diff --git a/ChangeLog.d/empty-digest-failure.txt b/ChangeLog.d/empty-digest-failure.txt
new file mode 100644
index 0000000000..2cec3a844a
--- /dev/null
+++ b/ChangeLog.d/empty-digest-failure.txt
@@ -0,0 +1,4 @@
+Bugfix
+   * Fix PKCS7 so that it successfully parses also in case of empty
+     or not supported digest algorithms. Validation of the digest algorithm
+     is performed at validation step.
diff --git a/library/pkcs7.c b/library/pkcs7.c
index 4e3b554f0e..fc241c86fa 100644
--- a/library/pkcs7.c
+++ b/library/pkcs7.c
@@ -142,6 +142,10 @@ static int pkcs7_get_digest_algorithm_set(unsigned char **p,
         return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PKCS7_INVALID_ALG, ret);
     }
 
+    if (len == 0) {
+        return 0;
+    }
+
     end = *p + len;
 
     ret = mbedtls_asn1_get_alg_null(p, end, alg);
@@ -333,10 +337,15 @@ static int pkcs7_get_signer_info(unsigned char **p, unsigned char *end,
         goto out;
     }
 
-    /* Check that the digest algorithm used matches the one provided earlier */
-    if (signer->alg_identifier.tag != alg->tag ||
-        signer->alg_identifier.len != alg->len ||
-        memcmp(signer->alg_identifier.p, alg->p, alg->len) != 0) {
+    /*
+     * If digestAlgorithms is present, require the signer digest algorithm to
+     * match it. If the outer set is empty, defer the failure until
+     * verification, where the missing digest algorithm is reported.
+     */
+    if (alg->p != NULL &&
+        (signer->alg_identifier.tag != alg->tag ||
+         signer->alg_identifier.len != alg->len ||
+         memcmp(signer->alg_identifier.p, alg->p, alg->len) != 0)) {
         ret = MBEDTLS_ERR_PKCS7_INVALID_SIGNER_INFO;
         goto out;
     }
@@ -481,9 +490,11 @@ static int pkcs7_get_signed_data(unsigned char *buf, size_t buflen,
         return ret;
     }
 
-    ret = mbedtls_x509_oid_get_md_alg(&signed_data->digest_alg_identifiers, &md_alg);
-    if (ret != 0) {
-        return MBEDTLS_ERR_PKCS7_INVALID_ALG;
+    if (signed_data->digest_alg_identifiers.p != NULL) {
+        ret = mbedtls_x509_oid_get_md_alg(&signed_data->digest_alg_identifiers, &md_alg);
+        if (ret != 0) {
+            return MBEDTLS_ERR_PKCS7_INVALID_ALG;
+        }
     }
 
     mbedtls_pkcs7_buf content_type;
diff --git a/tests/suites/test_suite_pkcs7.data b/tests/suites/test_suite_pkcs7.data
index 4aff54c1cc..3ba53b96c9 100644
--- a/tests/suites/test_suite_pkcs7.data
+++ b/tests/suites/test_suite_pkcs7.data
@@ -1,3 +1,10 @@
+PKCS7 With Empty Digest
+pkcs7_parse:"../framework/data_files/pkcs7_empty_digest.der":MBEDTLS_PKCS7_SIGNED_DATA
+
+PKCS7 Signed Data Parse Unsupported DigestAlgorithmSet
+depends_on:!PSA_WANT_ALG_SHA_256:PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY
+pkcs7_parse:"../framework/data_files/pkcs7_data_cert_signed_sha256.der":MBEDTLS_PKCS7_SIGNED_DATA
+
 PKCS7 Signed Data Parse Pass SHA256 #1
 depends_on:PSA_WANT_ALG_SHA_256:PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY
 pkcs7_parse:"../framework/data_files/pkcs7_data_cert_signed_sha256.der":MBEDTLS_PKCS7_SIGNED_DATA
@@ -90,6 +97,18 @@ PKCS7 Signed Data Verification Pass SHA256 #9
 depends_on:PSA_WANT_ALG_SHA_256:PSA_HAVE_ALG_RSA_PKCS1V15_VERIFY
 pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_sha256.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":0:0
 
+PKCS7 Signed Data Verification Fail empty digestAlgorithms
+depends_on:PSA_WANT_ALG_SHA_256:PSA_HAVE_ALG_RSA_PKCS1V15_VERIFY
+pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_sha256_empty_digest.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":0:MBEDTLS_ERR_X509_UNKNOWN_OID
+
+PKCS7 Signed Hash Verification Fail empty digestAlgorithms
+depends_on:PSA_WANT_ALG_SHA_256:PSA_HAVE_ALG_RSA_PKCS1V15_VERIFY
+pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_sha256_empty_digest.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":MBEDTLS_MD_SHA256:MBEDTLS_ERR_X509_UNKNOWN_OID
+
+PKCS7 Signed Data Parse Pass SHA256 empty digestAlgorithms
+depends_on:PSA_WANT_ALG_SHA_256:PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY
+pkcs7_parse:"../framework/data_files/pkcs7_data_cert_signed_sha256_empty_digest.der":MBEDTLS_PKCS7_SIGNED_DATA
+
 PKCS7 Signed Data Verification Pass SHA256 #9.1
 depends_on:PSA_WANT_ALG_SHA_256:PSA_HAVE_ALG_RSA_PKCS1V15_VERIFY
 pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_sha256.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":MBEDTLS_MD_SHA256:0