New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[TLS 1.3] Enable post-handshake auth for OpenSSL 1.1.1 #3026
Labels
Comments
It might be sufficient to just call the function. I'm not fully sure how the actual PHA handshake works with HTTP. If I understand the Apache mod_ssl implementation correctly, then it's like HTTP STARTTLS. The server sends a HTTP connection upgrade request along a CertRequest TLS message. The client response with an upgrade confirmation along with Certificate, CertificateVerify, and Finish TLS message. |
tiran
added a commit
to tiran/curl
that referenced
this issue
Sep 21, 2018
OpenSSL 1.1.1 requires clients to opt-in for post-handshake authentication. Fixes: curl#3026 Signed-off-by: Christian Heimes <christian@python.org>
tiran
added a commit
to tiran/curl
that referenced
this issue
Sep 21, 2018
OpenSSL 1.1.1 requires clients to opt-in for post-handshake authentication. Fixes: curl#3026 Signed-off-by: Christian Heimes <christian@python.org>
tiran
added a commit
to tiran/curl
that referenced
this issue
Sep 21, 2018
OpenSSL 1.1.1 requires clients to opt-in for post-handshake authentication. Fixes: curl#3026 Signed-off-by: Christian Heimes <christian@python.org>
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Curl does neither call
SSL_CTX_set_post_handshake_auth()
norSSL_set_post_handshake_auth()
to enable TLS 1.3's post handshake authentication feature. TLS 1.3 does no longer support renegotiation, therefore PHA is required when the server requires TLS client cert auth depending on HTTP method and/or path. OpenSSL 1.1.1 changed PHA to opt-in.I noticed the issue while I was working on PHA support for Python. I wanted to verify my implementation with curl...
Resources:
The text was updated successfully, but these errors were encountered: