diff --git a/nginx/fulltest-provider/README.md b/nginx/fulltest-provider/README.md
deleted file mode 100644
index 7f49b225..00000000
--- a/nginx/fulltest-provider/README.md
+++ /dev/null
@@ -1,43 +0,0 @@
-# Scripts to generate OQS test server
-
-This folder contains all scripts to [build a QSC-enabled nginx server running on ubuntu](build-ubuntu.sh) as well as generating all configuration files for running an interoperability test server: Running [python3 genconfig.py](genconfig.py) generates a local/self-signed root CA, all QSC certificates signed by this root CA for the currently supported list of QSC algorithms and the required nginx-server configuration file for a server running at the configured TESTFQDN server address.
-
-*Note*: These scripts assume
-- coherent definition of test server FQDN as TESTFQDN in `genconfig.py` and `ext-csr.conf` files: By default "test.openquantumsafe.org" is set.
-- presence of oqs-openssl common definitions file `common.py` (as stored at https://raw.githubusercontent.com/open-quantum-safe/oqs-provider/main/scripts/common.py).
-- presence of Docker on the build machine to run the build process, the guest OS needs to be able to mount host directories for Docker (i.e. on Linux, SELinux permissions might be needed).
-- presence on the target deploy server (i.e., at the machine designated at TESTFQDN) of a properly deployed [LetsEncrypt server certificate](https://letsencrypt.org/getting-started).
-
-By default, the server is built to a specific set of versions of `liboqs`, `openssl`, `oqs-provider` and `nginx`. These versions are encoded in `build-ubuntu.sh` and may be changed/upgraded there.
-
-### HOWTO
-
-#### Build and deploy test server
-
-On build machine run
-
-```
-./build-ubuntu.sh
-scp oqs-nginx-{LIBOQS_VERSION}.tgz yourid@yourserver:yourpath
-```
-
-At 'yourserver' run:
-```
-cd / && tar xzvf yourpath/oqs-nginx-{LIBOQS_VERSION}.tgz
-cd /opt/nginx
-/opt/nginx/sbin/nginx -c interop.conf
-```
-
-Note that, the oqs-nginx-{LIBOQS_VERSION}.tgz package contains all required configuration files and QSC certificates. **Unpacking the archive may overwrite an existing installation's configuration files. Use with care on a live server.**
-
-#### Activation
-
-Execute `OPENSSL_CONF=/opt/openssl/.openssl/ssl/openssl.cnf /opt/nginx/sbin/nginx -c /opt/nginx/interop.conf` to start the test server.
-
-*Note*: From nginx version 1.25.2, nginx does not try to load OpenSSL configuration if the --with-openssl option was used to built OpenSSL. We therefore have to set the `OPENSSL_CONF` environment variable when activating nginx.
-
-*Note*: As the server many of ports, the server may need to be configured to permit this, e.g., using `ulimit -S -n 4096`.
-
-#### Test run
-
-The `testrun.sh` script runs test connections against all ports configured by the server. To run the script, execute `testrun.sh openquantumsafe/curl`.
diff --git a/nginx/fulltest-provider/chromium-template b/nginx/fulltest-provider/chromium-template
deleted file mode 100644
index abee3f2a..00000000
--- a/nginx/fulltest-provider/chromium-template
+++ /dev/null
@@ -1,71 +0,0 @@
-
-
-
-
-Open Quantum Safe interop test server for quantum-safe cryptography - Chromium overview
-
-
-Open Quantum Safe interop test server for quantum-safe cryptography
- Purpose
-
-This server is an NGINX instance enhanced with support for quantum-safe cryptography (QSC) using software packages provided by the Open Quantum Safe project (OQS).
-
-In order to provide a means for clients to test interoperability with this QSC-enhanced software and the QSC algorithms contained it features separate ports for all QSC signature/key exchange algorithm combinations supported by the current OQS distribution. This page focuses on the algorithms supported by the OQS-enabled Chromium browser build.
-
- Specification details
-
-This nginx server supports
-
-- the TLS1.3 specification with QSC enhancement as specified in https://tools.ietf.org/html/draft-ietf-tls-hybrid-design-06
-- Code points/curve IDs of KEM algorithms are implemented with the highest numbers available for each algorithm listed here.
-- Code points/OIDs of SIG algorithms are implemented with the highest numbers available for each algorithm as listed here.
-
-
-This corresponds to the OQS release version LIBOQS_RELEASE and oqs-provider version OQSPROVIDER_RELEASE.
-
-These specifications should not be taken as a standard, de facto and otherwise, and are subject to change at any time.
-
-Use the OQS-enabled Chromium build to access this web page. As per the limitations concerning supported algorithms as documented here, only the KEM algorithm combinations listed below will function (P256_BIKEL1, P256_FRODO640AES, P256_KYBER90S512, P256_NTRU_HPS2048509, P256_LIGHTSABER) and no hybrid signature algorithms are supported.
-
-
More details are available at Github.
-
-An alternative view to all supported algorithms is available at this web page.
-
- Caveats
-
-
-- This test server by no means should be taken as containing production-ready software. See disclaimer. Its purpose is simply to provide a best-effort facility to allow anyone to "test-drive" QSC software packages including testing protocol level interoperability.
-
-
-
- Certificates
-
-Each test port provides TLS server authentication using a server certificate generated using the listed QSC-signature algorithm. All server certificates are signed by a common CA certificate using conventional (RSA) cryptography. This certificate is available for download here.
-
- List of all supported QSC Signature / Key Exchange algorithms for use by OQS-enabled Chromium
-
-The list below provides links to the entry points of all OQS signature / key exchange algorithm combinations supported by the OQS-Chromium build.
-
-
-
- | Signature algorithm |
- Key exchange algorithm |
- Port |
- Link |
-
diff --git a/nginx/fulltest-provider/ext-csr.conf b/nginx/fulltest-provider/ext-csr.conf
deleted file mode 100644
index b4fc0617..00000000
--- a/nginx/fulltest-provider/ext-csr.conf
+++ /dev/null
@@ -1,27 +0,0 @@
-[req]
-distinguished_name = req_distinguished_name
-req_extensions = v3_req
-prompt = no
-
-[req_distinguished_name]
-CN = test.openquantumsafe.org
-
-[v3_intermediate_ca]
-basicConstraints = critical, CA:true, pathlen:0
-keyUsage = critical, digitalSignature, cRLSign, keyCertSign
-subjectKeyIdentifier = hash
-authorityKeyIdentifier = keyid:always
-certificatePolicies = 2.5.29.32.0
-extendedKeyUsage = clientAuth, serverAuth
-
-[v3_req]
-basicConstraints = critical, CA:FALSE
-keyUsage = critical, digitalSignature
-extendedKeyUsage = serverAuth
-subjectKeyIdentifier = hash
-authorityKeyIdentifier = keyid:always
-subjectAltName = @alt_names
-certificatePolicies=2.23.140.1.2.1
-
-[alt_names]
-DNS.1 = test.openquantumsafe.org
diff --git a/nginx/fulltest-provider/genconfig.py b/nginx/fulltest-provider/genconfig.py
deleted file mode 100644
index 72e61fc7..00000000
--- a/nginx/fulltest-provider/genconfig.py
+++ /dev/null
@@ -1,237 +0,0 @@
-import common
-import os
-import json
-import oqsprovider_alglist
-
-# Script assumes nginx to have been built for this platform using build-ubuntu.sh
-
-############# Configuration section starting here
-
-# This is where the explanation HTML code is
-TEMPLATE_FILE="index-template"
-CHROMIUM_TEMPLATE_FILE="chromium-template"
-
-# This is where nginx is (to be) installed
-BASEPATH="/opt/nginx/"
-
-# This is the (relative to BASEPATH) path of all certificates
-PKIPATH="pki"
-
-# This is the port where all algorithms start to be present(ed)
-STARTPORT=6000
-
-# This is the local location of the OQS-enabled OpenSSL
-OPENSSL="/opt/openssl/apps/openssl"
-
-# This is the local OQS-OpenSSL config file
-OPENSSL_CNF="/opt/openssl/apps/openssl.cnf"
-
-# This is the fully-qualified domain name of the server to be set up
-# Ensure this is in sync with contents of ext-csr.conf file
-TESTFQDN="test.openquantumsafe.org"
-
-# This is the local folder where the root CA (key and cert) resides
-CAROOTDIR="/rootca"
-
-# This is the file containing the SIG/KEM/port assignments
-ASSIGNMENT_FILE="assignments.json"
-
-# The list of chromium-supported KEMs:
-# TODO: this list needs to be updated after a new Chromium build
-chromium_algs = ["p256_frodo640aes"]
-
-############# Functions starting here
-
-# Generate cert chain (server and CA for a given sig alg:
-# srv crt/key wind up in '/_srv.crt|key
-def gen_cert(_sig_alg):
- sig_alg = _sig_alg[0]
- # first check whether we already have a root CA; if not create it
- if not os.path.exists(CAROOTDIR):
- os.mkdir(CAROOTDIR)
- common.run_subprocess([OPENSSL, 'req', '-x509', '-new',
- '-newkey', "rsa:4096",
- '-keyout', os.path.join(CAROOTDIR, "CA.key"),
- '-out', os.path.join(CAROOTDIR, "CA.crt"),
- '-nodes',
- '-subj', '/CN=oqstest_CA',
- '-days', '500',
- '-config', OPENSSL_CNF])
- print("New root cert residing in %s." % (os.path.join(CAROOTDIR, "CA.crt")))
-
- # first check whether we already have a PKI dir; if not create it
- if not os.path.exists(PKIPATH):
- os.mkdir(PKIPATH)
-
- # now generate suitable server keys signed by that root; adapt algorithm names to std ossl
- if sig_alg == 'rsa3072':
- ossl_sig_alg_arg = 'rsa:3072'
- elif sig_alg == 'ecdsap256':
- common.run_subprocess([OPENSSL, "ecparam", "-name", "prime256v1", "-out", os.path.join(PKIPATH, "prime256v1.pem")])
- ossl_sig_alg_arg = 'ec:{}'.format(os.path.join(PKIPATH, "prime256v1.pem"))
- else:
- ossl_sig_alg_arg = sig_alg
- # generate intermediate CA key and CSR
- common.run_subprocess([OPENSSL, 'req', '-new',
- '-newkey', ossl_sig_alg_arg,
- '-keyout', os.path.join(PKIPATH, '{}_interm.key'.format(sig_alg)),
- '-out', os.path.join(PKIPATH, '{}_interm.csr'.format(sig_alg)),
- '-nodes',
- '-subj', '/CN=oqstest_intermediate_'+sig_alg,
- '-config', OPENSSL_CNF])
- # sign the intermediate CA using the root
- common.run_subprocess([OPENSSL, 'x509', '-req',
- '-in', os.path.join(PKIPATH, '{}_interm.csr'.format(sig_alg)),
- '-out', os.path.join(PKIPATH, '{}_interm.crt'.format(sig_alg)),
- '-CA', os.path.join(CAROOTDIR, 'CA.crt'),
- '-CAkey', os.path.join(CAROOTDIR, 'CA.key'),
- '-CAcreateserial',
- '-extfile', 'ext-csr.conf',
- '-extensions', 'v3_intermediate_ca',
- '-days', '366'])
- # generate server key and CSR
- common.run_subprocess([OPENSSL, 'req', '-new',
- '-newkey', ossl_sig_alg_arg,
- '-keyout', os.path.join(PKIPATH, '{}_srv.key'.format(sig_alg)),
- '-out', os.path.join(PKIPATH, '{}_srv.csr'.format(sig_alg)),
- '-nodes',
- '-subj', '/CN='+TESTFQDN,
- '-config', OPENSSL_CNF])
- # generate server cert off common root
- common.run_subprocess([OPENSSL, 'x509', '-req',
- '-in', os.path.join(PKIPATH, '{}_srv.csr'.format(sig_alg)),
- '-out', os.path.join(PKIPATH, '{}_srv.crt'.format(sig_alg)),
- '-CA', os.path.join(PKIPATH, '{}_interm.crt'.format(sig_alg)),
- '-CAkey', os.path.join(PKIPATH, '{}_interm.key'.format(sig_alg)),
- '-CAcreateserial',
- '-extfile', 'ext-csr.conf',
- '-extensions', 'v3_req',
- '-days', '365'])
- # append intermediate cert to server cert
- with open(os.path.join(PKIPATH, '{}_srv.crt'.format(sig_alg)), 'a') as srv:
- srv.write("\n")
- with open(os.path.join(PKIPATH, '{}_interm.crt'.format(sig_alg))) as interm:
- srv.write(interm.read())
-
-def write_nginx_config(f, i, cf, port, _sig, k):
- sig = _sig[0]
- f.write("server {\n")
- f.write(" listen 0.0.0.0:"+str(port)+" ssl;\n\n")
- f.write(" server_name "+TESTFQDN+";\n")
- f.write(" access_log "+BASEPATH+"logs/"+sig+"-access.log;\n")
- f.write(" error_log "+BASEPATH+"logs/"+sig+"-error.log;\n\n")
- f.write(" ssl_certificate "+BASEPATH+PKIPATH+"/"+sig+"_srv.crt;\n")
- f.write(" ssl_certificate_key "+BASEPATH+PKIPATH+"/"+sig+"_srv.key;\n\n")
- f.write(" ssl_protocols TLSv1.3;\n")
- if k!="*" :
- f.write(" ssl_ecdh_curve "+k+";\n")
- f.write(" location / {\n")
- f.write(" ssi on;\n")
- f.write(" set $oqs_sig_name \""+sig+"\";\n")
- f.write(" root html;\n")
- f.write(" index success.html;\n")
- f.write(" keepalive_timeout 0;\n")
- f.write(" }\n\n")
-
- f.write("}\n\n")
- # activate for more boring links-only display:
- #i.write(""+sig+"/"+k+" ("+str(port)+")\n")
- #if k in chromium_algs:
- # cf.write(""+sig+"/"+k+" ("+str(port)+")\n")
-
- # deactivate if you don't like tables:
- i.write("| "+sig+" | "+k+" | "+str(port)+" | "+sig+"/"+k+" |
\n")
- # chromium support discontinued
- #if k in chromium_algs and not ("_" in sig and (sig.startswith("p") or (sig.startswith("rsa")))):
- # cf.write("| "+sig+" | "+k+" | "+str(port)+" | "+sig+"/"+k+" |
\n")
-
-
-# generates nginx config
-def gen_conf(filename, indexbasefilename, chromiumfilename):
- port = STARTPORT
- assignments={}
- i = open(indexbasefilename, "w")
- # chromium support discontinued
- cf = None
- #cf = open(chromiumfilename, "w")
- # copy baseline templates
- with open(TEMPLATE_FILE, "r") as tf:
- for line in tf:
- i.write(line)
- #chromium support discontinued
- #with open(CHROMIUM_TEMPLATE_FILE, "r") as ctf:
- # for line in ctf:
- # cf.write(line)
-
- with open(filename, "w") as f:
- # baseline config
- f.write("worker_processes auto;\n")
- f.write("worker_rlimit_nofile 10000;\n")
- f.write("events {\n")
- f.write(" worker_connections 32000;\n")
- f.write("}\n")
- f.write("\n")
- f.write("http {\n")
- f.write(" include conf/mime.types;\n");
- f.write(" default_type application/octet-stream;\n")
- f.write(" keepalive_timeout 65;\n\n")
- # plain server for base information
- f.write("server {\n")
- f.write(" listen 80;\n")
- f.write(" server_name "+TESTFQDN+";\n")
- f.write(" access_log /opt/nginx/logs/80-access.log;\n")
- f.write(" error_log /opt/nginx/logs/80-error.log;\n\n")
- f.write(" location / {\n")
- f.write(" root html;\n")
- f.write(" index "+indexbasefilename+";\n")
- f.write(" }\n")
- f.write("}\n")
- f.write("server {\n")
- f.write(" listen 443 ssl;\n")
- f.write(" server_name "+TESTFQDN+";\n")
- f.write(" access_log /opt/nginx/logs/443-access.log;\n")
- f.write(" error_log /opt/nginx/logs/443-error.log;\n\n")
- f.write(" ssl_certificate /etc/letsencrypt/live/"+TESTFQDN+"/fullchain.pem;\n")
- f.write(" ssl_certificate_key /etc/letsencrypt/live/"+TESTFQDN+"/privkey.pem;\n\n")
- f.write(" ssl_protocols TLSv1.2 TLSv1.3;\n")
- f.write(" location / {\n")
- f.write(" root html;\n")
- f.write(" index "+indexbasefilename+";\n")
- f.write(" }\n")
- f.write("}\n")
-
- f.write("\n")
- for sig in oqsprovider_alglist.signatures:
- assignments[sig[0]]={}
- assignments[sig[0]]["*"]=port
- write_nginx_config(f, i, cf, port, sig, "*")
- port = port+1
- for kex in oqsprovider_alglist.key_exchanges:
- # replace oqs_kem_default with X25519:
- if kex[0]=='oqs_kem_default':
- write_nginx_config(f, i, cf, port, sig, "X25519")
- assignments[sig[0]][kex[0]]=port
- port = port+1
- elif kex[1] == sig[1] or sig[1] == 0: # only add if the sig and kex security levels match or sig[1]==0 (rsa/ecdsa)
- write_nginx_config(f, i, cf, port, sig, kex[0])
- assignments[sig[0]][kex[0]]=port
- port = port+1
- f.write("}\n")
- # deactivate if you don't like tables:
- i.write("
\n")
- i.write("\n")
- i.close()
- #cf.write("\n")
- #cf.write("