Description
Describe the feature you'd like supported
Currently MsQuic only supports a single QUIC_CERTIFICATE_HASH_STORE in QUIC_CREDENTIAL_CONFIG, so servers cannot offer both RSA-based and ECDSA-based ciphers. As certificate protocols evolve it would be useful to support multiple types of certificates simultaneously.
Proposed solution
QUIC_CREDENTIAL_CONFIG.CertificateHashStore is already a pointer type. Either accept an array length via the Reserved parameter, or create a new QUIC_CERTIFICATE_MULTI_HASH_STORE type to handle an array of hash store objects.
Additional context
No response
Metadata
Metadata
Assignees
Type
Projects
Status
Should be written
Status
No status
Activity
nibanks commentedon Oct 12, 2022
How does Schannel/OpenSSL expose/support this?
Techwolfy commentedon Oct 12, 2022
Schannel accepts an array of
SCHANNEL_CERT_HASH_STOREin the ACH call viaSCH_CREDENTIALS.{paCred,cCreds}. MsQuic already uses this butcCredsis currently always set to1. I'm not familiar with OpenSSL unfortunately.anrossi commentedon Oct 12, 2022
I think from the Envoy work I did, I saw a BoringSSL API for setting multiple certificates. It might also exist and behave the same in OpenSSL. So I might have an idea there
nibanks commentedon Oct 13, 2022
Thanks @Techwolfy. Is there a significant priority around this ask? Also, I'd recommend simply going with the
QUIC_CERTIFICATE_MULTI_HASH_STOREproposal (indicated by a newQUIC_CREDENTIAL_FLAGS). Should be pretty easy to wire up.Techwolfy commentedon Oct 14, 2022
I'm currently working on a new feature that uses this. It's not too urgent, but we'd like to get it done in the current semester.