diff --git a/test/build.info b/test/build.info
index f438270b86..34c81a4dfd 100644
--- a/test/build.info
+++ b/test/build.info
@@ -43,7 +43,7 @@ INCLUDE_MAIN___test_libtestutil_OLB = /INCLUDE=MAIN
           bioprinttest sslapitest dtlstest sslcorrupttest bio_enc_test \
           pkey_meth_test uitest cipherbytes_test asn1_encode_test \
           x509_time_test x509_dup_cert_test x509_check_cert_pkey_test recordlentest \
-          time_offset_test pemtest
+          time_offset_test pemtest ssl_cert_table_internal_test
 
   SOURCE[aborttest]=aborttest.c
   INCLUDE[aborttest]=../include
@@ -314,6 +314,10 @@ INCLUDE_MAIN___test_libtestutil_OLB = /INCLUDE=MAIN
   INCLUDE[pemtest]=../include .
   DEPEND[pemtest]=../libcrypto libtestutil.a
 
+  SOURCE[ssl_cert_table_internal_test]=ssl_cert_table_internal_test.c
+  INCLUDE[ssl_cert_table_internal_test]=.. ../include
+  DEPEND[ssl_cert_table_internal_test]=../libcrypto libtestutil.a
+
   IF[{- !$disabled{psk} -}]
     PROGRAMS_NO_INST=dtls_mtu_test
     SOURCE[dtls_mtu_test]=dtls_mtu_test.c ssltestlib.c
diff --git a/test/recipes/03-test_internal_ssl_cert_table.t b/test/recipes/03-test_internal_ssl_cert_table.t
new file mode 100644
index 0000000000..1cafc23637
--- /dev/null
+++ b/test/recipes/03-test_internal_ssl_cert_table.t
@@ -0,0 +1,19 @@
+#! /usr/bin/env perl
+# Copyright 2017 The OpenSSL Project Authors. All Rights Reserved.
+#
+# Licensed under the OpenSSL license (the "License").  You may not use
+# this file except in compliance with the License.  You can obtain a copy
+# in the file LICENSE in the source distribution or at
+# https://www.openssl.org/source/license.html
+
+use strict;
+use OpenSSL::Test;              # get 'plan'
+use OpenSSL::Test::Simple;
+use OpenSSL::Test::Utils;
+
+setup("test_internal_ssl_cert_table");
+
+plan skip_all => "This test is unsupported in a shared library build on Windows"
+    if $^O eq 'MSWin32' && !disabled("shared");
+
+simple_test("test_internal_ssl_cert_table", "ssl_cert_table_internal_test");
diff --git a/test/ssl_cert_table_internal_test.c b/test/ssl_cert_table_internal_test.c
new file mode 100644
index 0000000000..0fa5e4e214
--- /dev/null
+++ b/test/ssl_cert_table_internal_test.c
@@ -0,0 +1,80 @@
+/*
+ * Copyright 2017 The OpenSSL Project Authors. All Rights Reserved.
+ *
+ * Licensed under the OpenSSL license (the "License").  You may not use
+ * this file except in compliance with the License.  You can obtain a copy
+ * in the file LICENSE in the source distribution or at
+ * https://www.openssl.org/source/license.html
+ */
+
+/* Internal tests for the x509 and x509v3 modules */
+
+#include <stdio.h>
+#include <string.h>
+
+#include <openssl/ssl.h>
+#include "testutil.h"
+#include "e_os.h"
+
+#ifdef __VMS
+# pragma names save
+# pragma names as_is,shortened
+#endif
+
+#include "../ssl/ssl_locl.h"
+#include "../ssl/ssl_cert_table.h"
+
+#ifdef __VMS
+# pragma names restore
+#endif
+
+#define test_cert_table(nid, amask, idx) \
+    do_test_cert_table(nid, amask, idx, #idx)
+
+static int do_test_cert_table(int nid, uint32_t amask, size_t idx,
+                              const char *idxname)
+{
+    const SSL_CERT_LOOKUP *clu = &ssl_cert_info[idx];
+
+    if (clu->nid == nid && clu->amask == amask)
+        return 1;
+
+    TEST_error("Invalid table entry for certificate type %s, index %zu",
+               idxname, idx);
+    if (clu->nid != nid)
+        TEST_note("Expected %s, got %s\n", OBJ_nid2sn(nid),
+                  OBJ_nid2sn(clu->nid));
+    if (clu->amask != amask)
+        TEST_note("Expected auth mask 0x%x, got 0x%x\n", amask, clu->amask);
+    return 0;
+}
+
+/* Sanity check of ssl_cert_table */
+
+static int test_ssl_cert_table()
+{
+    TEST_size_t_eq(OSSL_NELEM(ssl_cert_info), SSL_PKEY_NUM);
+    if (!test_cert_table(EVP_PKEY_RSA, SSL_aRSA, SSL_PKEY_RSA))
+        return 0;
+    if (!test_cert_table(EVP_PKEY_DSA, SSL_aDSS, SSL_PKEY_DSA_SIGN))
+        return 0;
+    if (!test_cert_table(EVP_PKEY_EC, SSL_aECDSA, SSL_PKEY_ECC))
+        return 0;
+    if (!test_cert_table(NID_id_GostR3410_2001, SSL_aGOST01, SSL_PKEY_GOST01))
+        return 0;
+    if (!test_cert_table(NID_id_GostR3410_2012_256, SSL_aGOST12,
+                         SSL_PKEY_GOST12_256))
+        return 0;
+    if (!test_cert_table(NID_id_GostR3410_2012_512, SSL_aGOST12,
+                         SSL_PKEY_GOST12_512))
+        return 0;
+    if (!test_cert_table(EVP_PKEY_ED25519, SSL_aECDSA, SSL_PKEY_ED25519))
+        return 0;
+
+    return 1;
+}
+
+void register_tests()
+{
+    ADD_TEST(test_ssl_cert_table);
+}