apps: cover the req -set_serial option

The OPT_SET_SERIAL case in req_main() was not covered. Add a test that
generates a self-signed certificate with an explicit -set_serial value
and checks it, plus the error path when -set_serial is given twice.

Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Fri Jul  3 19:25:05 2026
(Merged from https://github.com/openssl/openssl/pull/31730)

diff --git a/test/recipes/25-test_req.t b/test/recipes/25-test_req.t
index 869ac4c3b756fe05b7d1561f79e76d7405cdea4a..b23e41ee2cdcd5d711b774ff3d3b777c1439a40e 100644 (file)
--- a/test/recipes/25-test_req.t
+++ b/test/recipes/25-test_req.t
@@ -15,7 +15,7 @@ use OpenSSL::Test qw/:DEFAULT srctop_file/;
 
 setup("test_req");
 
-plan tests => 129;
+plan tests => 130;
 
 require_ok(srctop_file('test', 'recipes', 'tconversion.pl'));
 
@@ -501,6 +501,27 @@ subtest "generating certificate requests with SLH-DSA" => sub {
     }
 };
 
+subtest "generating certificate with -set_serial" => sub {
+    plan tests => 3;
+
+    my $cert = "self-signed_set_serial.pem";
+    ok(run(app(["openssl", "req", "-x509", "-new", "-days", "365",
+                "-config", srctop_file("test", "test.cnf"),
+                "-key", srctop_file("test", "testrsa.pem"),
+                "-set_serial", "12345",
+                "-out", $cert])),
+       "Generating self-signed cert with -set_serial");
+
+    cert_contains($cert, "Serial Number: 12345", 1);
+
+    ok(!run(app(["openssl", "req", "-x509", "-new", "-days", "365",
+                 "-config", srctop_file("test", "test.cnf"),
+                 "-key", srctop_file("test", "testrsa.pem"),
+                 "-set_serial", "12345", "-set_serial", "67890",
+                 "-out", $cert])),
+       "Supplying -set_serial twice fails");
+};
+
 my @openssl_args = ("req", "-config", srctop_file("apps", "openssl.cnf"));
 
 run_conversion('req conversions',