From 7623e4e12ebb9ac5083905037e6a0b04b3c5161b Mon Sep 17 00:00:00 2001
From: Torben Hansen <50673096+torben-hansen@users.noreply.github.com>
Date: Mon, 2 Nov 2026 13:30:00 -0800
Subject: [PATCH] Handle diferent error code for AWS-LC in SPKI distrust test

---
 Lib/test/test_ssl.py | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/Lib/test/test_ssl.py b/Lib/test/test_ssl.py
index 7c69210263f0730..3c2966e8a50e80f 100644
--- a/Lib/test/test_ssl.py
+++ b/Lib/test/test_ssl.py
@@ -2801,8 +2801,14 @@ def test_distrusted_spki(self):
         with self.assertRaises(ssl.SSLCertVerificationError) as cm:
             connected_bio_pair(client_context, server_context,
                                DISTRUSTED_SPKI_HOSTNAME)
-        # X509_V_ERR_CERT_REJECTED
-        self.assertEqual(cm.exception.verify_code, 28)
+        if IS_AWS_LC:
+            # gh-160736: AWS-LC has its own SPKI denylist.  It fails the
+            # chain before _ssl's verify callback sees the certificate,
+            # so the library's error is kept: X509_V_ERR_CERT_REVOKED.
+            self.assertEqual(cm.exception.verify_code, 23)
+        else:
+            # Rejected by _ssl's verify callback: X509_V_ERR_CERT_REJECTED
+            self.assertEqual(cm.exception.verify_code, 28)
 
     def test_sni_callback_context_released_and_callback_raises(self):
         # Variant of the test below without a HelloRetryRequest: the callback