This issue relates to #9757
What version of Go are you using (go version)?
go 1.8.3
Does this issue reproduce with the latest release?
Yes
What operating system and processor architecture are you using (go env)?
Windows, x64
What did you do?
Tried to connect to SQL Server with go-mssql library with TLS 1.2. SQL server has a signed certificate using SHA512/RSA signature algorithm.
What did you expect to see?
Expect the communication to succeed.
What did you see instead?
Handshake fails with TLS Handshake failed: Cannot read handshake packet: EOF
The handshake failure is due to SQL server closing the connection because the signature algorithm SHA512/RSA is not in the list of supported signature algorithms in the tls library sent in the ClientHello message. The list of supported signature algorithms currently is defined here: https://github.com/golang/go/blob/master/src/crypto/tls/common.go#L139
Interestingly enough the tls library does work with SHA512/RSA if SQL server is configured to use TLS 1.1 where the server basically gets to choose which signature algorithm it uses (decided by the SSL certificate) and it is up to the client to reject an unknown signature algorithm.
Because the tls library works with SHA512/RSA it should advertise that as a supported signature algorithm.
This issue relates to #9757
What version of Go are you using (
go version)?go 1.8.3
Does this issue reproduce with the latest release?
Yes
What operating system and processor architecture are you using (
go env)?Windows, x64
What did you do?
Tried to connect to SQL Server with go-mssql library with TLS 1.2. SQL server has a signed certificate using SHA512/RSA signature algorithm.
What did you expect to see?
Expect the communication to succeed.
What did you see instead?
Handshake fails with
TLS Handshake failed: Cannot read handshake packet: EOFThe handshake failure is due to SQL server closing the connection because the signature algorithm SHA512/RSA is not in the list of supported signature algorithms in the tls library sent in the ClientHello message. The list of supported signature algorithms currently is defined here: https://github.com/golang/go/blob/master/src/crypto/tls/common.go#L139
Interestingly enough the tls library does work with SHA512/RSA if SQL server is configured to use TLS 1.1 where the server basically gets to choose which signature algorithm it uses (decided by the SSL certificate) and it is up to the client to reject an unknown signature algorithm.
Because the tls library works with SHA512/RSA it should advertise that as a supported signature algorithm.