test: account for OpenSSL 4.x changes

Skip the client certificate and private key engine addon tests on
OpenSSL 4, which no longer supports engines.

Account for OpenSSL 4.1 no longer checking the subject CN by default in
X509Certificate.checkHost(). Keep explicit subject matching and TLS CN
fallback expectations unchanged.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Assisted-by: Codex
PR-URL: #66775
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

Author: panva

test/addons/openssl-client-cert-engine/test.js

@@ -5,6 +5,11 @@ const fixture = require('../../common/fixtures');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
+const { hasOpenSSL } = require('../../common/crypto');
+
+if (hasOpenSSL(4))
+  common.skip('OpenSSL 4 does not support engines');
+
 const fs = require('fs');
 const path = require('path');
 

test/addons/openssl-key-engine/test.js

@@ -5,6 +5,11 @@ const fixture = require('../../common/fixtures');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
+const { hasOpenSSL } = require('../../common/crypto');
+
+if (hasOpenSSL(4))
+  common.skip('OpenSSL 4 does not support engines');
+
 const fs = require('fs');
 const path = require('path');
 

test/parallel/test-x509-escaping.js

@@ -472,7 +472,7 @@ const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
   })).unref();
 }
 
-// The subject MUST NOT be ignored if no dNSName subject alternative name
+// TLS MUST NOT ignore the subject if no dNSName subject alternative name
 // exists, even if other subject alternative names exist.
 {
   const key = fixtures.readKey('irrelevant_san_correct_subject-key.pem');
@@ -485,13 +485,12 @@ const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
   assert.strictEqual(certX509.subjectAltName, 'IP Address:1.2.3.4');
 
   // The newer X509Certificate API allows customizing this behavior:
-  const cnFallback = isBoringSSL ? undefined :
-    servername;
+  const cnFallback = isBoringSSL || hasOpenSSL(4, 1) ? undefined : servername;
   assert.strictEqual(certX509.checkHost(servername), cnFallback);
   assert.strictEqual(certX509.checkHost(servername, { subject: 'default' }),
                      cnFallback);
   assert.strictEqual(certX509.checkHost(servername, { subject: 'always' }),
-                     cnFallback);
+                     isBoringSSL ? undefined : servername);
   assert.strictEqual(certX509.checkHost(servername, { subject: 'never' }),
                      undefined);