Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add cert key type checking to chooseClientAlias #2417

Merged
merged 1 commit into from Jan 24, 2022
Merged

Add cert key type checking to chooseClientAlias #2417

merged 1 commit into from Jan 24, 2022

Commits on Jan 24, 2022

  1. Add cert key type checking to chooseClientAlias 

    Previously, these functions ignored the keyType (or 'strings') argument to the chooseClientAlias function. Some libraries (e.g. Bouncy Castle) expect that when chooseClientAlias is called and key types are passed in, that it will return null if the cert doesn't use one of the given key types. For example, if ['EC'] was passed in for keyType and the cert contained an RSA key, since this would return 'user' rather than null in that case, it would cause Bouncy Castle to assume using an ECDSA signing algorithm was okay, and cause problems during the Certificate Verify part of the handshake.

This modifies these functions to only return 'user' if keyType is passed in and the cert contains a key of that type. If keyType is empty or null, it will ignore this and continue to check only the issuer.
    @nmburgan
    nmburgan committed Jan 24, 2022
    Copy the full SHA
    788b228 View commit details
    Browse the repository at this point in the history