proposal: crypto/tls: Allow setting SignatureSchemes in Config

[klausenbusk]

There is currently no easy way to set SignatureSchemes when using crypto/tls as a client. I assume we could just add SignatureSchemes to Config.

I need this feature, so I can monitor both RSA and ECDSA certificates when the TLS server (HTTPS in this case) is offering both. Relevant issue: prometheus/blackbox_exporter#731.

[rsc]

/cc @FiloSottile

[FiloSottile]

Sorry, but we don't add options to crypto/tls that are only useful for diagnostic tools. As far as I know, applications have no reason to have preferences on signature algorithms, so we can make that selection for them.

[klausenbusk]

Sorry, but we don't add options to crypto/tls that are only useful for diagnostic tools.

That kinda make sense, but what are my options then? I need to monitor both certificates and for that I need SignatureSchemes support. Fork crypto/tls? Create my own TLS library? Create and bash script which run openssl?

[FiloSottile]

Forks are the usual solution to this. There are already a few that might work for you, like github.com/zmap/zcrypto/tls.