wolfSSL · Frauschi · Jun 2, 2026
diff --git a/certs/include.am b/certs/include.am
@@ -162,7 +162,6 @@ include certs/falcon/include.am
 include certs/rsapss/include.am
 include certs/slhdsa/include.am
 include certs/lms/include.am
-include certs/xmss/include.am
 include certs/rpk/include.am
 include certs/acert/include.am
 include certs/mldsa/include.am
diff --git a/certs/lms/bc_hss_L2_H5_W8_root.der b/certs/lms/bc_hss_L2_H5_W8_root.der
diff --git a/certs/lms/bc_hss_L3_H5_W4_root.der b/certs/lms/bc_hss_L3_H5_W4_root.der
diff --git a/certs/lms/bc_lms_chain_ca.der b/certs/lms/bc_lms_chain_ca.der
diff --git a/certs/lms/bc_lms_chain_leaf.der b/certs/lms/bc_lms_chain_leaf.der
diff --git a/certs/lms/bc_lms_sha256_h10_w8_root.der b/certs/lms/bc_lms_sha256_h10_w8_root.der
diff --git a/certs/lms/bc_lms_sha256_h5_w4_root.der b/certs/lms/bc_lms_sha256_h5_w4_root.der
diff --git a/certs/lms/include.am b/certs/lms/include.am
@@ -2,11 +2,10 @@
 # All paths should be given relative to the root
 #
 
+# bc_lms_native_bc_root.der is stock Bouncy Castle output (RFC 9802-aligned
+# HSS/LMS) kept as the cross-implementation interop anchor. wolfSSL's own
+# LMS certificate/CSR/chain generation is exercised in-process by the
+# test_rfc9802_lms_x509_gen unit test, so no other committed fixtures are
+# needed here.
 EXTRA_DIST += \
-         certs/lms/bc_lms_sha256_h5_w4_root.der \
-         certs/lms/bc_lms_sha256_h10_w8_root.der \
-         certs/lms/bc_hss_L2_H5_W8_root.der \
-         certs/lms/bc_hss_L3_H5_W4_root.der \
-         certs/lms/bc_lms_chain_ca.der \
-         certs/lms/bc_lms_chain_leaf.der \
          certs/lms/bc_lms_native_bc_root.der
diff --git a/certs/xmss/bc_xmss_chain_ca.der b/certs/xmss/bc_xmss_chain_ca.der
diff --git a/certs/xmss/bc_xmss_chain_leaf.der b/certs/xmss/bc_xmss_chain_leaf.der
diff --git a/certs/xmss/bc_xmss_sha2_10_256_root.der b/certs/xmss/bc_xmss_sha2_10_256_root.der
diff --git a/certs/xmss/bc_xmss_sha2_16_256_root.der b/certs/xmss/bc_xmss_sha2_16_256_root.der
diff --git a/certs/xmss/bc_xmssmt_sha2_20_2_256_root.der b/certs/xmss/bc_xmssmt_sha2_20_2_256_root.der
diff --git a/certs/xmss/bc_xmssmt_sha2_20_4_256_root.der b/certs/xmss/bc_xmssmt_sha2_20_4_256_root.der
diff --git a/certs/xmss/bc_xmssmt_sha2_40_8_256_root.der b/certs/xmss/bc_xmssmt_sha2_40_8_256_root.der
diff --git a/certs/xmss/include.am b/certs/xmss/include.am
diff --git a/tests/api/test_lms_xmss.c b/tests/api/test_lms_xmss.c
diff --git a/tests/api/test_lms_xmss.h b/tests/api/test_lms_xmss.h
@@ -28,12 +28,16 @@ int test_wc_LmsKey_sign_verify(void);
 int test_wc_LmsKey_reload_cache(void);
 int test_rfc9802_lms_x509_verify(void);
 int test_rfc9802_xmss_x509_verify(void);
+int test_rfc9802_lms_x509_gen(void);
+int test_rfc9802_xmss_x509_gen(void);
 
 /* LMS, and RFC 9802 (HSS/LMS and XMSS/XMSS^MT in X.509). */
 #define TEST_LMS_XMSS_DECLS                                                  \
     TEST_DECL_GROUP("lms", test_wc_LmsKey_sign_verify),                 \
     TEST_DECL_GROUP("lms", test_wc_LmsKey_reload_cache),                \
     TEST_DECL_GROUP("lms", test_rfc9802_lms_x509_verify),               \
-    TEST_DECL_GROUP("xmss", test_rfc9802_xmss_x509_verify)
+    TEST_DECL_GROUP("xmss", test_rfc9802_xmss_x509_verify),             \
+    TEST_DECL_GROUP("lms", test_rfc9802_lms_x509_gen),                  \
+    TEST_DECL_GROUP("xmss", test_rfc9802_xmss_x509_gen)
 
 #endif /* WOLFCRYPT_TEST_LMS_XMSS_H */