test,benchmark: drop OpenSSL 1.x-only coverage

Delete test-crypto-ecb.js, which can no longer run anywhere: Blowfish
is available only from OpenSSL's legacy provider and is absent from
BoringSSL.

The addon and cctest version guards become OPENSSL_IS_BORINGSSL checks.
Remove legacy digest-alias coverage and unreachable OpenSSL 1.x
branches. JavaScript test and benchmark gates, skip reasons, and TLS
error expectations that distinguished OpenSSL 1.x from provider-backed
OpenSSL now distinguish BoringSSL, including PKCS12 parsing, named DH
groups, private-key serialization, RSA-PSS parameters, consolidated
provider caches, FIPS availability, and empty KMAC output. Keep the CCM
alternate finalization error only for BoringSSL.

Provider-only test skips use version-neutral terminology or state the
actual minimum OpenSSL version.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Assisted-by: Codex
PR-URL: https://github.com/nodejs/node/pull/64777
Fixes: https://github.com/nodejs/node/issues/56733
Refs: https://github.com/nodejs/node/pull/64211
Refs: https://github.com/nodejs/node/pull/63966
Refs: https://github.com/nodejs/node/pull/53329
Refs: https://github.com/nodejs/node/pull/48950
Refs: https://github.com/nodejs/node/issues/45465
Refs: https://github.com/nodejs/node/issues/42827
Refs: https://github.com/nodejs/node/issues/47076
Refs: https://github.com/nodejs/node/pull/62862
Refs: https://github.com/nodejs/node/pull/38512
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>

test/addons/openssl-providers/binding.cc

@@ -1,8 +1,9 @@
 #include <assert.h>
 #include <node.h>
 
-#include <openssl/opensslv.h>
-#if OPENSSL_VERSION_MAJOR >= 3
+// BoringSSL declares OPENSSL_IS_BORINGSSL in crypto.h.
+#include <openssl/crypto.h>
+#ifndef OPENSSL_IS_BORINGSSL
 #include <openssl/provider.h>
 #endif
 
@@ -18,7 +19,7 @@ using v8::Object;
 using v8::String;
 using v8::Value;
 
-#if OPENSSL_VERSION_MAJOR >= 3
+#ifndef OPENSSL_IS_BORINGSSL
 int collectProviders(OSSL_PROVIDER* provider, void* cbdata) {
   static_cast<std::vector<OSSL_PROVIDER*>*>(cbdata)->push_back(provider);
   return 1;
@@ -28,7 +29,7 @@ int collectProviders(OSSL_PROVIDER* provider, void* cbdata) {
 inline void GetProviders(const FunctionCallbackInfo<Value>& args) {
   Isolate* isolate = args.GetIsolate();
   LocalVector<Value> arr(isolate, 0);
-#if OPENSSL_VERSION_MAJOR >= 3
+#ifndef OPENSSL_IS_BORINGSSL
   std::vector<OSSL_PROVIDER*> providers;
   OSSL_PROVIDER_do_all(nullptr, &collectProviders, &providers);
   for (auto provider : providers) {

test/addons/openssl-providers/providers.cjs

@@ -4,10 +4,10 @@ const common = require('../../common');
 if (!common.hasCrypto) {
   common.skip('missing crypto');
 }
-const { hasOpenSSL } = require('../../common/crypto');
+const { isBoringSSL } = require('../../common/crypto');
 
-if (!hasOpenSSL(3)) {
-  common.skip('this test requires OpenSSL 3.x');
+if (isBoringSSL) {
+  common.skip('OpenSSL provider support is required');
 }
 const assert = require('node:assert');
 const {

test/cctest/test_node_crypto_env.cc

@@ -26,7 +26,7 @@ TEST_F(NodeCryptoEnv, LoadBIO) {
   //  just put a random string into BIO
   Local<String> key = String::NewFromUtf8(isolate_, "abcdef").ToLocalChecked();
   ncrypto::BIOPointer bio(node::crypto::LoadBIO(*env, key));
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+#ifndef OPENSSL_IS_BORINGSSL
   const int ofs = 2;
   ASSERT_EQ(BIO_seek(bio.get(), ofs), ofs);
   ASSERT_EQ(BIO_tell(bio.get()), ofs);

test/common/crypto.js

@@ -147,9 +147,6 @@ module.exports = {
   hasOpenSSL,
   hasFIPS,
   isBoringSSL,
-  get hasOpenSSL3() {
-    return hasOpenSSL(3);
-  },
   // opensslCli defined lazily to reduce overhead of spawnSync
   get opensslCli() {
     if (opensslCli !== null) return opensslCli;

test/fixtures/webcrypto/supports-modern-algorithms.mjs

@@ -13,8 +13,8 @@ const shake128 = crypto.getHashes().includes('shake128');
 const shake256 = crypto.getHashes().includes('shake256');
 const cshake128 = crypto.getHashes().includes('cshake128');
 const cshake256 = crypto.getHashes().includes('cshake256');
-const ocb = hasOpenSSL(3) && crypto.getCiphers().includes('aes-128-ocb');
-const kmac = hasOpenSSL(3) && crypto.getMacs().includes('kmac128');
+const ocb = !isBoringSSL && crypto.getCiphers().includes('aes-128-ocb');
+const kmac = !isBoringSSL && crypto.getMacs().includes('kmac128');
 const hybridKems = !fips && pqc && (!boringSSL || shake256);
 
 

test/parallel/test-cli-node-options.js

@@ -12,7 +12,7 @@ const { Worker } = require('worker_threads');
 
 const fixtures = require('../common/fixtures');
 const tmpdir = require('../common/tmpdir');
-const { hasOpenSSL } = require('../common/crypto');
+const { isBoringSSL } = require('../common/crypto');
 tmpdir.refresh();
 
 const printA = path.relative(tmpdir.path, fixtures.path('printA.js'));
@@ -65,7 +65,7 @@ if (common.isLinux) {
 if (common.hasCrypto) {
   expectNoWorker('--use-openssl-ca', 'B\n');
   expectNoWorker('--use-bundled-ca', 'B\n');
-  if (!hasOpenSSL(3))
+  if (isBoringSSL)
     expectNoWorker('--openssl-config=_ossl_cfg', 'B\n');
   if (common.isMacOS) {
     expect('--use-system-ca', 'B\n');

test/parallel/test-config-json-schema.js

@@ -10,10 +10,10 @@ if (!common.hasCrypto) {
   common.skip('missing crypto');
 }
 
-const { hasOpenSSL } = require('../common/crypto');
+const { isBoringSSL } = require('../common/crypto');
 
-if (!hasOpenSSL(3)) {
-  common.skip('this test requires OpenSSL 3.x');
+if (isBoringSSL) {
+  common.skip('this test is not supported with BoringSSL');
 }
 
 if (!common.hasIntl) {

test/parallel/test-crypto-async-sign-verify.js

@@ -3,7 +3,7 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL, hasFIPS, isBoringSSL } = require('../common/crypto');
+const { hasFIPS, isBoringSSL } = require('../common/crypto');
 const assert = require('assert');
 const util = require('util');
 const crypto = require('crypto');
@@ -132,7 +132,7 @@ if (!isBoringSSL) {
   common.printSkipMessage('Skipping unsupported ed448/secp256k1/dsa test cases');
 }
 
-// Test Parallel Execution w/ KeyObject is threadsafe in openssl3
+// Test Parallel Execution w/ KeyObject is threadsafe in OpenSSL
 {
   const publicKey = {
     key: crypto.createPublicKey(
@@ -171,12 +171,10 @@ MCowBQYDK2VuAyEA6pwGRbadNQAI/tYN8+/p/0/hbsdHfOEGr1ADiLVk/Gc=
   const data = crypto.randomBytes(32);
   const signature = crypto.randomBytes(16);
 
-  let expected = /no default digest/;
-  let expectedCode = 'ERR_OSSL_EVP_NO_DEFAULT_DIGEST';
-  if (hasOpenSSL(3) || isBoringSSL) {
-    expected = /operation[\s_]not[\s_]supported[\s_]for[\s_]this[\s_]keytype/i;
-    expectedCode = 'ERR_OSSL_EVP_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE';
-  }
+  const expected =
+    /operation[\s_]not[\s_]supported[\s_]for[\s_]this[\s_]keytype/i;
+  const expectedCode =
+    'ERR_OSSL_EVP_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE';
 
   crypto.verify(undefined, data, untrustedKey, signature, common.mustCall((err) => {
     assert.ok(err);

test/parallel/test-crypto-authenticated.js

@@ -819,7 +819,7 @@ for (const test of TEST_CASES) {
     } catch (err) {
       // OpenSSL without https://github.com/openssl/openssl/pull/32427
       // cannot finalize an empty CCM message unless update() was called.
-      if (hasOpenSSL(3)) {
+      if (!isBoringSSL) {
         assert.strictEqual(err.code, 'ERR_OSSL_TAG_NOT_SET');
       } else {
         assert.match(err.message, /Unsupported state/);

test/parallel/test-crypto-cipheriv-decipheriv.js

@@ -5,7 +5,7 @@ if (!common.hasCrypto)
 
 const assert = require('assert');
 const crypto = require('crypto');
-const { hasOpenSSL, hasFIPS } = require('../common/crypto');
+const { hasFIPS, isBoringSSL } = require('../common/crypto');
 const isFipsEnabled = crypto.getFips() === 1;
 const fips3 = hasFIPS(3);
 
@@ -293,8 +293,8 @@ assert.throws(
   errMessage);
 
 // But all other IV lengths should be accepted.
-const minIvLength = hasOpenSSL(3) ? 8 : 1;
-const maxIvLength = hasOpenSSL(3) ? 64 : 256;
+const minIvLength = isBoringSSL ? 1 : 8;
+const maxIvLength = isBoringSSL ? 256 : 64;
 for (let n = minIvLength; n < maxIvLength; n += 1) {
   if (isFipsEnabled && n < 12) continue;
   crypto.createCipheriv('aes-128-gcm', Buffer.alloc(16), Buffer.alloc(n));

test/parallel/test-crypto-classes.js

@@ -6,7 +6,7 @@ if (!common.hasCrypto) {
   common.skip('missing crypto');
 }
 const crypto = require('crypto');
-const { hasOpenSSL, hasFIPS } = require('../common/crypto');
+const { hasFIPS, isBoringSSL } = require('../common/crypto');
 
 // 'ClassName' : ['args', 'for', 'constructor']
 const TEST_CASES = {
@@ -31,7 +31,7 @@ if (hasFIPS(3)) {
   TEST_CASES.DiffieHellman = [2048];
   TEST_CASES.DiffieHellmanGroup = ['modp14'];
 } else if (crypto.getFips() !== 1) {
-  TEST_CASES.DiffieHellman = [hasOpenSSL(3) ? 1024 : 256];
+  TEST_CASES.DiffieHellman = [isBoringSSL ? 256 : 1024];
 }
 
 for (const [clazz, args] of Object.entries(TEST_CASES)) {

test/parallel/test-crypto-dh-curves.js

@@ -5,7 +5,7 @@ if (!common.hasCrypto)
 
 const assert = require('assert');
 const crypto = require('crypto');
-const { hasOpenSSL, hasFIPS, isBoringSSL } = require('../common/crypto');
+const { hasFIPS, isBoringSSL } = require('../common/crypto');
 const {
   DH_CHECK_P_NOT_PRIME,
   DH_CHECK_P_NOT_SAFE_PRIME,
@@ -70,7 +70,7 @@ const bad_dh = isBoringSSL ?
   crypto.createDiffieHellman('02', 'hex');
 assert.notStrictEqual(bad_dh.verifyError, 0);
 
-if (hasOpenSSL(3)) {
+if (!isBoringSSL) {
   const smallSafePrime = crypto.createDiffieHellman(
     Buffer.from([23]), Buffer.from([2]));
   assert.notStrictEqual(smallSafePrime.verifyError, 0);
@@ -79,11 +79,6 @@ if (hasOpenSSL(3)) {
     () => crypto.createDiffieHellman(Buffer.from(p, 'hex'),
                                      Buffer.from(p, 'hex')),
     { code: 'ERR_OSSL_DH_BAD_GENERATOR' });
-} else if (!isBoringSSL) {
-  assert.strictEqual(
-    crypto.createDiffieHellman(Buffer.from(p, 'hex'),
-                               Buffer.from(p, 'hex')).verifyError,
-    DH_NOT_SUITABLE_GENERATOR);
 }
 
 const availableCurves = new Set(crypto.getCurves());
@@ -279,7 +274,7 @@ if (availableCurves.has('prime256v1') && availableHashes.has('sha256')) {
   crypto.createSign('SHA256').sign(ecPrivateKey);
 }
 
-if (hasFIPS(3) && availableCurves.has('secp256k1')) {
+if (hasFIPS() && availableCurves.has('secp256k1')) {
   const originalFips = crypto.getFips();
 
   try {

test/parallel/test-crypto-dh-errors.js

@@ -5,7 +5,7 @@ if (!common.hasCrypto)
 
 const assert = require('assert');
 const crypto = require('crypto');
-const { hasOpenSSL } = require('../common/crypto');
+const { isBoringSSL } = require('../common/crypto');
 
 // https://github.com/nodejs/node/issues/32738
 // XXX(bnoordhuis) validateInt32() throwing ERR_OUT_OF_RANGE and RangeError
@@ -25,7 +25,7 @@ assert.throws(() => crypto.createDiffieHellman('abcdef', 13.37), {
 });
 
 for (const bits of [-1, 0, 1]) {
-  if (hasOpenSSL(3)) {
+  if (!isBoringSSL) {
     assert.throws(() => crypto.createDiffieHellman(bits), {
       code: 'ERR_OSSL_DH_MODULUS_TOO_SMALL',
       name: 'Error',

test/parallel/test-crypto-dh-odd-key.js

@@ -27,12 +27,12 @@ if (!common.hasCrypto) {
 
 const assert = require('assert');
 const crypto = require('crypto');
-const { hasOpenSSL, hasFIPS } = require('../common/crypto');
+const { hasFIPS, isBoringSSL } = require('../common/crypto');
 
 function test() {
   const odd = Buffer.alloc(39, 'A');
 
-  const size = hasFIPS(3) ? 2048 : (hasOpenSSL(3) ? 1024 : 32);
+  const size = hasFIPS(3) ? 2048 : (isBoringSSL ? 32 : 1024);
   const c = crypto.createDiffieHellman(size);
   c.setPrivateKey(odd);
   c.generateKeys();

test/parallel/test-crypto-dh-stateless.js

@@ -20,7 +20,7 @@ let keyTypeMismatchCode;
 if (hasOpenSSL(4, 0)) {
   keyTypeMismatchCode =
     /^ERR_OSSL_EVP_(OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE|INTERNAL_ERROR)$/;
-} else if (hasOpenSSL(3)) {
+} else if (!isBoringSSL) {
   keyTypeMismatchCode = 'ERR_OSSL_EVP_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE';
 } else {
   keyTypeMismatchCode = 'ERR_OSSL_EVP_DIFFERENT_KEY_TYPES';
@@ -341,15 +341,6 @@ if (isBoringSSL) {
     // Same generator, but different primes.
       [{ group: 'modp5' }, { group: 'modp18' }]];
 
-    // TODO(danbev): Take a closer look if there should be a check in OpenSSL3
-    // when the dh parameters differ.
-    if (!hasOpenSSL(3)) {
-    // Same primes, but different generator.
-      list.push([{ group: 'modp5' }, { prime: group.getPrime(), generator: 5 }]);
-      // Same generator, but different primes.
-      list.push([{ primeLength: 1024 }, { primeLength: 1024 }]);
-    }
-
     for (const [params1, params2] of list) {
       const options = {
         privateKey: crypto.generateKeyPairSync('dh', params1).privateKey,
@@ -357,9 +348,7 @@ if (isBoringSSL) {
       };
       testDHError(options, {
         name: 'Error',
-        code: hasOpenSSL(3) ?
-          'ERR_OSSL_MISMATCHING_DOMAIN_PARAMETERS' :
-          'ERR_OSSL_EVP_DIFFERENT_PARAMETERS'
+        code: 'ERR_OSSL_MISMATCHING_DOMAIN_PARAMETERS'
       });
     }
   }
@@ -420,9 +409,9 @@ test(crypto.generateKeyPairSync('ec', { namedCurve: 'P-256' }),
   };
   testDHError(options, {
     name: 'Error',
-    code: hasOpenSSL(3) ?
-      'ERR_OSSL_MISMATCHING_DOMAIN_PARAMETERS' :
-      'ERR_OSSL_EVP_DIFFERENT_PARAMETERS'
+    code: isBoringSSL ?
+      'ERR_OSSL_EVP_DIFFERENT_PARAMETERS' :
+      'ERR_OSSL_MISMATCHING_DOMAIN_PARAMETERS'
   });
 }
 
@@ -576,9 +565,9 @@ for (const { privateKey: alicePriv, publicKey: bobPub } of [
     testDHError({
       privateKey: privKey(ec256.privateKey),
       publicKey: pubKey(ec384.publicKey),
-    }, { code: hasOpenSSL(3) ?
-      'ERR_OSSL_MISMATCHING_DOMAIN_PARAMETERS' :
-      'ERR_OSSL_EVP_DIFFERENT_PARAMETERS' });
+    }, { code: isBoringSSL ?
+      'ERR_OSSL_EVP_DIFFERENT_PARAMETERS' :
+      'ERR_OSSL_MISMATCHING_DOMAIN_PARAMETERS' });
 
     // Incompatible key types (ec + x25519)
     testDHError({
@@ -607,8 +596,6 @@ for (const { privateKey: alicePriv, publicKey: bobPub } of [
       privateKey: privKey(x25519.privateKey),
       publicKey: pubKey(zeroX25519PublicKey),
     }, isBoringSSL ? { code: 'ERR_OSSL_EVP_INVALID_PEER_KEY' } :
-      hasOpenSSL(3) ?
-        { code: 'ERR_OSSL_FAILED_DURING_DERIVATION' } :
-        { message: /Deriving bits failed/ });
+      { code: 'ERR_OSSL_FAILED_DURING_DERIVATION' });
   }
 }

test/parallel/test-crypto-dh.js

@@ -7,14 +7,13 @@ if (!common.hasCrypto) {
 const assert = require('assert');
 const crypto = require('crypto');
 const {
-  hasOpenSSL,
   hasFIPS,
   isBoringSSL,
 } = require('../common/crypto');
 
 {
   const size = hasFIPS(3) ?
-    2048 : (crypto.getFips() === 1 || hasOpenSSL(3) ? 1024 : 256);
+    2048 : (crypto.getFips() === 1 || !isBoringSSL ? 1024 : 256);
   const dh1 = crypto.createDiffieHellman(size);
   const p1 = dh1.getPrime('buffer');
   const dh2 = crypto.createDiffieHellman(p1, 'buffer');
@@ -60,7 +59,7 @@ const {
   assert.strictEqual(secret1, secret4);
 
   let wrongBlockLength;
-  if (hasOpenSSL(3)) {
+  if (!isBoringSSL) {
     wrongBlockLength = {
       message: /wrong[\s_]final[\s_]block[\s_]length/i,
       code: /ERR_OSSL_(EVP_)?WRONG_FINAL_BLOCK_LENGTH/,

test/parallel/test-crypto-ecb.js

@@ -1,63 +0,0 @@
-// Copyright Joyent, Inc. and other Node contributors.
-//
-// Permission is hereby granted, free of charge, to any person obtaining a
-// copy of this software and associated documentation files (the
-// "Software"), to deal in the Software without restriction, including
-// without limitation the rights to use, copy, modify, merge, publish,
-// distribute, sublicense, and/or sell copies of the Software, and to permit
-// persons to whom the Software is furnished to do so, subject to the
-// following conditions:
-//
-// The above copyright notice and this permission notice shall be included
-// in all copies or substantial portions of the Software.
-//
-// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
-// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
-// NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
-// DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
-// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
-// USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-'use strict';
-const common = require('../common');
-if (!common.hasCrypto) {
-  common.skip('missing crypto');
-}
-
-const { hasOpenSSL } = require('../common/crypto');
-const crypto = require('crypto');
-
-if (crypto.getFips()) {
-  common.skip('BF-ECB is not FIPS 140-2 compatible');
-}
-
-if (hasOpenSSL(3)) {
-  common.skip('Blowfish is only available with the legacy provider in ' +
-    'OpenSSl 3.x');
-}
-
-if (!crypto.getCiphers().includes('BF-ECB')) {
-  common.skip('BF-ECB cipher is not available');
-}
-
-const assert = require('assert');
-
-// Testing whether EVP_CipherInit_ex is functioning correctly.
-// Reference: bug#1997
-
-{
-  const encrypt =
-    crypto.createCipheriv('BF-ECB', 'SomeRandomBlahz0c5GZVnR', '');
-  let hex = encrypt.update('Hello World!', 'ascii', 'hex');
-  hex += encrypt.final('hex');
-  assert.strictEqual(hex.toUpperCase(), '6D385F424AAB0CFBF0BB86E07FFB7D71');
-}
-
-{
-  const decrypt =
-    crypto.createDecipheriv('BF-ECB', 'SomeRandomBlahz0c5GZVnR', '');
-  let msg = decrypt.update('6D385F424AAB0CFBF0BB86E07FFB7D71', 'hex', 'ascii');
-  msg += decrypt.final('ascii');
-  assert.strictEqual(msg, 'Hello World!');
-}

test/parallel/test-crypto-encap-decap.js

@@ -16,11 +16,6 @@ const { promisify } = require('util');
 const isBoringSSL = commonIsBoringSSL;
 const isFips = hasFIPS(3);
 
-if (!hasOpenSSL(3) && !isBoringSSL) {
-  assert.throws(() => crypto.encapsulate(), { code: 'ERR_CRYPTO_KEM_NOT_SUPPORTED' });
-  return;
-}
-
 assert.throws(() => crypto.encapsulate(), { code: 'ERR_INVALID_ARG_TYPE',
                                             message: /The "key" argument must be of type/ });
 assert.throws(() => crypto.decapsulate(), { code: 'ERR_INVALID_ARG_TYPE',
@@ -28,7 +23,7 @@ assert.throws(() => crypto.decapsulate(), { code: 'ERR_INVALID_ARG_TYPE',
 
 const keys = {
   'rsa': {
-    supported: hasOpenSSL(3), // RSASVE was added in 3.0
+    supported: !isBoringSSL, // BoringSSL does not support RSASVE
     publicKey: fixtures.readKey('rsa_public_2048.pem', 'ascii'),
     privateKey: fixtures.readKey('rsa_private_2048.pem', 'ascii'),
     sharedSecretLength: 256,

test/parallel/test-crypto-fips-indicator-strict.js

@@ -31,7 +31,7 @@ const mode = process.env.NODE_TEST_FIPS_FORCE_MODE;
 if (!hasOpenSSL(3, 4)) {
   common.skip('OpenSSL 3.4 or later is required');
 } else if (!hasFIPS(3, 4)) {
-  common.skip('an active OpenSSL 3.4+ FIPS provider is required');
+  common.skip('an active OpenSSL FIPS provider is required');
 } else if (mode === 'provider') {
   assertSerializedMode(mode);
   assert.strictEqual(

test/parallel/test-crypto-getcipherinfo.js

@@ -10,7 +10,7 @@ const {
   getCiphers,
   getCipherInfo,
 } = require('crypto');
-const { hasFIPS, hasOpenSSL, isBoringSSL } = require('../common/crypto');
+const { hasFIPS, isBoringSSL } = require('../common/crypto');
 
 const assert = require('assert');
 
@@ -18,7 +18,7 @@ const ciphers = getCiphers();
 
 assert.strictEqual(getCipherInfo(-1), undefined);
 assert.strictEqual(getCipherInfo('cipher that does not exist'), undefined);
-if (hasOpenSSL(3)) {
+if (!isBoringSSL) {
   assert.deepStrictEqual(
     ciphers.filter((cipher) => cipher.includes('cbc-hmac')), []);
   for (const cipher of [

test/parallel/test-crypto-hkdf.js

@@ -13,7 +13,7 @@ const {
   hkdfSync,
   getHashes
 } = require('crypto');
-const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
+const { isBoringSSL } = require('../common/crypto');
 
 {
   assert.throws(() => hkdf(), {
@@ -142,9 +142,6 @@ const algorithms = [
   ['sha256', '', 'salt', '', 10],
   ['sha512', 'secret', 'salt', '', 15],
 ];
-if (!hasOpenSSL(3) && !isBoringSSL)
-  algorithms.push(['whirlpool', 'secret', '', 'info', 20]);
-
 algorithms.forEach(([ hash, secret, salt, info, length ]) => {
   {
     const syncResult = hkdfSync(hash, secret, salt, info, length);
@@ -233,7 +230,7 @@ algorithms.forEach(([ hash, secret, salt, info, length ]) => {
 });
 
 
-if (!hasOpenSSL(3)) {
+if (isBoringSSL) {
   const kKnownUnsupported = ['shake128', 'shake256'];
   for (const hash of getHashes()) {
     if (kKnownUnsupported.includes(hash)) continue;

test/parallel/test-crypto-hmac.js

@@ -69,19 +69,6 @@ function testHmac(algo, key, data, expected) {
            '19fd6e1ba73d9ed2224dd5094a71babe85d9a892');
 }
 
-{
-  // Historically, dss1 and DSS1 are SHA-1 aliases.
-  const key = '0123456789abcdef';
-  const expected =
-    crypto.createHmac('sha1', key).update('data').digest('hex');
-
-  for (const algo of ['dss1', 'DSS1']) {
-    assert.strictEqual(
-      crypto.createHmac(algo, key).update('data').digest('hex'),
-      expected);
-  }
-}
-
 // Test HMAC (Wikipedia Test Cases)
 const wikipedia = [
   {

test/parallel/test-crypto-job-error-parity.js

@@ -8,7 +8,7 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL, hasFIPS } = require('../common/crypto');
+const { hasFIPS, isBoringSSL } = require('../common/crypto');
 const assert = require('assert');
 const crypto = require('crypto');
 const fixtures = require('../common/fixtures');
@@ -195,7 +195,7 @@ const data = Buffer.from('test data');
 }
 
 // === crypto.encapsulate / crypto.decapsulate ===
-if (hasOpenSSL(3)) {
+if (!isBoringSSL) {
   // KEM: Decapsulate with wrong private key type
   {
     const rsaPublicKey = crypto.createPublicKey(

test/parallel/test-crypto-kem-shared-key.js

@@ -18,9 +18,6 @@ const { hasOpenSSL, hasFIPS, isBoringSSL } = require('../common/crypto');
 const fixtures = require('../common/fixtures');
 const { subtle } = globalThis.crypto;
 
-if (!hasOpenSSL(3) && !isBoringSSL)
-  common.skip('requires OpenSSL >= 3 or BoringSSL');
-
 const encapsulateAsync = promisify(encapsulate);
 const decapsulateAsync = promisify(decapsulate);
 
@@ -103,7 +100,7 @@ async function testKeys(keys) {
 
 async function runMain() {
   const types = [];
-  if (hasOpenSSL(3)) {
+  if (!isBoringSSL) {
     types.push(['rsa', 'rsa', 256, 256]);
   }
   if (hasOpenSSL(3, 2) && !hasFIPS(3)) {

test/parallel/test-crypto-key-encoding-provider-cipher.js

@@ -4,8 +4,8 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasFIPS, hasOpenSSL, isBoringSSL } = require('../common/crypto');
-if (isBoringSSL || !hasOpenSSL(3))
+const { hasFIPS, isBoringSSL } = require('../common/crypto');
+if (isBoringSSL)
   common.skip('OpenSSL providers are required');
 
 const assert = require('assert');

test/parallel/test-crypto-key-objects.js

@@ -25,7 +25,6 @@ const {
 } = require('crypto');
 
 const {
-  hasOpenSSL,
   hasFIPS,
   isBoringSSL,
 } = require('../common/crypto');
@@ -350,20 +349,14 @@ const privateDsa = fixtures.readKey('dsa_private_encrypted_1025.pem',
   // This should not cause a crash: https://github.com/nodejs/node/issues/25247
   assert.throws(() => {
     createPrivateKey({ key: '' });
-  }, hasOpenSSL(3) ? {
-    message: 'error:1E08010C:DECODER routines::unsupported',
-  } : isBoringSSL ? {
+  }, isBoringSSL ? {
     message: 'error:0900006e:PEM routines:OPENSSL_internal:NO_START_LINE',
     code: 'ERR_OSSL_PEM_NO_START_LINE',
     reason: 'NO_START_LINE',
     library: 'PEM routines',
     function: 'OPENSSL_internal',
   } : {
-    message: 'error:0909006C:PEM routines:get_name:no start line',
-    code: 'ERR_OSSL_PEM_NO_START_LINE',
-    reason: 'no start line',
-    library: 'PEM routines',
-    function: 'get_name',
+    message: 'error:1E08010C:DECODER routines::unsupported',
   });
 
   // This should not abort either: https://github.com/nodejs/node/issues/29904
@@ -382,15 +375,12 @@ const privateDsa = fixtures.readKey('dsa_private_encrypted_1025.pem',
       type: 'pkcs1'
     });
     createPrivateKey({ key, format: 'der', type: 'pkcs1' });
-  }, hasOpenSSL(3) ? {
-    message: /error:1E08010C:DECODER routines::unsupported/,
-    library: 'DECODER routines'
-  } : isBoringSSL ? {
+  }, isBoringSSL ? {
     library: 'public key routines',
     message: 'error:06000066:public key routines:OPENSSL_internal:DECODE_ERROR'
   } : {
-    message: /asn1 encoding/,
-    library: 'asn1 encoding routines'
+    message: /error:1E08010C:DECODER routines::unsupported/,
+    library: 'DECODER routines'
   });
 }
 
@@ -791,14 +781,14 @@ for (const info of [
 
 {
   // Reading an encrypted key without a passphrase should fail.
-  assert.throws(() => createPrivateKey(privateDsa), hasOpenSSL(3) ? {
-    name: 'Error',
-    message: 'error:07880109:common libcrypto routines::interrupted or ' +
-             'cancelled',
-  } : {
+  assert.throws(() => createPrivateKey(privateDsa), isBoringSSL ? {
     name: 'TypeError',
     code: 'ERR_MISSING_PASSPHRASE',
     message: 'Passphrase required for encrypted key'
+  } : {
+    name: 'Error',
+    message: 'error:07880109:common libcrypto routines::interrupted or ' +
+             'cancelled',
   });
 
   // Reading an encrypted key with a passphrase that exceeds OpenSSL's buffer
@@ -807,10 +797,10 @@ for (const info of [
     key: privateDsa,
     format: 'pem',
     passphrase: Buffer.alloc(1025, 'a')
-  }), hasOpenSSL(3) ? { name: 'Error' } : {
+  }), isBoringSSL ? {
     code: 'ERR_OSSL_PEM_BAD_PASSWORD_READ',
     name: 'Error'
-  });
+  } : { name: 'Error' });
 
   // The buffer has a size of 1024 bytes, so this passphrase should be permitted
   // (but will fail decryption).

test/parallel/test-crypto-key-store-pkcs11.js

@@ -3,9 +3,9 @@
 const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
-const { hasOpenSSL } = require('../common/crypto');
-if (!hasOpenSSL(3, 0))
-  common.skip('requires OpenSSL 3.x');
+const { isBoringSSL } = require('../common/crypto');
+if (isBoringSSL)
+  common.skip('OpenSSL provider support is required');
 
 // The PKCS#11 token, the OpenSSL configuration that activates a provider for
 // it, and the PIN that unlocks it are all provided by the environment. See

test/parallel/test-crypto-key-store.js

@@ -2,9 +2,9 @@
 const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
-const { hasFIPS, hasOpenSSL } = require('../common/crypto');
-if (!hasOpenSSL(3))
-  common.skip('requires OpenSSL 3.x');
+const { hasFIPS, hasOpenSSL, isBoringSSL } = require('../common/crypto');
+if (isBoringSSL)
+  common.skip('OpenSSL provider support is required');
 
 // Verifies that crypto.createPrivateKey() can pass a WHATWG URL (here a file:
 // URI) to an OpenSSL STORE loader, and that the resulting KeyObject works for

test/parallel/test-crypto-keygen-async-dsa-key-object.js

@@ -4,7 +4,7 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { isBoringSSL, hasOpenSSL } = require('../common/crypto');
+const { isBoringSSL } = require('../common/crypto');
 
 if (isBoringSSL)
   common.skip('not supported by BoringSSL');
@@ -17,20 +17,20 @@ const {
 // Test async DSA key object generation.
 {
   generateKeyPair('dsa', {
-    modulusLength: hasOpenSSL(3) ? 2048 : 512,
+    modulusLength: 2048,
     divisorLength: 256
   }, common.mustSucceed((publicKey, privateKey) => {
     assert.strictEqual(publicKey.type, 'public');
     assert.strictEqual(publicKey.asymmetricKeyType, 'dsa');
     assert.deepStrictEqual(publicKey.asymmetricKeyDetails, {
-      modulusLength: hasOpenSSL(3) ? 2048 : 512,
+      modulusLength: 2048,
       divisorLength: 256
     });
 
     assert.strictEqual(privateKey.type, 'private');
     assert.strictEqual(privateKey.asymmetricKeyType, 'dsa');
     assert.deepStrictEqual(privateKey.asymmetricKeyDetails, {
-      modulusLength: hasOpenSSL(3) ? 2048 : 512,
+      modulusLength: 2048,
       divisorLength: 256
     });
   }));

test/parallel/test-crypto-keygen-async-dsa.js

@@ -9,7 +9,6 @@ const {
   assertApproximateSize,
   testSignVerify,
   spkiExp,
-  hasOpenSSL,
 } = require('../common/crypto');
 
 if (isBoringSSL)
@@ -19,7 +18,6 @@ const assert = require('assert');
 const {
   generateKeyPair,
 } = require('crypto');
-
 // Test async DSA key generation.
 {
   const privateKeyEncoding = {
@@ -28,7 +26,7 @@ const {
   };
 
   generateKeyPair('dsa', {
-    modulusLength: hasOpenSSL(3) ? 2048 : 512,
+    modulusLength: 2048,
     divisorLength: 256,
     publicKeyEncoding: {
       type: 'spki',
@@ -45,8 +43,8 @@ const {
     // The private key is DER-encoded.
     assert(Buffer.isBuffer(privateKeyDER));
 
-    assertApproximateSize(publicKey, hasOpenSSL(3) ? 1194 : 440);
-    assertApproximateSize(privateKeyDER, hasOpenSSL(3) ? 721 : 336);
+    assertApproximateSize(publicKey, 1194);
+    assertApproximateSize(privateKeyDER, 721);
 
     // Since the private key is encrypted, signing shouldn't work anymore.
     assert.throws(() => {

test/parallel/test-crypto-keygen-async-explicit-elliptic-curve-encrypted-p256.js

@@ -9,7 +9,6 @@ const {
   testSignVerify,
   spkiExp,
   pkcs8EncExp,
-  hasOpenSSL,
 } = require('../common/crypto');
 
 if (isBoringSSL)
@@ -19,7 +18,6 @@ const assert = require('assert');
 const {
   generateKeyPair,
 } = require('crypto');
-
 // Test async elliptic curve key generation, e.g. for ECDSA, with an encrypted
 // private key with paramEncoding explicit.
 {
@@ -44,13 +42,9 @@ const {
 
     // Since the private key is encrypted, signing shouldn't work anymore.
     assert.throws(() => testSignVerify(publicKey, privateKey),
-                  hasOpenSSL(3) ? {
+                  {
                     message: 'error:07880109:common libcrypto ' +
                              'routines::interrupted or cancelled'
-                  } : {
-                    name: 'TypeError',
-                    code: 'ERR_MISSING_PASSPHRASE',
-                    message: 'Passphrase required for encrypted key'
                   });
 
     testSignVerify(publicKey, {

test/parallel/test-crypto-keygen-async-explicit-elliptic-curve-encrypted.js.js

@@ -10,7 +10,6 @@ const {
   testSignVerify,
   spkiExp,
   sec1EncExp,
-  hasOpenSSL,
 } = require('../common/crypto');
 
 if (isBoringSSL)
@@ -50,13 +49,9 @@ const {
 
     // Since the private key is encrypted, signing shouldn't work anymore.
     assert.throws(() => testSignVerify(publicKey, privateKey),
-                  hasOpenSSL(3) ? {
+                  {
                     message: 'error:07880109:common libcrypto ' +
                              'routines::interrupted or cancelled'
-                  } : {
-                    name: 'TypeError',
-                    code: 'ERR_MISSING_PASSPHRASE',
-                    message: 'Passphrase required for encrypted key'
                   });
 
     testSignVerify(publicKey, { key: privateKey, passphrase: 'secret' });

test/parallel/test-crypto-keygen-async-named-elliptic-curve-encrypted-p256.js

@@ -12,7 +12,7 @@ const {
   testSignVerify,
   spkiExp,
   pkcs8EncExp,
-  hasOpenSSL,
+  isBoringSSL,
 } = require('../common/crypto');
 
 // Test async elliptic curve key generation, e.g. for ECDSA, with an encrypted
@@ -39,13 +39,13 @@ const {
 
     // Since the private key is encrypted, signing shouldn't work anymore.
     assert.throws(() => testSignVerify(publicKey, privateKey),
-                  hasOpenSSL(3) ? {
-                    message: 'error:07880109:common libcrypto ' +
-                             'routines::interrupted or cancelled'
-                  } : {
+                  isBoringSSL ? {
                     name: 'TypeError',
                     code: 'ERR_MISSING_PASSPHRASE',
                     message: 'Passphrase required for encrypted key'
+                  } : {
+                    message: 'error:07880109:common libcrypto ' +
+                             'routines::interrupted or cancelled'
                   });
 
     testSignVerify(publicKey, {

test/parallel/test-crypto-keygen-async-named-elliptic-curve-encrypted.js

@@ -13,7 +13,7 @@ const {
   testSignVerify,
   spkiExp,
   sec1EncExp,
-  hasOpenSSL,
+  isBoringSSL,
 } = require('../common/crypto');
 
 {
@@ -45,13 +45,13 @@ const {
 
     // Since the private key is encrypted, signing shouldn't work anymore.
     assert.throws(() => testSignVerify(publicKey, privateKey),
-                  hasOpenSSL(3) ? {
-                    message: 'error:07880109:common libcrypto ' +
-                             'routines::interrupted or cancelled'
-                  } : {
+                  isBoringSSL ? {
                     name: 'TypeError',
                     code: 'ERR_MISSING_PASSPHRASE',
                     message: 'Passphrase required for encrypted key'
+                  } : {
+                    message: 'error:07880109:common libcrypto ' +
+                             'routines::interrupted or cancelled'
                   });
 
     testSignVerify(publicKey, { key: privateKey, passphrase: 'secret' });

test/parallel/test-crypto-keygen-async-rsa.js

@@ -14,7 +14,7 @@ const {
   testEncryptDecrypt,
   testSignVerify,
   pkcs1EncExp,
-  hasOpenSSL,
+  isBoringSSL,
 } = require('../common/crypto');
 
 // Test async RSA key generation with an encrypted private key.
@@ -51,14 +51,14 @@ const {
       type: 'pkcs1',
       format: 'der',
     };
-    const expectedError = hasOpenSSL(3) ? {
-      name: 'Error',
-      message: 'error:07880109:common libcrypto routines::interrupted or ' +
-               'cancelled'
-    } : {
+    const expectedError = isBoringSSL ? {
       name: 'TypeError',
       code: 'ERR_MISSING_PASSPHRASE',
       message: 'Passphrase required for encrypted key'
+    } : {
+      name: 'Error',
+      message: 'error:07880109:common libcrypto routines::interrupted or ' +
+               'cancelled'
     };
     assert.throws(() => testSignVerify(publicKey, privateKey), expectedError);
 

test/parallel/test-crypto-keygen-bit-length.js

@@ -6,7 +6,6 @@ if (!common.hasCrypto)
 
 const {
   isBoringSSL,
-  hasOpenSSL,
   hasFIPS,
 } = require('../common/crypto');
 
@@ -18,7 +17,6 @@ const assert = require('assert');
 const {
   generateKeyPair,
 } = require('crypto');
-
 const fips3 = hasFIPS(3);
 
 // This tests check that generateKeyPair returns correct bit length in
@@ -49,18 +47,16 @@ const fips3 = hasFIPS(3);
     assert.strictEqual(publicKey.asymmetricKeyDetails.modulusLength, 513);
   }));
 
-  if (hasOpenSSL(3)) {
-    generateKeyPair('dsa', {
-      modulusLength: 2049,
-      divisorLength: 256,
-    }, common.mustCall((err, publicKey, privateKey) => {
-      if (fips3) {
-        assert.strictEqual(err?.code, 'ERR_OSSL_DSA_BAD_FFC_PARAMETERS');
-        return;
-      }
-      assert.ifError(err);
-      assert.strictEqual(privateKey.asymmetricKeyDetails.modulusLength, 2049);
-      assert.strictEqual(publicKey.asymmetricKeyDetails.modulusLength, 2049);
-    }));
-  }
+  generateKeyPair('dsa', {
+    modulusLength: 2049,
+    divisorLength: 256,
+  }, common.mustCall((err, publicKey, privateKey) => {
+    if (fips3) {
+      assert.strictEqual(err?.code, 'ERR_OSSL_DSA_BAD_FFC_PARAMETERS');
+      return;
+    }
+    assert.ifError(err);
+    assert.strictEqual(privateKey.asymmetricKeyDetails.modulusLength, 2049);
+    assert.strictEqual(publicKey.asymmetricKeyDetails.modulusLength, 2049);
+  }));
 }

test/parallel/test-crypto-keygen-empty-passphrase-no-prompt.js

@@ -12,7 +12,7 @@ const {
 const {
   hasFIPS,
   testSignVerify,
-  hasOpenSSL,
+  isBoringSSL,
 } = require('../common/crypto');
 
 const fips4 = hasFIPS(4);
@@ -56,14 +56,14 @@ for (const type of ['pkcs1', 'pkcs8']) {
     // the key, and not specifying a passphrase should fail when decoding it.
     assert.throws(() => {
       return testSignVerify(publicKey, privateKey);
-    }, hasOpenSSL(3) ? {
-      name: 'Error',
-      code: 'ERR_OSSL_CRYPTO_INTERRUPTED_OR_CANCELLED',
-      message: 'error:07880109:common libcrypto routines::interrupted or cancelled'
-    } : {
+    }, isBoringSSL ? {
       name: 'TypeError',
       code: 'ERR_MISSING_PASSPHRASE',
       message: 'Passphrase required for encrypted key'
+    } : {
+      name: 'Error',
+      code: 'ERR_OSSL_CRYPTO_INTERRUPTED_OR_CANCELLED',
+      message: 'error:07880109:common libcrypto routines::interrupted or cancelled'
     });
   }));
 }

test/parallel/test-crypto-keygen-missing-oid.js

@@ -11,36 +11,34 @@ const {
   getCurves,
 } = require('crypto');
 
-const { hasOpenSSL, hasFIPS } = require('../common/crypto');
+const { hasFIPS, isBoringSSL } = require('../common/crypto');
 
 // This test creates EC key pairs on curves without associated OIDs.
 // Specifying a key encoding should not crash.
 {
-  if (process.versions.openssl >= '1.1.1i') {
-    for (const namedCurve of ['Oakley-EC2N-3', 'Oakley-EC2N-4']) {
-      if (!getCurves().includes(namedCurve))
-        continue;
+  for (const namedCurve of ['Oakley-EC2N-3', 'Oakley-EC2N-4']) {
+    if (!getCurves().includes(namedCurve))
+      continue;
 
-      const expectedErrorCode =
-        hasFIPS(3) ? 'ERR_OSSL_EC_UNKNOWN_GROUP' :
-          hasOpenSSL(3) ? 'ERR_OSSL_MISSING_OID' : 'ERR_OSSL_EC_MISSING_OID';
-      const params = {
-        namedCurve,
-        publicKeyEncoding: {
-          format: 'der',
-          type: 'spki'
-        }
-      };
+    const expectedErrorCode =
+      hasFIPS(3) ? 'ERR_OSSL_EC_UNKNOWN_GROUP' :
+        isBoringSSL ? 'ERR_OSSL_EC_MISSING_OID' : 'ERR_OSSL_MISSING_OID';
+    const params = {
+      namedCurve,
+      publicKeyEncoding: {
+        format: 'der',
+        type: 'spki'
+      }
+    };
 
-      assert.throws(() => {
-        generateKeyPairSync('ec', params);
-      }, {
-        code: expectedErrorCode
-      });
+    assert.throws(() => {
+      generateKeyPairSync('ec', params);
+    }, {
+      code: expectedErrorCode
+    });
 
-      generateKeyPair('ec', params, common.mustCall((err) => {
-        assert.strictEqual(err.code, expectedErrorCode);
-      }));
-    }
+    generateKeyPair('ec', params, common.mustCall((err) => {
+      assert.strictEqual(err.code, expectedErrorCode);
+    }));
   }
 }

test/parallel/test-crypto-keygen.js

@@ -14,11 +14,7 @@ const {
 } = require('crypto');
 const { inspect } = require('util');
 
-const {
-  hasOpenSSL,
-  isBoringSSL: commonIsBoringSSL,
-} = require('../common/crypto');
-const isBoringSSL = commonIsBoringSSL;
+const { isBoringSSL } = require('../common/crypto');
 
 // Test invalid parameter encoding.
 {
@@ -379,12 +375,7 @@ const isBoringSSL = commonIsBoringSSL;
   }
 
   // Test invalid exponents. (caught by OpenSSL)
-  let invalidExponentError = /bad e value/;
-  if (isBoringSSL) {
-    invalidExponentError = /BAD_E_VALUE/;
-  } else if (hasOpenSSL(3)) {
-    invalidExponentError = /exponent/;
-  }
+  const invalidExponentError = isBoringSSL ? /BAD_E_VALUE/ : /exponent/;
   for (const publicExponent of [1, 1 + 0x10001]) {
     generateKeyPair('rsa', {
       modulusLength: 4096,

test/parallel/test-crypto-mac-errors.js

@@ -6,10 +6,10 @@ if (!common.hasCrypto) {
   common.skip('missing crypto');
 }
 
-const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
+const { isBoringSSL } = require('../common/crypto');
 
-if (!hasOpenSSL(3) || isBoringSSL) {
-  common.skip('OpenSSL 3 EVP_MAC support is required');
+if (isBoringSSL) {
+  common.skip('OpenSSL EVP_MAC support is required');
 }
 
 const assert = require('node:assert');

test/parallel/test-crypto-mac-unsupported.js

@@ -6,9 +6,9 @@ if (!common.hasCrypto) {
   common.skip('missing crypto');
 }
 
-const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
+const { isBoringSSL } = require('../common/crypto');
 
-if (hasOpenSSL(3) && !isBoringSSL) {
+if (!isBoringSSL) {
   common.skip('this test requires a build without EVP_MAC support');
 }
 

test/parallel/test-crypto-mac-vectors.js

@@ -8,10 +8,10 @@ if (!common.hasCrypto) {
   common.skip('missing crypto');
 }
 
-const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
+const { isBoringSSL } = require('../common/crypto');
 
-if (!hasOpenSSL(3) || isBoringSSL) {
-  common.skip('OpenSSL 3 EVP_MAC support is required');
+if (isBoringSSL) {
+  common.skip('OpenSSL EVP_MAC support is required');
 }
 
 const assert = require('node:assert');

test/parallel/test-crypto-mac.js

@@ -8,10 +8,10 @@ if (!common.hasCrypto) {
   common.skip('missing crypto');
 }
 
-const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
+const { isBoringSSL } = require('../common/crypto');
 
-if (!hasOpenSSL(3) || isBoringSSL) {
-  common.skip('OpenSSL 3 EVP_MAC support is required');
+if (isBoringSSL) {
+  common.skip('OpenSSL EVP_MAC support is required');
 }
 
 const assert = require('node:assert');

test/parallel/test-crypto-negative-zero.js

@@ -6,7 +6,7 @@ if (!common.hasCrypto)
 
 const assert = require('assert');
 const crypto = require('crypto');
-const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
+const { isBoringSSL } = require('../common/crypto');
 
 function getOutcome(fn) {
   try {
@@ -88,9 +88,9 @@ function assertSameErrorOrSuccess(actual, expected) {
     );
   }
 
-  if (!hasOpenSSL(3)) {
+  if (isBoringSSL) {
     common.printSkipMessage(
-      'Skipping DSA divisorLength 0 key generation on OpenSSL 1.1.1');
+      'BoringSSL does not support DSA key pair generation');
   } else {
     assertSameErrorOrSuccess(
       getOutcome(() => crypto.generateKeyPairSync('dsa', {

test/parallel/test-crypto-no-algorithm.js

@@ -4,10 +4,10 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL } = require('../common/crypto');
+const { isBoringSSL } = require('../common/crypto');
 
-if (!hasOpenSSL(3))
-  common.skip('this test requires OpenSSL 3.x');
+if (isBoringSSL)
+  common.skip('this test requires OpenSSL');
 
 const assert = require('node:assert/strict');
 const crypto = require('node:crypto');

test/parallel/test-crypto-padding.js

@@ -26,7 +26,7 @@ if (!common.hasCrypto)
 
 const assert = require('assert');
 const crypto = require('crypto');
-const { hasOpenSSL } = require('../common/crypto');
+const { isBoringSSL } = require('../common/crypto');
 
 // Input data.
 const ODD_LENGTH_PLAIN = 'Hello node world!';
@@ -83,14 +83,14 @@ assert.strictEqual(enc(EVEN_LENGTH_PLAIN, true), EVEN_LENGTH_ENCRYPTED);
 assert.throws(function() {
   // Input must have block length %.
   enc(ODD_LENGTH_PLAIN, false);
-}, hasOpenSSL(3) ? {
-  message: /wrong[\s_]final[\s_]block[\s_]length/i,
-  code: /ERR_OSSL(_EVP)?_WRONG_FINAL_BLOCK_LENGTH/,
-  reason: /wrong[\s_]final[\s_]block[\s_]length/i,
-} : {
+}, isBoringSSL ? {
   message: /data[\s_]not[\s_]multiple[\s_]of[\s_]block[\s_]length/i,
   code: /ERR_OSSL(_EVP)?_DATA_NOT_MULTIPLE_OF_BLOCK_LENGTH/,
   reason: /data[\s_]not[\s_]multiple[\s_]of[\s_]block[\s_]length/i,
+} : {
+  message: /wrong[\s_]final[\s_]block[\s_]length/i,
+  code: /ERR_OSSL(_EVP)?_WRONG_FINAL_BLOCK_LENGTH/,
+  reason: /wrong[\s_]final[\s_]block[\s_]length/i,
 }
 );
 

test/parallel/test-crypto-pbkdf2.js

@@ -6,8 +6,8 @@ if (!common.hasCrypto)
 const assert = require('assert');
 const crypto = require('crypto');
 const {
-  hasOpenSSL,
   hasFIPS,
+  isBoringSSL,
 } = require('../common/crypto');
 
 const fips4 = hasFIPS(4);
@@ -335,7 +335,7 @@ assert.throws(
   }
 );
 
-if (!hasOpenSSL(3)) {
+if (isBoringSSL) {
   const kNotPBKDF2Supported = ['shake128', 'shake256'];
   crypto.getHashes()
     .filter((hash) => !kNotPBKDF2Supported.includes(hash))

test/parallel/test-crypto-pkcs12.js

@@ -5,7 +5,7 @@ if (!common.hasCrypto) common.skip('missing crypto');
 const assert = require('assert');
 const crypto = require('crypto');
 const fixtures = require('../common/fixtures');
-const { hasOpenSSL3, hasFIPS } = require('../common/crypto');
+const { hasFIPS, isBoringSSL } = require('../common/crypto');
 
 const fips3 = hasFIPS(3);
 
@@ -140,7 +140,7 @@ if (!fips3) {
   assert.ok(additionalCertificates[0] instanceof crypto.X509Certificate);
 }
 
-if (hasOpenSSL3) {
+if (!isBoringSSL) {
   // Legacy algorithms (RC2-40-CBC) throw a recognizable, actionable error
   // rather than a bare OpenSSL string. Mirrors the behavior added for the
   // TLS path in https://github.com/nodejs/node/pull/54485.

test/parallel/test-crypto-pqc-key-objects-ml-dsa.js

@@ -102,12 +102,12 @@ for (const [asymmetricKeyType, pubLen] of [
 
   if (!hasOpenSSL(3, 5) && !isBoringSSL) {
     assert.throws(() => createPublicKey(keys.public), {
-      code: hasOpenSSL(3) ? 'ERR_OSSL_EVP_DECODE_ERROR' : 'ERR_OSSL_EVP_UNSUPPORTED_ALGORITHM',
+      code: 'ERR_OSSL_EVP_DECODE_ERROR',
     });
 
     for (const pem of [keys.private, keys.private_seed_only, keys.private_priv_only]) {
       assert.throws(() => createPrivateKey(pem), {
-        code: hasOpenSSL(3) ? 'ERR_OSSL_UNSUPPORTED' : 'ERR_OSSL_EVP_UNSUPPORTED_ALGORITHM',
+        code: 'ERR_OSSL_UNSUPPORTED',
       });
     }
   } else {

test/parallel/test-crypto-pqc-key-objects-ml-kem.js

@@ -102,12 +102,12 @@ for (const [asymmetricKeyType, pubLen] of [
 
   if (!hasOpenSSL(3, 5) && !isBoringSSL) {
     assert.throws(() => createPublicKey(keys.public), {
-      code: hasOpenSSL(3) ? 'ERR_OSSL_EVP_DECODE_ERROR' : 'ERR_OSSL_EVP_UNSUPPORTED_ALGORITHM',
+      code: 'ERR_OSSL_EVP_DECODE_ERROR',
     });
 
     for (const pem of [keys.private, keys.private_seed_only, keys.private_priv_only]) {
       assert.throws(() => createPrivateKey(pem), {
-        code: hasOpenSSL(3) ? 'ERR_OSSL_UNSUPPORTED' : 'ERR_OSSL_EVP_UNSUPPORTED_ALGORITHM',
+        code: 'ERR_OSSL_UNSUPPORTED',
       });
     }
   } else if (isBoringSSL && asymmetricKeyType === 'ml-kem-512') {

test/parallel/test-crypto-pqc-key-objects-slh-dsa.js

@@ -4,7 +4,7 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 
 const assert = require('assert');
 const {
@@ -101,11 +101,11 @@ for (const asymmetricKeyType of [
 
   if (!hasOpenSSL(3, 5)) {
     assert.throws(() => createPublicKey(keys.public), {
-      code: hasOpenSSL(3) ? 'ERR_OSSL_EVP_DECODE_ERROR' : 'ERR_OSSL_EVP_UNSUPPORTED_ALGORITHM',
+      code: isBoringSSL ? 'ERR_OSSL_EVP_UNSUPPORTED_ALGORITHM' : 'ERR_OSSL_EVP_DECODE_ERROR',
     });
 
     assert.throws(() => createPrivateKey(keys.private), {
-      code: hasOpenSSL(3) ? 'ERR_OSSL_UNSUPPORTED' : 'ERR_OSSL_EVP_UNSUPPORTED_ALGORITHM',
+      code: isBoringSSL ? 'ERR_OSSL_EVP_UNSUPPORTED_ALGORITHM' : 'ERR_OSSL_UNSUPPORTED',
     });
   } else {
     const publicKey = createPublicKey(keys.public);

test/parallel/test-crypto-prime.js

@@ -5,6 +5,7 @@ if (!common.hasCrypto)
   common.skip('missing crypto');
 
 const assert = require('assert');
+const { isBoringSSL } = require('../common/crypto');
 
 const {
   generatePrime,
@@ -165,7 +166,7 @@ generatePrime(
   // The behavior when specifying only add without rem should depend on the
   // safe option.
 
-  if (process.versions.openssl >= '1.1.1f') {
+  if (!isBoringSSL) {
     generatePrime(128, {
       bigint: true,
       add: 5n
@@ -215,7 +216,7 @@ generatePrime(
     code: 'ERR_OUT_OF_RANGE'
   });
 
-  if (process.versions.openssl >= '1.1.1f') {
+  if (!isBoringSSL) {
     // This is possible and allowed (but makes little sense).
     assert.strictEqual(generatePrimeSync(4, {
       add: 15n,

test/parallel/test-crypto-private-decrypt-gh32240.js

@@ -15,8 +15,8 @@ const {
 } = require('crypto');
 
 const {
-  hasOpenSSL,
   hasFIPS,
+  isBoringSSL,
 } = require('../common/crypto');
 
 const fips3 = hasFIPS(3);
@@ -64,8 +64,8 @@ function decrypt(key) {
 }
 
 decrypt(pkey);
-assert.throws(() => decrypt(pkeyEncrypted), hasOpenSSL(3) ?
+assert.throws(() => decrypt(pkeyEncrypted), isBoringSSL ?
+  { code: 'ERR_MISSING_PASSPHRASE' } :
   { message: 'error:07880109:common libcrypto routines::interrupted or ' +
-             'cancelled' } :
-  { code: 'ERR_MISSING_PASSPHRASE' });
+             'cancelled' });
 decrypt(pkey);  // Should not throw.

test/parallel/test-crypto-provider-cache-snapshot.js

@@ -5,13 +5,13 @@ if (!common.hasCrypto)
   common.skip('missing crypto');
 
 const assert = require('node:assert');
-const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
+const { isBoringSSL } = require('../common/crypto');
 const fixtures = require('../common/fixtures');
 const tmpdir = require('../common/tmpdir');
 const { buildSnapshot, runWithSnapshot } = require('../common/snapshot');
 
-if (!hasOpenSSL(3) || isBoringSSL)
-  common.skip('this test requires OpenSSL 3.x');
+if (isBoringSSL)
+  common.skip('OpenSSL provider support is required');
 
 const entry = fixtures.path('snapshot', 'crypto-provider-cache.js');
 const buildEnv = {

test/parallel/test-crypto-provider-cache.js

@@ -5,9 +5,9 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
-if (!hasOpenSSL(3) || isBoringSSL)
-  common.skip('this test requires OpenSSL 3 provider support');
+const { isBoringSSL } = require('../common/crypto');
+if (isBoringSSL)
+  common.skip('this test requires OpenSSL provider support');
 
 const assert = require('node:assert');
 const crypto = require('node:crypto');

test/parallel/test-crypto-provider-hash-options.js

@@ -11,7 +11,7 @@ if (!common.hasCrypto) {
 
 if (Number(process.versions.openssl.split('.')[0]) < 4 ||
     isBoringSSL) {
-  common.skip('OpenSSL 4 provider support is required');
+  common.skip('OpenSSL 4.0 or later is required');
 }
 
 const assert = require('node:assert');

test/parallel/test-crypto-provider-hashes.js

@@ -26,10 +26,10 @@ const {
   sign,
   verify,
 } = require('node:crypto');
-const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
+const { isBoringSSL } = require('../common/crypto');
 
-if (!hasOpenSSL(3) || isBoringSSL) {
-  common.skip('OpenSSL 3 provider support is required');
+if (isBoringSSL) {
+  common.skip('OpenSSL provider support is required');
 }
 
 const { internalBinding } = require('internal/test/binding');

test/parallel/test-crypto-publicDecrypt-fails-first-time.js

@@ -7,10 +7,10 @@ if (!common.hasCrypto) {
   common.skip('missing crypto');
 }
 
-const { hasOpenSSL } = require('../common/crypto');
+const { isBoringSSL } = require('../common/crypto');
 
-if (!hasOpenSSL(3)) {
-  common.skip('only openssl3'); // https://github.com/nodejs/node/pull/42793#issuecomment-1107491901
+if (isBoringSSL) {
+  common.skip('this test is not supported with BoringSSL'); // https://github.com/nodejs/node/pull/42793#issuecomment-1107491901
 }
 
 const assert = require('assert');

test/parallel/test-crypto-rsa-dsa.js

@@ -16,9 +16,7 @@ const {
 } = require('../common/crypto');
 const fips3 = hasFIPS(3);
 const fips35 = hasFIPS(3, 5);
-const fips30 = fips3 && !fips35;
 const fips4 = hasFIPS(4);
-const fipsDigestErrorCode = 'ERR_OSSL_DIGEST_NOT_ALLOWED';
 const wrongPassphrase = 'wrong-password';
 
 // Test certificates
@@ -40,34 +38,25 @@ const dsaPkcs8KeyPem = fixtures.readKey('dsa_private_pkcs8.pem');
 
 const ec = new TextEncoder();
 
-const openssl1DecryptError = {
-  message: 'error:06065064:digital envelope routines:EVP_DecryptFinal_ex:' +
-    'bad decrypt',
-  code: 'ERR_OSSL_EVP_BAD_DECRYPT',
-  reason: 'bad decrypt',
-  function: 'EVP_DecryptFinal_ex',
-  library: 'digital envelope routines',
-};
-
 const decryptError = fips4 ?
-  { code: 'ERR_OSSL_BAD_DECRYPT' } : hasOpenSSL(3) ?
-    { message: 'error:1C800064:Provider routines::bad decrypt' } :
-    isBoringSSL ? {
-      message: 'error:1e000065:Cipher functions:OPENSSL_internal:BAD_DECRYPT',
-      code: 'ERR_OSSL_BAD_DECRYPT',
-      reason: 'BAD_DECRYPT',
-      function: 'OPENSSL_internal',
-      library: 'Cipher functions',
-    } :
-      openssl1DecryptError;
+  { code: 'ERR_OSSL_BAD_DECRYPT' } :
+  isBoringSSL ? {
+    message: 'error:1e000065:Cipher functions:OPENSSL_internal:BAD_DECRYPT',
+    code: 'ERR_OSSL_BAD_DECRYPT',
+    reason: 'BAD_DECRYPT',
+    function: 'OPENSSL_internal',
+    library: 'Cipher functions',
+  } : {
+    message: 'error:1C800064:Provider routines::bad decrypt',
+  };
 
 const decryptPrivateKeyError = fips4 ? {
   code: 'ERR_OSSL_BAD_DECRYPT',
-} : hasOpenSSL(3) ? {
-  message: 'error:1C800064:Provider routines::bad decrypt',
 } : isBoringSSL ? {
   message: 'error:1e000065:Cipher functions:OPENSSL_internal:BAD_DECRYPT',
-} : openssl1DecryptError;
+} : {
+  message: 'error:1C800064:Provider routines::bad decrypt',
+};
 
 function getBufferCopy(buf) {
   return buf.buffer.slice(buf.byteOffset, buf.byteOffset + buf.byteLength);
@@ -168,10 +157,8 @@ function getBufferCopy(buf) {
   }, encryptedBuffer);
   assert.strictEqual(decryptedBufferWithPassword.toString(), input);
 
-  // Now with RSA_NO_PADDING. Plaintext needs to match key size.
-  // OpenSSL 3.x has a rsa_check_padding that will cause an error if
-  // RSA_NO_PADDING is used.
-  if (!hasOpenSSL(3)) {
+  // BoringSSL does not apply OpenSSL's rsa_check_padding validation here.
+  if (isBoringSSL) {
     {
       const plaintext = 'x'.repeat(rsaKeySize / 8);
       encryptedBuffer = crypto.privateEncrypt({
@@ -541,21 +528,6 @@ if (!isBoringSSL) {
 
   assert.strictEqual(verify.verify(dsaPubPem, signature, 'hex'), true);
 
-  // Test the legacy 'DSS1' name.
-  const sign2 = crypto.createSign('DSS1');
-  sign2.update(input);
-  if (fips30) {
-    assert.throws(() => sign2.sign(dsaKeyPem, 'hex'), {
-      code: fipsDigestErrorCode,
-    });
-  } else {
-    const signature2 = sign2.sign(dsaKeyPem, 'hex');
-
-    const verify2 = crypto.createVerify('DSS1');
-    verify2.update(input);
-
-    assert.strictEqual(verify2.verify(dsaPubPem, signature2, 'hex'), true);
-  }
 } else {
   common.printSkipMessage('Skipping unsupported DSA test case');
 }

test/parallel/test-crypto-rsa-multiprime-jwk.js

@@ -6,13 +6,13 @@ if (!common.hasCrypto)
 
 const assert = require('assert');
 const fixtures = require('../common/fixtures');
-const { hasFIPS } = require('../common/crypto');
+const { hasFIPS, isBoringSSL } = require('../common/crypto');
 const {
   createPrivateKey,
 } = require('crypto');
 const { subtle } = globalThis.crypto;
 
-if (process.features.openssl_is_boringssl)
+if (isBoringSSL)
   common.skip('multi-prime RSA is not available with BoringSSL');
 if (hasFIPS())
   common.skip('multi-prime RSA is not available in FIPS mode');

test/parallel/test-crypto-rsa-pss-parameters.js

@@ -2,9 +2,9 @@
 
 const common = require('../common');
 if (!common.hasCrypto) common.skip('missing crypto');
-const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
-if (!hasOpenSSL(3) || isBoringSSL)
-  common.skip('requires OpenSSL 3 provider support');
+const { isBoringSSL } = require('../common/crypto');
+if (isBoringSSL)
+  common.skip('requires OpenSSL provider support');
 
 const assert = require('assert');
 const fixtures = require('../common/fixtures');

test/parallel/test-crypto-sec-level.js

@@ -13,7 +13,7 @@ const assert = require('assert');
 // are available by default. Different OpenSSL versions have different
 // default security levels and we use this value to adjust what a test
 // expects based on the security level. You can read more in
-// https://docs.openssl.org/1.1.1/man3/SSL_CTX_set_security_level/#default-callback-behaviour
+// https://docs.openssl.org/3.0/man3/SSL_CTX_set_security_level/#default-callback-behaviour
 // This test simply validates that we can get some value for the secLevel
 // when needed by tests.
 const secLevel = require('internal/crypto/util').getOpenSSLSecLevel();

test/parallel/test-crypto-secure-heap.js

@@ -19,7 +19,6 @@ if (common.hasV8Sandbox) {
 
 const {
   isBoringSSL,
-  hasOpenSSL,
   hasFIPS,
 } = require('../common/crypto');
 
@@ -33,7 +32,6 @@ const fixtures = require('../common/fixtures');
 const {
   secureHeapUsed,
   createDiffieHellman,
-  getFips,
 } = require('crypto');
 
 if (process.argv[2] === 'child') {
@@ -47,8 +45,7 @@ if (process.argv[2] === 'child') {
   assert.strictEqual(a.used, 0);
 
   {
-    const size = hasFIPS(3) ?
-      2048 : (getFips() === 1 || hasOpenSSL(3) ? 1024 : 256);
+    const size = hasFIPS(3) ? 2048 : 1024;
     const dh1 = createDiffieHellman(size);
     const p1 = dh1.getPrime('buffer');
     const dh2 = createDiffieHellman(p1, 'buffer');

test/parallel/test-crypto-sign-verify.js

@@ -79,11 +79,9 @@ if (fips30) {
         key: keyPem,
         padding: crypto.constants.RSA_PKCS1_OAEP_PADDING
       });
-  }, { message: hasOpenSSL(3) ?
-    'error:1C8000A5:Provider routines::illegal or unsupported padding mode' :
-    isBoringSSL ?
-      'error:0600006d:public key routines:OPENSSL_internal:ILLEGAL_OR_UNSUPPORTED_PADDING_MODE' :
-      'bye, bye, error stack' });
+  }, { message: isBoringSSL ?
+    'error:0600006d:public key routines:OPENSSL_internal:ILLEGAL_OR_UNSUPPORTED_PADDING_MODE' :
+    'error:1C8000A5:Provider routines::illegal or unsupported padding mode' });
 
   delete Object.prototype.opensslErrorStack;
 }
@@ -374,19 +372,12 @@ assert.throws(
         key: keyPem,
         padding: crypto.constants.RSA_PKCS1_OAEP_PADDING
       });
-  }, hasOpenSSL(3) ? {
-    code: 'ERR_OSSL_ILLEGAL_OR_UNSUPPORTED_PADDING_MODE',
-    message: /illegal or unsupported padding mode/,
-  } : isBoringSSL ? {
+  }, isBoringSSL ? {
     code: 'ERR_OSSL_EVP_ILLEGAL_OR_UNSUPPORTED_PADDING_MODE',
     message: /ILLEGAL_OR_UNSUPPORTED_PADDING_MODE/,
   } : {
-    code: 'ERR_OSSL_RSA_ILLEGAL_OR_UNSUPPORTED_PADDING_MODE',
+    code: 'ERR_OSSL_ILLEGAL_OR_UNSUPPORTED_PADDING_MODE',
     message: /illegal or unsupported padding mode/,
-    opensslErrorStack: [
-      'error:06089093:digital envelope routines:EVP_PKEY_CTX_ctrl:' +
-      'command not supported',
-    ],
   });
 }
 
@@ -682,7 +673,7 @@ if (hasOpenSSL(3, 2)) {
 
 // Preserve the current behavior from https://github.com/nodejs/node/issues/53761:
 // one-shot verify does not accept SM2 signatures produced by the streaming path.
-if (hasOpenSSL(3) && crypto.getHashes().includes('sm3')) {
+if (!isBoringSSL && crypto.getHashes().includes('sm3')) {
   const data = Buffer.from('AABB');
   const privateKey = crypto.createPrivateKey(`-----BEGIN PRIVATE KEY-----
 MIGHAgEAMBMGByqGSM49AgEGCCqBHM9VAYItBG0wawIBAQQgbjCNHopgvyGVfLaP

test/parallel/test-crypto-stream.js

@@ -28,7 +28,6 @@ if (!common.hasCrypto) {
 const assert = require('assert');
 const stream = require('stream');
 const crypto = require('crypto');
-const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 
 if (!crypto.getFips()) {
   // Small stream to buffer converter
@@ -73,15 +72,10 @@ const cipher = crypto.createCipheriv('aes-128-cbc', key, iv);
 const decipher = crypto.createDecipheriv('aes-128-cbc', badkey, iv);
 
 cipher.pipe(decipher)
-  .on('error', common.expectsError((hasOpenSSL(3) || isBoringSSL) ? {
+  .on('error', common.expectsError({
     message: /bad[\s_]decrypt/i,
     library: /Provider routines|Cipher functions/,
     reason: /bad[\s_]decrypt/i,
-  } : {
-    message: /bad[\s_]decrypt/i,
-    function: 'EVP_DecryptFinal_ex',
-    library: 'digital envelope routines',
-    reason: /bad[\s_]decrypt/i,
   }));
 
 cipher.end('Papaya!');  // Should not cause an unhandled exception.

test/parallel/test-crypto-x509.js

@@ -31,7 +31,7 @@ const ca = readFileSync(fixtures.path('keys', 'ca1-cert.pem'));
 const privateKey = createPrivateKey(key);
 
 if (!isBoringSSL) {
-  const expectedPubkeys = hasOpenSSL(3) ? [
+  const expectedPubkeys = [
     [
       'rsa_pss_cert_2048.pem',
       292,
@@ -42,17 +42,6 @@ if (!isBoringSSL) {
       342,
       'da0bcd53fbe3969c7cc2730f86abc34e0e1c340264bbdfa3faf01484c2eeece0',
     ],
-  ] : [
-    [
-      'rsa_pss_cert_2048.pem',
-      294,
-      '4d4f2f076aced4f0df922b84b466b0a60ba4cb50a23d695ae12ddc5fff7aca14',
-    ],
-    [
-      'rsa_pss_cert_2048_sha256_sha256_16.pem',
-      294,
-      'd37942c3bd02bc25c724fcd31efd647824e536c13d62d9ad0b5db8c0900d3cba',
-    ],
   ];
 
   for (const [name, length, digest] of expectedPubkeys) {
@@ -90,7 +79,7 @@ emailAddress=ry@tinyclouds.org`;
 
 let infoAccessCheck = `OCSP - URI:http://ocsp.nodejs.org/
 CA Issuers - URI:http://ca.nodejs.org/ca.cert`;
-if (!hasOpenSSL(3))
+if (isBoringSSL)
   infoAccessCheck += '\n';
 
 const der = Buffer.from(
@@ -519,7 +508,7 @@ UcXd/5qu2GhokrKU2cPttU+XAN2Om6a0
     assert.strictEqual(child.status, 0, child.stderr || child.stdout);
 
     assert.throws(() => cert.publicKey, {
-      message: hasOpenSSL(3) ? /decode error/ : /wrong tag/,
+      message: /decode error/,
       name: 'Error'
     });
 

test/parallel/test-crypto.js

@@ -29,7 +29,7 @@ const assert = require('assert');
 const crypto = require('crypto');
 const tls = require('tls');
 const fixtures = require('../common/fixtures');
-const { hasOpenSSL, hasFIPS, isBoringSSL } = require('../common/crypto');
+const { hasFIPS, isBoringSSL } = require('../common/crypto');
 const isFips = hasFIPS(3);
 
 // Test Certificates
@@ -244,25 +244,16 @@ assert.throws(() => {
     assert(Array.isArray(err.opensslErrorStack));
     assert(err.opensslErrorStack.length > 0);
   } else {
-    if (!hasOpenSSL(3))
-      assert.ok(!('opensslErrorStack' in err));
-    assert.throws(() => { throw err; }, hasOpenSSL(3) ? {
+    assert.throws(() => { throw err; }, {
       name: 'Error',
       message: 'error:02000070:rsa routines::digest too big for rsa key',
       library: 'rsa routines',
-    } : {
-      name: 'Error',
-      message: /routines:RSA_sign:digest too big for rsa key$/,
-      library: /rsa routines/i,
-      function: 'RSA_sign',
-      reason: /digest[\s_]too[\s_]big[\s_]for[\s_]rsa[\s_]key/i,
-      code: 'ERR_OSSL_RSA_DIGEST_TOO_BIG_FOR_RSA_KEY'
     });
   }
   return true;
 });
 
-if (!hasOpenSSL(3)) {
+if (isBoringSSL) {
   // The correct header inside `rsa_private_pkcs8_bad.pem` should have been
   // -----BEGIN PRIVATE KEY----- and -----END PRIVATE KEY-----
   // instead of
@@ -270,32 +261,10 @@ if (!hasOpenSSL(3)) {
   const sha1_privateKey = fixtures.readKey('rsa_private_pkcs8_bad.pem',
                                            'ascii');
 
-  if (isBoringSSL) {
-    // BoringSSL accepts the PKCS#8 payload despite the legacy PEM label.
-    const signature = crypto.createSign('sha1').sign(sha1_privateKey);
-    assert(Buffer.isBuffer(signature));
-    assert.strictEqual(signature.length, 256);
-  } else {
-    assert.throws(() => {
-      // This would inject errors onto OpenSSL's error stack
-      crypto.createSign('sha1').sign(sha1_privateKey);
-    }, (err) => {
-      // Do the standard checks, but then do some custom checks afterwards.
-      assert.throws(() => { throw err; }, {
-        message: 'error:0D0680A8:asn1 encoding routines:asn1_check_tlen:' +
-                 'wrong tag',
-        library: 'asn1 encoding routines',
-        function: 'asn1_check_tlen',
-        reason: 'wrong tag',
-        code: 'ERR_OSSL_ASN1_WRONG_TAG',
-      });
-      // Throws crypto error, so there is an opensslErrorStack property.
-      // The openSSL stack should have content.
-      assert(Array.isArray(err.opensslErrorStack));
-      assert(err.opensslErrorStack.length > 0);
-      return true;
-    });
-  }
+  // BoringSSL accepts the PKCS#8 payload despite the legacy PEM label.
+  const signature = crypto.createSign('sha1').sign(sha1_privateKey);
+  assert(Buffer.isBuffer(signature));
+  assert.strictEqual(signature.length, 256);
 }
 
 // Make sure memory isn't released before being returned

test/parallel/test-diagnostics-channel-crypto-fips-indicator.js

@@ -26,7 +26,7 @@ const channelName = 'crypto.fips.indicator';
 if (!hasOpenSSL(3, 4)) {
   common.skip('OpenSSL 3.4 or later is required');
 } else if (!hasFIPS(3, 4)) {
-  common.skip('an active OpenSSL 3.4+ FIPS provider is required');
+  common.skip('an active OpenSSL FIPS provider is required');
 } else if (!process.execArgv.includes('--enable-fips-indicator-events')) {
   spawnSyncAndExitWithoutError(
     process.execPath,

test/parallel/test-https-agent-session-eviction.js

@@ -84,7 +84,7 @@ function second(server, session) {
   // Offering the cached session to a server using another TLS version should
   // not prevent a fresh connection.
   req.on('response', common.mustCall(function(res) {
-    // The test is now complete for OpenSSL 1.1.0.
+    // The test is now complete.
     server.close();
   }));
 

test/parallel/test-https-selfsigned-no-keycertsign-no-crash.js

@@ -12,18 +12,9 @@ const fixtures = require('../common/fixtures');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const crypto = require('crypto');
-const { hasOpenSSL } = require('../common/crypto');
-
-// See #37990 for details on why this is problematic with FIPS.
-if (crypto.getFips() === 1 && !hasOpenSSL(3))
-  common.skip('Skipping as test uses non-fips compliant EC curve');
-
-// This test will fail for OpenSSL < 1.1.1h
-const minOpenSSL = 269488271;
-
-if (crypto.constants.OPENSSL_VERSION_NUMBER < minOpenSSL)
-  common.skip('OpenSSL < 1.1.1h');
+const { isBoringSSL } = require('../common/crypto');
+if (isBoringSSL)
+  common.skip('not supported by BoringSSL');
 
 const https = require('https');
 const path = require('path');

test/parallel/test-permission-openssl-store.js

@@ -4,9 +4,9 @@
 const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
-const { hasOpenSSL } = require('../common/crypto');
-if (!hasOpenSSL(3))
-  common.skip('requires OpenSSL 3.x');
+const { isBoringSSL } = require('../common/crypto');
+if (isBoringSSL)
+  common.skip('OpenSSL provider support is required');
 
 // Verifies the openssl.store permission: allowed when --allow-openssl-store is
 // set, can be dropped at runtime, and denied by default in a child process.

test/parallel/test-process-env-allowed-flags-are-documented.js

@@ -5,7 +5,7 @@ const common = require('../common');
 const assert = require('assert');
 const fs = require('fs');
 const path = require('path');
-const { hasOpenSSL } = require('../common/crypto');
+const { isBoringSSL } = require('../common/crypto');
 
 const rootDir = path.resolve(__dirname, '..', '..');
 const cliMd = path.join(rootDir, 'doc', 'api', 'cli.md');
@@ -44,7 +44,7 @@ for (const line of [...nodeOptionsLines, ...v8OptionsLines]) {
   }
 }
 
-if (!hasOpenSSL(3)) {
+if (isBoringSSL) {
   documented.delete('--openssl-legacy-provider');
   documented.delete('--openssl-shared-config');
 }
@@ -63,8 +63,8 @@ const conditionalOpts = [
     filter: (opt) => {
       return [
         '--openssl-config',
-        hasOpenSSL(3) ? '--openssl-legacy-provider' : '',
-        hasOpenSSL(3) ? '--openssl-shared-config' : '',
+        isBoringSSL ? '' : '--openssl-legacy-provider',
+        isBoringSSL ? '' : '--openssl-shared-config',
         '--tls-cipher-list',
         '--use-bundled-ca',
         '--use-openssl-ca',

test/parallel/test-process-versions.js

@@ -104,18 +104,14 @@ assert.match(
 assert.match(process.versions.modules, /^\d+$/);
 
 if (common.hasCrypto) {
-  const { hasOpenSSL } = require('../common/crypto');
   assert.match(process.versions.ncrypto, commonTemplate);
   if (process.config.variables.node_shared_openssl) {
     assert.ok(process.versions.openssl);
   } else {
-    const versionRegex = hasOpenSSL(3) ?
-      // The following also matches a development version of OpenSSL 3.x which
-      // can be in the format '3.0.0-alpha4-dev'. This can be handy when
-      // building and linking against the main development branch of OpenSSL.
-      /^\d+\.\d+\.\d+(?:[-+][a-z0-9]+)*$/ :
-      /^\d+\.\d+\.\d+[a-z]?(\+quic)?(-fips)?$/;
-    assert.match(process.versions.openssl, versionRegex);
+    // The following also matches a development version of OpenSSL, such as
+    // '3.0.0-alpha4-dev'. This can be handy when
+    // building and linking against the main development branch of OpenSSL.
+    assert.match(process.versions.openssl, /^\d+\.\d+\.\d+(?:[-+][a-z0-9]+)*$/);
   }
 }
 

test/parallel/test-tls-alert-handling.js

@@ -5,11 +5,6 @@ if (!common.hasCrypto) {
   common.skip('missing crypto');
 }
 
-const {
-  hasOpenSSL,
-  isBoringSSL,
-} = require('../common/crypto');
-
 const assert = require('assert');
 const net = require('net');
 const tls = require('tls');
@@ -39,8 +34,6 @@ const errorHandler = common.mustCall((err) => {
   assert.match(err.code,
                /ERR_SSL_(WRONG_VERSION_NUMBER|PACKET_LENGTH_TOO_LONG|BAD_RECORD_TYPE)/);
   assert.strictEqual(err.library, 'SSL routines');
-  if (!hasOpenSSL(3) && !isBoringSSL)
-    assert.strictEqual(err.function, 'ssl3_get_record');
   assert.match(err.reason,
                /wrong[\s_]version[\s_]number|packet[\s_]length[\s_]too[\s_]long|bad[\s_]record[\s_]type/i);
   errorReceived = true;
@@ -100,8 +93,6 @@ function sendBADTLSRecord() {
     assert.match(err.code,
                  /ERR_SSL_(TLSV1_ALERT_PROTOCOL_VERSION|TLSV1_ALERT_RECORD_OVERFLOW|(SSL\/)?TLS_ALERT_UNEXPECTED_MESSAGE)/);
     assert.strictEqual(err.library, 'SSL routines');
-    if (!hasOpenSSL(3) && !isBoringSSL)
-      assert.strictEqual(err.function, 'ssl3_read_bytes');
     assert.match(err.reason,
                  /tlsv1[\s_]alert[\s_]protocol[\s_]version|tlsv1[\s_]alert[\s_]record[\s_]overflow|(ssl\/)?tls[\s_]alert[\s_]unexpected[\s_]message/i);
   }));

test/parallel/test-tls-client-mindhsize.js

@@ -8,7 +8,7 @@ if (!common.hasCrypto)
 // are available by default. Different OpenSSL versions have different
 // default security levels and we use this value to adjust what a test
 // expects based on the security level. You can read more in
-// https://docs.openssl.org/1.1.1/man3/SSL_CTX_set_security_level/#default-callback-behaviour
+// https://docs.openssl.org/3.0/man3/SSL_CTX_set_security_level/#default-callback-behaviour
 const secLevel = require('internal/crypto/util').getOpenSSLSecLevel();
 const assert = require('assert');
 const tls = require('tls');

test/parallel/test-tls-client-renegotiation-13.js

@@ -5,7 +5,7 @@ const common = require('../common');
 if (!common.hasCrypto) {
   common.skip('missing crypto');
 }
-const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
+const { isBoringSSL } = require('../common/crypto');
 
 const fixtures = require('../common/fixtures');
 
@@ -40,9 +40,7 @@ connect({
       });
     } else {
       assert.throws(() => { throw err; }, {
-        message: hasOpenSSL(3) ?
-          'error:0A00010A:SSL routines::wrong ssl version' :
-          'error:1420410A:SSL routines:SSL_renegotiate:wrong ssl version',
+        message: 'error:0A00010A:SSL routines::wrong ssl version',
         code: 'ERR_SSL_WRONG_SSL_VERSION',
         library: 'SSL routines',
         reason: 'wrong ssl version',

test/parallel/test-tls-dhe.js

@@ -43,7 +43,7 @@ const {
 // are available by default. Different OpenSSL versions have different
 // default security levels and we use this value to adjust what a test
 // expects based on the security level. You can read more in
-// https://docs.openssl.org/1.1.1/man3/SSL_CTX_set_security_level/#default-callback-behaviour
+// https://docs.openssl.org/3.0/man3/SSL_CTX_set_security_level/#default-callback-behaviour
 const secLevel = require('internal/crypto/util').getOpenSSLSecLevel();
 
 if (!opensslCli) {
@@ -67,7 +67,7 @@ const ciphers = `${dheCipher}:${ecdheCipher}`;
 
 if (secLevel < 2 && !hasFIPS(3)) {
   // Test will emit a warning because the DH parameter size is < 2048 bits
-  // when the test is run on versions lower than OpenSSL32
+  // when the test is run on OpenSSL versions earlier than 3.2
   common.expectWarning('SecurityWarning',
                        'DH parameter is less than 2048 bits');
 }

test/parallel/test-tls-junk-closes-server.js

@@ -42,7 +42,7 @@ server.listen(0, common.mustCall(function() {
   c.on('data', function() {
     // We must consume all data sent by the server. Otherwise the
     // end event will not be sent and the test will hang.
-    // For example, when compiled with OpenSSL32 we see the
+    // For example, when compiled with OpenSSL 3.2 we see the
     // following response '15 03 03 00 02 02 16' which
     // decodes as a fatal (0x02) TLS error alert number 22 (0x16),
     // which corresponds to TLS1_AD_RECORD_OVERFLOW which matches
@@ -51,7 +51,7 @@ server.listen(0, common.mustCall(function() {
     // but the TLS spec seems to indicate there should be one
     // https://datatracker.ietf.org/doc/html/rfc8446#page-85
     // and error handling seems to have been re-written/improved
-    // in OpenSSL32. Consuming the data allows the test to pass
+    // in OpenSSL 3.2. Consuming the data allows the test to pass
     // either way.
   });
 

test/parallel/test-tls-key-mismatch.js

@@ -27,15 +27,13 @@ if (!common.hasCrypto) {
 }
 
 const fixtures = require('../common/fixtures');
-const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
+const { isBoringSSL } = require('../common/crypto');
 
 const assert = require('assert');
 const tls = require('tls');
 const errorMessageRegex = isBoringSSL ?
   /^Error: error:0b000074:X\.509 certificate routines:OPENSSL_internal:KEY_VALUES_MISMATCH$/ :
-  hasOpenSSL(3) ?
-    /^Error: error:05800074:x509 certificate routines::key values mismatch$/ :
-    /^Error: error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch$/;
+  /^Error: error:05800074:x509 certificate routines::key values mismatch$/;
 
 const options = {
   key: fixtures.readKey('agent1-key.pem'),

test/parallel/test-tls-legacy-pfx.js

@@ -4,10 +4,10 @@ if (!common.hasCrypto) {
   common.skip('missing crypto');
 }
 
-const { hasOpenSSL } = require('../common/crypto');
+const { isBoringSSL } = require('../common/crypto');
 
-if (!hasOpenSSL(3)) {
-  common.skip('OpenSSL legacy failures are only testable with OpenSSL 3+');
+if (isBoringSSL) {
+  common.skip('OpenSSL legacy failures are not testable with BoringSSL');
 }
 
 const fixtures = require('../common/fixtures');

test/parallel/test-tls-min-max-version.js

@@ -43,9 +43,9 @@ function test(cmin, cmax, cprot, smin, smax, sprot, proto, cerr, serr) {
   }
 
   let ciphers;
-  if (hasOpenSSL(3) && (proto === 'TLSv1' || proto === 'TLSv1.1' ||
-      proto === 'TLSv1_1_method' || proto === 'TLSv1_method' ||
-      sprot === 'TLSv1_1_method' || sprot === 'TLSv1_method')) {
+  if (!isBoringSSL && (proto === 'TLSv1' || proto === 'TLSv1.1' ||
+                      proto === 'TLSv1_1_method' || proto === 'TLSv1_method' ||
+                      sprot === 'TLSv1_1_method' || sprot === 'TLSv1_method')) {
     if (serr !== 'ERR_SSL_UNSUPPORTED_PROTOCOL')
       ciphers = 'ALL@SECLEVEL=0';
   }
@@ -179,15 +179,11 @@ for (const [method, version] of [
   test(U, U, 'TLS_method', U, U, method, ...expected);
 }
 
-// OpenSSL 1.1.1 and 3.0 use a different error code and alert (sent to the
-// client) when no protocols are enabled on the server.
 // BoringSSL closes the connection without sending an alert in this case.
 const NO_PROTOCOLS_AVAILABLE_SERVER = isBoringSSL ?
-  'ERR_SSL_NO_SUPPORTED_VERSIONS_ENABLED' : hasOpenSSL(3) ?
-    'ERR_SSL_NO_PROTOCOLS_AVAILABLE' : 'ERR_SSL_INTERNAL_ERROR';
+  'ERR_SSL_NO_SUPPORTED_VERSIONS_ENABLED' : 'ERR_SSL_NO_PROTOCOLS_AVAILABLE';
 const NO_PROTOCOLS_AVAILABLE_SERVER_ALERT = isBoringSSL ?
-  'ECONNRESET' : hasOpenSSL(3) ?
-    'ERR_SSL_TLSV1_ALERT_PROTOCOL_VERSION' : 'ERR_SSL_TLSV1_ALERT_INTERNAL_ERROR';
+  'ECONNRESET' : 'ERR_SSL_TLSV1_ALERT_PROTOCOL_VERSION';
 const NO_PROTOCOLS_AVAILABLE_CLIENT = isBoringSSL ?
   'ERR_SSL_NO_SUPPORTED_VERSIONS_ENABLED' : 'ERR_SSL_NO_PROTOCOLS_AVAILABLE';
 const NO_PROTOCOLS_AVAILABLE_CLIENT_ALERT = isBoringSSL ?

test/parallel/test-tls-set-ciphers.js

@@ -1,7 +1,7 @@
 'use strict';
 const common = require('../common');
 if (!common.hasCrypto) {
-  common.skip('missing crypto, or OpenSSL version lower than 3');
+  common.skip('missing crypto');
 }
 
 const {
@@ -10,10 +10,6 @@ const {
   isBoringSSL,
 } = require('../common/crypto');
 
-if (!hasOpenSSL(3) && !isBoringSSL) {
-  common.skip('missing crypto, or OpenSSL version lower than 3');
-}
-
 const fixtures = require('../common/fixtures');
 const { inspect } = require('util');
 
@@ -154,7 +150,7 @@ if (hasFIPS(3)) {
 
   // TLS_AES_128_CCM_8_SHA256 & TLS_AES_128_CCM_SHA256 are not enabled by
   // default, but work.
-  // However, for OpenSSL32 AES_128 is not enabled due to the
+  // However, for OpenSSL 3.2 AES_128 is not enabled due to the
   // default security level
   if (isBoringSSL) {
     // BoringSSL does not implement the TLS 1.3 CCM cipher suites.

test/parallel/test-tls13-ciphers.js

@@ -7,7 +7,7 @@ const assert = require('assert');
 const { constants } = require('crypto');
 const tls = require('tls');
 const fixtures = require('../common/fixtures');
-const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
+const { isBoringSSL } = require('../common/crypto');
 const { spawnSyncAndAssert } = require('../common/child_process');
 const { connect, keys } = require(fixtures.path('tls-connect'));
 
@@ -90,16 +90,10 @@ test(aes128, aes256, undefined);
 const duplicates = `${aes256} \t:${aes256}`;
 test(duplicates, duplicates, aes256);
 
-// OpenSSL 1.1.1 rejects unknown TLS 1.3 cipher names. OpenSSL 3 and BoringSSL
-// ignore them and do not interpret exclusion rules in the TLS 1.3 list.
+// Unknown TLS 1.3 cipher names are ignored, and exclusion rules are not
+// interpreted in the TLS 1.3 list.
 const list = `TLS_UNKNOWN:!${aes128}:${duplicates}`;
-if (hasOpenSSL(3) || isBoringSSL) {
-  test(list, list, aes256);
-} else {
-  assert.throws(() => tls.createSecureContext({ ciphers: list }), {
-    code: 'ERR_SSL_NO_CIPHER_MATCH',
-  });
-}
+test(list, list, aes256);
 for (const ciphers of ['TLS_UNKNOWN', `!${aes128}`]) {
   assert.throws(() => tls.createSecureContext({ ciphers }), {
     code: 'ERR_SSL_NO_CIPHER_MATCH',

test/parallel/test-trace-env.js

@@ -19,8 +19,8 @@ spawnSyncAndAssert(process.execPath, ['--trace-env', fixtures.path('empty.js')],
     if (common.hasCrypto) {
       assert.match(output, /get "NODE_EXTRA_CA_CERTS"/);
 
-      const { hasOpenSSL } = require('../common/crypto');
-      if (hasOpenSSL(3)) {
+      const { isBoringSSL } = require('../common/crypto');
+      if (!isBoringSSL) {
         assert.match(output, /get "OPENSSL_CONF"/);
       }
     }

test/parallel/test-webcrypto-aead-decrypt-detached-buffer.js

@@ -6,7 +6,7 @@ if (!common.hasCrypto)
   common.skip('missing crypto');
 
 const assert = require('assert');
-const { hasOpenSSL, hasFIPS } = require('../common/crypto');
+const { hasFIPS, isBoringSSL } = require('../common/crypto');
 const { subtle } = globalThis.crypto;
 const fips3 = hasFIPS(3);
 
@@ -56,7 +56,7 @@ if (fips3) {
   tests.push(test('ChaCha20-Poly1305', 32, 12, 'raw-secret'));
 }
 
-if (hasOpenSSL(3)) {
+if (!isBoringSSL) {
   tests.push(test(
     'AES-OCB',
     32,

test/parallel/test-webcrypto-deduplicate-usages.js

@@ -54,7 +54,7 @@ function assertSameSet(actual, expected, msg) {
     symmetric.splice(symmetric.findIndex(({ algorithm }) =>
       algorithm.name === 'ChaCha20-Poly1305'), 1);
 
-  if (hasOpenSSL(3)) {
+  if (!isBoringSSL) {
     symmetric.push({
       algorithm: { name: 'AES-OCB', length: 128 },
       usages: ['decrypt', 'encrypt', 'decrypt', 'encrypt'],
@@ -66,7 +66,7 @@ function assertSameSet(actual, expected, msg) {
       expected: ['sign', 'verify'],
     });
   } else {
-    common.printSkipMessage('AES-OCB and KMAC require OpenSSL >= 3');
+    common.printSkipMessage('AES-OCB and KMAC are not supported by BoringSSL');
   }
 
   for (const { algorithm, usages, expected } of symmetric) {
@@ -178,7 +178,7 @@ function assertSameSet(actual, expected, msg) {
       expected: ['wrapKey', 'unwrapKey'] },
   ];
 
-  if (hasOpenSSL(3)) {
+  if (!isBoringSSL) {
     // KMAC does not support `raw` format, only `raw-secret` and `jwk`.
     tests.push((async () => {
       const key = await subtle.importKey(
@@ -203,7 +203,7 @@ function assertSameSet(actual, expected, msg) {
       assert.strictEqual(key.usages.length, 2);
     })());
   } else {
-    common.printSkipMessage('AES-OCB and KMAC require OpenSSL >= 3');
+    common.printSkipMessage('AES-OCB and KMAC are not supported by BoringSSL');
   }
 
   for (const { algorithm, keyData, usages, expected } of rawSymmetric) {
@@ -374,7 +374,7 @@ function assertSameSet(actual, expected, msg) {
   })());
 
   // AES-OCB raw-secret import.
-  if (hasOpenSSL(3)) {
+  if (!isBoringSSL) {
     tests.push((async () => {
       const imported = subtle.importKey(
         'raw-secret',
@@ -393,7 +393,7 @@ function assertSameSet(actual, expected, msg) {
       assert.strictEqual(key.usages.length, 2);
     })());
   } else {
-    common.printSkipMessage('AES-OCB requires OpenSSL >= 3');
+    common.printSkipMessage('AES-OCB is not supported by BoringSSL');
   }
 
   Promise.all(tests).then(common.mustCall());
@@ -469,7 +469,7 @@ function assertSameSet(actual, expected, msg) {
       expected: ['wrapKey', 'unwrapKey'] },
   ];
 
-  if (hasOpenSSL(3)) {
+  if (!isBoringSSL) {
     jwkVectors.push({
       algorithm: { name: 'AES-OCB', length: 128 },
       usages: ['decrypt', 'encrypt', 'decrypt', 'encrypt'],
@@ -481,7 +481,7 @@ function assertSameSet(actual, expected, msg) {
       expected: ['sign', 'verify'],
     });
   } else {
-    common.printSkipMessage('AES-OCB and KMAC require OpenSSL >= 3');
+    common.printSkipMessage('AES-OCB and KMAC are not supported by BoringSSL');
   }
 
   for (const { algorithm, usages, expected } of jwkVectors) {

test/parallel/test-webcrypto-derivebits-hkdf.js

@@ -6,7 +6,7 @@ if (!common.hasCrypto)
   common.skip('missing crypto');
 
 const assert = require('assert');
-const { hasOpenSSL, hasFIPS, isBoringSSL } = require('../common/crypto');
+const { hasFIPS, isBoringSSL } = require('../common/crypto');
 const { subtle } = globalThis.crypto;
 
 function getDeriveKeyInfo(name, length, hash, ...usages) {
@@ -38,13 +38,13 @@ if (!isBoringSSL) {
   common.printSkipMessage('SHA-3 is only supported for digest operations');
 }
 
-if (hasOpenSSL(3)) {
+if (!isBoringSSL) {
   kDerivedKeyTypes.push(
     ['AES-OCB', 128, undefined, 'encrypt', 'decrypt'],
     ['AES-OCB', 256, undefined, 'encrypt', 'decrypt'],
   );
 } else {
-  common.printSkipMessage('Skipping unsupported test cases');
+  common.printSkipMessage('Skipping AES-OCB test cases unsupported by BoringSSL');
 }
 
 const kDerivedKeys = {

test/parallel/test-webcrypto-derivekey.js

@@ -6,7 +6,7 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL, hasFIPS, isBoringSSL } = require('../common/crypto');
+const { hasFIPS, isBoringSSL } = require('../common/crypto');
 
 const assert = require('assert');
 const { subtle } = globalThis.crypto;
@@ -191,7 +191,7 @@ const fips4 = hasFIPS(4);
     common.printSkipMessage('SHA-3 is only supported for digest operations');
   }
 
-  if (hasOpenSSL(3)) {
+  if (!isBoringSSL) {
     vectors.push(
       ['KMAC128', 'sign', 128],
       [{ name: 'KMAC128', length: 384 }, 'sign', 384],
@@ -251,7 +251,7 @@ const fips4 = hasFIPS(4);
     common.printSkipMessage('SHA-3 is only supported for digest operations');
   }
 
-  if (hasOpenSSL(3)) {
+  if (!isBoringSSL) {
     vectors.push(
       ['KMAC128', 'sign', 128],
       [{ name: 'KMAC128', length: 384 }, 'sign', 384],
@@ -284,7 +284,7 @@ const fips4 = hasFIPS(4);
   })().then(common.mustCall());
 }
 
-if (hasOpenSSL(3)) {
+if (!isBoringSSL) {
   (async () => {
     const derivedKeyAlgorithm = { name: 'KMAC128', length: 0 };
     const usages = ['sign'];

test/parallel/test-webcrypto-encrypt-decrypt-aes.js

@@ -5,7 +5,7 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL } = require('../common/crypto');
+const { isBoringSSL } = require('../common/crypto');
 
 const assert = require('assert');
 const { getFips } = require('crypto');
@@ -230,7 +230,7 @@ async function testDecrypt({ keyBuffer, algorithm, result }) {
 }
 
 // Test aes-ocb vectors
-if (hasOpenSSL(3)) {
+if (!isBoringSSL) {
   const {
     passing,
     failing,

test/parallel/test-webcrypto-encrypt-decrypt.js

@@ -6,7 +6,7 @@ if (!common.hasCrypto)
   common.skip('missing crypto');
 
 const assert = require('assert');
-const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
+const { isBoringSSL } = require('../common/crypto');
 const { getFips } = require('crypto');
 const { subtle } = globalThis.crypto;
 
@@ -148,7 +148,7 @@ async function testRSAOaep(publicKey, privateKey) {
 }
 
 // Test Encrypt/Decrypt AES-OCB
-if (hasOpenSSL(3)) {
+if (!isBoringSSL) {
   const buf = globalThis.crypto.getRandomValues(new Uint8Array(50));
   const iv = globalThis.crypto.getRandomValues(new Uint8Array(12));
 
@@ -180,5 +180,5 @@ if (hasOpenSSL(3)) {
     test().then(common.mustCall());
   }
 } else {
-  common.printSkipMessage('Skipping unsupported AES-OCB test cases');
+  common.printSkipMessage('Skipping AES-OCB test cases unsupported by BoringSSL');
 }

test/parallel/test-webcrypto-export-import.js

@@ -6,7 +6,7 @@ const fixtures = require('../common/fixtures');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
+const { isBoringSSL } = require('../common/crypto');
 
 const assert = require('assert');
 const { subtle } = globalThis.crypto;
@@ -221,7 +221,7 @@ const {
 }
 
 // Import/Export KMAC Secret Key
-if (hasOpenSSL(3)) {
+if (!isBoringSSL) {
   async function test(name) {
     const keyData = globalThis.crypto.getRandomValues(new Uint8Array(32));
     const key = await subtle.importKey(

test/parallel/test-webcrypto-keygen-kmac.js

@@ -5,10 +5,10 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL } = require('../common/crypto');
+const { isBoringSSL } = require('../common/crypto');
 
-if (!hasOpenSSL(3))
-  common.skip('requires OpenSSL >= 3');
+if (isBoringSSL)
+  common.skip('KMAC is not supported by BoringSSL');
 
 const assert = require('assert');
 const { types: { isCryptoKey } } = require('util');

test/parallel/test-webcrypto-keygen.js

@@ -177,7 +177,7 @@ if (!isBoringSSL) {
   common.printSkipMessage('Skipping unsupported test cases');
 }
 
-if (hasOpenSSL(3)) {
+if (!isBoringSSL) {
   vectors['AES-OCB'] = {
     algorithm: { length: 256 },
     result: 'CryptoKey',

test/parallel/test-webcrypto-kmac-empty-output.js

@@ -5,10 +5,10 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasFIPS, hasOpenSSL } = require('../common/crypto');
+const { hasFIPS, isBoringSSL } = require('../common/crypto');
 
-if (!hasOpenSSL(3))
-  common.skip('requires OpenSSL >= 3');
+if (isBoringSSL)
+  common.skip('KMAC is not supported by BoringSSL');
 if (hasFIPS())
   common.skip('empty KMAC output is not supported in FIPS mode');
 

test/parallel/test-webcrypto-sign-verify-kmac.js

@@ -5,10 +5,10 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL } = require('../common/crypto');
+const { isBoringSSL } = require('../common/crypto');
 
-if (!hasOpenSSL(3))
-  common.skip('requires OpenSSL >= 3');
+if (isBoringSSL)
+  common.skip('KMAC is not supported by BoringSSL');
 
 const assert = require('assert');
 const { subtle } = globalThis.crypto;

test/parallel/test-webcrypto-sign-verify.js

@@ -109,7 +109,7 @@ const { subtle } = globalThis.crypto;
 }
 
 // Test Sign/Verify KMAC
-if (hasOpenSSL(3)) {
+if (!isBoringSSL) {
   async function test(name, data) {
     const ec = new TextEncoder();
 

test/parallel/test-webcrypto-supports-fips.js

@@ -3,8 +3,8 @@
 
 const common = require('../common');
 if (!common.hasCrypto) common.skip('missing crypto');
-const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
-if (!hasOpenSSL(3) || isBoringSSL) common.skip('requires OpenSSL 3');
+const { isBoringSSL } = require('../common/crypto');
+if (isBoringSSL) common.skip('requires an OpenSSL provider');
 
 const assert = require('node:assert');
 const crypto = require('node:crypto');

test/parallel/test-webcrypto-wrap-unwrap.js

@@ -60,7 +60,7 @@ const kWrappingData = {
 if (fips3)
   delete kWrappingData['ChaCha20-Poly1305'];
 
-if (hasOpenSSL(3) && !fips3) {
+if (!isBoringSSL && !fips3) {
   kWrappingData['AES-OCB'] = {
     generate: { length: 128 },
     wrap: {
@@ -484,7 +484,7 @@ async function testNonByteLengthWrapUnwrap({
     implicitAlgorithm: hmacAlgorithm,
   });
 
-  if (hasOpenSSL(3) && getFips() !== 1) {
+  if (!isBoringSSL && getFips() !== 1) {
     for (const name of ['KMAC128', 'KMAC256']) {
       const keyData = new Uint8Array(32).fill(0xff);
       const kmacKey = await subtle.importKey(

test/parallel/test-x509-escaping.js

@@ -59,8 +59,8 @@ const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
     'IP Address:8.8.8.8',
     'IP Address:8.8.4.4',
     // For backward-compatibility, include invalid IP address lengths.
-    hasOpenSSL(3) ? 'IP Address:<invalid length=5>' : 'IP Address:<invalid>',
-    hasOpenSSL(3) ? 'IP Address:<invalid length=6>' : 'IP Address:<invalid>',
+    isBoringSSL ? 'IP Address:<invalid>' : 'IP Address:<invalid length=5>',
+    isBoringSSL ? 'IP Address:<invalid>' : 'IP Address:<invalid length=6>',
     // IPv6 addresses are represented as OpenSSL does.
     'IP Address:A0B:C0D:E0F:0:0:0:7A7B:7C7D',
     // Regular email addresses don't require escaping.
@@ -88,22 +88,22 @@ const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
     // This is an OID that will likely never be assigned to anything, thus
     // OpenSSL should not know it.
     'Registered ID:1.3.9999.12.34',
-    hasOpenSSL(3) ?
+    !isBoringSSL ?
       'othername:XmppAddr:abc123' :
       'othername:<unsupported>',
-    hasOpenSSL(3) ?
+    !isBoringSSL ?
       'othername:"XmppAddr:abc123\\u002c DNS:good.example.com"' :
       'othername:<unsupported>',
-    hasOpenSSL(3) ?
+    !isBoringSSL ?
       'othername:"XmppAddr:good.example.com\\u0000abc123"' :
       'othername:<unsupported>',
     // This is unsupported because the OID is not recognized.
     'othername:<unsupported>',
-    hasOpenSSL(3) ? 'othername:SRVName:abc123' : 'othername:<unsupported>',
+    isBoringSSL ? 'othername:<unsupported>' : 'othername:SRVName:abc123',
     // This is unsupported because it is an SRVName with a UTF8String value,
     // which is not allowed for SRVName.
     'othername:<unsupported>',
-    hasOpenSSL(3) ?
+    !isBoringSSL ?
       'othername:"SRVName:abc\\u0000def"' :
       'othername:<unsupported>',
   ];
@@ -173,7 +173,7 @@ const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
         ],
       },
     },
-    hasOpenSSL(3) ? {
+    !isBoringSSL ? {
       text: 'OCSP - othername:XmppAddr:good.example.com\n' +
             'OCSP - othername:<unsupported>\n' +
             'OCSP - othername:SRVName:abc123',
@@ -196,7 +196,7 @@ const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
         ],
       },
     },
-    hasOpenSSL(3) ? {
+    !isBoringSSL ? {
       text: 'OCSP - othername:"XmppAddr:good.example.com\\u0000abc123"',
       legacy: {
         'OCSP - othername': [
@@ -222,7 +222,7 @@ const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
     // Test the subjectAltName property of the X509Certificate API.
     const cert = new X509Certificate(pem);
     assert.strictEqual(cert.infoAccess,
-                       `${expected.text}${hasOpenSSL(3) ? '' : '\n'}`);
+                       `${expected.text}${isBoringSSL ? '\n' : ''}`);
 
     // Test that the certificate obtained by checkServerIdentity has the correct
     // subjectaltname property.

test/pummel/test-crypto-dh-hash.js

@@ -30,10 +30,10 @@ if (common.isPi()) {
   common.skip('Too slow for Raspberry Pi devices');
 }
 
-const { hasOpenSSL } = require('../common/crypto');
+const { isBoringSSL } = require('../common/crypto');
 
-if (!hasOpenSSL(3)) {
-  common.skip('Too slow when dynamically linked against OpenSSL 1.1.1');
+if (isBoringSSL) {
+  common.skip('BoringSSL does not support all tested MODP groups');
 }
 
 const assert = require('assert');