Commit 7aa9f5091c for openssl.org

commit 7aa9f5091ce768d21448e22d6ff00b04dcb39d02
Author: Mounir IDRASSI <mounir.idrassi@idrix.fr>
Date:   Mon Aug 3 20:58:38 2026 +0900

    apps/x509: Fix new output detection for -key signing

    The signing-only option validation runs before load_key(), so
    privkey is always NULL when determining newout. Consequently, -key
    or -signkey alone does not identify re-signing an input certificate
    or signing an -x509toreq output. Signing options are rejected, and
    the default extensions section is not loaded.

    Check privkeyfile at this stage, which records that the option was
    supplied. Keep the later privkey check unchanged because the key has
    been loaded by then. Add tests for the validation guard, re-signing
    options, and certificate and request extensions.

    Fixes #32150

    Assisted-by: pi:kimi-k3
    Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
    Reviewed-by: Jakub Zelenka <jakub.zelenka@openssl.foundation>
    Merge-date: Fri Sep 25 11:07:32 2026
    Merged-from: https://github.com/openssl/openssl/pull/32151

diff --git a/apps/x509.c b/apps/x509.c
index 3fd41465e2..baf4da16f7 100644
--- a/apps/x509.c
+++ b/apps/x509.c
@@ -713,7 +713,7 @@ int x509_main(int argc, char **argv)
     if (!opt_check_md(digest))
         goto opthelp;

-    if (reqfile || newcert || privkey != NULL || CAfile != NULL)
+    if (reqfile || newcert || privkeyfile != NULL || CAfile != NULL)
         newout = 1;
     else if (sno != NULL
         || not_before != NULL
diff --git a/test/recipes/25-test_x509.t b/test/recipes/25-test_x509.t
index 2824f19006..cc8f313403 100644
--- a/test/recipes/25-test_x509.t
+++ b/test/recipes/25-test_x509.t
@@ -598,6 +598,30 @@ ok(!run(app(["openssl", "x509", "-req", "-in", $in_csr, "-signkey", $in_key,
             "-out", File::Spec->devnull(), "-days", "3650" , "-extensions", "ext",
             "-extfile", $invextfile])));

+subtest "signing output detection with -key" => sub {
+    plan tests => 5;
+
+    my $v1_cert = srctop_file("test", "testx509.pem");
+    my $with_days_cert = "x509-resigned-with-days.pem";
+    my $default_ext_cert = "x509-resigned-with-default-ext.pem";
+    my $request = "x509-to-request-with-ext.pem";
+
+    ok(!run(app(["openssl", "x509", "-in", $v1_cert, "-noout",
+                 "-days", "1"])),
+       "reject -days when no signed output is requested");
+    ok(run(app(["openssl", "x509", "-in", $v1_cert, "-signkey", $in_key,
+                "-days", "1", "-out", $with_days_cert])),
+       "accept -days when re-signing with -signkey");
+    ok(run(app(["openssl", "x509", "-in", $v1_cert, "-key", $in_key,
+                "-out", $default_ext_cert])),
+       "re-sign a certificate with -key");
+    has_SKID($default_ext_cert, 1);
+    ok(run(app(["openssl", "x509", "-in", $v1_cert, "-x509toreq",
+                "-key", $in_key, "-extfile", $cnf,
+                "-extensions", "v3_req", "-out", $request])),
+       "accept extension options when signing a request with -key");
+};
+
 # Tests for issue #16080 (fixed in 1.1.1o)
 my $b_key = "b-key.pem";
 my $b_csr = "b-cert.csr";