mirrors/utls
1
0
Fork 0
mirror of https://github.com/refraction-networking/utls.git synced 2025-04-03 20:17:36 +03:00
Code Issues Projects Releases Packages Wiki Activity

crypto/tls: fix client certificates support for legacy servers

Browse source 
signatureSchemesForCertificate was written to be used with TLS 1.3, but
ended up used for TLS 1.2 client certificates in a refactor. Since it
only supported TLS 1.3 signature algorithms, it would lead to no RSA
client certificates being sent to servers that didn't support RSA-PSS.

TestHandshakeClientCertRSAPKCS1v15 was testing *specifically* for this,
but alas the OpenSSL flag -verify accepts an empty certificates list as
valid, as opposed to -Verify...

Fixes #28925

Change-Id: I61afc02ca501d3d64ab4ad77bbb4cf10931e6f93
Reviewed-on: https://go-review.googlesource.com/c/151660
Run-TryBot: Filippo Valsorda <filippo@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Adam Langley <agl@golang.org>
This commit is contained in:
Filippo Valsorda 2018-11-29 01:38:07 -05:00 • committed by Filippo Valsorda
parent 6571d32361
commit daa7ff8195
10 changed files with 298 additions and 142 deletions
Download patch file Download diff file Expand all files Collapse all files

2
handshake_client.go
View file

@ -934,7 +934,7 @@ func (c *Conn) getClientCertificate(cri *CertificateRequestInfo) (*Certificate,
// Issuer is in AcceptableCAs.
for i, chain := range c.config.Certificates {
sigOK := false
for _, alg := range signatureSchemesForCertificate(&chain) {
for _, alg := range signatureSchemesForCertificate(c.vers, &chain) {
if isSupportedSignatureAlgorithm(alg, cri.SignatureSchemes) {
sigOK = true
break