.org>
Date:   Fri Sep 4 01:40:40 2026 +1000

    ML-KEM-512 hybrid TLS KEMs

    Per the new codepoints assigned by IANA for
    draft-rosomakho-tls-ecdhe-mlkem512-00.

    Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
    Reviewed-by: Neil Horman <nhorman@openssl.org>
    MergeDate: Mon Sep 21 11:52:03 2026
    (Merged from https://github.com/openssl/openssl/pull/32670)

diff --git a/CHANGES.md b/CHANGES.md
index 48d45332d9..5cfdf30c9b 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -30,10 +30,14 @@ OpenSSL Releases
  - [OpenSSL 0.9.x](#openssl-09x)

 OpenSSL 4.2
------------

 ### Changes between 4.1 and 4.2 [xx XXX xxxx]

+ * Added the `MLKEM512X25519` and `SecP256r1MLKEM512` hybrid TLS KEMs for the
+   newly assigned IANA codepoints per [draft-rosomakho-tls-ecdhe-mlkem512-00].
+
+   *Viktor Dukhovni*
+
  * Added public API for `IPAddrBlocks` ([RFC 3779]), mirroring the existing
    `ASIdentifiers` API: `IPAddrBlocks_new()`, `IPAddrBlocks_free()`,
    `d2i_IPAddrBlocks()`, `i2d_IPAddrBlocks()`, and the exported
@@ -24222,3 +24226,4 @@ ndif
 [SP 800-208]: https://csrc.nist.gov/pubs/sp/800/208/final
 [TCG Credential Profiles specification Version 1.2, Section 3.2.7]: https://trustedcomputinggroup.org/wp-content/uploads/Credential_Profiles_V1.2_Level2_Revision8.pdf#page=35
 [tls-hybrid-sm2-mlkem]: https://datatracker.ietf.org/doc/html/draft-yang-tls-hybrid-sm2-mlkem-03#name-iana-considerations
+[draft-rosomakho-tls-ecdhe-mlkem512-00]: https://datatracker.ietf.org/doc/html/draft-rosomakho-tls-ecdhe-mlkem512-00.html
diff --git a/doc/man3/SSL_CONF_cmd.pod b/doc/man3/SSL_CONF_cmd.pod
index 4fb06ed9dc..5eb1fffc67 100644
--- a/doc/man3/SSL_CONF_cmd.pod
+++ b/doc/man3/SSL_CONF_cmd.pod
@@ -923,6 +923,9 @@ OpenSSL 4.0 introduced the B<curveSM2> (also known as C<ECDHE over SM2>) key
 exchange group as specified in RFC8998, and B<curveSM2MLKEM768>, which is a
 hybrid of the B<curveSM2> group with B<ML-KEM-768>.

+OpenSSL 4.2 introduced support for two additional B<hybrid> ECDH PQ key
+exchange groups: B<MLKEM512X25519> and B<SecP256r1MLKEM512>.
+
 As of OpenSSL 3.5 key exchange group names are case-insensitive.

 =head1 COPYRIGHT
diff --git a/doc/man3/SSL_CTX_set1_curves.pod b/doc/man3/SSL_CTX_set1_curves.pod
index f791c28682..aea32c4306 100755
--- a/doc/man3/SSL_CTX_set1_curves.pod
+++ b/doc/man3/SSL_CTX_set1_curves.pod
@@ -421,6 +421,9 @@ OpenSSL 4.0 introduced the B<curveSM2> (also known as C<ECDHE over SM2>) key
 exchange group as specified in RFC8998, and B<curveSM2MLKEM768>, which is a
 hybrid of the B<curveSM2> group with B<ML-KEM-768>.

+OpenSSL 4.2 introduced support for two additional B<hybrid> ECDH PQ key
+exchange groups: B<MLKEM512X25519> and B<SecP256r1MLKEM512>.
+
 As of OpenSSL 3.5 key exchange group names are case-insensitive.

 B<SSL_CTX_get0_implemented_groups> was first implemented in OpenSSL 3.5.
diff --git a/doc/man7/EVP_PKEY-MLX-KEM.pod b/doc/man7/EVP_PKEY-MLX-KEM.pod
index 4c197bd078..0106b0b26d 100644
--- a/doc/man7/EVP_PKEY-MLX-KEM.pod
+++ b/doc/man7/EVP_PKEY-MLX-KEM.pod
@@ -21,12 +21,19 @@ default and FIPS providers.

 =over 4

+=item B<MLKEM512X25519>
+
+The shared secret is a concatenation of a 32-byte L<EVP_PKEY-ML-KEM(7)> shared
+secret and a 32 byte L<EVP_PKEY-X25519(7)> shared secret.
+X25519 is not an approved FIPS algorithm, but this combination is still allowed
+by FIPS 140-3, since ML-KEM is FIPS approved.
+
 =item B<X25519MLKEM768>

-The shared secret is the concatenation of a 32 byte L<EVP_PKEY-ML-KEM(7)> shared
-secret followed by a 32 byte L<EVP_PKEY-X25519(7)> shared secret. X25519 is not an
-approved FIPS algorithm, but this combination is still allowed by FIPS 140-3
-since ML-KEM is FIPS approved.
+The shared secret is a concatenation of a 32-byte L<EVP_PKEY-ML-KEM(7)> shared
+secret and a 32 byte L<EVP_PKEY-X25519(7)> shared secret.
+X25519 is not an approved FIPS algorithm, but this combination is still allowed
+by FIPS 140-3, since ML-KEM is FIPS approved.

 =item B<X448MLKEM1024>

@@ -34,6 +41,12 @@ Similar to B<X25519MLKEM768> with a higher security strength, the shared secret
 is the concatenation of a 32 byte L<EVP_PKEY-ML-KEM(7)> shared secret followed
 by a 56 byte L<EVP_PKEY-X448(7)> shared secret.

+=item B<SecP256r1MLKEM512>
+
+The shared secret is the concatenation of a 32 byte L<EVP_PKEY-EC(7)> shared
+secret followed by a 32 byte L<EVP_PKEY-ML-KEM(7)> shared secret.
+Both algorithms used are FIPS approved.
+
 =item B<SecP256r1MLKEM768>

 The shared secret is the concatenation of a 32 byte L<EVP_PKEY-EC(7)> shared
@@ -110,25 +123,33 @@ The format of the public keys for the different algorithms is:

 =over 4

+=item B<SecP256r1MLKEM512>
+
+A 65-byte EC public key followed by an 800-byte ML-KEM-512 public key.
+
 =item B<SecP256r1MLKEM768>

-A 65 byte EC public key followed by a 1184 byte ML-KEM-768 public key.
+A 65-byte EC public key followed by an 1184-byte ML-KEM-768 public key.

 =item B<SecP384r1MLKEM1024>

-A 97 byte EC public key followed by a 1568 byte ML-KEM-1024 public key.
+A 97 byte EC public key followed by a 1568-byte ML-KEM-1024 public key.
+
+=item B<MLKEM512X25519>
+
+An 800-byte ML-KEM-512 public key followed by a 32-byte X25519 public key.

 =item B<X25519MLKEM768>

-A 1184 byte ML-KEM-768 public key followed by a 32 byte X25519 public key.
+A 1184-byte ML-KEM-768 public key followed by a 32-byte X25519 public key.

 =item B<X448MLKEM1024>

-A 1568 byte ML-KEM-1024 public key followed by a 56 byte X448 public key.
+A 1568-byte ML-KEM-1024 public key followed by a 56-byte X448 public key.

 =item B<curveSM2MLKEM768>

-A 65 byte SM2 public key followed by a 1184 byte ML-KEM-768 public key.
+A 65-byte SM2 public key followed by an 1184-byte ML-KEM-768 public key.

 =back

@@ -152,6 +173,10 @@ The format of the private keys for the different algorithms is:

 =over 4

+=item B<SecP256r1MLKEM512>
+
+32 byte EC private key followed by a 1632 byte ML-KEM-512 private key.
+
 =item B<SecP256r1MLKEM768>

 32 byte EC private key followed by a 2400 byte ML-KEM-768 private key.
@@ -160,6 +185,10 @@ The format of the private keys for the different algorithms is:

 48 byte EC private key followed by a 3168 byte ML-KEM-1024 private key.

+=item B<MLKEM512X25519>
+
+1632 byte ML-KEM-512 private key followed by a 32 byte X25519 private key.
+
 =item B<X25519MLKEM768>

 2400 byte ML-KEM-768 private key followed by a 32 byte X25519 private key.
@@ -209,6 +238,9 @@ This functionality was added in OpenSSL 3.5.

 Support for B<curveSM2MLKEM768> was added in OpenSSL 4.0.

+Support for B<MLKEM512X25519> and B<SecP256r1MLKEM512> was added in OpenSSL
+4.2.
+
 =head1 COPYRIGHT

 Copyright 2026 The OpenSSL Project Authors. All Rights Reserved.
diff --git a/doc/man7/OSSL_PROVIDER-FIPS.pod b/doc/man7/OSSL_PROVIDER-FIPS.pod
index c45788ddf9..c5422e2fcc 100644
--- a/doc/man7/OSSL_PROVIDER-FIPS.pod
+++ b/doc/man7/OSSL_PROVIDER-FIPS.pod
@@ -159,10 +159,14 @@ It is used internally as a sub algorithm of CSHAKE.

 =item ML-KEM-1024, see L<EVP_KEM-ML-KEM-1024(7)>

+=item MLKEM512X25519, see L<EVP_PKEY-MLX-KEM(7)>
+
 =item X25519MLKEM768, see L<EVP_PKEY-MLX-KEM(7)>

 =item X448MLKEM1024, see L<EVP_PKEY-MLX-KEM(7)>

+=item SecP256r1MLKEM512, see L<EVP_PKEY-MLX-KEM(7)>
+
 =item SecP256r1MLKEM768, see L<EVP_PKEY-MLX-KEM(7)>

 =item SecP384r1MLKEM1024, see L<EVP_PKEY-MLX-KEM(7)>
@@ -275,10 +279,14 @@ included in SP 800-56Arev3 are not approved for key agreement".

 =item MK-KEM-1024, see L<EVP_KEYMGMT-ML-KEM-1024(7)>

+=item MLKEM512X25519, see L<EVP_KEYMGMT-MLX-KEM(7)>
+
 =item X25519MLKEM768, see L<EVP_KEYMGMT-MLX-KEM(7)>

 =item X448MLKEM1024, see L<EVP_KEYMGMT-MLX-KEM(7)>

+=item SecP256r1MLKEM512, see L<EVP_KEYMGMT-MLX-KEM(7)>
+
 =item SecP256r1MLKEM768, see L<EVP_KEYMGMT-MLX-KEM(7)>

 =item SecP384r1MLKEM1024, see L<EVP_KEYMGMT-MLX-KEM(7)>
@@ -643,8 +651,16 @@ L<https://www.openssl.org/source/>

 =head1 HISTORY

+The ML-DSA-44, ML-DSA-65, ML-DSA-87 signature algorithms, the ML-KEM-512,
+ML-KEM-768, ML-KEM-768 key exchange algorithms, and the hybrid X25519MLKEM768,
+SecP256r1MLKEM768, SecP384r1MLKEM1024 key exchange algorithms were added in
+OpenSSL 3.5.
+
 The HKDF-SHA256, HKDF-SHA384 and HKDF-SHA512 algorithms were added in OpenSSL 3.6.

+The hybrid key exchange MLKEM512X25519 and SecP256r1MLKEM512 algorithms were
+added in OpenSSL 4.2.
+
 The CSHAKE-128 and CSHAKE-256 algorithms were added in OpenSSL 4.0.

 All other functionality was added in OpenSSL 3.0.
diff --git a/doc/man7/OSSL_PROVIDER-default.pod b/doc/man7/OSSL_PROVIDER-default.pod
index e61d3d8137..96b76a8cd0 100644
--- a/doc/man7/OSSL_PROVIDER-default.pod
+++ b/doc/man7/OSSL_PROVIDER-default.pod
@@ -189,10 +189,14 @@ The OpenSSL default provider supports these operations and algorithms:

 =item ML-KEM-1024, see L<EVP_KEM-ML-KEM-1024(7)>

+=item MLKEM512X25519, see L<EVP_PKEY-MLX-KEM(7)>
+
 =item X25519MLKEM768, see L<EVP_PKEY-MLX-KEM(7)>

 =item X448MLKEM1024, see L<EVP_PKEY-MLX-KEM(7)>

+=item SecP256r1MLKEM512, see L<EVP_PKEY-MLX-KEM(7)>
+
 =item SecP256r1MLKEM768, see L<EVP_PKEY-MLX-KEM(7)>

 =item SecP384r1MLKEM1024, see L<EVP_PKEY-MLX-KEM(7)>
@@ -327,16 +331,20 @@ The OpenSSL default provider supports these operations and algorithms:

 =item ML-DSA-87, see L<EVP_KEYMGMT-ML-DSA(7)>

-=item MK-KEM-512, see L<EVP_KEYMGMT-ML-KEM-512(7)>
+=item ML-KEM-512, see L<EVP_KEYMGMT-ML-KEM-512(7)>
+
+=item ML-KEM-768, see L<EVP_KEYMGMT-ML-KEM-768(7)>

-=item MK-KEM-768, see L<EVP_KEYMGMT-ML-KEM-768(7)>
+=item ML-KEM-1024, see L<EVP_KEYMGMT-ML-KEM-1024(7)>

-=item MK-KEM-1024, see L<EVP_KEYMGMT-ML-KEM-1024(7)>
+=item MLKEM512X25519, see L<EVP_KEYMGMT-MLX-KEM(7)>

 =item X25519MLKEM768, see L<EVP_KEYMGMT-MLX-KEM(7)>

 =item X448MLKEM1024, see L<EVP_KEYMGMT-MLX-KEM(7)>

+=item SecP256r1MLKEM512, see L<EVP_KEYMGMT-MLX-KEM(7)>
+
 =item SecP256r1MLKEM768, see L<EVP_KEYMGMT-MLX-KEM(7)>

 =item SecP384r1MLKEM1024, see L<EVP_KEYMGMT-MLX-KEM(7)>
@@ -584,6 +592,9 @@ Support for B<curveSM2MLKEM768> was added in OpenSSL 4.0.

 Support for CSHAKE-128 and CSHAKE-256 was added in OpenSSL 4.0.

+Support for B<MLKEM512X25519> and B<SecP256r1MLKEM512> was added in OpenSSL
+4.2.
+
 =head1 COPYRIGHT

 Copyright 2020-2026 The OpenSSL Project Authors. All Rights Reserved.
diff --git a/include/internal/tlsgroups.h b/include/internal/tlsgroups.h
index f12e142b9a..8f9e9e83e5 100644
--- a/include/internal/tlsgroups.h
+++ b/include/internal/tlsgroups.h
@@ -64,6 +64,8 @@
 #define OSSL_TLS_GROUP_ID_mlkem512 0x0200
 #define OSSL_TLS_GROUP_ID_mlkem768 0x0201
 #define OSSL_TLS_GROUP_ID_mlkem1024 0x0202
+#define OSSL_TLS_GROUP_ID_SecP256r1MLKEM512 0x11E9
+#define OSSL_TLS_GROUP_ID_MLKEM512X25519 0x11EA
 #define OSSL_TLS_GROUP_ID_SecP256r1MLKEM768 0x11EB
 #define OSSL_TLS_GROUP_ID_X25519MLKEM768 0x11EC
 #define OSSL_TLS_GROUP_ID_SecP384r1MLKEM1024 0x11ED
diff --git a/providers/common/capabilities.c b/providers/common/capabilities.c
index 1f281695f9..13ad72ffb5 100644
--- a/providers/common/capabilities.c
+++ b/providers/common/capabilities.c
@@ -94,6 +94,8 @@ static const TLS_GROUP_CONSTANTS group_list[] = {
     /* 43 */ { OSSL_TLS_GROUP_ID_SecP384r1MLKEM1024, ML_KEM_1024_SECBITS, TLS1_3_VERSION, 0, DTLS1_3_VERSION, 0, 1 },
     /* 44 */ { OSSL_TLS_GROUP_ID_curveSM2, 128, TLS1_3_VERSION, 0, DTLS1_3_VERSION, 0, 0 },
     /* 45 */ { OSSL_TLS_GROUP_ID_curveSM2MLKEM768, ML_KEM_768_SECBITS, TLS1_3_VERSION, 0, DTLS1_3_VERSION, 0, 1 },
+    /* 46 */ { OSSL_TLS_GROUP_ID_MLKEM512X25519, ML_KEM_512_SECBITS, TLS1_3_VERSION, 0, DTLS1_3_VERSION, 0, 1 },
+    /* 47 */ { OSSL_TLS_GROUP_ID_SecP256r1MLKEM512, ML_KEM_512_SECBITS, TLS1_3_VERSION, 0, DTLS1_3_VERSION, 0, 1 },
 };

 #define TLS_GROUP_ENTRY(tlsname, realname, algorithm, idx)              \
@@ -157,6 +159,7 @@ static const OSSL_PARAM param_group_list[][11] = {
 #ifndef OPENSSL_NO_EC
 #if !defined(OPENSSL_NO_ML_KEM)
 #if !defined(OPENSSL_NO_ECX)
+    TLS_GROUP_ENTRY("MLKEM512X25519", "", "MLKEM512X25519", 46),
     TLS_GROUP_ENTRY("X25519MLKEM768", "", "X25519MLKEM768", 41),
 #endif
 #endif
@@ -198,6 +201,7 @@ static const OSSL_PARAM param_group_list[][11] = {
 #endif
 #endif
 #ifndef OPENSSL_NO_ML_KEM
+    TLS_GROUP_ENTRY("SecP256r1MLKEM512", "", "SecP256r1MLKEM512", 47),
     TLS_GROUP_ENTRY("SecP256r1MLKEM768", "", "SecP256r1MLKEM768", 42),
     TLS_GROUP_ENTRY("SecP384r1MLKEM1024", "", "SecP384r1MLKEM1024", 43),
 #endif
diff --git a/providers/defltprov.c b/providers/defltprov.c
index bc48a518bc..c902ad97b1 100644
--- a/providers/defltprov.c
+++ b/providers/defltprov.c
@@ -569,10 +569,12 @@ static const OSSL_ALGORITHM deflt_asym_kem[] = {
     { PROV_NAMES_ML_KEM_768, "provider=default", ossl_ml_kem_asym_kem_functions },
     { PROV_NAMES_ML_KEM_1024, "provider=default", ossl_ml_kem_asym_kem_functions },
 #if !defined(OPENSSL_NO_ECX)
+    { PROV_NAMES_MLKEM512X25519, "provider=default", ossl_mlx_kem_asym_kem_functions },
     { PROV_NAMES_X25519MLKEM768, "provider=default", ossl_mlx_kem_asym_kem_functions },
     { PROV_NAMES_X448MLKEM1024, "provider=default", ossl_mlx_kem_asym_kem_functions },
 #endif
 #if !defined(OPENSSL_NO_EC)
+    { PROV_NAMES_SecP256r1MLKEM512, "provider=default", ossl_mlx_kem_asym_kem_functions },
     { PROV_NAMES_SecP256r1MLKEM768, "provider=default", ossl_mlx_kem_asym_kem_functions },
     { PROV_NAMES_SecP384r1MLKEM1024, "provider=default", ossl_mlx_kem_asym_kem_functions },
 #endif
@@ -660,12 +662,16 @@ static const OSSL_ALGORITHM deflt_keymgmt[] = {
     { PROV_NAMES_ML_KEM_1024, "provider=default", ossl_ml_kem_1024_keymgmt_functions,
         PROV_DESCS_ML_KEM_1024 },
 #if !defined(OPENSSL_NO_ECX)
+    { PROV_NAMES_MLKEM512X25519, "provider=default", ossl_mlx_x25519_512_kem_kmgmt_functions,
+        PROV_DESCS_MLKEM512X25519 },
     { PROV_NAMES_X25519MLKEM768, "provider=default", ossl_mlx_x25519_kem_kmgmt_functions,
         PROV_DESCS_X25519MLKEM768 },
     { PROV_NAMES_X448MLKEM1024, "provider=default", ossl_mlx_x448_kem_kmgmt_functions,
         PROV_DESCS_X448MLKEM1024 },
 #endif
 #if !defined(OPENSSL_NO_EC)
+    { PROV_NAMES_SecP256r1MLKEM512, "provider=default", ossl_mlx_p256_512_kem_kmgmt_functions,
+        PROV_DESCS_SecP256r1MLKEM512 },
     { PROV_NAMES_SecP256r1MLKEM768, "provider=default", ossl_mlx_p256_kem_kmgmt_functions,
         PROV_DESCS_SecP256r1MLKEM768 },
     { PROV_NAMES_SecP384r1MLKEM1024, "provider=default", ossl_mlx_p384_kem_kmgmt_functions,
diff --git a/providers/fips/fipsprov.c b/providers/fips/fipsprov.c
index b07c5c7607..033f685c22 100644
--- a/providers/fips/fipsprov.c
+++ b/providers/fips/fipsprov.c
@@ -585,10 +585,12 @@ static const OSSL_ALGORITHM fips_asym_kem[] = {
     { PROV_NAMES_ML_KEM_768, FIPS_DEFAULT_PROPERTIES, ossl_ml_kem_asym_kem_functions },
     { PROV_NAMES_ML_KEM_1024, FIPS_DEFAULT_PROPERTIES, ossl_ml_kem_asym_kem_functions },
 #if !defined(OPENSSL_NO_ECX)
+    { PROV_NAMES_MLKEM512X25519, FIPS_DEFAULT_PROPERTIES, ossl_mlx_kem_asym_kem_functions },
     { PROV_NAMES_X25519MLKEM768, FIPS_DEFAULT_PROPERTIES, ossl_mlx_kem_asym_kem_functions },
     { PROV_NAMES_X448MLKEM1024, FIPS_UNAPPROVED_PROPERTIES, ossl_mlx_kem_asym_kem_functions },
 #endif
 #if !defined(OPENSSL_NO_EC)
+    { PROV_NAMES_SecP256r1MLKEM512, FIPS_DEFAULT_PROPERTIES, ossl_mlx_kem_asym_kem_functions },
     { PROV_NAMES_SecP256r1MLKEM768, FIPS_DEFAULT_PROPERTIES, ossl_mlx_kem_asym_kem_functions },
     { PROV_NAMES_SecP384r1MLKEM1024, FIPS_DEFAULT_PROPERTIES, ossl_mlx_kem_asym_kem_functions },
 #endif
@@ -655,12 +657,16 @@ static const OSSL_ALGORITHM fips_keymgmt[] = {
     { PROV_NAMES_ML_KEM_1024, FIPS_DEFAULT_PROPERTIES, ossl_ml_kem_1024_keymgmt_functions,
         PROV_DESCS_ML_KEM_1024 },
 #if !defined(OPENSSL_NO_ECX)
+    { PROV_NAMES_MLKEM512X25519, FIPS_DEFAULT_PROPERTIES, ossl_mlx_x25519_512_kem_kmgmt_functions,
+        PROV_DESCS_MLKEM512X25519 },
     { PROV_NAMES_X25519MLKEM768, FIPS_DEFAULT_PROPERTIES, ossl_mlx_x25519_kem_kmgmt_functions,
         PROV_DESCS_X25519MLKEM768 },
     { PROV_NAMES_X448MLKEM1024, FIPS_UNAPPROVED_PROPERTIES, ossl_mlx_x448_kem_kmgmt_functions,
         PROV_DESCS_X448MLKEM1024 },
 #endif
 #if !defined(OPENSSL_NO_EC)
+    { PROV_NAMES_SecP256r1MLKEM512, FIPS_DEFAULT_PROPERTIES, ossl_mlx_p256_512_kem_kmgmt_functions,
+        PROV_DESCS_SecP256r1MLKEM512 },
     { PROV_NAMES_SecP256r1MLKEM768, FIPS_DEFAULT_PROPERTIES, ossl_mlx_p256_kem_kmgmt_functions,
         PROV_DESCS_SecP256r1MLKEM768 },
     { PROV_NAMES_SecP384r1MLKEM1024, FIPS_DEFAULT_PROPERTIES, ossl_mlx_p384_kem_kmgmt_functions,
diff --git a/providers/implementations/include/prov/implementations.h b/providers/implementations/include/prov/implementations.h
index 36e82c643a..1a758ce8a6 100644
--- a/providers/implementations/include/prov/implementations.h
+++ b/providers/implementations/include/prov/implementations.h
@@ -362,9 +362,11 @@ extern const OSSL_DISPATCH ossl_ml_kem_768_keymgmt_functions[];
 extern const OSSL_DISPATCH ossl_ml_kem_1024_keymgmt_functions[];
 #ifndef OPENSSL_NO_EC
 #ifndef OPENSSL_NO_ECX
+extern const OSSL_DISPATCH ossl_mlx_x25519_512_kem_kmgmt_functions[];
 extern const OSSL_DISPATCH ossl_mlx_x25519_kem_kmgmt_functions[];
 extern const OSSL_DISPATCH ossl_mlx_x448_kem_kmgmt_functions[];
 #endif
+extern const OSSL_DISPATCH ossl_mlx_p256_512_kem_kmgmt_functions[];
 extern const OSSL_DISPATCH ossl_mlx_p256_kem_kmgmt_functions[];
 extern const OSSL_DISPATCH ossl_mlx_p384_kem_kmgmt_functions[];
 #ifndef OPENSSL_NO_SM2
diff --git a/providers/implementations/include/prov/names.h b/providers/implementations/include/prov/names.h
index fa850ebf57..f08d1411d2 100644
--- a/providers/implementations/include/prov/names.h
+++ b/providers/implementations/include/prov/names.h
@@ -435,10 +435,14 @@
 #define PROV_DESCS_ML_KEM_768 "OpenSSL ML-KEM-768 implementation"
 #define PROV_NAMES_ML_KEM_1024 "ML-KEM-1024:MLKEM1024:id-alg-ml-kem-1024:2.16.840.1.101.3.4.4.3"
 #define PROV_DESCS_ML_KEM_1024 "OpenSSL ML-KEM-1024 implementation"
+#define PROV_NAMES_MLKEM512X25519 "MLKEM512X25519"
+#define PROV_DESCS_MLKEM512X25519 "ML-KEM-512+X25519 TLS hybrid implementation"
 #define PROV_NAMES_X25519MLKEM768 "X25519MLKEM768"
 #define PROV_DESCS_X25519MLKEM768 "X25519+ML-KEM-768 TLS hybrid implementation"
 #define PROV_NAMES_X448MLKEM1024 "X448MLKEM1024"
 #define PROV_DESCS_X448MLKEM1024 "X448+ML-KEM-1024 TLS hybrid implementation"
+#define PROV_NAMES_SecP256r1MLKEM512 "SecP256r1MLKEM512"
+#define PROV_DESCS_SecP256r1MLKEM512 "P-256+ML-KEM-512 TLS hybrid implementation"
 #define PROV_NAMES_SecP256r1MLKEM768 "SecP256r1MLKEM768"
 #define PROV_DESCS_SecP256r1MLKEM768 "P-256+ML-KEM-768 TLS hybrid implementation"
 #define PROV_NAMES_SecP384r1MLKEM1024 "SecP384r1MLKEM1024"
diff --git a/providers/implementations/keymgmt/mlx_kmgmt.c b/providers/implementations/keymgmt/mlx_kmgmt.c
index 2fe7017b6f..4612250570 100644
--- a/providers/implementations/keymgmt/mlx_kmgmt.c
+++ b/providers/implementations/keymgmt/mlx_kmgmt.c
@@ -45,14 +45,17 @@ static const int minimal_selection = OSSL_KEYMGMT_SELECT_DOMAIN_PARAMETERS

 /* Must match DECLARE_DISPATCH invocations at the end of the file */
 static const ECDH_VINFO hybrid_vtable[] = {
+    { "EC", "P-256", 65, 32, 32, 1, EVP_PKEY_ML_KEM_512 },
     { "EC", "P-256", 65, 32, 32, 1, EVP_PKEY_ML_KEM_768 },
     { "EC", "P-384", 97, 48, 48, 1, EVP_PKEY_ML_KEM_1024 },
 #if !defined(OPENSSL_NO_ECX)
+    { "X25519", NULL, 32, 32, 32, 0, EVP_PKEY_ML_KEM_512 },
     { "X25519", NULL, 32, 32, 32, 0, EVP_PKEY_ML_KEM_768 },
     { "X448", NULL, 56, 56, 56, 0, EVP_PKEY_ML_KEM_1024 },
 #else
     { NULL, NULL, 0, 0, 0, 0, NID_undef },
     { NULL, NULL, 0, 0, 0, 0, NID_undef },
+    { NULL, NULL, 0, 0, 0, 0, NID_undef },
 #endif
 #if !defined(FIPS_MODULE) && !defined(OPENSSL_NO_SM2)
     { "curveSM2", "SM2", 65, 32, 32, 1, EVP_PKEY_ML_KEM_768 },
@@ -804,12 +807,14 @@ static void *mlx_kem_dup(const void *vkey, int selection)
         OSSL_DISPATCH_END                                                                  \
     }
 /* See |hybrid_vtable| above */
-DECLARE_DISPATCH(p256, 0);
-DECLARE_DISPATCH(p384, 1);
+DECLARE_DISPATCH(p256_512, 0);
+DECLARE_DISPATCH(p256, 1);
+DECLARE_DISPATCH(p384, 2);
 #if !defined(OPENSSL_NO_ECX)
-DECLARE_DISPATCH(x25519, 2);
-DECLARE_DISPATCH(x448, 3);
+DECLARE_DISPATCH(x25519_512, 3);
+DECLARE_DISPATCH(x25519, 4);
+DECLARE_DISPATCH(x448, 5);
 #endif
 #if !defined(FIPS_MODULE) && !defined(OPENSSL_NO_SM2)
-DECLARE_DISPATCH(curve_sm2, 4);
+DECLARE_DISPATCH(curve_sm2, 6);
 #endif
diff --git a/test/helpers/ssl_test_ctx.c b/test/helpers/ssl_test_ctx.c
index 2ac0cb3ab7..a65cfe4259 100644
--- a/test/helpers/ssl_test_ctx.c
+++ b/test/helpers/ssl_test_ctx.c
@@ -534,23 +534,27 @@ __owur static int parse_expected_key_type(int *ptype, const char *value)
      */
     if (strcmp("RSA", value) == 0) {
         nid = OBJ_ln2nid("rsaEncryption");
-    } else if (strcmp("RSA-PSS", value) == 0) {
+    } else if (OPENSSL_strcasecmp("RSA-PSS", value) == 0) {
         nid = OBJ_ln2nid("rsassaPss");
-    } else if (strcmp("Ed448", value) == 0) {
+    } else if (OPENSSL_strcasecmp("Ed448", value) == 0) {
         nid = OBJ_sn2nid("ED448");
-    } else if (strcmp("Ed25519", value) == 0) {
+    } else if (OPENSSL_strcasecmp("Ed25519", value) == 0) {
         nid = OBJ_sn2nid("ED25519");
-    } else if (strcmp("EC", value) == 0) {
+    } else if (OPENSSL_strcasecmp("EC", value) == 0) {
         nid = OBJ_sn2nid("id-ecPublicKey");
-    } else if (strcmp("curveSM2", value) == 0) {
+    } else if (OPENSSL_strcasecmp("curveSM2", value) == 0) {
         nid = TLSEXT_nid_unknown | OSSL_TLS_GROUP_ID_curveSM2;
-    } else if (strcmp("X25519MLKEM768", value) == 0) {
+    } else if (OPENSSL_strcasecmp("MLKEM512X25519", value) == 0) {
+        nid = TLSEXT_nid_unknown | OSSL_TLS_GROUP_ID_MLKEM512X25519;
+    } else if (OPENSSL_strcasecmp("X25519MLKEM768", value) == 0) {
         nid = TLSEXT_nid_unknown | OSSL_TLS_GROUP_ID_X25519MLKEM768;
-    } else if (strcmp("SecP256r1MLKEM768", value) == 0) {
+    } else if (OPENSSL_strcasecmp("SecP256r1MLKEM512", value) == 0) {
+        nid = TLSEXT_nid_unknown | OSSL_TLS_GROUP_ID_SecP256r1MLKEM512;
+    } else if (OPENSSL_strcasecmp("SecP256r1MLKEM768", value) == 0) {
         nid = TLSEXT_nid_unknown | OSSL_TLS_GROUP_ID_SecP256r1MLKEM768;
-    } else if (strcmp("SecP384r1MLKEM1024", value) == 0) {
+    } else if (OPENSSL_strcasecmp("SecP384r1MLKEM1024", value) == 0) {
         nid = TLSEXT_nid_unknown | OSSL_TLS_GROUP_ID_SecP384r1MLKEM1024;
-    } else if (strcmp("curveSM2MLKEM768", value) == 0) {
+    } else if (OPENSSL_strcasecmp("curveSM2MLKEM768", value) == 0) {
         nid = TLSEXT_nid_unknown | OSSL_TLS_GROUP_ID_curveSM2MLKEM768;
     } else {
         nid = OBJ_ln2nid(value);
diff --git a/test/ml_kem_evp_extra_test.c b/test/ml_kem_evp_extra_test.c
index 980c81a55c..1f282034cf 100644
--- a/test/ml_kem_evp_extra_test.c
+++ b/test/ml_kem_evp_extra_test.c
@@ -425,6 +425,7 @@ static int test_ml_kem_from_data_propq(void)
 #ifndef OPENSSL_NO_EC
 static const char *mlx_kem_algs[] = {
 #ifndef OPENSSL_NO_ECX
+    "MLKEM512X25519",
     "X25519MLKEM768",
 #endif
     "SecP256r1MLKEM768",
diff --git a/test/ssl-tests/14-curves.cnf b/test/ssl-tests/14-curves.cnf
index 5a215d5b4e..71977ae32e 100644
--- a/test/ssl-tests/14-curves.cnf
+++ b/test/ssl-tests/14-curves.cnf
@@ -1,6 +1,6 @@
 # Generated with generate_ssl_tests.pl

-num_tests = 119
+num_tests = 125

 test-0 = 0-curve-prime256v1
 test-1 = 1-curve-secp384r1
@@ -20,107 +20,113 @@ test-14 = 14-curve-SecP256r1MLKEM768
 test-15 = 15-curve-SecP384r1MLKEM1024
 test-16 = 16-curve-curveSM2
 test-17 = 17-curve-curveSM2MLKEM768
-test-18 = 18-curve-sect233k1
-test-19 = 19-curve-sect233r1
-test-20 = 20-curve-sect283k1
-test-21 = 21-curve-sect283r1
-test-22 = 22-curve-sect409k1
-test-23 = 23-curve-sect409r1
-test-24 = 24-curve-sect571k1
-test-25 = 25-curve-sect571r1
-test-26 = 26-curve-secp224r1
-test-27 = 27-curve-sect163k1
-test-28 = 28-curve-sect163r2
-test-29 = 29-curve-prime192v1
-test-30 = 30-curve-sect163r1
-test-31 = 31-curve-sect193r1
-test-32 = 32-curve-sect193r2
-test-33 = 33-curve-sect239k1
-test-34 = 34-curve-secp160k1
-test-35 = 35-curve-secp160r1
-test-36 = 36-curve-secp160r2
-test-37 = 37-curve-secp192k1
-test-38 = 38-curve-secp224k1
-test-39 = 39-curve-secp256k1
-test-40 = 40-curve-brainpoolP256r1
-test-41 = 41-curve-brainpoolP384r1
-test-42 = 42-curve-brainpoolP512r1
-test-43 = 43-curve-sect233k1-tls12-in-tls13
-test-44 = 44-curve-sect233r1-tls12-in-tls13
-test-45 = 45-curve-sect283k1-tls12-in-tls13
-test-46 = 46-curve-sect283r1-tls12-in-tls13
-test-47 = 47-curve-sect409k1-tls12-in-tls13
-test-48 = 48-curve-sect409r1-tls12-in-tls13
-test-49 = 49-curve-sect571k1-tls12-in-tls13
-test-50 = 50-curve-sect571r1-tls12-in-tls13
-test-51 = 51-curve-secp224r1-tls12-in-tls13
-test-52 = 52-curve-sect163k1-tls12-in-tls13
-test-53 = 53-curve-sect163r2-tls12-in-tls13
-test-54 = 54-curve-prime192v1-tls12-in-tls13
-test-55 = 55-curve-sect163r1-tls12-in-tls13
-test-56 = 56-curve-sect193r1-tls12-in-tls13
-test-57 = 57-curve-sect193r2-tls12-in-tls13
-test-58 = 58-curve-sect239k1-tls12-in-tls13
-test-59 = 59-curve-secp160k1-tls12-in-tls13
-test-60 = 60-curve-secp160r1-tls12-in-tls13
-test-61 = 61-curve-secp160r2-tls12-in-tls13
-test-62 = 62-curve-secp192k1-tls12-in-tls13
-test-63 = 63-curve-secp224k1-tls12-in-tls13
-test-64 = 64-curve-secp256k1-tls12-in-tls13
-test-65 = 65-curve-brainpoolP256r1-tls12-in-tls13
-test-66 = 66-curve-brainpoolP384r1-tls12-in-tls13
-test-67 = 67-curve-brainpoolP512r1-tls12-in-tls13
-test-68 = 68-curve-sect233k1-tls13
-test-69 = 69-curve-sect233r1-tls13
-test-70 = 70-curve-sect283k1-tls13
-test-71 = 71-curve-sect283r1-tls13
-test-72 = 72-curve-sect409k1-tls13
-test-73 = 73-curve-sect409r1-tls13
-test-74 = 74-curve-sect571k1-tls13
-test-75 = 75-curve-sect571r1-tls13
-test-76 = 76-curve-secp224r1-tls13
-test-77 = 77-curve-sect163k1-tls13
-test-78 = 78-curve-sect163r2-tls13
-test-79 = 79-curve-prime192v1-tls13
-test-80 = 80-curve-sect163r1-tls13
-test-81 = 81-curve-sect193r1-tls13
-test-82 = 82-curve-sect193r2-tls13
-test-83 = 83-curve-sect239k1-tls13
-test-84 = 84-curve-secp160k1-tls13
-test-85 = 85-curve-secp160r1-tls13
-test-86 = 86-curve-secp160r2-tls13
-test-87 = 87-curve-secp192k1-tls13
-test-88 = 88-curve-secp224k1-tls13
-test-89 = 89-curve-secp256k1-tls13
-test-90 = 90-curve-brainpoolP256r1-tls13
-test-91 = 91-curve-brainpoolP384r1-tls13
-test-92 = 92-curve-brainpoolP512r1-tls13
-test-93 = 93-curve-ffdhe2048-tls13-in-tls12
-test-94 = 94-curve-ffdhe2048-tls13-in-tls12-2
-test-95 = 95-curve-ffdhe3072-tls13-in-tls12
-test-96 = 96-curve-ffdhe3072-tls13-in-tls12-2
-test-97 = 97-curve-ffdhe4096-tls13-in-tls12
-test-98 = 98-curve-ffdhe4096-tls13-in-tls12-2
-test-99 = 99-curve-ffdhe6144-tls13-in-tls12
-test-100 = 100-curve-ffdhe6144-tls13-in-tls12-2
-test-101 = 101-curve-ffdhe8192-tls13-in-tls12
-test-102 = 102-curve-ffdhe8192-tls13-in-tls12-2
-test-103 = 103-curve-brainpoolP256r1tls13-tls13-in-tls12
-test-104 = 104-curve-brainpoolP256r1tls13-tls13-in-tls12-2
-test-105 = 105-curve-brainpoolP384r1tls13-tls13-in-tls12
-test-106 = 106-curve-brainpoolP384r1tls13-tls13-in-tls12-2
-test-107 = 107-curve-brainpoolP512r1tls13-tls13-in-tls12
-test-108 = 108-curve-brainpoolP512r1tls13-tls13-in-tls12-2
-test-109 = 109-curve-X25519MLKEM768-tls13-in-tls12
-test-110 = 110-curve-X25519MLKEM768-tls13-in-tls12-2
-test-111 = 111-curve-SecP256r1MLKEM768-tls13-in-tls12
-test-112 = 112-curve-SecP256r1MLKEM768-tls13-in-tls12-2
-test-113 = 113-curve-SecP384r1MLKEM1024-tls13-in-tls12
-test-114 = 114-curve-SecP384r1MLKEM1024-tls13-in-tls12-2
-test-115 = 115-curve-curveSM2-tls13-in-tls12
-test-116 = 116-curve-curveSM2-tls13-in-tls12-2
-test-117 = 117-curve-curveSM2MLKEM768-tls13-in-tls12
-test-118 = 118-curve-curveSM2MLKEM768-tls13-in-tls12-2
+test-18 = 18-curve-MLKEM512X25519
+test-19 = 19-curve-SecP256r1MLKEM512
+test-20 = 20-curve-sect233k1
+test-21 = 21-curve-sect233r1
+test-22 = 22-curve-sect283k1
+test-23 = 23-curve-sect283r1
+test-24 = 24-curve-sect409k1
+test-25 = 25-curve-sect409r1
+test-26 = 26-curve-sect571k1
+test-27 = 27-curve-sect571r1
+test-28 = 28-curve-secp224r1
+test-29 = 29-curve-sect163k1
+test-30 = 30-curve-sect163r2
+test-31 = 31-curve-prime192v1
+test-32 = 32-curve-sect163r1
+test-33 = 33-curve-sect193r1
+test-34 = 34-curve-sect193r2
+test-35 = 35-curve-sect239k1
+test-36 = 36-curve-secp160k1
+test-37 = 37-curve-secp160r1
+test-38 = 38-curve-secp160r2
+test-39 = 39-curve-secp192k1
+test-40 = 40-curve-secp224k1
+test-41 = 41-curve-secp256k1
+test-42 = 42-curve-brainpoolP256r1
+test-43 = 43-curve-brainpoolP384r1
+test-44 = 44-curve-brainpoolP512r1
+test-45 = 45-curve-sect233k1-tls12-in-tls13
+test-46 = 46-curve-sect233r1-tls12-in-tls13
+test-47 = 47-curve-sect283k1-tls12-in-tls13
+test-48 = 48-curve-sect283r1-tls12-in-tls13
+test-49 = 49-curve-sect409k1-tls12-in-tls13
+test-50 = 50-curve-sect409r1-tls12-in-tls13
+test-51 = 51-curve-sect571k1-tls12-in-tls13
+test-52 = 52-curve-sect571r1-tls12-in-tls13
+test-53 = 53-curve-secp224r1-tls12-in-tls13
+test-54 = 54-curve-sect163k1-tls12-in-tls13
+test-55 = 55-curve-sect163r2-tls12-in-tls13
+test-56 = 56-curve-prime192v1-tls12-in-tls13
+test-57 = 57-curve-sect163r1-tls12-in-tls13
+test-58 = 58-curve-sect193r1-tls12-in-tls13
+test-59 = 59-curve-sect193r2-tls12-in-tls13
+test-60 = 60-curve-sect239k1-tls12-in-tls13
+test-61 = 61-curve-secp160k1-tls12-in-tls13
+test-62 = 62-curve-secp160r1-tls12-in-tls13
+test-63 = 63-curve-secp160r2-tls12-in-tls13
+test-64 = 64-curve-secp192k1-tls12-in-tls13
+test-65 = 65-curve-secp224k1-tls12-in-tls13
+test-66 = 66-curve-secp256k1-tls12-in-tls13
+test-67 = 67-curve-brainpoolP256r1-tls12-in-tls13
+test-68 = 68-curve-brainpoolP384r1-tls12-in-tls13
+test-69 = 69-curve-brainpoolP512r1-tls12-in-tls13
+test-70 = 70-curve-sect233k1-tls13
+test-71 = 71-curve-sect233r1-tls13
+test-72 = 72-curve-sect283k1-tls13
+test-73 = 73-curve-sect283r1-tls13
+test-74 = 74-curve-sect409k1-tls13
+test-75 = 75-curve-sect409r1-tls13
+test-76 = 76-curve-sect571k1-tls13
+test-77 = 77-curve-sect571r1-tls13
+test-78 = 78-curve-secp224r1-tls13
+test-79 = 79-curve-sect163k1-tls13
+test-80 = 80-curve-sect163r2-tls13
+test-81 = 81-curve-prime192v1-tls13
+test-82 = 82-curve-sect163r1-tls13
+test-83 = 83-curve-sect193r1-tls13
+test-84 = 84-curve-sect193r2-tls13
+test-85 = 85-curve-sect239k1-tls13
+test-86 = 86-curve-secp160k1-tls13
+test-87 = 87-curve-secp160r1-tls13
+test-88 = 88-curve-secp160r2-tls13
+test-89 = 89-curve-secp192k1-tls13
+test-90 = 90-curve-secp224k1-tls13
+test-91 = 91-curve-secp256k1-tls13
+test-92 = 92-curve-brainpoolP256r1-tls13
+test-93 = 93-curve-brainpoolP384r1-tls13
+test-94 = 94-curve-brainpoolP512r1-tls13
+test-95 = 95-curve-ffdhe2048-tls13-in-tls12
+test-96 = 96-curve-ffdhe2048-tls13-in-tls12-2
+test-97 = 97-curve-ffdhe3072-tls13-in-tls12
+test-98 = 98-curve-ffdhe3072-tls13-in-tls12-2
+test-99 = 99-curve-ffdhe4096-tls13-in-tls12
+test-100 = 100-curve-ffdhe4096-tls13-in-tls12-2
+test-101 = 101-curve-ffdhe6144-tls13-in-tls12
+test-102 = 102-curve-ffdhe6144-tls13-in-tls12-2
+test-103 = 103-curve-ffdhe8192-tls13-in-tls12
+test-104 = 104-curve-ffdhe8192-tls13-in-tls12-2
+test-105 = 105-curve-brainpoolP256r1tls13-tls13-in-tls12
+test-106 = 106-curve-brainpoolP256r1tls13-tls13-in-tls12-2
+test-107 = 107-curve-brainpoolP384r1tls13-tls13-in-tls12
+test-108 = 108-curve-brainpoolP384r1tls13-tls13-in-tls12-2
+test-109 = 109-curve-brainpoolP512r1tls13-tls13-in-tls12
+test-110 = 110-curve-brainpoolP512r1tls13-tls13-in-tls12-2
+test-111 = 111-curve-X25519MLKEM768-tls13-in-tls12
+test-112 = 112-curve-X25519MLKEM768-tls13-in-tls12-2
+test-113 = 113-curve-SecP256r1MLKEM768-tls13-in-tls12
+test-114 = 114-curve-SecP256r1MLKEM768-tls13-in-tls12-2
+test-115 = 115-curve-SecP384r1MLKEM1024-tls13-in-tls12
+test-116 = 116-curve-SecP384r1MLKEM1024-tls13-in-tls12-2
+test-117 = 117-curve-curveSM2-tls13-in-tls12
+test-118 = 118-curve-curveSM2-tls13-in-tls12-2
+test-119 = 119-curve-curveSM2MLKEM768-tls13-in-tls12
+test-120 = 120-curve-curveSM2MLKEM768-tls13-in-tls12-2
+test-121 = 121-curve-MLKEM512X25519-tls13-in-tls12
+test-122 = 122-curve-MLKEM512X25519-tls13-in-tls12-2
+test-123 = 123-curve-SecP256r1MLKEM512-tls13-in-tls12
+test-124 = 124-curve-SecP256r1MLKEM512-tls13-in-tls12-2
 # ===========================================================

 [0-curve-prime256v1]
@@ -645,28 +651,86 @@ ExpectedTmpKeyType = curveSM2MLKEM768

 # ===========================================================

-[18-curve-sect233k1]
-ssl_conf = 18-curve-sect233k1-ssl
+[18-curve-MLKEM512X25519]
+ssl_conf = 18-curve-MLKEM512X25519-ssl

-[18-curve-sect233k1-ssl]
-server = 18-curve-sect233k1-server
-client = 18-curve-sect233k1-client
+[18-curve-MLKEM512X25519-ssl]
+server = 18-curve-MLKEM512X25519-server
+client = 18-curve-MLKEM512X25519-client

-[18-curve-sect233k1-server]
+[18-curve-MLKEM512X25519-server]
+Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
+CipherString = DEFAULT@SECLEVEL=1
+Curves = MLKEM512X25519
+MaxProtocol = TLSv1.3
+PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
+
+[18-curve-MLKEM512X25519-client]
+CipherString = ECDHE@SECLEVEL=1
+Curves = MLKEM512X25519
+MaxProtocol = TLSv1.3
+VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
+VerifyMode = Peer
+
+[test-18]
+ExpectedProtocol = TLSv1.3
+ExpectedResult = Success
+ExpectedTmpKeyType = MLKEM512X25519
+
+
+# ===========================================================
+
+[19-curve-SecP256r1MLKEM512]
+ssl_conf = 19-curve-SecP256r1MLKEM512-ssl
+
+[19-curve-SecP256r1MLKEM512-ssl]
+server = 19-curve-SecP256r1MLKEM512-server
+client = 19-curve-SecP256r1MLKEM512-client
+
+[19-curve-SecP256r1MLKEM512-server]
+Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
+CipherString = DEFAULT@SECLEVEL=1
+Curves = SecP256r1MLKEM512
+MaxProtocol = TLSv1.3
+PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
+
+[19-curve-SecP256r1MLKEM512-client]
+CipherString = ECDHE@SECLEVEL=1
+Curves = SecP256r1MLKEM512
+MaxProtocol = TLSv1.3
+VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
+VerifyMode = Peer
+
+[test-19]
+ExpectedProtocol = TLSv1.3
+ExpectedResult = Success
+ExpectedTmpKeyType = SecP256r1MLKEM512
+
+
+# ===========================================================
+
+[20-curve-sect233k1]
+ssl_conf = 20-curve-sect233k1-ssl
+
+[20-curve-sect233k1-ssl]
+server = 20-curve-sect233k1-server
+client = 20-curve-sect233k1-client
+
+[20-curve-sect233k1-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = sect233k1
 MaxProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[18-curve-sect233k1-client]
+[20-curve-sect233k1-client]
 CipherString = ECDHE@SECLEVEL=1
 Curves = sect233k1
 MaxProtocol = TLSv1.2
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-18]
+[test-20]
 ExpectedProtocol = TLSv1.2
 ExpectedResult = Success
 ExpectedTmpKeyType = sect233k1
@@ -674,28 +738,28 @@ ExpectedTmpKeyType = sect233k1

 # ===========================================================

-[19-curve-sect233r1]
-ssl_conf = 19-curve-sect233r1-ssl
+[21-curve-sect233r1]
+ssl_conf = 21-curve-sect233r1-ssl

-[19-curve-sect233r1-ssl]
-server = 19-curve-sect233r1-server
-client = 19-curve-sect233r1-client
+[21-curve-sect233r1-ssl]
+server = 21-curve-sect233r1-server
+client = 21-curve-sect233r1-client

-[19-curve-sect233r1-server]
+[21-curve-sect233r1-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = sect233r1
 MaxProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[19-curve-sect233r1-client]
+[21-curve-sect233r1-client]
 CipherString = ECDHE@SECLEVEL=1
 Curves = sect233r1
 MaxProtocol = TLSv1.2
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-19]
+[test-21]
 ExpectedProtocol = TLSv1.2
 ExpectedResult = Success
 ExpectedTmpKeyType = sect233r1
@@ -703,28 +767,28 @@ ExpectedTmpKeyType = sect233r1

 # ===========================================================

-[20-curve-sect283k1]
-ssl_conf = 20-curve-sect283k1-ssl
+[22-curve-sect283k1]
+ssl_conf = 22-curve-sect283k1-ssl

-[20-curve-sect283k1-ssl]
-server = 20-curve-sect283k1-server
-client = 20-curve-sect283k1-client
+[22-curve-sect283k1-ssl]
+server = 22-curve-sect283k1-server
+client = 22-curve-sect283k1-client

-[20-curve-sect283k1-server]
+[22-curve-sect283k1-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = sect283k1
 MaxProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[20-curve-sect283k1-client]
+[22-curve-sect283k1-client]
 CipherString = ECDHE@SECLEVEL=1
 Curves = sect283k1
 MaxProtocol = TLSv1.2
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-20]
+[test-22]
 ExpectedProtocol = TLSv1.2
 ExpectedResult = Success
 ExpectedTmpKeyType = sect283k1
@@ -732,28 +796,28 @@ ExpectedTmpKeyType = sect283k1

 # ===========================================================

-[21-curve-sect283r1]
-ssl_conf = 21-curve-sect283r1-ssl
+[23-curve-sect283r1]
+ssl_conf = 23-curve-sect283r1-ssl

-[21-curve-sect283r1-ssl]
-server = 21-curve-sect283r1-server
-client = 21-curve-sect283r1-client
+[23-curve-sect283r1-ssl]
+server = 23-curve-sect283r1-server
+client = 23-curve-sect283r1-client

-[21-curve-sect283r1-server]
+[23-curve-sect283r1-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = sect283r1
 MaxProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[21-curve-sect283r1-client]
+[23-curve-sect283r1-client]
 CipherString = ECDHE@SECLEVEL=1
 Curves = sect283r1
 MaxProtocol = TLSv1.2
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-21]
+[test-23]
 ExpectedProtocol = TLSv1.2
 ExpectedResult = Success
 ExpectedTmpKeyType = sect283r1
@@ -761,28 +825,28 @@ ExpectedTmpKeyType = sect283r1

 # ===========================================================

-[22-curve-sect409k1]
-ssl_conf = 22-curve-sect409k1-ssl
+[24-curve-sect409k1]
+ssl_conf = 24-curve-sect409k1-ssl

-[22-curve-sect409k1-ssl]
-server = 22-curve-sect409k1-server
-client = 22-curve-sect409k1-client
+[24-curve-sect409k1-ssl]
+server = 24-curve-sect409k1-server
+client = 24-curve-sect409k1-client

-[22-curve-sect409k1-server]
+[24-curve-sect409k1-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = sect409k1
 MaxProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[22-curve-sect409k1-client]
+[24-curve-sect409k1-client]
 CipherString = ECDHE@SECLEVEL=1
 Curves = sect409k1
 MaxProtocol = TLSv1.2
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-22]
+[test-24]
 ExpectedProtocol = TLSv1.2
 ExpectedResult = Success
 ExpectedTmpKeyType = sect409k1
@@ -790,28 +854,28 @@ ExpectedTmpKeyType = sect409k1

 # ===========================================================

-[23-curve-sect409r1]
-ssl_conf = 23-curve-sect409r1-ssl
+[25-curve-sect409r1]
+ssl_conf = 25-curve-sect409r1-ssl

-[23-curve-sect409r1-ssl]
-server = 23-curve-sect409r1-server
-client = 23-curve-sect409r1-client
+[25-curve-sect409r1-ssl]
+server = 25-curve-sect409r1-server
+client = 25-curve-sect409r1-client

-[23-curve-sect409r1-server]
+[25-curve-sect409r1-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = sect409r1
 MaxProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[23-curve-sect409r1-client]
+[25-curve-sect409r1-client]
 CipherString = ECDHE@SECLEVEL=1
 Curves = sect409r1
 MaxProtocol = TLSv1.2
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-23]
+[test-25]
 ExpectedProtocol = TLSv1.2
 ExpectedResult = Success
 ExpectedTmpKeyType = sect409r1
@@ -819,28 +883,28 @@ ExpectedTmpKeyType = sect409r1

 # ===========================================================

-[24-curve-sect571k1]
-ssl_conf = 24-curve-sect571k1-ssl
+[26-curve-sect571k1]
+ssl_conf = 26-curve-sect571k1-ssl

-[24-curve-sect571k1-ssl]
-server = 24-curve-sect571k1-server
-client = 24-curve-sect571k1-client
+[26-curve-sect571k1-ssl]
+server = 26-curve-sect571k1-server
+client = 26-curve-sect571k1-client

-[24-curve-sect571k1-server]
+[26-curve-sect571k1-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = sect571k1
 MaxProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[24-curve-sect571k1-client]
+[26-curve-sect571k1-client]
 CipherString = ECDHE@SECLEVEL=1
 Curves = sect571k1
 MaxProtocol = TLSv1.2
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-24]
+[test-26]
 ExpectedProtocol = TLSv1.2
 ExpectedResult = Success
 ExpectedTmpKeyType = sect571k1
@@ -848,28 +912,28 @@ ExpectedTmpKeyType = sect571k1

 # ===========================================================

-[25-curve-sect571r1]
-ssl_conf = 25-curve-sect571r1-ssl
+[27-curve-sect571r1]
+ssl_conf = 27-curve-sect571r1-ssl

-[25-curve-sect571r1-ssl]
-server = 25-curve-sect571r1-server
-client = 25-curve-sect571r1-client
+[27-curve-sect571r1-ssl]
+server = 27-curve-sect571r1-server
+client = 27-curve-sect571r1-client

-[25-curve-sect571r1-server]
+[27-curve-sect571r1-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = sect571r1
 MaxProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[25-curve-sect571r1-client]
+[27-curve-sect571r1-client]
 CipherString = ECDHE@SECLEVEL=1
 Curves = sect571r1
 MaxProtocol = TLSv1.2
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-25]
+[test-27]
 ExpectedProtocol = TLSv1.2
 ExpectedResult = Success
 ExpectedTmpKeyType = sect571r1
@@ -877,28 +941,28 @@ ExpectedTmpKeyType = sect571r1

 # ===========================================================

-[26-curve-secp224r1]
-ssl_conf = 26-curve-secp224r1-ssl
+[28-curve-secp224r1]
+ssl_conf = 28-curve-secp224r1-ssl

-[26-curve-secp224r1-ssl]
-server = 26-curve-secp224r1-server
-client = 26-curve-secp224r1-client
+[28-curve-secp224r1-ssl]
+server = 28-curve-secp224r1-server
+client = 28-curve-secp224r1-client

-[26-curve-secp224r1-server]
+[28-curve-secp224r1-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = secp224r1
 MaxProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[26-curve-secp224r1-client]
+[28-curve-secp224r1-client]
 CipherString = ECDHE@SECLEVEL=1
 Curves = secp224r1
 MaxProtocol = TLSv1.2
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-26]
+[test-28]
 ExpectedProtocol = TLSv1.2
 ExpectedResult = Success
 ExpectedTmpKeyType = secp224r1
@@ -906,28 +970,28 @@ ExpectedTmpKeyType = secp224r1

 # ===========================================================

-[27-curve-sect163k1]
-ssl_conf = 27-curve-sect163k1-ssl
+[29-curve-sect163k1]
+ssl_conf = 29-curve-sect163k1-ssl

-[27-curve-sect163k1-ssl]
-server = 27-curve-sect163k1-server
-client = 27-curve-sect163k1-client
+[29-curve-sect163k1-ssl]
+server = 29-curve-sect163k1-server
+client = 29-curve-sect163k1-client

-[27-curve-sect163k1-server]
+[29-curve-sect163k1-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = sect163k1
 MaxProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[27-curve-sect163k1-client]
+[29-curve-sect163k1-client]
 CipherString = ECDHE@SECLEVEL=1
 Curves = sect163k1
 MaxProtocol = TLSv1.2
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-27]
+[test-29]
 ExpectedProtocol = TLSv1.2
 ExpectedResult = Success
 ExpectedTmpKeyType = sect163k1
@@ -935,28 +999,28 @@ ExpectedTmpKeyType = sect163k1

 # ===========================================================

-[28-curve-sect163r2]
-ssl_conf = 28-curve-sect163r2-ssl
+[30-curve-sect163r2]
+ssl_conf = 30-curve-sect163r2-ssl

-[28-curve-sect163r2-ssl]
-server = 28-curve-sect163r2-server
-client = 28-curve-sect163r2-client
+[30-curve-sect163r2-ssl]
+server = 30-curve-sect163r2-server
+client = 30-curve-sect163r2-client

-[28-curve-sect163r2-server]
+[30-curve-sect163r2-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = sect163r2
 MaxProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[28-curve-sect163r2-client]
+[30-curve-sect163r2-client]
 CipherString = ECDHE@SECLEVEL=1
 Curves = sect163r2
 MaxProtocol = TLSv1.2
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-28]
+[test-30]
 ExpectedProtocol = TLSv1.2
 ExpectedResult = Success
 ExpectedTmpKeyType = sect163r2
@@ -964,28 +1028,28 @@ ExpectedTmpKeyType = sect163r2

 # ===========================================================

-[29-curve-prime192v1]
-ssl_conf = 29-curve-prime192v1-ssl
+[31-curve-prime192v1]
+ssl_conf = 31-curve-prime192v1-ssl

-[29-curve-prime192v1-ssl]
-server = 29-curve-prime192v1-server
-client = 29-curve-prime192v1-client
+[31-curve-prime192v1-ssl]
+server = 31-curve-prime192v1-server
+client = 31-curve-prime192v1-client

-[29-curve-prime192v1-server]
+[31-curve-prime192v1-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = prime192v1
 MaxProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[29-curve-prime192v1-client]
+[31-curve-prime192v1-client]
 CipherString = ECDHE@SECLEVEL=1
 Curves = prime192v1
 MaxProtocol = TLSv1.2
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-29]
+[test-31]
 ExpectedProtocol = TLSv1.2
 ExpectedResult = Success
 ExpectedTmpKeyType = prime192v1
@@ -993,28 +1057,28 @@ ExpectedTmpKeyType = prime192v1

 # ===========================================================

-[30-curve-sect163r1]
-ssl_conf = 30-curve-sect163r1-ssl
+[32-curve-sect163r1]
+ssl_conf = 32-curve-sect163r1-ssl

-[30-curve-sect163r1-ssl]
-server = 30-curve-sect163r1-server
-client = 30-curve-sect163r1-client
+[32-curve-sect163r1-ssl]
+server = 32-curve-sect163r1-server
+client = 32-curve-sect163r1-client

-[30-curve-sect163r1-server]
+[32-curve-sect163r1-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = sect163r1
 MaxProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[30-curve-sect163r1-client]
+[32-curve-sect163r1-client]
 CipherString = ECDHE@SECLEVEL=1
 Curves = sect163r1
 MaxProtocol = TLSv1.2
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-30]
+[test-32]
 ExpectedProtocol = TLSv1.2
 ExpectedResult = Success
 ExpectedTmpKeyType = sect163r1
@@ -1022,28 +1086,28 @@ ExpectedTmpKeyType = sect163r1

 # ===========================================================

-[31-curve-sect193r1]
-ssl_conf = 31-curve-sect193r1-ssl
+[33-curve-sect193r1]
+ssl_conf = 33-curve-sect193r1-ssl

-[31-curve-sect193r1-ssl]
-server = 31-curve-sect193r1-server
-client = 31-curve-sect193r1-client
+[33-curve-sect193r1-ssl]
+server = 33-curve-sect193r1-server
+client = 33-curve-sect193r1-client

-[31-curve-sect193r1-server]
+[33-curve-sect193r1-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = sect193r1
 MaxProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[31-curve-sect193r1-client]
+[33-curve-sect193r1-client]
 CipherString = ECDHE@SECLEVEL=1
 Curves = sect193r1
 MaxProtocol = TLSv1.2
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-31]
+[test-33]
 ExpectedProtocol = TLSv1.2
 ExpectedResult = Success
 ExpectedTmpKeyType = sect193r1
@@ -1051,28 +1115,28 @@ ExpectedTmpKeyType = sect193r1

 # ===========================================================

-[32-curve-sect193r2]
-ssl_conf = 32-curve-sect193r2-ssl
+[34-curve-sect193r2]
+ssl_conf = 34-curve-sect193r2-ssl

-[32-curve-sect193r2-ssl]
-server = 32-curve-sect193r2-server
-client = 32-curve-sect193r2-client
+[34-curve-sect193r2-ssl]
+server = 34-curve-sect193r2-server
+client = 34-curve-sect193r2-client

-[32-curve-sect193r2-server]
+[34-curve-sect193r2-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = sect193r2
 MaxProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[32-curve-sect193r2-client]
+[34-curve-sect193r2-client]
 CipherString = ECDHE@SECLEVEL=1
 Curves = sect193r2
 MaxProtocol = TLSv1.2
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-32]
+[test-34]
 ExpectedProtocol = TLSv1.2
 ExpectedResult = Success
 ExpectedTmpKeyType = sect193r2
@@ -1080,28 +1144,28 @@ ExpectedTmpKeyType = sect193r2

 # ===========================================================

-[33-curve-sect239k1]
-ssl_conf = 33-curve-sect239k1-ssl
+[35-curve-sect239k1]
+ssl_conf = 35-curve-sect239k1-ssl

-[33-curve-sect239k1-ssl]
-server = 33-curve-sect239k1-server
-client = 33-curve-sect239k1-client
+[35-curve-sect239k1-ssl]
+server = 35-curve-sect239k1-server
+client = 35-curve-sect239k1-client

-[33-curve-sect239k1-server]
+[35-curve-sect239k1-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = sect239k1
 MaxProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[33-curve-sect239k1-client]
+[35-curve-sect239k1-client]
 CipherString = ECDHE@SECLEVEL=1
 Curves = sect239k1
 MaxProtocol = TLSv1.2
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-33]
+[test-35]
 ExpectedProtocol = TLSv1.2
 ExpectedResult = Success
 ExpectedTmpKeyType = sect239k1
@@ -1109,28 +1173,28 @@ ExpectedTmpKeyType = sect239k1

 # ===========================================================

-[34-curve-secp160k1]
-ssl_conf = 34-curve-secp160k1-ssl
+[36-curve-secp160k1]
+ssl_conf = 36-curve-secp160k1-ssl

-[34-curve-secp160k1-ssl]
-server = 34-curve-secp160k1-server
-client = 34-curve-secp160k1-client
+[36-curve-secp160k1-ssl]
+server = 36-curve-secp160k1-server
+client = 36-curve-secp160k1-client

-[34-curve-secp160k1-server]
+[36-curve-secp160k1-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = secp160k1
 MaxProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[34-curve-secp160k1-client]
+[36-curve-secp160k1-client]
 CipherString = ECDHE@SECLEVEL=1
 Curves = secp160k1
 MaxProtocol = TLSv1.2
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-34]
+[test-36]
 ExpectedProtocol = TLSv1.2
 ExpectedResult = Success
 ExpectedTmpKeyType = secp160k1
@@ -1138,28 +1202,28 @@ ExpectedTmpKeyType = secp160k1

 # ===========================================================

-[35-curve-secp160r1]
-ssl_conf = 35-curve-secp160r1-ssl
+[37-curve-secp160r1]
+ssl_conf = 37-curve-secp160r1-ssl

-[35-curve-secp160r1-ssl]
-server = 35-curve-secp160r1-server
-client = 35-curve-secp160r1-client
+[37-curve-secp160r1-ssl]
+server = 37-curve-secp160r1-server
+client = 37-curve-secp160r1-client

-[35-curve-secp160r1-server]
+[37-curve-secp160r1-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = secp160r1
 MaxProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[35-curve-secp160r1-client]
+[37-curve-secp160r1-client]
 CipherString = ECDHE@SECLEVEL=1
 Curves = secp160r1
 MaxProtocol = TLSv1.2
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-35]
+[test-37]
 ExpectedProtocol = TLSv1.2
 ExpectedResult = Success
 ExpectedTmpKeyType = secp160r1
@@ -1167,28 +1231,28 @@ ExpectedTmpKeyType = secp160r1

 # ===========================================================

-[36-curve-secp160r2]
-ssl_conf = 36-curve-secp160r2-ssl
+[38-curve-secp160r2]
+ssl_conf = 38-curve-secp160r2-ssl

-[36-curve-secp160r2-ssl]
-server = 36-curve-secp160r2-server
-client = 36-curve-secp160r2-client
+[38-curve-secp160r2-ssl]
+server = 38-curve-secp160r2-server
+client = 38-curve-secp160r2-client

-[36-curve-secp160r2-server]
+[38-curve-secp160r2-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = secp160r2
 MaxProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[36-curve-secp160r2-client]
+[38-curve-secp160r2-client]
 CipherString = ECDHE@SECLEVEL=1
 Curves = secp160r2
 MaxProtocol = TLSv1.2
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-36]
+[test-38]
 ExpectedProtocol = TLSv1.2
 ExpectedResult = Success
 ExpectedTmpKeyType = secp160r2
@@ -1196,28 +1260,28 @@ ExpectedTmpKeyType = secp160r2

 # ===========================================================

-[37-curve-secp192k1]
-ssl_conf = 37-curve-secp192k1-ssl
+[39-curve-secp192k1]
+ssl_conf = 39-curve-secp192k1-ssl

-[37-curve-secp192k1-ssl]
-server = 37-curve-secp192k1-server
-client = 37-curve-secp192k1-client
+[39-curve-secp192k1-ssl]
+server = 39-curve-secp192k1-server
+client = 39-curve-secp192k1-client

-[37-curve-secp192k1-server]
+[39-curve-secp192k1-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = secp192k1
 MaxProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[37-curve-secp192k1-client]
+[39-curve-secp192k1-client]
 CipherString = ECDHE@SECLEVEL=1
 Curves = secp192k1
 MaxProtocol = TLSv1.2
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-37]
+[test-39]
 ExpectedProtocol = TLSv1.2
 ExpectedResult = Success
 ExpectedTmpKeyType = secp192k1
@@ -1225,28 +1289,28 @@ ExpectedTmpKeyType = secp192k1

 # ===========================================================

-[38-curve-secp224k1]
-ssl_conf = 38-curve-secp224k1-ssl
+[40-curve-secp224k1]
+ssl_conf = 40-curve-secp224k1-ssl

-[38-curve-secp224k1-ssl]
-server = 38-curve-secp224k1-server
-client = 38-curve-secp224k1-client
+[40-curve-secp224k1-ssl]
+server = 40-curve-secp224k1-server
+client = 40-curve-secp224k1-client

-[38-curve-secp224k1-server]
+[40-curve-secp224k1-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = secp224k1
 MaxProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[38-curve-secp224k1-client]
+[40-curve-secp224k1-client]
 CipherString = ECDHE@SECLEVEL=1
 Curves = secp224k1
 MaxProtocol = TLSv1.2
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-38]
+[test-40]
 ExpectedProtocol = TLSv1.2
 ExpectedResult = Success
 ExpectedTmpKeyType = secp224k1
@@ -1254,28 +1318,28 @@ ExpectedTmpKeyType = secp224k1

 # ===========================================================

-[39-curve-secp256k1]
-ssl_conf = 39-curve-secp256k1-ssl
+[41-curve-secp256k1]
+ssl_conf = 41-curve-secp256k1-ssl

-[39-curve-secp256k1-ssl]
-server = 39-curve-secp256k1-server
-client = 39-curve-secp256k1-client
+[41-curve-secp256k1-ssl]
+server = 41-curve-secp256k1-server
+client = 41-curve-secp256k1-client

-[39-curve-secp256k1-server]
+[41-curve-secp256k1-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = secp256k1
 MaxProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[39-curve-secp256k1-client]
+[41-curve-secp256k1-client]
 CipherString = ECDHE@SECLEVEL=1
 Curves = secp256k1
 MaxProtocol = TLSv1.2
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-39]
+[test-41]
 ExpectedProtocol = TLSv1.2
 ExpectedResult = Success
 ExpectedTmpKeyType = secp256k1
@@ -1283,28 +1347,28 @@ ExpectedTmpKeyType = secp256k1

 # ===========================================================

-[40-curve-brainpoolP256r1]
-ssl_conf = 40-curve-brainpoolP256r1-ssl
+[42-curve-brainpoolP256r1]
+ssl_conf = 42-curve-brainpoolP256r1-ssl

-[40-curve-brainpoolP256r1-ssl]
-server = 40-curve-brainpoolP256r1-server
-client = 40-curve-brainpoolP256r1-client
+[42-curve-brainpoolP256r1-ssl]
+server = 42-curve-brainpoolP256r1-server
+client = 42-curve-brainpoolP256r1-client

-[40-curve-brainpoolP256r1-server]
+[42-curve-brainpoolP256r1-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = brainpoolP256r1
 MaxProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[40-curve-brainpoolP256r1-client]
+[42-curve-brainpoolP256r1-client]
 CipherString = ECDHE@SECLEVEL=1
 Curves = brainpoolP256r1
 MaxProtocol = TLSv1.2
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-40]
+[test-42]
 ExpectedProtocol = TLSv1.2
 ExpectedResult = Success
 ExpectedTmpKeyType = brainpoolP256r1
@@ -1312,28 +1376,28 @@ ExpectedTmpKeyType = brainpoolP256r1

 # ===========================================================

-[41-curve-brainpoolP384r1]
-ssl_conf = 41-curve-brainpoolP384r1-ssl
+[43-curve-brainpoolP384r1]
+ssl_conf = 43-curve-brainpoolP384r1-ssl

-[41-curve-brainpoolP384r1-ssl]
-server = 41-curve-brainpoolP384r1-server
-client = 41-curve-brainpoolP384r1-client
+[43-curve-brainpoolP384r1-ssl]
+server = 43-curve-brainpoolP384r1-server
+client = 43-curve-brainpoolP384r1-client

-[41-curve-brainpoolP384r1-server]
+[43-curve-brainpoolP384r1-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = brainpoolP384r1
 MaxProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[41-curve-brainpoolP384r1-client]
+[43-curve-brainpoolP384r1-client]
 CipherString = ECDHE@SECLEVEL=1
 Curves = brainpoolP384r1
 MaxProtocol = TLSv1.2
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-41]
+[test-43]
 ExpectedProtocol = TLSv1.2
 ExpectedResult = Success
 ExpectedTmpKeyType = brainpoolP384r1
@@ -1341,28 +1405,28 @@ ExpectedTmpKeyType = brainpoolP384r1

 # ===========================================================

-[42-curve-brainpoolP512r1]
-ssl_conf = 42-curve-brainpoolP512r1-ssl
+[44-curve-brainpoolP512r1]
+ssl_conf = 44-curve-brainpoolP512r1-ssl

-[42-curve-brainpoolP512r1-ssl]
-server = 42-curve-brainpoolP512r1-server
-client = 42-curve-brainpoolP512r1-client
+[44-curve-brainpoolP512r1-ssl]
+server = 44-curve-brainpoolP512r1-server
+client = 44-curve-brainpoolP512r1-client

-[42-curve-brainpoolP512r1-server]
+[44-curve-brainpoolP512r1-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = brainpoolP512r1
 MaxProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[42-curve-brainpoolP512r1-client]
+[44-curve-brainpoolP512r1-client]
 CipherString = ECDHE@SECLEVEL=1
 Curves = brainpoolP512r1
 MaxProtocol = TLSv1.2
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-42]
+[test-44]
 ExpectedProtocol = TLSv1.2
 ExpectedResult = Success
 ExpectedTmpKeyType = brainpoolP512r1
@@ -1370,21 +1434,21 @@ ExpectedTmpKeyType = brainpoolP512r1

 # ===========================================================

-[43-curve-sect233k1-tls12-in-tls13]
-ssl_conf = 43-curve-sect233k1-tls12-in-tls13-ssl
+[45-curve-sect233k1-tls12-in-tls13]
+ssl_conf = 45-curve-sect233k1-tls12-in-tls13-ssl

-[43-curve-sect233k1-tls12-in-tls13-ssl]
-server = 43-curve-sect233k1-tls12-in-tls13-server
-client = 43-curve-sect233k1-tls12-in-tls13-client
+[45-curve-sect233k1-tls12-in-tls13-ssl]
+server = 45-curve-sect233k1-tls12-in-tls13-server
+client = 45-curve-sect233k1-tls12-in-tls13-client

-[43-curve-sect233k1-tls12-in-tls13-server]
+[45-curve-sect233k1-tls12-in-tls13-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = sect233k1:P-256
 MaxProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[43-curve-sect233k1-tls12-in-tls13-client]
+[45-curve-sect233k1-tls12-in-tls13-client]
 CipherString = ECDHE@SECLEVEL=1
 Curves = sect233k1:P-256
 MaxProtocol = TLSv1.3
@@ -1392,7 +1456,7 @@ MinProtocol = TLSv1.3
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-43]
+[test-45]
 ExpectedProtocol = TLSv1.3
 ExpectedResult = Success
 ExpectedTmpKeyType = P-256
@@ -1400,21 +1464,21 @@ ExpectedTmpKeyType = P-256

 # ===========================================================

-[44-curve-sect233r1-tls12-in-tls13]
-ssl_conf = 44-curve-sect233r1-tls12-in-tls13-ssl
+[46-curve-sect233r1-tls12-in-tls13]
+ssl_conf = 46-curve-sect233r1-tls12-in-tls13-ssl

-[44-curve-sect233r1-tls12-in-tls13-ssl]
-server = 44-curve-sect233r1-tls12-in-tls13-server
-client = 44-curve-sect233r1-tls12-in-tls13-client
+[46-curve-sect233r1-tls12-in-tls13-ssl]
+server = 46-curve-sect233r1-tls12-in-tls13-server
+client = 46-curve-sect233r1-tls12-in-tls13-client

-[44-curve-sect233r1-tls12-in-tls13-server]
+[46-curve-sect233r1-tls12-in-tls13-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = sect233r1:P-256
 MaxProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[44-curve-sect233r1-tls12-in-tls13-client]
+[46-curve-sect233r1-tls12-in-tls13-client]
 CipherString = ECDHE@SECLEVEL=1
 Curves = sect233r1:P-256
 MaxProtocol = TLSv1.3
@@ -1422,7 +1486,7 @@ MinProtocol = TLSv1.3
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-44]
+[test-46]
 ExpectedProtocol = TLSv1.3
 ExpectedResult = Success
 ExpectedTmpKeyType = P-256
@@ -1430,21 +1494,21 @@ ExpectedTmpKeyType = P-256

 # ===========================================================

-[45-curve-sect283k1-tls12-in-tls13]
-ssl_conf = 45-curve-sect283k1-tls12-in-tls13-ssl
+[47-curve-sect283k1-tls12-in-tls13]
+ssl_conf = 47-curve-sect283k1-tls12-in-tls13-ssl

-[45-curve-sect283k1-tls12-in-tls13-ssl]
-server = 45-curve-sect283k1-tls12-in-tls13-server
-client = 45-curve-sect283k1-tls12-in-tls13-client
+[47-curve-sect283k1-tls12-in-tls13-ssl]
+server = 47-curve-sect283k1-tls12-in-tls13-server
+client = 47-curve-sect283k1-tls12-in-tls13-client

-[45-curve-sect283k1-tls12-in-tls13-server]
+[47-curve-sect283k1-tls12-in-tls13-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = sect283k1:P-256
 MaxProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[45-curve-sect283k1-tls12-in-tls13-client]
+[47-curve-sect283k1-tls12-in-tls13-client]
 CipherString = ECDHE@SECLEVEL=1
 Curves = sect283k1:P-256
 MaxProtocol = TLSv1.3
@@ -1452,7 +1516,7 @@ MinProtocol = TLSv1.3
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-45]
+[test-47]
 ExpectedProtocol = TLSv1.3
 ExpectedResult = Success
 ExpectedTmpKeyType = P-256
@@ -1460,21 +1524,21 @@ ExpectedTmpKeyType = P-256

 # ===========================================================

-[46-curve-sect283r1-tls12-in-tls13]
-ssl_conf = 46-curve-sect283r1-tls12-in-tls13-ssl
+[48-curve-sect283r1-tls12-in-tls13]
+ssl_conf = 48-curve-sect283r1-tls12-in-tls13-ssl

-[46-curve-sect283r1-tls12-in-tls13-ssl]
-server = 46-curve-sect283r1-tls12-in-tls13-server
-client = 46-curve-sect283r1-tls12-in-tls13-client
+[48-curve-sect283r1-tls12-in-tls13-ssl]
+server = 48-curve-sect283r1-tls12-in-tls13-server
+client = 48-curve-sect283r1-tls12-in-tls13-client

-[46-curve-sect283r1-tls12-in-tls13-server]
+[48-curve-sect283r1-tls12-in-tls13-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = sect283r1:P-256
 MaxProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[46-curve-sect283r1-tls12-in-tls13-client]
+[48-curve-sect283r1-tls12-in-tls13-client]
 CipherString = ECDHE@SECLEVEL=1
 Curves = sect283r1:P-256
 MaxProtocol = TLSv1.3
@@ -1482,7 +1546,7 @@ MinProtocol = TLSv1.3
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-46]
+[test-48]
 ExpectedProtocol = TLSv1.3
 ExpectedResult = Success
 ExpectedTmpKeyType = P-256
@@ -1490,21 +1554,21 @@ ExpectedTmpKeyType = P-256

 # ===========================================================

-[47-curve-sect409k1-tls12-in-tls13]
-ssl_conf = 47-curve-sect409k1-tls12-in-tls13-ssl
+[49-curve-sect409k1-tls12-in-tls13]
+ssl_conf = 49-curve-sect409k1-tls12-in-tls13-ssl

-[47-curve-sect409k1-tls12-in-tls13-ssl]
-server = 47-curve-sect409k1-tls12-in-tls13-server
-client = 47-curve-sect409k1-tls12-in-tls13-client
+[49-curve-sect409k1-tls12-in-tls13-ssl]
+server = 49-curve-sect409k1-tls12-in-tls13-server
+client = 49-curve-sect409k1-tls12-in-tls13-client

-[47-curve-sect409k1-tls12-in-tls13-server]
+[49-curve-sect409k1-tls12-in-tls13-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = sect409k1:P-256
 MaxProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[47-curve-sect409k1-tls12-in-tls13-client]
+[49-curve-sect409k1-tls12-in-tls13-client]
 CipherString = ECDHE@SECLEVEL=1
 Curves = sect409k1:P-256
 MaxProtocol = TLSv1.3
@@ -1512,7 +1576,7 @@ MinProtocol = TLSv1.3
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-47]
+[test-49]
 ExpectedProtocol = TLSv1.3
 ExpectedResult = Success
 ExpectedTmpKeyType = P-256
@@ -1520,21 +1584,21 @@ ExpectedTmpKeyType = P-256

 # ===========================================================

-[48-curve-sect409r1-tls12-in-tls13]
-ssl_conf = 48-curve-sect409r1-tls12-in-tls13-ssl
+[50-curve-sect409r1-tls12-in-tls13]
+ssl_conf = 50-curve-sect409r1-tls12-in-tls13-ssl

-[48-curve-sect409r1-tls12-in-tls13-ssl]
-server = 48-curve-sect409r1-tls12-in-tls13-server
-client = 48-curve-sect409r1-tls12-in-tls13-client
+[50-curve-sect409r1-tls12-in-tls13-ssl]
+server = 50-curve-sect409r1-tls12-in-tls13-server
+client = 50-curve-sect409r1-tls12-in-tls13-client

-[48-curve-sect409r1-tls12-in-tls13-server]
+[50-curve-sect409r1-tls12-in-tls13-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = sect409r1:P-256
 MaxProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[48-curve-sect409r1-tls12-in-tls13-client]
+[50-curve-sect409r1-tls12-in-tls13-client]
 CipherString = ECDHE@SECLEVEL=1
 Curves = sect409r1:P-256
 MaxProtocol = TLSv1.3
@@ -1542,7 +1606,7 @@ MinProtocol = TLSv1.3
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-48]
+[test-50]
 ExpectedProtocol = TLSv1.3
 ExpectedResult = Success
 ExpectedTmpKeyType = P-256
@@ -1550,21 +1614,21 @@ ExpectedTmpKeyType = P-256

 # ===========================================================

-[49-curve-sect571k1-tls12-in-tls13]
-ssl_conf = 49-curve-sect571k1-tls12-in-tls13-ssl
+[51-curve-sect571k1-tls12-in-tls13]
+ssl_conf = 51-curve-sect571k1-tls12-in-tls13-ssl

-[49-curve-sect571k1-tls12-in-tls13-ssl]
-server = 49-curve-sect571k1-tls12-in-tls13-server
-client = 49-curve-sect571k1-tls12-in-tls13-client
+[51-curve-sect571k1-tls12-in-tls13-ssl]
+server = 51-curve-sect571k1-tls12-in-tls13-server
+client = 51-curve-sect571k1-tls12-in-tls13-client

-[49-curve-sect571k1-tls12-in-tls13-server]
+[51-curve-sect571k1-tls12-in-tls13-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = sect571k1:P-256
 MaxProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[49-curve-sect571k1-tls12-in-tls13-client]
+[51-curve-sect571k1-tls12-in-tls13-client]
 CipherString = ECDHE@SECLEVEL=1
 Curves = sect571k1:P-256
 MaxProtocol = TLSv1.3
@@ -1572,7 +1636,7 @@ MinProtocol = TLSv1.3
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-49]
+[test-51]
 ExpectedProtocol = TLSv1.3
 ExpectedResult = Success
 ExpectedTmpKeyType = P-256
@@ -1580,21 +1644,21 @@ ExpectedTmpKeyType = P-256

 # ===========================================================

-[50-curve-sect571r1-tls12-in-tls13]
-ssl_conf = 50-curve-sect571r1-tls12-in-tls13-ssl
+[52-curve-sect571r1-tls12-in-tls13]
+ssl_conf = 52-curve-sect571r1-tls12-in-tls13-ssl

-[50-curve-sect571r1-tls12-in-tls13-ssl]
-server = 50-curve-sect571r1-tls12-in-tls13-server
-client = 50-curve-sect571r1-tls12-in-tls13-client
+[52-curve-sect571r1-tls12-in-tls13-ssl]
+server = 52-curve-sect571r1-tls12-in-tls13-server
+client = 52-curve-sect571r1-tls12-in-tls13-client

-[50-curve-sect571r1-tls12-in-tls13-server]
+[52-curve-sect571r1-tls12-in-tls13-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = sect571r1:P-256
 MaxProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[50-curve-sect571r1-tls12-in-tls13-client]
+[52-curve-sect571r1-tls12-in-tls13-client]
 CipherString = ECDHE@SECLEVEL=1
 Curves = sect571r1:P-256
 MaxProtocol = TLSv1.3
@@ -1602,7 +1666,7 @@ MinProtocol = TLSv1.3
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-50]
+[test-52]
 ExpectedProtocol = TLSv1.3
 ExpectedResult = Success
 ExpectedTmpKeyType = P-256
@@ -1610,21 +1674,21 @@ ExpectedTmpKeyType = P-256

 # ===========================================================

-[51-curve-secp224r1-tls12-in-tls13]
-ssl_conf = 51-curve-secp224r1-tls12-in-tls13-ssl
+[53-curve-secp224r1-tls12-in-tls13]
+ssl_conf = 53-curve-secp224r1-tls12-in-tls13-ssl

-[51-curve-secp224r1-tls12-in-tls13-ssl]
-server = 51-curve-secp224r1-tls12-in-tls13-server
-client = 51-curve-secp224r1-tls12-in-tls13-client
+[53-curve-secp224r1-tls12-in-tls13-ssl]
+server = 53-curve-secp224r1-tls12-in-tls13-server
+client = 53-curve-secp224r1-tls12-in-tls13-client

-[51-curve-secp224r1-tls12-in-tls13-server]
+[53-curve-secp224r1-tls12-in-tls13-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = secp224r1:P-256
 MaxProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[51-curve-secp224r1-tls12-in-tls13-client]
+[53-curve-secp224r1-tls12-in-tls13-client]
 CipherString = ECDHE@SECLEVEL=1
 Curves = secp224r1:P-256
 MaxProtocol = TLSv1.3
@@ -1632,7 +1696,7 @@ MinProtocol = TLSv1.3
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-51]
+[test-53]
 ExpectedProtocol = TLSv1.3
 ExpectedResult = Success
 ExpectedTmpKeyType = P-256
@@ -1640,21 +1704,21 @@ ExpectedTmpKeyType = P-256

 # ===========================================================

-[52-curve-sect163k1-tls12-in-tls13]
-ssl_conf = 52-curve-sect163k1-tls12-in-tls13-ssl
+[54-curve-sect163k1-tls12-in-tls13]
+ssl_conf = 54-curve-sect163k1-tls12-in-tls13-ssl

-[52-curve-sect163k1-tls12-in-tls13-ssl]
-server = 52-curve-sect163k1-tls12-in-tls13-server
-client = 52-curve-sect163k1-tls12-in-tls13-client
+[54-curve-sect163k1-tls12-in-tls13-ssl]
+server = 54-curve-sect163k1-tls12-in-tls13-server
+client = 54-curve-sect163k1-tls12-in-tls13-client

-[52-curve-sect163k1-tls12-in-tls13-server]
+[54-curve-sect163k1-tls12-in-tls13-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = sect163k1:P-256
 MaxProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[52-curve-sect163k1-tls12-in-tls13-client]
+[54-curve-sect163k1-tls12-in-tls13-client]
 CipherString = ECDHE@SECLEVEL=1
 Curves = sect163k1:P-256
 MaxProtocol = TLSv1.3
@@ -1662,7 +1726,7 @@ MinProtocol = TLSv1.3
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-52]
+[test-54]
 ExpectedProtocol = TLSv1.3
 ExpectedResult = Success
 ExpectedTmpKeyType = P-256
@@ -1670,21 +1734,21 @@ ExpectedTmpKeyType = P-256

 # ===========================================================

-[53-curve-sect163r2-tls12-in-tls13]
-ssl_conf = 53-curve-sect163r2-tls12-in-tls13-ssl
+[55-curve-sect163r2-tls12-in-tls13]
+ssl_conf = 55-curve-sect163r2-tls12-in-tls13-ssl

-[53-curve-sect163r2-tls12-in-tls13-ssl]
-server = 53-curve-sect163r2-tls12-in-tls13-server
-client = 53-curve-sect163r2-tls12-in-tls13-client
+[55-curve-sect163r2-tls12-in-tls13-ssl]
+server = 55-curve-sect163r2-tls12-in-tls13-server
+client = 55-curve-sect163r2-tls12-in-tls13-client

-[53-curve-sect163r2-tls12-in-tls13-server]
+[55-curve-sect163r2-tls12-in-tls13-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = sect163r2:P-256
 MaxProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[53-curve-sect163r2-tls12-in-tls13-client]
+[55-curve-sect163r2-tls12-in-tls13-client]
 CipherString = ECDHE@SECLEVEL=1
 Curves = sect163r2:P-256
 MaxProtocol = TLSv1.3
@@ -1692,7 +1756,7 @@ MinProtocol = TLSv1.3
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-53]
+[test-55]
 ExpectedProtocol = TLSv1.3
 ExpectedResult = Success
 ExpectedTmpKeyType = P-256
@@ -1700,21 +1764,21 @@ ExpectedTmpKeyType = P-256

 # ===========================================================

-[54-curve-prime192v1-tls12-in-tls13]
-ssl_conf = 54-curve-prime192v1-tls12-in-tls13-ssl
+[56-curve-prime192v1-tls12-in-tls13]
+ssl_conf = 56-curve-prime192v1-tls12-in-tls13-ssl

-[54-curve-prime192v1-tls12-in-tls13-ssl]
-server = 54-curve-prime192v1-tls12-in-tls13-server
-client = 54-curve-prime192v1-tls12-in-tls13-client
+[56-curve-prime192v1-tls12-in-tls13-ssl]
+server = 56-curve-prime192v1-tls12-in-tls13-server
+client = 56-curve-prime192v1-tls12-in-tls13-client

-[54-curve-prime192v1-tls12-in-tls13-server]
+[56-curve-prime192v1-tls12-in-tls13-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = prime192v1:P-256
 MaxProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[54-curve-prime192v1-tls12-in-tls13-client]
+[56-curve-prime192v1-tls12-in-tls13-client]
 CipherString = ECDHE@SECLEVEL=1
 Curves = prime192v1:P-256
 MaxProtocol = TLSv1.3
@@ -1722,7 +1786,7 @@ MinProtocol = TLSv1.3
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-54]
+[test-56]
 ExpectedProtocol = TLSv1.3
 ExpectedResult = Success
 ExpectedTmpKeyType = P-256
@@ -1730,21 +1794,21 @@ ExpectedTmpKeyType = P-256

 # ===========================================================

-[55-curve-sect163r1-tls12-in-tls13]
-ssl_conf = 55-curve-sect163r1-tls12-in-tls13-ssl
+[57-curve-sect163r1-tls12-in-tls13]
+ssl_conf = 57-curve-sect163r1-tls12-in-tls13-ssl

-[55-curve-sect163r1-tls12-in-tls13-ssl]
-server = 55-curve-sect163r1-tls12-in-tls13-server
-client = 55-curve-sect163r1-tls12-in-tls13-client
+[57-curve-sect163r1-tls12-in-tls13-ssl]
+server = 57-curve-sect163r1-tls12-in-tls13-server
+client = 57-curve-sect163r1-tls12-in-tls13-client

-[55-curve-sect163r1-tls12-in-tls13-server]
+[57-curve-sect163r1-tls12-in-tls13-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = sect163r1:P-256
 MaxProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[55-curve-sect163r1-tls12-in-tls13-client]
+[57-curve-sect163r1-tls12-in-tls13-client]
 CipherString = ECDHE@SECLEVEL=1
 Curves = sect163r1:P-256
 MaxProtocol = TLSv1.3
@@ -1752,7 +1816,7 @@ MinProtocol = TLSv1.3
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-55]
+[test-57]
 ExpectedProtocol = TLSv1.3
 ExpectedResult = Success
 ExpectedTmpKeyType = P-256
@@ -1760,21 +1824,21 @@ ExpectedTmpKeyType = P-256

 # ===========================================================

-[56-curve-sect193r1-tls12-in-tls13]
-ssl_conf = 56-curve-sect193r1-tls12-in-tls13-ssl
+[58-curve-sect193r1-tls12-in-tls13]
+ssl_conf = 58-curve-sect193r1-tls12-in-tls13-ssl

-[56-curve-sect193r1-tls12-in-tls13-ssl]
-server = 56-curve-sect193r1-tls12-in-tls13-server
-client = 56-curve-sect193r1-tls12-in-tls13-client
+[58-curve-sect193r1-tls12-in-tls13-ssl]
+server = 58-curve-sect193r1-tls12-in-tls13-server
+client = 58-curve-sect193r1-tls12-in-tls13-client

-[56-curve-sect193r1-tls12-in-tls13-server]
+[58-curve-sect193r1-tls12-in-tls13-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = sect193r1:P-256
 MaxProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[56-curve-sect193r1-tls12-in-tls13-client]
+[58-curve-sect193r1-tls12-in-tls13-client]
 CipherString = ECDHE@SECLEVEL=1
 Curves = sect193r1:P-256
 MaxProtocol = TLSv1.3
@@ -1782,7 +1846,7 @@ MinProtocol = TLSv1.3
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-56]
+[test-58]
 ExpectedProtocol = TLSv1.3
 ExpectedResult = Success
 ExpectedTmpKeyType = P-256
@@ -1790,21 +1854,21 @@ ExpectedTmpKeyType = P-256

 # ===========================================================

-[57-curve-sect193r2-tls12-in-tls13]
-ssl_conf = 57-curve-sect193r2-tls12-in-tls13-ssl
+[59-curve-sect193r2-tls12-in-tls13]
+ssl_conf = 59-curve-sect193r2-tls12-in-tls13-ssl

-[57-curve-sect193r2-tls12-in-tls13-ssl]
-server = 57-curve-sect193r2-tls12-in-tls13-server
-client = 57-curve-sect193r2-tls12-in-tls13-client
+[59-curve-sect193r2-tls12-in-tls13-ssl]
+server = 59-curve-sect193r2-tls12-in-tls13-server
+client = 59-curve-sect193r2-tls12-in-tls13-client

-[57-curve-sect193r2-tls12-in-tls13-server]
+[59-curve-sect193r2-tls12-in-tls13-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = sect193r2:P-256
 MaxProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[57-curve-sect193r2-tls12-in-tls13-client]
+[59-curve-sect193r2-tls12-in-tls13-client]
 CipherString = ECDHE@SECLEVEL=1
 Curves = sect193r2:P-256
 MaxProtocol = TLSv1.3
@@ -1812,7 +1876,7 @@ MinProtocol = TLSv1.3
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-57]
+[test-59]
 ExpectedProtocol = TLSv1.3
 ExpectedResult = Success
 ExpectedTmpKeyType = P-256
@@ -1820,21 +1884,21 @@ ExpectedTmpKeyType = P-256

 # ===========================================================

-[58-curve-sect239k1-tls12-in-tls13]
-ssl_conf = 58-curve-sect239k1-tls12-in-tls13-ssl
+[60-curve-sect239k1-tls12-in-tls13]
+ssl_conf = 60-curve-sect239k1-tls12-in-tls13-ssl

-[58-curve-sect239k1-tls12-in-tls13-ssl]
-server = 58-curve-sect239k1-tls12-in-tls13-server
-client = 58-curve-sect239k1-tls12-in-tls13-client
+[60-curve-sect239k1-tls12-in-tls13-ssl]
+server = 60-curve-sect239k1-tls12-in-tls13-server
+client = 60-curve-sect239k1-tls12-in-tls13-client

-[58-curve-sect239k1-tls12-in-tls13-server]
+[60-curve-sect239k1-tls12-in-tls13-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = sect239k1:P-256
 MaxProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[58-curve-sect239k1-tls12-in-tls13-client]
+[60-curve-sect239k1-tls12-in-tls13-client]
 CipherString = ECDHE@SECLEVEL=1
 Curves = sect239k1:P-256
 MaxProtocol = TLSv1.3
@@ -1842,7 +1906,7 @@ MinProtocol = TLSv1.3
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-58]
+[test-60]
 ExpectedProtocol = TLSv1.3
 ExpectedResult = Success
 ExpectedTmpKeyType = P-256
@@ -1850,21 +1914,21 @@ ExpectedTmpKeyType = P-256

 # ===========================================================

-[59-curve-secp160k1-tls12-in-tls13]
-ssl_conf = 59-curve-secp160k1-tls12-in-tls13-ssl
+[61-curve-secp160k1-tls12-in-tls13]
+ssl_conf = 61-curve-secp160k1-tls12-in-tls13-ssl

-[59-curve-secp160k1-tls12-in-tls13-ssl]
-server = 59-curve-secp160k1-tls12-in-tls13-server
-client = 59-curve-secp160k1-tls12-in-tls13-client
+[61-curve-secp160k1-tls12-in-tls13-ssl]
+server = 61-curve-secp160k1-tls12-in-tls13-server
+client = 61-curve-secp160k1-tls12-in-tls13-client

-[59-curve-secp160k1-tls12-in-tls13-server]
+[61-curve-secp160k1-tls12-in-tls13-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = secp160k1:P-256
 MaxProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[59-curve-secp160k1-tls12-in-tls13-client]
+[61-curve-secp160k1-tls12-in-tls13-client]
 CipherString = ECDHE@SECLEVEL=1
 Curves = secp160k1:P-256
 MaxProtocol = TLSv1.3
@@ -1872,7 +1936,7 @@ MinProtocol = TLSv1.3
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-59]
+[test-61]
 ExpectedProtocol = TLSv1.3
 ExpectedResult = Success
 ExpectedTmpKeyType = P-256
@@ -1880,21 +1944,21 @@ ExpectedTmpKeyType = P-256

 # ===========================================================

-[60-curve-secp160r1-tls12-in-tls13]
-ssl_conf = 60-curve-secp160r1-tls12-in-tls13-ssl
+[62-curve-secp160r1-tls12-in-tls13]
+ssl_conf = 62-curve-secp160r1-tls12-in-tls13-ssl

-[60-curve-secp160r1-tls12-in-tls13-ssl]
-server = 60-curve-secp160r1-tls12-in-tls13-server
-client = 60-curve-secp160r1-tls12-in-tls13-client
+[62-curve-secp160r1-tls12-in-tls13-ssl]
+server = 62-curve-secp160r1-tls12-in-tls13-server
+client = 62-curve-secp160r1-tls12-in-tls13-client

-[60-curve-secp160r1-tls12-in-tls13-server]
+[62-curve-secp160r1-tls12-in-tls13-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = secp160r1:P-256
 MaxProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[60-curve-secp160r1-tls12-in-tls13-client]
+[62-curve-secp160r1-tls12-in-tls13-client]
 CipherString = ECDHE@SECLEVEL=1
 Curves = secp160r1:P-256
 MaxProtocol = TLSv1.3
@@ -1902,7 +1966,7 @@ MinProtocol = TLSv1.3
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-60]
+[test-62]
 ExpectedProtocol = TLSv1.3
 ExpectedResult = Success
 ExpectedTmpKeyType = P-256
@@ -1910,21 +1974,21 @@ ExpectedTmpKeyType = P-256

 # ===========================================================

-[61-curve-secp160r2-tls12-in-tls13]
-ssl_conf = 61-curve-secp160r2-tls12-in-tls13-ssl
+[63-curve-secp160r2-tls12-in-tls13]
+ssl_conf = 63-curve-secp160r2-tls12-in-tls13-ssl

-[61-curve-secp160r2-tls12-in-tls13-ssl]
-server = 61-curve-secp160r2-tls12-in-tls13-server
-client = 61-curve-secp160r2-tls12-in-tls13-client
+[63-curve-secp160r2-tls12-in-tls13-ssl]
+server = 63-curve-secp160r2-tls12-in-tls13-server
+client = 63-curve-secp160r2-tls12-in-tls13-client

-[61-curve-secp160r2-tls12-in-tls13-server]
+[63-curve-secp160r2-tls12-in-tls13-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = secp160r2:P-256
 MaxProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[61-curve-secp160r2-tls12-in-tls13-client]
+[63-curve-secp160r2-tls12-in-tls13-client]
 CipherString = ECDHE@SECLEVEL=1
 Curves = secp160r2:P-256
 MaxProtocol = TLSv1.3
@@ -1932,7 +1996,7 @@ MinProtocol = TLSv1.3
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-61]
+[test-63]
 ExpectedProtocol = TLSv1.3
 ExpectedResult = Success
 ExpectedTmpKeyType = P-256
@@ -1940,21 +2004,21 @@ ExpectedTmpKeyType = P-256

 # ===========================================================

-[62-curve-secp192k1-tls12-in-tls13]
-ssl_conf = 62-curve-secp192k1-tls12-in-tls13-ssl
+[64-curve-secp192k1-tls12-in-tls13]
+ssl_conf = 64-curve-secp192k1-tls12-in-tls13-ssl

-[62-curve-secp192k1-tls12-in-tls13-ssl]
-server = 62-curve-secp192k1-tls12-in-tls13-server
-client = 62-curve-secp192k1-tls12-in-tls13-client
+[64-curve-secp192k1-tls12-in-tls13-ssl]
+server = 64-curve-secp192k1-tls12-in-tls13-server
+client = 64-curve-secp192k1-tls12-in-tls13-client

-[62-curve-secp192k1-tls12-in-tls13-server]
+[64-curve-secp192k1-tls12-in-tls13-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = secp192k1:P-256
 MaxProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[62-curve-secp192k1-tls12-in-tls13-client]
+[64-curve-secp192k1-tls12-in-tls13-client]
 CipherString = ECDHE@SECLEVEL=1
 Curves = secp192k1:P-256
 MaxProtocol = TLSv1.3
@@ -1962,7 +2026,7 @@ MinProtocol = TLSv1.3
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-62]
+[test-64]
 ExpectedProtocol = TLSv1.3
 ExpectedResult = Success
 ExpectedTmpKeyType = P-256
@@ -1970,21 +2034,21 @@ ExpectedTmpKeyType = P-256

 # ===========================================================

-[63-curve-secp224k1-tls12-in-tls13]
-ssl_conf = 63-curve-secp224k1-tls12-in-tls13-ssl
+[65-curve-secp224k1-tls12-in-tls13]
+ssl_conf = 65-curve-secp224k1-tls12-in-tls13-ssl

-[63-curve-secp224k1-tls12-in-tls13-ssl]
-server = 63-curve-secp224k1-tls12-in-tls13-server
-client = 63-curve-secp224k1-tls12-in-tls13-client
+[65-curve-secp224k1-tls12-in-tls13-ssl]
+server = 65-curve-secp224k1-tls12-in-tls13-server
+client = 65-curve-secp224k1-tls12-in-tls13-client

-[63-curve-secp224k1-tls12-in-tls13-server]
+[65-curve-secp224k1-tls12-in-tls13-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = secp224k1:P-256
 MaxProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[63-curve-secp224k1-tls12-in-tls13-client]
+[65-curve-secp224k1-tls12-in-tls13-client]
 CipherString = ECDHE@SECLEVEL=1
 Curves = secp224k1:P-256
 MaxProtocol = TLSv1.3
@@ -1992,7 +2056,7 @@ MinProtocol = TLSv1.3
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-63]
+[test-65]
 ExpectedProtocol = TLSv1.3
 ExpectedResult = Success
 ExpectedTmpKeyType = P-256
@@ -2000,21 +2064,21 @@ ExpectedTmpKeyType = P-256

 # ===========================================================

-[64-curve-secp256k1-tls12-in-tls13]
-ssl_conf = 64-curve-secp256k1-tls12-in-tls13-ssl
+[66-curve-secp256k1-tls12-in-tls13]
+ssl_conf = 66-curve-secp256k1-tls12-in-tls13-ssl

-[64-curve-secp256k1-tls12-in-tls13-ssl]
-server = 64-curve-secp256k1-tls12-in-tls13-server
-client = 64-curve-secp256k1-tls12-in-tls13-client
+[66-curve-secp256k1-tls12-in-tls13-ssl]
+server = 66-curve-secp256k1-tls12-in-tls13-server
+client = 66-curve-secp256k1-tls12-in-tls13-client

-[64-curve-secp256k1-tls12-in-tls13-server]
+[66-curve-secp256k1-tls12-in-tls13-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = secp256k1:P-256
 MaxProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[64-curve-secp256k1-tls12-in-tls13-client]
+[66-curve-secp256k1-tls12-in-tls13-client]
 CipherString = ECDHE@SECLEVEL=1
 Curves = secp256k1:P-256
 MaxProtocol = TLSv1.3
@@ -2022,7 +2086,7 @@ MinProtocol = TLSv1.3
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-64]
+[test-66]
 ExpectedProtocol = TLSv1.3
 ExpectedResult = Success
 ExpectedTmpKeyType = P-256
@@ -2030,21 +2094,21 @@ ExpectedTmpKeyType = P-256

 # ===========================================================

-[65-curve-brainpoolP256r1-tls12-in-tls13]
-ssl_conf = 65-curve-brainpoolP256r1-tls12-in-tls13-ssl
+[67-curve-brainpoolP256r1-tls12-in-tls13]
+ssl_conf = 67-curve-brainpoolP256r1-tls12-in-tls13-ssl

-[65-curve-brainpoolP256r1-tls12-in-tls13-ssl]
-server = 65-curve-brainpoolP256r1-tls12-in-tls13-server
-client = 65-curve-brainpoolP256r1-tls12-in-tls13-client
+[67-curve-brainpoolP256r1-tls12-in-tls13-ssl]
+server = 67-curve-brainpoolP256r1-tls12-in-tls13-server
+client = 67-curve-brainpoolP256r1-tls12-in-tls13-client

-[65-curve-brainpoolP256r1-tls12-in-tls13-server]
+[67-curve-brainpoolP256r1-tls12-in-tls13-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = brainpoolP256r1:P-256
 MaxProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[65-curve-brainpoolP256r1-tls12-in-tls13-client]
+[67-curve-brainpoolP256r1-tls12-in-tls13-client]
 CipherString = ECDHE@SECLEVEL=1
 Curves = brainpoolP256r1:P-256
 MaxProtocol = TLSv1.3
@@ -2052,7 +2116,7 @@ MinProtocol = TLSv1.3
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-65]
+[test-67]
 ExpectedProtocol = TLSv1.3
 ExpectedResult = Success
 ExpectedTmpKeyType = P-256
@@ -2060,21 +2124,21 @@ ExpectedTmpKeyType = P-256

 # ===========================================================

-[66-curve-brainpoolP384r1-tls12-in-tls13]
-ssl_conf = 66-curve-brainpoolP384r1-tls12-in-tls13-ssl
+[68-curve-brainpoolP384r1-tls12-in-tls13]
+ssl_conf = 68-curve-brainpoolP384r1-tls12-in-tls13-ssl

-[66-curve-brainpoolP384r1-tls12-in-tls13-ssl]
-server = 66-curve-brainpoolP384r1-tls12-in-tls13-server
-client = 66-curve-brainpoolP384r1-tls12-in-tls13-client
+[68-curve-brainpoolP384r1-tls12-in-tls13-ssl]
+server = 68-curve-brainpoolP384r1-tls12-in-tls13-server
+client = 68-curve-brainpoolP384r1-tls12-in-tls13-client

-[66-curve-brainpoolP384r1-tls12-in-tls13-server]
+[68-curve-brainpoolP384r1-tls12-in-tls13-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = brainpoolP384r1:P-256
 MaxProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[66-curve-brainpoolP384r1-tls12-in-tls13-client]
+[68-curve-brainpoolP384r1-tls12-in-tls13-client]
 CipherString = ECDHE@SECLEVEL=1
 Curves = brainpoolP384r1:P-256
 MaxProtocol = TLSv1.3
@@ -2082,7 +2146,7 @@ MinProtocol = TLSv1.3
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-66]
+[test-68]
 ExpectedProtocol = TLSv1.3
 ExpectedResult = Success
 ExpectedTmpKeyType = P-256
@@ -2090,21 +2154,21 @@ ExpectedTmpKeyType = P-256

 # ===========================================================

-[67-curve-brainpoolP512r1-tls12-in-tls13]
-ssl_conf = 67-curve-brainpoolP512r1-tls12-in-tls13-ssl
+[69-curve-brainpoolP512r1-tls12-in-tls13]
+ssl_conf = 69-curve-brainpoolP512r1-tls12-in-tls13-ssl

-[67-curve-brainpoolP512r1-tls12-in-tls13-ssl]
-server = 67-curve-brainpoolP512r1-tls12-in-tls13-server
-client = 67-curve-brainpoolP512r1-tls12-in-tls13-client
+[69-curve-brainpoolP512r1-tls12-in-tls13-ssl]
+server = 69-curve-brainpoolP512r1-tls12-in-tls13-server
+client = 69-curve-brainpoolP512r1-tls12-in-tls13-client

-[67-curve-brainpoolP512r1-tls12-in-tls13-server]
+[69-curve-brainpoolP512r1-tls12-in-tls13-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = brainpoolP512r1:P-256
 MaxProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[67-curve-brainpoolP512r1-tls12-in-tls13-client]
+[69-curve-brainpoolP512r1-tls12-in-tls13-client]
 CipherString = ECDHE@SECLEVEL=1
 Curves = brainpoolP512r1:P-256
 MaxProtocol = TLSv1.3
@@ -2112,7 +2176,7 @@ MinProtocol = TLSv1.3
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-67]
+[test-69]
 ExpectedProtocol = TLSv1.3
 ExpectedResult = Success
 ExpectedTmpKeyType = P-256
@@ -2120,1378 +2184,1486 @@ ExpectedTmpKeyType = P-256

 # ===========================================================

-[68-curve-sect233k1-tls13]
-ssl_conf = 68-curve-sect233k1-tls13-ssl
+[70-curve-sect233k1-tls13]
+ssl_conf = 70-curve-sect233k1-tls13-ssl

-[68-curve-sect233k1-tls13-ssl]
-server = 68-curve-sect233k1-tls13-server
-client = 68-curve-sect233k1-tls13-client
+[70-curve-sect233k1-tls13-ssl]
+server = 70-curve-sect233k1-tls13-server
+client = 70-curve-sect233k1-tls13-client

-[68-curve-sect233k1-tls13-server]
+[70-curve-sect233k1-tls13-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = sect233k1
 MaxProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[68-curve-sect233k1-tls13-client]
+[70-curve-sect233k1-tls13-client]
 CipherString = ECDHE@SECLEVEL=1
 Curves = sect233k1
 MinProtocol = TLSv1.3
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-68]
+[test-70]
 ExpectedResult = ClientFail


 # ===========================================================

-[69-curve-sect233r1-tls13]
-ssl_conf = 69-curve-sect233r1-tls13-ssl
+[71-curve-sect233r1-tls13]
+ssl_conf = 71-curve-sect233r1-tls13-ssl

-[69-curve-sect233r1-tls13-ssl]
-server = 69-curve-sect233r1-tls13-server
-client = 69-curve-sect233r1-tls13-client
+[71-curve-sect233r1-tls13-ssl]
+server = 71-curve-sect233r1-tls13-server
+client = 71-curve-sect233r1-tls13-client

-[69-curve-sect233r1-tls13-server]
+[71-curve-sect233r1-tls13-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = sect233r1
 MaxProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[69-curve-sect233r1-tls13-client]
+[71-curve-sect233r1-tls13-client]
 CipherString = ECDHE@SECLEVEL=1
 Curves = sect233r1
 MinProtocol = TLSv1.3
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-69]
+[test-71]
 ExpectedResult = ClientFail


 # ===========================================================

-[70-curve-sect283k1-tls13]
-ssl_conf = 70-curve-sect283k1-tls13-ssl
+[72-curve-sect283k1-tls13]
+ssl_conf = 72-curve-sect283k1-tls13-ssl

-[70-curve-sect283k1-tls13-ssl]
-server = 70-curve-sect283k1-tls13-server
-client = 70-curve-sect283k1-tls13-client
+[72-curve-sect283k1-tls13-ssl]
+server = 72-curve-sect283k1-tls13-server
+client = 72-curve-sect283k1-tls13-client

-[70-curve-sect283k1-tls13-server]
+[72-curve-sect283k1-tls13-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = sect283k1
 MaxProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[70-curve-sect283k1-tls13-client]
+[72-curve-sect283k1-tls13-client]
 CipherString = ECDHE@SECLEVEL=1
 Curves = sect283k1
 MinProtocol = TLSv1.3
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-70]
+[test-72]
 ExpectedResult = ClientFail


 # ===========================================================

-[71-curve-sect283r1-tls13]
-ssl_conf = 71-curve-sect283r1-tls13-ssl
+[73-curve-sect283r1-tls13]
+ssl_conf = 73-curve-sect283r1-tls13-ssl

-[71-curve-sect283r1-tls13-ssl]
-server = 71-curve-sect283r1-tls13-server
-client = 71-curve-sect283r1-tls13-client
+[73-curve-sect283r1-tls13-ssl]
+server = 73-curve-sect283r1-tls13-server
+client = 73-curve-sect283r1-tls13-client

-[71-curve-sect283r1-tls13-server]
+[73-curve-sect283r1-tls13-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = sect283r1
 MaxProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[71-curve-sect283r1-tls13-client]
+[73-curve-sect283r1-tls13-client]
 CipherString = ECDHE@SECLEVEL=1
 Curves = sect283r1
 MinProtocol = TLSv1.3
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-71]
+[test-73]
 ExpectedResult = ClientFail


 # ===========================================================

-[72-curve-sect409k1-tls13]
-ssl_conf = 72-curve-sect409k1-tls13-ssl
+[74-curve-sect409k1-tls13]
+ssl_conf = 74-curve-sect409k1-tls13-ssl

-[72-curve-sect409k1-tls13-ssl]
-server = 72-curve-sect409k1-tls13-server
-client = 72-curve-sect409k1-tls13-client
+[74-curve-sect409k1-tls13-ssl]
+server = 74-curve-sect409k1-tls13-server
+client = 74-curve-sect409k1-tls13-client

-[72-curve-sect409k1-tls13-server]
+[74-curve-sect409k1-tls13-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = sect409k1
 MaxProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[72-curve-sect409k1-tls13-client]
+[74-curve-sect409k1-tls13-client]
 CipherString = ECDHE@SECLEVEL=1
 Curves = sect409k1
 MinProtocol = TLSv1.3
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-72]
+[test-74]
 ExpectedResult = ClientFail


 # ===========================================================

-[73-curve-sect409r1-tls13]
-ssl_conf = 73-curve-sect409r1-tls13-ssl
+[75-curve-sect409r1-tls13]
+ssl_conf = 75-curve-sect409r1-tls13-ssl

-[73-curve-sect409r1-tls13-ssl]
-server = 73-curve-sect409r1-tls13-server
-client = 73-curve-sect409r1-tls13-client
+[75-curve-sect409r1-tls13-ssl]
+server = 75-curve-sect409r1-tls13-server
+client = 75-curve-sect409r1-tls13-client

-[73-curve-sect409r1-tls13-server]
+[75-curve-sect409r1-tls13-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = sect409r1
 MaxProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[73-curve-sect409r1-tls13-client]
+[75-curve-sect409r1-tls13-client]
 CipherString = ECDHE@SECLEVEL=1
 Curves = sect409r1
 MinProtocol = TLSv1.3
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-73]
+[test-75]
 ExpectedResult = ClientFail


 # ===========================================================

-[74-curve-sect571k1-tls13]
-ssl_conf = 74-curve-sect571k1-tls13-ssl
+[76-curve-sect571k1-tls13]
+ssl_conf = 76-curve-sect571k1-tls13-ssl

-[74-curve-sect571k1-tls13-ssl]
-server = 74-curve-sect571k1-tls13-server
-client = 74-curve-sect571k1-tls13-client
+[76-curve-sect571k1-tls13-ssl]
+server = 76-curve-sect571k1-tls13-server
+client = 76-curve-sect571k1-tls13-client

-[74-curve-sect571k1-tls13-server]
+[76-curve-sect571k1-tls13-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = sect571k1
 MaxProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[74-curve-sect571k1-tls13-client]
+[76-curve-sect571k1-tls13-client]
 CipherString = ECDHE@SECLEVEL=1
 Curves = sect571k1
 MinProtocol = TLSv1.3
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-74]
+[test-76]
 ExpectedResult = ClientFail


 # ===========================================================

-[75-curve-sect571r1-tls13]
-ssl_conf = 75-curve-sect571r1-tls13-ssl
+[77-curve-sect571r1-tls13]
+ssl_conf = 77-curve-sect571r1-tls13-ssl

-[75-curve-sect571r1-tls13-ssl]
-server = 75-curve-sect571r1-tls13-server
-client = 75-curve-sect571r1-tls13-client
+[77-curve-sect571r1-tls13-ssl]
+server = 77-curve-sect571r1-tls13-server
+client = 77-curve-sect571r1-tls13-client

-[75-curve-sect571r1-tls13-server]
+[77-curve-sect571r1-tls13-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = sect571r1
 MaxProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[75-curve-sect571r1-tls13-client]
+[77-curve-sect571r1-tls13-client]
 CipherString = ECDHE@SECLEVEL=1
 Curves = sect571r1
 MinProtocol = TLSv1.3
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-75]
+[test-77]
 ExpectedResult = ClientFail


 # ===========================================================

-[76-curve-secp224r1-tls13]
-ssl_conf = 76-curve-secp224r1-tls13-ssl
+[78-curve-secp224r1-tls13]
+ssl_conf = 78-curve-secp224r1-tls13-ssl

-[76-curve-secp224r1-tls13-ssl]
-server = 76-curve-secp224r1-tls13-server
-client = 76-curve-secp224r1-tls13-client
+[78-curve-secp224r1-tls13-ssl]
+server = 78-curve-secp224r1-tls13-server
+client = 78-curve-secp224r1-tls13-client

-[76-curve-secp224r1-tls13-server]
+[78-curve-secp224r1-tls13-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = secp224r1
 MaxProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[76-curve-secp224r1-tls13-client]
+[78-curve-secp224r1-tls13-client]
 CipherString = ECDHE@SECLEVEL=1
 Curves = secp224r1
 MinProtocol = TLSv1.3
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-76]
+[test-78]
 ExpectedResult = ClientFail


 # ===========================================================

-[77-curve-sect163k1-tls13]
-ssl_conf = 77-curve-sect163k1-tls13-ssl
+[79-curve-sect163k1-tls13]
+ssl_conf = 79-curve-sect163k1-tls13-ssl

-[77-curve-sect163k1-tls13-ssl]
-server = 77-curve-sect163k1-tls13-server
-client = 77-curve-sect163k1-tls13-client
+[79-curve-sect163k1-tls13-ssl]
+server = 79-curve-sect163k1-tls13-server
+client = 79-curve-sect163k1-tls13-client

-[77-curve-sect163k1-tls13-server]
+[79-curve-sect163k1-tls13-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = sect163k1
 MaxProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[77-curve-sect163k1-tls13-client]
+[79-curve-sect163k1-tls13-client]
 CipherString = ECDHE@SECLEVEL=1
 Curves = sect163k1
 MinProtocol = TLSv1.3
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-77]
+[test-79]
 ExpectedResult = ClientFail


 # ===========================================================

-[78-curve-sect163r2-tls13]
-ssl_conf = 78-curve-sect163r2-tls13-ssl
+[80-curve-sect163r2-tls13]
+ssl_conf = 80-curve-sect163r2-tls13-ssl

-[78-curve-sect163r2-tls13-ssl]
-server = 78-curve-sect163r2-tls13-server
-client = 78-curve-sect163r2-tls13-client
+[80-curve-sect163r2-tls13-ssl]
+server = 80-curve-sect163r2-tls13-server
+client = 80-curve-sect163r2-tls13-client

-[78-curve-sect163r2-tls13-server]
+[80-curve-sect163r2-tls13-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = sect163r2
 MaxProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[78-curve-sect163r2-tls13-client]
+[80-curve-sect163r2-tls13-client]
 CipherString = ECDHE@SECLEVEL=1
 Curves = sect163r2
 MinProtocol = TLSv1.3
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-78]
+[test-80]
 ExpectedResult = ClientFail


 # ===========================================================

-[79-curve-prime192v1-tls13]
-ssl_conf = 79-curve-prime192v1-tls13-ssl
+[81-curve-prime192v1-tls13]
+ssl_conf = 81-curve-prime192v1-tls13-ssl

-[79-curve-prime192v1-tls13-ssl]
-server = 79-curve-prime192v1-tls13-server
-client = 79-curve-prime192v1-tls13-client
+[81-curve-prime192v1-tls13-ssl]
+server = 81-curve-prime192v1-tls13-server
+client = 81-curve-prime192v1-tls13-client

-[79-curve-prime192v1-tls13-server]
+[81-curve-prime192v1-tls13-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = prime192v1
 MaxProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[79-curve-prime192v1-tls13-client]
+[81-curve-prime192v1-tls13-client]
 CipherString = ECDHE@SECLEVEL=1
 Curves = prime192v1
 MinProtocol = TLSv1.3
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-79]
+[test-81]
 ExpectedResult = ClientFail


 # ===========================================================

-[80-curve-sect163r1-tls13]
-ssl_conf = 80-curve-sect163r1-tls13-ssl
+[82-curve-sect163r1-tls13]
+ssl_conf = 82-curve-sect163r1-tls13-ssl

-[80-curve-sect163r1-tls13-ssl]
-server = 80-curve-sect163r1-tls13-server
-client = 80-curve-sect163r1-tls13-client
+[82-curve-sect163r1-tls13-ssl]
+server = 82-curve-sect163r1-tls13-server
+client = 82-curve-sect163r1-tls13-client

-[80-curve-sect163r1-tls13-server]
+[82-curve-sect163r1-tls13-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = sect163r1
 MaxProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[80-curve-sect163r1-tls13-client]
+[82-curve-sect163r1-tls13-client]
 CipherString = ECDHE@SECLEVEL=1
 Curves = sect163r1
 MinProtocol = TLSv1.3
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-80]
+[test-82]
 ExpectedResult = ClientFail


 # ===========================================================

-[81-curve-sect193r1-tls13]
-ssl_conf = 81-curve-sect193r1-tls13-ssl
+[83-curve-sect193r1-tls13]
+ssl_conf = 83-curve-sect193r1-tls13-ssl

-[81-curve-sect193r1-tls13-ssl]
-server = 81-curve-sect193r1-tls13-server
-client = 81-curve-sect193r1-tls13-client
+[83-curve-sect193r1-tls13-ssl]
+server = 83-curve-sect193r1-tls13-server
+client = 83-curve-sect193r1-tls13-client

-[81-curve-sect193r1-tls13-server]
+[83-curve-sect193r1-tls13-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = sect193r1
 MaxProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[81-curve-sect193r1-tls13-client]
+[83-curve-sect193r1-tls13-client]
 CipherString = ECDHE@SECLEVEL=1
 Curves = sect193r1
 MinProtocol = TLSv1.3
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-81]
+[test-83]
 ExpectedResult = ClientFail


 # ===========================================================

-[82-curve-sect193r2-tls13]
-ssl_conf = 82-curve-sect193r2-tls13-ssl
+[84-curve-sect193r2-tls13]
+ssl_conf = 84-curve-sect193r2-tls13-ssl

-[82-curve-sect193r2-tls13-ssl]
-server = 82-curve-sect193r2-tls13-server
-client = 82-curve-sect193r2-tls13-client
+[84-curve-sect193r2-tls13-ssl]
+server = 84-curve-sect193r2-tls13-server
+client = 84-curve-sect193r2-tls13-client

-[82-curve-sect193r2-tls13-server]
+[84-curve-sect193r2-tls13-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = sect193r2
 MaxProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[82-curve-sect193r2-tls13-client]
+[84-curve-sect193r2-tls13-client]
 CipherString = ECDHE@SECLEVEL=1
 Curves = sect193r2
 MinProtocol = TLSv1.3
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-82]
+[test-84]
 ExpectedResult = ClientFail


 # ===========================================================

-[83-curve-sect239k1-tls13]
-ssl_conf = 83-curve-sect239k1-tls13-ssl
+[85-curve-sect239k1-tls13]
+ssl_conf = 85-curve-sect239k1-tls13-ssl

-[83-curve-sect239k1-tls13-ssl]
-server = 83-curve-sect239k1-tls13-server
-client = 83-curve-sect239k1-tls13-client
+[85-curve-sect239k1-tls13-ssl]
+server = 85-curve-sect239k1-tls13-server
+client = 85-curve-sect239k1-tls13-client

-[83-curve-sect239k1-tls13-server]
+[85-curve-sect239k1-tls13-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = sect239k1
 MaxProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[83-curve-sect239k1-tls13-client]
+[85-curve-sect239k1-tls13-client]
 CipherString = ECDHE@SECLEVEL=1
 Curves = sect239k1
 MinProtocol = TLSv1.3
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-83]
+[test-85]
 ExpectedResult = ClientFail


 # ===========================================================

-[84-curve-secp160k1-tls13]
-ssl_conf = 84-curve-secp160k1-tls13-ssl
+[86-curve-secp160k1-tls13]
+ssl_conf = 86-curve-secp160k1-tls13-ssl

-[84-curve-secp160k1-tls13-ssl]
-server = 84-curve-secp160k1-tls13-server
-client = 84-curve-secp160k1-tls13-client
+[86-curve-secp160k1-tls13-ssl]
+server = 86-curve-secp160k1-tls13-server
+client = 86-curve-secp160k1-tls13-client

-[84-curve-secp160k1-tls13-server]
+[86-curve-secp160k1-tls13-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = secp160k1
 MaxProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[84-curve-secp160k1-tls13-client]
+[86-curve-secp160k1-tls13-client]
 CipherString = ECDHE@SECLEVEL=1
 Curves = secp160k1
 MinProtocol = TLSv1.3
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-84]
+[test-86]
 ExpectedResult = ClientFail


 # ===========================================================

-[85-curve-secp160r1-tls13]
-ssl_conf = 85-curve-secp160r1-tls13-ssl
+[87-curve-secp160r1-tls13]
+ssl_conf = 87-curve-secp160r1-tls13-ssl

-[85-curve-secp160r1-tls13-ssl]
-server = 85-curve-secp160r1-tls13-server
-client = 85-curve-secp160r1-tls13-client
+[87-curve-secp160r1-tls13-ssl]
+server = 87-curve-secp160r1-tls13-server
+client = 87-curve-secp160r1-tls13-client

-[85-curve-secp160r1-tls13-server]
+[87-curve-secp160r1-tls13-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = secp160r1
 MaxProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[85-curve-secp160r1-tls13-client]
+[87-curve-secp160r1-tls13-client]
 CipherString = ECDHE@SECLEVEL=1
 Curves = secp160r1
 MinProtocol = TLSv1.3
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-85]
+[test-87]
 ExpectedResult = ClientFail


 # ===========================================================

-[86-curve-secp160r2-tls13]
-ssl_conf = 86-curve-secp160r2-tls13-ssl
+[88-curve-secp160r2-tls13]
+ssl_conf = 88-curve-secp160r2-tls13-ssl

-[86-curve-secp160r2-tls13-ssl]
-server = 86-curve-secp160r2-tls13-server
-client = 86-curve-secp160r2-tls13-client
+[88-curve-secp160r2-tls13-ssl]
+server = 88-curve-secp160r2-tls13-server
+client = 88-curve-secp160r2-tls13-client

-[86-curve-secp160r2-tls13-server]
+[88-curve-secp160r2-tls13-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = secp160r2
 MaxProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[86-curve-secp160r2-tls13-client]
+[88-curve-secp160r2-tls13-client]
 CipherString = ECDHE@SECLEVEL=1
 Curves = secp160r2
 MinProtocol = TLSv1.3
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-86]
+[test-88]
 ExpectedResult = ClientFail


 # ===========================================================

-[87-curve-secp192k1-tls13]
-ssl_conf = 87-curve-secp192k1-tls13-ssl
+[89-curve-secp192k1-tls13]
+ssl_conf = 89-curve-secp192k1-tls13-ssl

-[87-curve-secp192k1-tls13-ssl]
-server = 87-curve-secp192k1-tls13-server
-client = 87-curve-secp192k1-tls13-client
+[89-curve-secp192k1-tls13-ssl]
+server = 89-curve-secp192k1-tls13-server
+client = 89-curve-secp192k1-tls13-client

-[87-curve-secp192k1-tls13-server]
+[89-curve-secp192k1-tls13-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = secp192k1
 MaxProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[87-curve-secp192k1-tls13-client]
+[89-curve-secp192k1-tls13-client]
 CipherString = ECDHE@SECLEVEL=1
 Curves = secp192k1
 MinProtocol = TLSv1.3
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-87]
+[test-89]
 ExpectedResult = ClientFail


 # ===========================================================

-[88-curve-secp224k1-tls13]
-ssl_conf = 88-curve-secp224k1-tls13-ssl
+[90-curve-secp224k1-tls13]
+ssl_conf = 90-curve-secp224k1-tls13-ssl

-[88-curve-secp224k1-tls13-ssl]
-server = 88-curve-secp224k1-tls13-server
-client = 88-curve-secp224k1-tls13-client
+[90-curve-secp224k1-tls13-ssl]
+server = 90-curve-secp224k1-tls13-server
+client = 90-curve-secp224k1-tls13-client

-[88-curve-secp224k1-tls13-server]
+[90-curve-secp224k1-tls13-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = secp224k1
 MaxProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[88-curve-secp224k1-tls13-client]
+[90-curve-secp224k1-tls13-client]
 CipherString = ECDHE@SECLEVEL=1
 Curves = secp224k1
 MinProtocol = TLSv1.3
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-88]
+[test-90]
 ExpectedResult = ClientFail


 # ===========================================================

-[89-curve-secp256k1-tls13]
-ssl_conf = 89-curve-secp256k1-tls13-ssl
+[91-curve-secp256k1-tls13]
+ssl_conf = 91-curve-secp256k1-tls13-ssl

-[89-curve-secp256k1-tls13-ssl]
-server = 89-curve-secp256k1-tls13-server
-client = 89-curve-secp256k1-tls13-client
+[91-curve-secp256k1-tls13-ssl]
+server = 91-curve-secp256k1-tls13-server
+client = 91-curve-secp256k1-tls13-client

-[89-curve-secp256k1-tls13-server]
+[91-curve-secp256k1-tls13-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = secp256k1
 MaxProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[89-curve-secp256k1-tls13-client]
+[91-curve-secp256k1-tls13-client]
 CipherString = ECDHE@SECLEVEL=1
 Curves = secp256k1
 MinProtocol = TLSv1.3
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-89]
+[test-91]
 ExpectedResult = ClientFail


 # ===========================================================

-[90-curve-brainpoolP256r1-tls13]
-ssl_conf = 90-curve-brainpoolP256r1-tls13-ssl
+[92-curve-brainpoolP256r1-tls13]
+ssl_conf = 92-curve-brainpoolP256r1-tls13-ssl

-[90-curve-brainpoolP256r1-tls13-ssl]
-server = 90-curve-brainpoolP256r1-tls13-server
-client = 90-curve-brainpoolP256r1-tls13-client
+[92-curve-brainpoolP256r1-tls13-ssl]
+server = 92-curve-brainpoolP256r1-tls13-server
+client = 92-curve-brainpoolP256r1-tls13-client

-[90-curve-brainpoolP256r1-tls13-server]
+[92-curve-brainpoolP256r1-tls13-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = brainpoolP256r1
 MaxProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[90-curve-brainpoolP256r1-tls13-client]
+[92-curve-brainpoolP256r1-tls13-client]
 CipherString = ECDHE@SECLEVEL=1
 Curves = brainpoolP256r1
 MinProtocol = TLSv1.3
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-90]
+[test-92]
 ExpectedResult = ClientFail


 # ===========================================================

-[91-curve-brainpoolP384r1-tls13]
-ssl_conf = 91-curve-brainpoolP384r1-tls13-ssl
+[93-curve-brainpoolP384r1-tls13]
+ssl_conf = 93-curve-brainpoolP384r1-tls13-ssl

-[91-curve-brainpoolP384r1-tls13-ssl]
-server = 91-curve-brainpoolP384r1-tls13-server
-client = 91-curve-brainpoolP384r1-tls13-client
+[93-curve-brainpoolP384r1-tls13-ssl]
+server = 93-curve-brainpoolP384r1-tls13-server
+client = 93-curve-brainpoolP384r1-tls13-client

-[91-curve-brainpoolP384r1-tls13-server]
+[93-curve-brainpoolP384r1-tls13-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = brainpoolP384r1
 MaxProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[91-curve-brainpoolP384r1-tls13-client]
+[93-curve-brainpoolP384r1-tls13-client]
 CipherString = ECDHE@SECLEVEL=1
 Curves = brainpoolP384r1
 MinProtocol = TLSv1.3
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-91]
+[test-93]
 ExpectedResult = ClientFail


 # ===========================================================

-[92-curve-brainpoolP512r1-tls13]
-ssl_conf = 92-curve-brainpoolP512r1-tls13-ssl
+[94-curve-brainpoolP512r1-tls13]
+ssl_conf = 94-curve-brainpoolP512r1-tls13-ssl

-[92-curve-brainpoolP512r1-tls13-ssl]
-server = 92-curve-brainpoolP512r1-tls13-server
-client = 92-curve-brainpoolP512r1-tls13-client
+[94-curve-brainpoolP512r1-tls13-ssl]
+server = 94-curve-brainpoolP512r1-tls13-server
+client = 94-curve-brainpoolP512r1-tls13-client

-[92-curve-brainpoolP512r1-tls13-server]
+[94-curve-brainpoolP512r1-tls13-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = brainpoolP512r1
 MaxProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[92-curve-brainpoolP512r1-tls13-client]
+[94-curve-brainpoolP512r1-tls13-client]
 CipherString = ECDHE@SECLEVEL=1
 Curves = brainpoolP512r1
 MinProtocol = TLSv1.3
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-92]
+[test-94]
 ExpectedResult = ClientFail


 # ===========================================================

-[93-curve-ffdhe2048-tls13-in-tls12]
-ssl_conf = 93-curve-ffdhe2048-tls13-in-tls12-ssl
+[95-curve-ffdhe2048-tls13-in-tls12]
+ssl_conf = 95-curve-ffdhe2048-tls13-in-tls12-ssl

-[93-curve-ffdhe2048-tls13-in-tls12-ssl]
-server = 93-curve-ffdhe2048-tls13-in-tls12-server
-client = 93-curve-ffdhe2048-tls13-in-tls12-client
+[95-curve-ffdhe2048-tls13-in-tls12-ssl]
+server = 95-curve-ffdhe2048-tls13-in-tls12-server
+client = 95-curve-ffdhe2048-tls13-in-tls12-client

-[93-curve-ffdhe2048-tls13-in-tls12-server]
+[95-curve-ffdhe2048-tls13-in-tls12-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = ffdhe2048
 MaxProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[93-curve-ffdhe2048-tls13-in-tls12-client]
+[95-curve-ffdhe2048-tls13-in-tls12-client]
 CipherString = ECDHE@SECLEVEL=1
 Curves = ffdhe2048
 MaxProtocol = TLSv1.2
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-93]
+[test-95]
 ExpectedResult = ServerFail


 # ===========================================================

-[94-curve-ffdhe2048-tls13-in-tls12-2]
-ssl_conf = 94-curve-ffdhe2048-tls13-in-tls12-2-ssl
+[96-curve-ffdhe2048-tls13-in-tls12-2]
+ssl_conf = 96-curve-ffdhe2048-tls13-in-tls12-2-ssl

-[94-curve-ffdhe2048-tls13-in-tls12-2-ssl]
-server = 94-curve-ffdhe2048-tls13-in-tls12-2-server
-client = 94-curve-ffdhe2048-tls13-in-tls12-2-client
+[96-curve-ffdhe2048-tls13-in-tls12-2-ssl]
+server = 96-curve-ffdhe2048-tls13-in-tls12-2-server
+client = 96-curve-ffdhe2048-tls13-in-tls12-2-client

-[94-curve-ffdhe2048-tls13-in-tls12-2-server]
+[96-curve-ffdhe2048-tls13-in-tls12-2-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = ffdhe2048
 MaxProtocol = TLSv1.2
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[94-curve-ffdhe2048-tls13-in-tls12-2-client]
+[96-curve-ffdhe2048-tls13-in-tls12-2-client]
 CipherString = DEFAULT@SECLEVEL=1
 Curves = ffdhe2048
 MaxProtocol = TLSv1.3
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-94]
+[test-96]
 ExpectedResult = Success


 # ===========================================================

-[95-curve-ffdhe3072-tls13-in-tls12]
-ssl_conf = 95-curve-ffdhe3072-tls13-in-tls12-ssl
+[97-curve-ffdhe3072-tls13-in-tls12]
+ssl_conf = 97-curve-ffdhe3072-tls13-in-tls12-ssl

-[95-curve-ffdhe3072-tls13-in-tls12-ssl]
-server = 95-curve-ffdhe3072-tls13-in-tls12-server
-client = 95-curve-ffdhe3072-tls13-in-tls12-client
+[97-curve-ffdhe3072-tls13-in-tls12-ssl]
+server = 97-curve-ffdhe3072-tls13-in-tls12-server
+client = 97-curve-ffdhe3072-tls13-in-tls12-client

-[95-curve-ffdhe3072-tls13-in-tls12-server]
+[97-curve-ffdhe3072-tls13-in-tls12-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = ffdhe3072
 MaxProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[95-curve-ffdhe3072-tls13-in-tls12-client]
+[97-curve-ffdhe3072-tls13-in-tls12-client]
 CipherString = ECDHE@SECLEVEL=1
 Curves = ffdhe3072
 MaxProtocol = TLSv1.2
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-95]
+[test-97]
 ExpectedResult = ServerFail


 # ===========================================================

-[96-curve-ffdhe3072-tls13-in-tls12-2]
-ssl_conf = 96-curve-ffdhe3072-tls13-in-tls12-2-ssl
+[98-curve-ffdhe3072-tls13-in-tls12-2]
+ssl_conf = 98-curve-ffdhe3072-tls13-in-tls12-2-ssl

-[96-curve-ffdhe3072-tls13-in-tls12-2-ssl]
-server = 96-curve-ffdhe3072-tls13-in-tls12-2-server
-client = 96-curve-ffdhe3072-tls13-in-tls12-2-client
+[98-curve-ffdhe3072-tls13-in-tls12-2-ssl]
+server = 98-curve-ffdhe3072-tls13-in-tls12-2-server
+client = 98-curve-ffdhe3072-tls13-in-tls12-2-client

-[96-curve-ffdhe3072-tls13-in-tls12-2-server]
+[98-curve-ffdhe3072-tls13-in-tls12-2-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = ffdhe3072
 MaxProtocol = TLSv1.2
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[96-curve-ffdhe3072-tls13-in-tls12-2-client]
+[98-curve-ffdhe3072-tls13-in-tls12-2-client]
 CipherString = DEFAULT@SECLEVEL=1
 Curves = ffdhe3072
 MaxProtocol = TLSv1.3
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-96]
+[test-98]
 ExpectedResult = Success


 # ===========================================================

-[97-curve-ffdhe4096-tls13-in-tls12]
-ssl_conf = 97-curve-ffdhe4096-tls13-in-tls12-ssl
+[99-curve-ffdhe4096-tls13-in-tls12]
+ssl_conf = 99-curve-ffdhe4096-tls13-in-tls12-ssl

-[97-curve-ffdhe4096-tls13-in-tls12-ssl]
-server = 97-curve-ffdhe4096-tls13-in-tls12-server
-client = 97-curve-ffdhe4096-tls13-in-tls12-client
+[99-curve-ffdhe4096-tls13-in-tls12-ssl]
+server = 99-curve-ffdhe4096-tls13-in-tls12-server
+client = 99-curve-ffdhe4096-tls13-in-tls12-client

-[97-curve-ffdhe4096-tls13-in-tls12-server]
+[99-curve-ffdhe4096-tls13-in-tls12-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = ffdhe4096
 MaxProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[97-curve-ffdhe4096-tls13-in-tls12-client]
+[99-curve-ffdhe4096-tls13-in-tls12-client]
 CipherString = ECDHE@SECLEVEL=1
 Curves = ffdhe4096
 MaxProtocol = TLSv1.2
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-97]
+[test-99]
 ExpectedResult = ServerFail


 # ===========================================================

-[98-curve-ffdhe4096-tls13-in-tls12-2]
-ssl_conf = 98-curve-ffdhe4096-tls13-in-tls12-2-ssl
+[100-curve-ffdhe4096-tls13-in-tls12-2]
+ssl_conf = 100-curve-ffdhe4096-tls13-in-tls12-2-ssl

-[98-curve-ffdhe4096-tls13-in-tls12-2-ssl]
-server = 98-curve-ffdhe4096-tls13-in-tls12-2-server
-client = 98-curve-ffdhe4096-tls13-in-tls12-2-client
+[100-curve-ffdhe4096-tls13-in-tls12-2-ssl]
+server = 100-curve-ffdhe4096-tls13-in-tls12-2-server
+client = 100-curve-ffdhe4096-tls13-in-tls12-2-client

-[98-curve-ffdhe4096-tls13-in-tls12-2-server]
+[100-curve-ffdhe4096-tls13-in-tls12-2-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = ffdhe4096
 MaxProtocol = TLSv1.2
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[98-curve-ffdhe4096-tls13-in-tls12-2-client]
+[100-curve-ffdhe4096-tls13-in-tls12-2-client]
 CipherString = DEFAULT@SECLEVEL=1
 Curves = ffdhe4096
 MaxProtocol = TLSv1.3
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-98]
+[test-100]
 ExpectedResult = Success


 # ===========================================================

-[99-curve-ffdhe6144-tls13-in-tls12]
-ssl_conf = 99-curve-ffdhe6144-tls13-in-tls12-ssl
+[101-curve-ffdhe6144-tls13-in-tls12]
+ssl_conf = 101-curve-ffdhe6144-tls13-in-tls12-ssl

-[99-curve-ffdhe6144-tls13-in-tls12-ssl]
-server = 99-curve-ffdhe6144-tls13-in-tls12-server
-client = 99-curve-ffdhe6144-tls13-in-tls12-client
+[101-curve-ffdhe6144-tls13-in-tls12-ssl]
+server = 101-curve-ffdhe6144-tls13-in-tls12-server
+client = 101-curve-ffdhe6144-tls13-in-tls12-client

-[99-curve-ffdhe6144-tls13-in-tls12-server]
+[101-curve-ffdhe6144-tls13-in-tls12-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = ffdhe6144
 MaxProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[99-curve-ffdhe6144-tls13-in-tls12-client]
+[101-curve-ffdhe6144-tls13-in-tls12-client]
 CipherString = ECDHE@SECLEVEL=1
 Curves = ffdhe6144
 MaxProtocol = TLSv1.2
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-99]
+[test-101]
 ExpectedResult = ServerFail


 # ===========================================================

-[100-curve-ffdhe6144-tls13-in-tls12-2]
-ssl_conf = 100-curve-ffdhe6144-tls13-in-tls12-2-ssl
+[102-curve-ffdhe6144-tls13-in-tls12-2]
+ssl_conf = 102-curve-ffdhe6144-tls13-in-tls12-2-ssl

-[100-curve-ffdhe6144-tls13-in-tls12-2-ssl]
-server = 100-curve-ffdhe6144-tls13-in-tls12-2-server
-client = 100-curve-ffdhe6144-tls13-in-tls12-2-client
+[102-curve-ffdhe6144-tls13-in-tls12-2-ssl]
+server = 102-curve-ffdhe6144-tls13-in-tls12-2-server
+client = 102-curve-ffdhe6144-tls13-in-tls12-2-client

-[100-curve-ffdhe6144-tls13-in-tls12-2-server]
+[102-curve-ffdhe6144-tls13-in-tls12-2-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = ffdhe6144
 MaxProtocol = TLSv1.2
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[100-curve-ffdhe6144-tls13-in-tls12-2-client]
+[102-curve-ffdhe6144-tls13-in-tls12-2-client]
 CipherString = DEFAULT@SECLEVEL=1
 Curves = ffdhe6144
 MaxProtocol = TLSv1.3
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-100]
+[test-102]
 ExpectedResult = Success


 # ===========================================================

-[101-curve-ffdhe8192-tls13-in-tls12]
-ssl_conf = 101-curve-ffdhe8192-tls13-in-tls12-ssl
+[103-curve-ffdhe8192-tls13-in-tls12]
+ssl_conf = 103-curve-ffdhe8192-tls13-in-tls12-ssl

-[101-curve-ffdhe8192-tls13-in-tls12-ssl]
-server = 101-curve-ffdhe8192-tls13-in-tls12-server
-client = 101-curve-ffdhe8192-tls13-in-tls12-client
+[103-curve-ffdhe8192-tls13-in-tls12-ssl]
+server = 103-curve-ffdhe8192-tls13-in-tls12-server
+client = 103-curve-ffdhe8192-tls13-in-tls12-client

-[101-curve-ffdhe8192-tls13-in-tls12-server]
+[103-curve-ffdhe8192-tls13-in-tls12-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = ffdhe8192
 MaxProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[101-curve-ffdhe8192-tls13-in-tls12-client]
+[103-curve-ffdhe8192-tls13-in-tls12-client]
 CipherString = ECDHE@SECLEVEL=1
 Curves = ffdhe8192
 MaxProtocol = TLSv1.2
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-101]
+[test-103]
 ExpectedResult = ServerFail


 # ===========================================================

-[102-curve-ffdhe8192-tls13-in-tls12-2]
-ssl_conf = 102-curve-ffdhe8192-tls13-in-tls12-2-ssl
+[104-curve-ffdhe8192-tls13-in-tls12-2]
+ssl_conf = 104-curve-ffdhe8192-tls13-in-tls12-2-ssl

-[102-curve-ffdhe8192-tls13-in-tls12-2-ssl]
-server = 102-curve-ffdhe8192-tls13-in-tls12-2-server
-client = 102-curve-ffdhe8192-tls13-in-tls12-2-client
+[104-curve-ffdhe8192-tls13-in-tls12-2-ssl]
+server = 104-curve-ffdhe8192-tls13-in-tls12-2-server
+client = 104-curve-ffdhe8192-tls13-in-tls12-2-client

-[102-curve-ffdhe8192-tls13-in-tls12-2-server]
+[104-curve-ffdhe8192-tls13-in-tls12-2-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = ffdhe8192
 MaxProtocol = TLSv1.2
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[102-curve-ffdhe8192-tls13-in-tls12-2-client]
+[104-curve-ffdhe8192-tls13-in-tls12-2-client]
 CipherString = DEFAULT@SECLEVEL=1
 Curves = ffdhe8192
 MaxProtocol = TLSv1.3
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-102]
+[test-104]
 ExpectedResult = Success


 # ===========================================================

-[103-curve-brainpoolP256r1tls13-tls13-in-tls12]
-ssl_conf = 103-curve-brainpoolP256r1tls13-tls13-in-tls12-ssl
+[105-curve-brainpoolP256r1tls13-tls13-in-tls12]
+ssl_conf = 105-curve-brainpoolP256r1tls13-tls13-in-tls12-ssl

-[103-curve-brainpoolP256r1tls13-tls13-in-tls12-ssl]
-server = 103-curve-brainpoolP256r1tls13-tls13-in-tls12-server
-client = 103-curve-brainpoolP256r1tls13-tls13-in-tls12-client
+[105-curve-brainpoolP256r1tls13-tls13-in-tls12-ssl]
+server = 105-curve-brainpoolP256r1tls13-tls13-in-tls12-server
+client = 105-curve-brainpoolP256r1tls13-tls13-in-tls12-client

-[103-curve-brainpoolP256r1tls13-tls13-in-tls12-server]
+[105-curve-brainpoolP256r1tls13-tls13-in-tls12-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = brainpoolP256r1tls13
 MaxProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[103-curve-brainpoolP256r1tls13-tls13-in-tls12-client]
+[105-curve-brainpoolP256r1tls13-tls13-in-tls12-client]
 CipherString = ECDHE@SECLEVEL=1
 Curves = brainpoolP256r1tls13
 MaxProtocol = TLSv1.2
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-103]
+[test-105]
 ExpectedResult = ServerFail


 # ===========================================================

-[104-curve-brainpoolP256r1tls13-tls13-in-tls12-2]
-ssl_conf = 104-curve-brainpoolP256r1tls13-tls13-in-tls12-2-ssl
+[106-curve-brainpoolP256r1tls13-tls13-in-tls12-2]
+ssl_conf = 106-curve-brainpoolP256r1tls13-tls13-in-tls12-2-ssl

-[104-curve-brainpoolP256r1tls13-tls13-in-tls12-2-ssl]
-server = 104-curve-brainpoolP256r1tls13-tls13-in-tls12-2-server
-client = 104-curve-brainpoolP256r1tls13-tls13-in-tls12-2-client
+[106-curve-brainpoolP256r1tls13-tls13-in-tls12-2-ssl]
+server = 106-curve-brainpoolP256r1tls13-tls13-in-tls12-2-server
+client = 106-curve-brainpoolP256r1tls13-tls13-in-tls12-2-client

-[104-curve-brainpoolP256r1tls13-tls13-in-tls12-2-server]
+[106-curve-brainpoolP256r1tls13-tls13-in-tls12-2-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = brainpoolP256r1tls13
 MaxProtocol = TLSv1.2
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[104-curve-brainpoolP256r1tls13-tls13-in-tls12-2-client]
+[106-curve-brainpoolP256r1tls13-tls13-in-tls12-2-client]
 CipherString = DEFAULT@SECLEVEL=1
 Curves = brainpoolP256r1tls13
 MaxProtocol = TLSv1.3
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-104]
+[test-106]
 ExpectedResult = Success


 # ===========================================================

-[105-curve-brainpoolP384r1tls13-tls13-in-tls12]
-ssl_conf = 105-curve-brainpoolP384r1tls13-tls13-in-tls12-ssl
+[107-curve-brainpoolP384r1tls13-tls13-in-tls12]
+ssl_conf = 107-curve-brainpoolP384r1tls13-tls13-in-tls12-ssl

-[105-curve-brainpoolP384r1tls13-tls13-in-tls12-ssl]
-server = 105-curve-brainpoolP384r1tls13-tls13-in-tls12-server
-client = 105-curve-brainpoolP384r1tls13-tls13-in-tls12-client
+[107-curve-brainpoolP384r1tls13-tls13-in-tls12-ssl]
+server = 107-curve-brainpoolP384r1tls13-tls13-in-tls12-server
+client = 107-curve-brainpoolP384r1tls13-tls13-in-tls12-client

-[105-curve-brainpoolP384r1tls13-tls13-in-tls12-server]
+[107-curve-brainpoolP384r1tls13-tls13-in-tls12-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = brainpoolP384r1tls13
 MaxProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[105-curve-brainpoolP384r1tls13-tls13-in-tls12-client]
+[107-curve-brainpoolP384r1tls13-tls13-in-tls12-client]
 CipherString = ECDHE@SECLEVEL=1
 Curves = brainpoolP384r1tls13
 MaxProtocol = TLSv1.2
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-105]
+[test-107]
 ExpectedResult = ServerFail


 # ===========================================================

-[106-curve-brainpoolP384r1tls13-tls13-in-tls12-2]
-ssl_conf = 106-curve-brainpoolP384r1tls13-tls13-in-tls12-2-ssl
+[108-curve-brainpoolP384r1tls13-tls13-in-tls12-2]
+ssl_conf = 108-curve-brainpoolP384r1tls13-tls13-in-tls12-2-ssl

-[106-curve-brainpoolP384r1tls13-tls13-in-tls12-2-ssl]
-server = 106-curve-brainpoolP384r1tls13-tls13-in-tls12-2-server
-client = 106-curve-brainpoolP384r1tls13-tls13-in-tls12-2-client
+[108-curve-brainpoolP384r1tls13-tls13-in-tls12-2-ssl]
+server = 108-curve-brainpoolP384r1tls13-tls13-in-tls12-2-server
+client = 108-curve-brainpoolP384r1tls13-tls13-in-tls12-2-client

-[106-curve-brainpoolP384r1tls13-tls13-in-tls12-2-server]
+[108-curve-brainpoolP384r1tls13-tls13-in-tls12-2-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = brainpoolP384r1tls13
 MaxProtocol = TLSv1.2
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[106-curve-brainpoolP384r1tls13-tls13-in-tls12-2-client]
+[108-curve-brainpoolP384r1tls13-tls13-in-tls12-2-client]
 CipherString = DEFAULT@SECLEVEL=1
 Curves = brainpoolP384r1tls13
 MaxProtocol = TLSv1.3
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-106]
+[test-108]
 ExpectedResult = Success


 # ===========================================================

-[107-curve-brainpoolP512r1tls13-tls13-in-tls12]
-ssl_conf = 107-curve-brainpoolP512r1tls13-tls13-in-tls12-ssl
+[109-curve-brainpoolP512r1tls13-tls13-in-tls12]
+ssl_conf = 109-curve-brainpoolP512r1tls13-tls13-in-tls12-ssl

-[107-curve-brainpoolP512r1tls13-tls13-in-tls12-ssl]
-server = 107-curve-brainpoolP512r1tls13-tls13-in-tls12-server
-client = 107-curve-brainpoolP512r1tls13-tls13-in-tls12-client
+[109-curve-brainpoolP512r1tls13-tls13-in-tls12-ssl]
+server = 109-curve-brainpoolP512r1tls13-tls13-in-tls12-server
+client = 109-curve-brainpoolP512r1tls13-tls13-in-tls12-client

-[107-curve-brainpoolP512r1tls13-tls13-in-tls12-server]
+[109-curve-brainpoolP512r1tls13-tls13-in-tls12-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = brainpoolP512r1tls13
 MaxProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[107-curve-brainpoolP512r1tls13-tls13-in-tls12-client]
+[109-curve-brainpoolP512r1tls13-tls13-in-tls12-client]
 CipherString = ECDHE@SECLEVEL=1
 Curves = brainpoolP512r1tls13
 MaxProtocol = TLSv1.2
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-107]
+[test-109]
 ExpectedResult = ServerFail


 # ===========================================================

-[108-curve-brainpoolP512r1tls13-tls13-in-tls12-2]
-ssl_conf = 108-curve-brainpoolP512r1tls13-tls13-in-tls12-2-ssl
+[110-curve-brainpoolP512r1tls13-tls13-in-tls12-2]
+ssl_conf = 110-curve-brainpoolP512r1tls13-tls13-in-tls12-2-ssl

-[108-curve-brainpoolP512r1tls13-tls13-in-tls12-2-ssl]
-server = 108-curve-brainpoolP512r1tls13-tls13-in-tls12-2-server
-client = 108-curve-brainpoolP512r1tls13-tls13-in-tls12-2-client
+[110-curve-brainpoolP512r1tls13-tls13-in-tls12-2-ssl]
+server = 110-curve-brainpoolP512r1tls13-tls13-in-tls12-2-server
+client = 110-curve-brainpoolP512r1tls13-tls13-in-tls12-2-client

-[108-curve-brainpoolP512r1tls13-tls13-in-tls12-2-server]
+[110-curve-brainpoolP512r1tls13-tls13-in-tls12-2-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = brainpoolP512r1tls13
 MaxProtocol = TLSv1.2
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[108-curve-brainpoolP512r1tls13-tls13-in-tls12-2-client]
+[110-curve-brainpoolP512r1tls13-tls13-in-tls12-2-client]
 CipherString = DEFAULT@SECLEVEL=1
 Curves = brainpoolP512r1tls13
 MaxProtocol = TLSv1.3
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-108]
+[test-110]
 ExpectedResult = Success


 # ===========================================================

-[109-curve-X25519MLKEM768-tls13-in-tls12]
-ssl_conf = 109-curve-X25519MLKEM768-tls13-in-tls12-ssl
+[111-curve-X25519MLKEM768-tls13-in-tls12]
+ssl_conf = 111-curve-X25519MLKEM768-tls13-in-tls12-ssl

-[109-curve-X25519MLKEM768-tls13-in-tls12-ssl]
-server = 109-curve-X25519MLKEM768-tls13-in-tls12-server
-client = 109-curve-X25519MLKEM768-tls13-in-tls12-client
+[111-curve-X25519MLKEM768-tls13-in-tls12-ssl]
+server = 111-curve-X25519MLKEM768-tls13-in-tls12-server
+client = 111-curve-X25519MLKEM768-tls13-in-tls12-client

-[109-curve-X25519MLKEM768-tls13-in-tls12-server]
+[111-curve-X25519MLKEM768-tls13-in-tls12-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = X25519MLKEM768
 MaxProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[109-curve-X25519MLKEM768-tls13-in-tls12-client]
+[111-curve-X25519MLKEM768-tls13-in-tls12-client]
 CipherString = ECDHE@SECLEVEL=1
 Curves = X25519MLKEM768
 MaxProtocol = TLSv1.2
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-109]
+[test-111]
 ExpectedResult = ServerFail


 # ===========================================================

-[110-curve-X25519MLKEM768-tls13-in-tls12-2]
-ssl_conf = 110-curve-X25519MLKEM768-tls13-in-tls12-2-ssl
+[112-curve-X25519MLKEM768-tls13-in-tls12-2]
+ssl_conf = 112-curve-X25519MLKEM768-tls13-in-tls12-2-ssl

-[110-curve-X25519MLKEM768-tls13-in-tls12-2-ssl]
-server = 110-curve-X25519MLKEM768-tls13-in-tls12-2-server
-client = 110-curve-X25519MLKEM768-tls13-in-tls12-2-client
+[112-curve-X25519MLKEM768-tls13-in-tls12-2-ssl]
+server = 112-curve-X25519MLKEM768-tls13-in-tls12-2-server
+client = 112-curve-X25519MLKEM768-tls13-in-tls12-2-client

-[110-curve-X25519MLKEM768-tls13-in-tls12-2-server]
+[112-curve-X25519MLKEM768-tls13-in-tls12-2-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = X25519MLKEM768
 MaxProtocol = TLSv1.2
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[110-curve-X25519MLKEM768-tls13-in-tls12-2-client]
+[112-curve-X25519MLKEM768-tls13-in-tls12-2-client]
 CipherString = DEFAULT@SECLEVEL=1
 Curves = X25519MLKEM768
 MaxProtocol = TLSv1.3
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-110]
+[test-112]
 ExpectedResult = Success


 # ===========================================================

-[111-curve-SecP256r1MLKEM768-tls13-in-tls12]
-ssl_conf = 111-curve-SecP256r1MLKEM768-tls13-in-tls12-ssl
+[113-curve-SecP256r1MLKEM768-tls13-in-tls12]
+ssl_conf = 113-curve-SecP256r1MLKEM768-tls13-in-tls12-ssl

-[111-curve-SecP256r1MLKEM768-tls13-in-tls12-ssl]
-server = 111-curve-SecP256r1MLKEM768-tls13-in-tls12-server
-client = 111-curve-SecP256r1MLKEM768-tls13-in-tls12-client
+[113-curve-SecP256r1MLKEM768-tls13-in-tls12-ssl]
+server = 113-curve-SecP256r1MLKEM768-tls13-in-tls12-server
+client = 113-curve-SecP256r1MLKEM768-tls13-in-tls12-client

-[111-curve-SecP256r1MLKEM768-tls13-in-tls12-server]
+[113-curve-SecP256r1MLKEM768-tls13-in-tls12-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = SecP256r1MLKEM768
 MaxProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[111-curve-SecP256r1MLKEM768-tls13-in-tls12-client]
+[113-curve-SecP256r1MLKEM768-tls13-in-tls12-client]
 CipherString = ECDHE@SECLEVEL=1
 Curves = SecP256r1MLKEM768
 MaxProtocol = TLSv1.2
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-111]
+[test-113]
 ExpectedResult = ServerFail


 # ===========================================================

-[112-curve-SecP256r1MLKEM768-tls13-in-tls12-2]
-ssl_conf = 112-curve-SecP256r1MLKEM768-tls13-in-tls12-2-ssl
+[114-curve-SecP256r1MLKEM768-tls13-in-tls12-2]
+ssl_conf = 114-curve-SecP256r1MLKEM768-tls13-in-tls12-2-ssl

-[112-curve-SecP256r1MLKEM768-tls13-in-tls12-2-ssl]
-server = 112-curve-SecP256r1MLKEM768-tls13-in-tls12-2-server
-client = 112-curve-SecP256r1MLKEM768-tls13-in-tls12-2-client
+[114-curve-SecP256r1MLKEM768-tls13-in-tls12-2-ssl]
+server = 114-curve-SecP256r1MLKEM768-tls13-in-tls12-2-server
+client = 114-curve-SecP256r1MLKEM768-tls13-in-tls12-2-client

-[112-curve-SecP256r1MLKEM768-tls13-in-tls12-2-server]
+[114-curve-SecP256r1MLKEM768-tls13-in-tls12-2-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = SecP256r1MLKEM768
 MaxProtocol = TLSv1.2
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[112-curve-SecP256r1MLKEM768-tls13-in-tls12-2-client]
+[114-curve-SecP256r1MLKEM768-tls13-in-tls12-2-client]
 CipherString = DEFAULT@SECLEVEL=1
 Curves = SecP256r1MLKEM768
 MaxProtocol = TLSv1.3
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-112]
+[test-114]
 ExpectedResult = Success


 # ===========================================================

-[113-curve-SecP384r1MLKEM1024-tls13-in-tls12]
-ssl_conf = 113-curve-SecP384r1MLKEM1024-tls13-in-tls12-ssl
+[115-curve-SecP384r1MLKEM1024-tls13-in-tls12]
+ssl_conf = 115-curve-SecP384r1MLKEM1024-tls13-in-tls12-ssl

-[113-curve-SecP384r1MLKEM1024-tls13-in-tls12-ssl]
-server = 113-curve-SecP384r1MLKEM1024-tls13-in-tls12-server
-client = 113-curve-SecP384r1MLKEM1024-tls13-in-tls12-client
+[115-curve-SecP384r1MLKEM1024-tls13-in-tls12-ssl]
+server = 115-curve-SecP384r1MLKEM1024-tls13-in-tls12-server
+client = 115-curve-SecP384r1MLKEM1024-tls13-in-tls12-client

-[113-curve-SecP384r1MLKEM1024-tls13-in-tls12-server]
+[115-curve-SecP384r1MLKEM1024-tls13-in-tls12-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = SecP384r1MLKEM1024
 MaxProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[113-curve-SecP384r1MLKEM1024-tls13-in-tls12-client]
+[115-curve-SecP384r1MLKEM1024-tls13-in-tls12-client]
 CipherString = ECDHE@SECLEVEL=1
 Curves = SecP384r1MLKEM1024
 MaxProtocol = TLSv1.2
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-113]
+[test-115]
 ExpectedResult = ServerFail


 # ===========================================================

-[114-curve-SecP384r1MLKEM1024-tls13-in-tls12-2]
-ssl_conf = 114-curve-SecP384r1MLKEM1024-tls13-in-tls12-2-ssl
+[116-curve-SecP384r1MLKEM1024-tls13-in-tls12-2]
+ssl_conf = 116-curve-SecP384r1MLKEM1024-tls13-in-tls12-2-ssl

-[114-curve-SecP384r1MLKEM1024-tls13-in-tls12-2-ssl]
-server = 114-curve-SecP384r1MLKEM1024-tls13-in-tls12-2-server
-client = 114-curve-SecP384r1MLKEM1024-tls13-in-tls12-2-client
+[116-curve-SecP384r1MLKEM1024-tls13-in-tls12-2-ssl]
+server = 116-curve-SecP384r1MLKEM1024-tls13-in-tls12-2-server
+client = 116-curve-SecP384r1MLKEM1024-tls13-in-tls12-2-client

-[114-curve-SecP384r1MLKEM1024-tls13-in-tls12-2-server]
+[116-curve-SecP384r1MLKEM1024-tls13-in-tls12-2-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = SecP384r1MLKEM1024
 MaxProtocol = TLSv1.2
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[114-curve-SecP384r1MLKEM1024-tls13-in-tls12-2-client]
+[116-curve-SecP384r1MLKEM1024-tls13-in-tls12-2-client]
 CipherString = DEFAULT@SECLEVEL=1
 Curves = SecP384r1MLKEM1024
 MaxProtocol = TLSv1.3
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-114]
+[test-116]
 ExpectedResult = Success


 # ===========================================================

-[115-curve-curveSM2-tls13-in-tls12]
-ssl_conf = 115-curve-curveSM2-tls13-in-tls12-ssl
+[117-curve-curveSM2-tls13-in-tls12]
+ssl_conf = 117-curve-curveSM2-tls13-in-tls12-ssl

-[115-curve-curveSM2-tls13-in-tls12-ssl]
-server = 115-curve-curveSM2-tls13-in-tls12-server
-client = 115-curve-curveSM2-tls13-in-tls12-client
+[117-curve-curveSM2-tls13-in-tls12-ssl]
+server = 117-curve-curveSM2-tls13-in-tls12-server
+client = 117-curve-curveSM2-tls13-in-tls12-client

-[115-curve-curveSM2-tls13-in-tls12-server]
+[117-curve-curveSM2-tls13-in-tls12-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = curveSM2
 MaxProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[115-curve-curveSM2-tls13-in-tls12-client]
+[117-curve-curveSM2-tls13-in-tls12-client]
 CipherString = ECDHE@SECLEVEL=1
 Curves = curveSM2
 MaxProtocol = TLSv1.2
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-115]
+[test-117]
 ExpectedResult = ServerFail


 # ===========================================================

-[116-curve-curveSM2-tls13-in-tls12-2]
-ssl_conf = 116-curve-curveSM2-tls13-in-tls12-2-ssl
+[118-curve-curveSM2-tls13-in-tls12-2]
+ssl_conf = 118-curve-curveSM2-tls13-in-tls12-2-ssl

-[116-curve-curveSM2-tls13-in-tls12-2-ssl]
-server = 116-curve-curveSM2-tls13-in-tls12-2-server
-client = 116-curve-curveSM2-tls13-in-tls12-2-client
+[118-curve-curveSM2-tls13-in-tls12-2-ssl]
+server = 118-curve-curveSM2-tls13-in-tls12-2-server
+client = 118-curve-curveSM2-tls13-in-tls12-2-client

-[116-curve-curveSM2-tls13-in-tls12-2-server]
+[118-curve-curveSM2-tls13-in-tls12-2-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = curveSM2
 MaxProtocol = TLSv1.2
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[116-curve-curveSM2-tls13-in-tls12-2-client]
+[118-curve-curveSM2-tls13-in-tls12-2-client]
 CipherString = DEFAULT@SECLEVEL=1
 Curves = curveSM2
 MaxProtocol = TLSv1.3
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-116]
+[test-118]
 ExpectedResult = Success


 # ===========================================================

-[117-curve-curveSM2MLKEM768-tls13-in-tls12]
-ssl_conf = 117-curve-curveSM2MLKEM768-tls13-in-tls12-ssl
+[119-curve-curveSM2MLKEM768-tls13-in-tls12]
+ssl_conf = 119-curve-curveSM2MLKEM768-tls13-in-tls12-ssl

-[117-curve-curveSM2MLKEM768-tls13-in-tls12-ssl]
-server = 117-curve-curveSM2MLKEM768-tls13-in-tls12-server
-client = 117-curve-curveSM2MLKEM768-tls13-in-tls12-client
+[119-curve-curveSM2MLKEM768-tls13-in-tls12-ssl]
+server = 119-curve-curveSM2MLKEM768-tls13-in-tls12-server
+client = 119-curve-curveSM2MLKEM768-tls13-in-tls12-client

-[117-curve-curveSM2MLKEM768-tls13-in-tls12-server]
+[119-curve-curveSM2MLKEM768-tls13-in-tls12-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = curveSM2MLKEM768
 MaxProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[117-curve-curveSM2MLKEM768-tls13-in-tls12-client]
+[119-curve-curveSM2MLKEM768-tls13-in-tls12-client]
 CipherString = ECDHE@SECLEVEL=1
 Curves = curveSM2MLKEM768
 MaxProtocol = TLSv1.2
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-117]
+[test-119]
 ExpectedResult = ServerFail


 # ===========================================================

-[118-curve-curveSM2MLKEM768-tls13-in-tls12-2]
-ssl_conf = 118-curve-curveSM2MLKEM768-tls13-in-tls12-2-ssl
+[120-curve-curveSM2MLKEM768-tls13-in-tls12-2]
+ssl_conf = 120-curve-curveSM2MLKEM768-tls13-in-tls12-2-ssl

-[118-curve-curveSM2MLKEM768-tls13-in-tls12-2-ssl]
-server = 118-curve-curveSM2MLKEM768-tls13-in-tls12-2-server
-client = 118-curve-curveSM2MLKEM768-tls13-in-tls12-2-client
+[120-curve-curveSM2MLKEM768-tls13-in-tls12-2-ssl]
+server = 120-curve-curveSM2MLKEM768-tls13-in-tls12-2-server
+client = 120-curve-curveSM2MLKEM768-tls13-in-tls12-2-client

-[118-curve-curveSM2MLKEM768-tls13-in-tls12-2-server]
+[120-curve-curveSM2MLKEM768-tls13-in-tls12-2-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT@SECLEVEL=1
 Curves = curveSM2MLKEM768
 MaxProtocol = TLSv1.2
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem

-[118-curve-curveSM2MLKEM768-tls13-in-tls12-2-client]
+[120-curve-curveSM2MLKEM768-tls13-in-tls12-2-client]
 CipherString = DEFAULT@SECLEVEL=1
 Curves = curveSM2MLKEM768
 MaxProtocol = TLSv1.3
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer

-[test-118]
+[test-120]
+ExpectedResult = Success
+
+
+# ===========================================================
+
+[121-curve-MLKEM512X25519-tls13-in-tls12]
+ssl_conf = 121-curve-MLKEM512X25519-tls13-in-tls12-ssl
+
+[121-curve-MLKEM512X25519-tls13-in-tls12-ssl]
+server = 121-curve-MLKEM512X25519-tls13-in-tls12-server
+client = 121-curve-MLKEM512X25519-tls13-in-tls12-client
+
+[121-curve-MLKEM512X25519-tls13-in-tls12-server]
+Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
+CipherString = DEFAULT@SECLEVEL=1
+Curves = MLKEM512X25519
+MaxProtocol = TLSv1.3
+PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
+
+[121-curve-MLKEM512X25519-tls13-in-tls12-client]
+CipherString = ECDHE@SECLEVEL=1
+Curves = MLKEM512X25519
+MaxProtocol = TLSv1.2
+VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
+VerifyMode = Peer
+
+[test-121]
+ExpectedResult = ServerFail
+
+
+# ===========================================================
+
+[122-curve-MLKEM512X25519-tls13-in-tls12-2]
+ssl_conf = 122-curve-MLKEM512X25519-tls13-in-tls12-2-ssl
+
+[122-curve-MLKEM512X25519-tls13-in-tls12-2-ssl]
+server = 122-curve-MLKEM512X25519-tls13-in-tls12-2-server
+client = 122-curve-MLKEM512X25519-tls13-in-tls12-2-client
+
+[122-curve-MLKEM512X25519-tls13-in-tls12-2-server]
+Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
+CipherString = DEFAULT@SECLEVEL=1
+Curves = MLKEM512X25519
+MaxProtocol = TLSv1.2
+PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
+
+[122-curve-MLKEM512X25519-tls13-in-tls12-2-client]
+CipherString = DEFAULT@SECLEVEL=1
+Curves = MLKEM512X25519
+MaxProtocol = TLSv1.3
+VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
+VerifyMode = Peer
+
+[test-122]
+ExpectedResult = Success
+
+
+# ===========================================================
+
+[123-curve-SecP256r1MLKEM512-tls13-in-tls12]
+ssl_conf = 123-curve-SecP256r1MLKEM512-tls13-in-tls12-ssl
+
+[123-curve-SecP256r1MLKEM512-tls13-in-tls12-ssl]
+server = 123-curve-SecP256r1MLKEM512-tls13-in-tls12-server
+client = 123-curve-SecP256r1MLKEM512-tls13-in-tls12-client
+
+[123-curve-SecP256r1MLKEM512-tls13-in-tls12-server]
+Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
+CipherString = DEFAULT@SECLEVEL=1
+Curves = SecP256r1MLKEM512
+MaxProtocol = TLSv1.3
+PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
+
+[123-curve-SecP256r1MLKEM512-tls13-in-tls12-client]
+CipherString = ECDHE@SECLEVEL=1
+Curves = SecP256r1MLKEM512
+MaxProtocol = TLSv1.2
+VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
+VerifyMode = Peer
+
+[test-123]
+ExpectedResult = ServerFail
+
+
+# ===========================================================
+
+[124-curve-SecP256r1MLKEM512-tls13-in-tls12-2]
+ssl_conf = 124-curve-SecP256r1MLKEM512-tls13-in-tls12-2-ssl
+
+[124-curve-SecP256r1MLKEM512-tls13-in-tls12-2-ssl]
+server = 124-curve-SecP256r1MLKEM512-tls13-in-tls12-2-server
+client = 124-curve-SecP256r1MLKEM512-tls13-in-tls12-2-client
+
+[124-curve-SecP256r1MLKEM512-tls13-in-tls12-2-server]
+Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
+CipherString = DEFAULT@SECLEVEL=1
+Curves = SecP256r1MLKEM512
+MaxProtocol = TLSv1.2
+PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
+
+[124-curve-SecP256r1MLKEM512-tls13-in-tls12-2-client]
+CipherString = DEFAULT@SECLEVEL=1
+Curves = SecP256r1MLKEM512
+MaxProtocol = TLSv1.3
+VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
+VerifyMode = Peer
+
+[test-124]
 ExpectedResult = Success


diff --git a/test/ssl-tests/14-curves.cnf.in b/test/ssl-tests/14-curves.cnf.in
index abcdb5dc0f..f4a564897b 100644
--- a/test/ssl-tests/14-curves.cnf.in
+++ b/test/ssl-tests/14-curves.cnf.in
@@ -55,6 +55,10 @@ push @curves_no_nid, qw(curveSM2)
     unless ($fips_mode || disabled("sm2"));
 push @curves_no_nid, qw(curveSM2MLKEM768)
     unless ($fips_mode || disabled("sm2") || disabled("ml-kem"));
+push @curves_no_nid, qw(MLKEM512X25519)
+    unless (disabled("ml-kem") || disabled("ecx") || $fips_mode);
+push @curves_no_nid, qw(SecP256r1MLKEM512)
+    unless (disabled("ml-kem") || $fips_mode);

 push @curves_tls_1_3, @curves_no_nid;
 push @curves, @curves_no_nid;
diff --git a/test/sslapitest.c b/test/sslapitest.c
index 6addf17ba5..133e2efb42 100644
--- a/test/sslapitest.c
+++ b/test/sslapitest.c
@@ -6637,14 +6637,16 @@ end:
  * Test 13 = Test MLKEM512
  * Test 14 = Test MLKEM768
  * Test 15 = Test MLKEM1024
- * Test 16 = Test X25519MLKEM768
- * Test 17 = Test SecP256r1MLKEM768
- * Test 18 = Test SecP384r1MLKEM1024
- * Test 19 = Test curveSM2 with TLSv1.3 client and server
- * Test 20 = Test curveSM2MLKEM768 with TLSv1.3 client and server
- * Test 21 = Test all ML-KEM with TLSv1.2 client and server
- * Test 22 = Test all FFDHE with TLSv1.2 client and server
- * Test 23 = Test all ECDHE with TLSv1.2 client and server
+ * Test 16 = Test MLKEM512X25519
+ * Test 17 = Test X25519MLKEM768
+ * Test 18 = Test SecP256r1MLKEM512
+ * Test 19 = Test SecP256r1MLKEM768
+ * Test 20 = Test SecP384r1MLKEM1024
+ * Test 21 = Test curveSM2 with TLSv1.3 client and server
+ * Test 22 = Test curveSM2MLKEM768 with TLSv1.3 client and server
+ * Test 23 = Test all ML-KEM with TLSv1.2 client and server
+ * Test 24 = Test all FFDHE with TLSv1.2 client and server
+ * Test 25 = Test all ECDHE with TLSv1.2 client and server
  */
 #ifndef OPENSSL_NO_EC
 static int ecdhe_kexch_groups[] = { NID_X9_62_prime256v1, NID_secp384r1,
@@ -6675,7 +6677,7 @@ static int test_key_exchange(int idx)
     switch (idx) {
 #ifndef OPENSSL_NO_EC
 #ifndef OPENSSL_NO_TLS1_2
-    case 23:
+    case 25:
         max_version = TLS1_2_VERSION;
 #endif /* OPENSSL_NO_TLS1_2 */
         /* Fall through */
@@ -6713,7 +6715,7 @@ static int test_key_exchange(int idx)
 #endif /* OPENSSL_NO_EC */
 #ifndef OPENSSL_NO_DH
 #ifndef OPENSSL_NO_TLS1_2
-    case 22:
+    case 24:
         max_version = TLS1_2_VERSION;
 #endif /* OPENSSL_NO_TLS1_2 */
         /* Fall through */
@@ -6745,7 +6747,7 @@ static int test_key_exchange(int idx)
 #endif /* OPENSSL_NO_DH */
 #ifndef OPENSSL_NO_ML_KEM
 #if !defined(OPENSSL_NO_TLS1_2)
-    case 21:
+    case 23:
         max_version = TLS1_2_VERSION;
         kexch_groups = NULL;
 #if !defined(OPENSSL_NO_EC)
@@ -6786,17 +6788,27 @@ static int test_key_exchange(int idx)
 #ifndef OPENSSL_NO_EC
 #ifndef OPENSSL_NO_ECX
     case 16:
+        kexch_groups = NULL;
+        kexch_name0 = "MLKEM512X25519";
+        kexch_names = kexch_name0;
+        break;
+    case 17:
         kexch_groups = NULL;
         kexch_name0 = "X25519MLKEM768";
         kexch_names = kexch_name0;
         break;
 #endif /* OPENSSL_NO_ECX */
-    case 17:
+    case 18:
+        kexch_groups = NULL;
+        kexch_name0 = "SecP256r1MLKEM512";
+        kexch_names = kexch_name0;
+        break;
+    case 19:
         kexch_groups = NULL;
         kexch_name0 = "SecP256r1MLKEM768";
         kexch_names = kexch_name0;
         break;
-    case 18:
+    case 20:
         kexch_groups = NULL;
         kexch_name0 = "SecP384r1MLKEM1024";
         kexch_names = kexch_name0;
@@ -6806,7 +6818,7 @@ static int test_key_exchange(int idx)

 #ifndef OPENSSL_NO_EC
 #ifndef OPENSSL_NO_SM2
-    case 19:
+    case 21:
         if (is_fips)
             return TEST_skip("curveSM2 is not supported by the fips provider.");
         kexch_groups = NULL;
@@ -6814,7 +6826,7 @@ static int test_key_exchange(int idx)
         kexch_names = kexch_name0;
         break;
 #ifndef OPENSSL_NO_ML_KEM
-    case 20:
+    case 22:
         if (is_fips)
             return TEST_skip("curveSM2MLKEM768 is not supported by the fips provider.");
         kexch_groups = NULL;
@@ -6831,7 +6843,7 @@ static int test_key_exchange(int idx)
     }

     if (is_fips && fips_provider_version_lt(libctx, 3, 5, 0)
-        && ((idx >= 12 && idx <= 18) || idx == 21))
+        && ((idx >= 12 && idx <= 20) || idx == 23))
         return TEST_skip("ML-KEM not supported in this version of fips provider");

     if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
@@ -17326,14 +17338,14 @@ int setup_tests(void)
 #if !defined(OSSL_NO_USABLE_TLS1_3)
 #ifndef OPENSSL_NO_TLS1_2
     /* Test with both TLSv1.3 and 1.2 versions */
-    ADD_ALL_TESTS(test_key_exchange, 23);
+    ADD_ALL_TESTS(test_key_exchange, 26);
 #if !defined(OPENSSL_NO_EC) && !defined(OPENSSL_NO_DH)
     ADD_ALL_TESTS(test_negotiated_group,
         4 * (OSSL_NELEM(ecdhe_kexch_groups) + OSSL_NELEM(ffdhe_kexch_groups)));
 #endif
 #else
     /* Test with only TLSv1.3 versions */
-    ADD_ALL_TESTS(test_key_exchange, 20);
+    ADD_ALL_TESTS(test_key_exchange, 23);
 #endif
     ADD_ALL_TESTS(test_custom_exts, 6);
     ADD_TEST(test_pha_key_update);