diff --git a/xCAT-test/unit/dhcp_omapi_policy.t b/xCAT-test/unit/dhcp_omapi_policy.t
index a871ade34..861e173bd 100644
--- a/xCAT-test/unit/dhcp_omapi_policy.t
+++ b/xCAT-test/unit/dhcp_omapi_policy.t
@@ -187,8 +187,8 @@ ok( !$explicit_md5->{needs_omshell_key_algorithm},
 
 my $sha512 = omapi_settings(
     dhcpomapialgorithm => ' HMAC-SHA512 ',
-    dhcpomapikeyname   => 'external.key-name',
-    dhcpomshellpath    => '/opt/dhcp/bin/omshell',
+    dhcpomapikeyname   => ' external.key-name ',
+    dhcpomshellpath    => ' /opt/dhcp/bin/omshell ',
 );
 is( $sha512->{algorithm},   'hmac-sha512',    'algorithm is canonicalized' );
 is( $sha512->{key_rr_type}, 165,              'SHA512 KEY RR type is mapped' );
diff --git a/xCAT-test/unit/dhcp_range.t b/xCAT-test/unit/dhcp_range.t
index 4dad80558..70517ceb6 100644
--- a/xCAT-test/unit/dhcp_range.t
+++ b/xCAT-test/unit/dhcp_range.t
@@ -15,6 +15,9 @@ is( $pair->{end}, '10.0.0.20', 'range end is parsed' );
 is( xCAT::DHCP::Range->isc_range($pair), '10.0.0.10 10.0.0.20', 'ISC range uses space separator' );
 is( xCAT::DHCP::Range->kea_pool($pair), '10.0.0.10 - 10.0.0.20', 'Kea pool uses JSON pool syntax' );
 
+my $padded_pair = xCAT::DHCP::Range->parse(" \t10.0.0.10-10.0.0.20\r\n");
+is( $padded_pair->{source}, '10.0.0.10-10.0.0.20', 'surrounding range whitespace is removed' );
+
 is_deeply(
     [ xCAT::DHCP::Range->isc_ranges('10.0.0.10,10.0.0.20;10.0.1.10 10.0.1.20') ],
     [ '10.0.0.10 10.0.0.20', '10.0.1.10 10.0.1.20' ],
diff --git a/xCAT-test/unit/string_utils.t b/xCAT-test/unit/string_utils.t
new file mode 100644
index 000000000..2c751ffca
--- /dev/null
+++ b/xCAT-test/unit/string_utils.t
@@ -0,0 +1,34 @@
+#!/usr/bin/env perl
+use strict;
+use warnings;
+
+use FindBin;
+use lib "$FindBin::Bin/../../perl-xCAT";
+
+use Test::More;
+
+use xCAT::StringUtils qw(trim);
+
+is( trim(undef), undef, 'undefined values remain undefined' );
+is_deeply( [ trim(undef) ], [undef], 'undefined values are preserved in list context' );
+is( trim(''), '', 'empty strings remain empty' );
+is( trim(" \t\n"), '', 'whitespace-only strings become empty' );
+is( trim('value'), 'value', 'strings without surrounding whitespace are unchanged' );
+is( trim(" \tvalue\r\n"), 'value', 'leading and trailing whitespace is removed' );
+is(
+    trim("  first line \n second line  \n"),
+    "first line \n second line",
+    'whitespace inside multiline content is preserved'
+);
+is(
+    trim("\x{2003}\x{03b1}\x{03b2}\x{2003}"),
+    "\x{03b1}\x{03b2}",
+    'Unicode whitespace is removed without changing non-ASCII content'
+);
+is( trim(0), '0', 'defined false values are preserved' );
+
+my $original = '  original  ';
+is( trim($original), 'original', 'trim returns the normalized value' );
+is( $original, '  original  ', 'trim does not modify the caller value' );
+
+done_testing();
diff --git a/xCAT-test/unit/tls_policy.t b/xCAT-test/unit/tls_policy.t
index 518ea9ca6..ed0acef78 100644
--- a/xCAT-test/unit/tls_policy.t
+++ b/xCAT-test/unit/tls_policy.t
@@ -60,6 +60,12 @@ is(scalar @modern_override, 0, 'modern explicit override does not warn');
 my @modern_override_tlsv11 = tls_setting_warnings({ xcatsslversion => 'SSLv23:!SSLv2:!SSLv3:!TLSv1:!TLSv11' });
 is(scalar @modern_override_tlsv11, 0, 'modern explicit override accepts TLSv11 spelling');
 
+my @spaced_disabled_protocol = tls_setting_warnings({ xcatsslversion => 'SSLv23: !SSLv2:!SSLv3:!TLSv1:!TLSv1_1' });
+is(scalar @spaced_disabled_protocol, 0, 'disabled protocol selectors tolerate surrounding whitespace');
+
+my @spaced_enabled_protocol = tls_setting_warnings({ xcatsslversion => 'TLSv12: TLSv1' });
+like($spaced_enabled_protocol[0], qr/deprecated protocols/, 'enabled protocol selectors tolerate surrounding whitespace');
+
 my @old_cipher = tls_setting_warnings({ xcatsslciphers => '3DES' });
 like($old_cipher[0], qr/legacy cipher/, 'legacy cipher selector produces a warning');
 
@@ -72,4 +78,7 @@ like($openssl_3des_cipher[0], qr/legacy cipher/, 'OpenSSL 3DES cipher name produ
 my @disabled_old_cipher = tls_setting_warnings({ xcatsslciphers => 'HIGH:!RC4:!3DES:!LOW:!EXP:!EXPORT' });
 is(scalar @disabled_old_cipher, 0, 'disabled legacy cipher selectors do not warn');
 
+my @spaced_old_cipher = tls_setting_warnings({ xcatsslciphers => 'HIGH: 3DES' });
+like($spaced_old_cipher[0], qr/legacy cipher/, 'cipher selectors tolerate surrounding whitespace');
+
 done_testing();