[gnutls-devel] GnuTLS | Fix TLS 1.3 handshake (!2095)

[Read-only notification of GnuTLS library development activities]

Daiki Ueno commented: https://gitlab.com/gnutls/gnutls/-/merge_requests/2095#note_3260134885


Note that the `signature_algorithms_cert` extension is not widely used; none of OpenSSL, NSS, and GnuTLS handles the extension (OpenSSL does send it, but doesn't recognize it).

In the [parse_cert_extension](https://gitlab.com/gnutls/gnutls/-/blob/master/lib/tls13/certificate_request.c#L115) function you mentioned in #1842, the values come from the `signature_algorithms` extension (not the `signature_algorithms_cert` extension) attached to Certificate Request message, meaning that the server requests a cert signed with an algorithm listed in the extension, while the client has only RSA signed certificate.

According to your comment on #1842, the server wants either ecdsa_*, ed25519, ed448, or rsa_pss*. If the server is indicating rsa_pss_rsae_* (not rsa_pss_pss_*), the client should be able to present the (non-restricted) RSA certificates. Could you check that, maybe using wireshark (see https://wiki.wireshark.org/TLS)?

-- 
Reply to this email directly or view it on GitLab: https://gitlab.com/gnutls/gnutls/-/merge_requests/2095#note_3260134885
You're receiving this email because of your account on gitlab.com. Unsubscribe from this thread: https://gitlab.com/-/sent_notifications/4-8x4fsx2piqvw7g5bhrahc8pmu-a84t7/unsubscribe | Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.gnupg.org/pipermail/gnutls-devel/attachments/20260417/e97bce07/attachment.html>