crypto/tls: Config.EncryptedClientHelloRejectionVerify has no access to the certificates

[fortuna]

Go version

go version go1.25.0 darwin/arm64

Output of go env in your module/workspace:

Not relevant

What did you do?

I'm trying to use Config.EncryptedClientHelloRejectionVerify to validate the certificate for the rejection. However, there's nothing about the certificates in the input ConnectionState:

My code:

			tlsConfig.EncryptedClientHelloRejectionVerify = func(cs tls.ConnectionState) error {
				slog.Debug("EncryptedClientHelloRejectionVerify", "ConnectionState", cs)
				return nil
			}

What did you see happen?

Output:

{Version:772 HandshakeComplete:false DidResume:false CipherSuite:4865 CurveID:X25519MLKEM768 NegotiatedProtocol:http/1.1 NegotiatedProtocolIsMutual:true ServerName:public.test.defo.ie PeerCertificates:[] VerifiedChains:[] SignedCertificateTimestamps:[] OCSPResponse:[] TLSUnique:[] ECHAccepted:false ekm:<nil> testingOnlyDidHRR:false testingOnlyPeerSignatureAlgorithm:0}

If I try to access the PeerCertificate, it panics, because it's empty.

What did you expect to see?

I need the PeerCertificates and VerifiedChains in order to do custom certificate verification like we do with TLS without ECH.

Strangely, the if the verification function is not set, the code does its own validation, but it's not customizable:
https://cs.opensource.google/go/go/+/master:src/crypto/tls/handshake_client.go;l=1137;drc=7bba745820b771307593b7278ce17464eeda2f3d

I also don't understand why the VerifyPeerCertificate is disabled when ECH is rejected:
https://cs.opensource.google/go/go/+/master:src/crypto/tls/handshake_client.go;l=1194;drc=7bba745820b771307593b7278ce17464eeda2f3d

Because of that, there's no way to validate the certificate on ECH rejection with custom Roots or for a server name that doesn't match the public name.

[fortuna]

Of note: it does see the OCSPResponse, when available:

{Version:772 HandshakeComplete:false DidResume:false CipherSuite:4866 CurveID:X25519 NegotiatedProtocol:http/1.1 NegotiatedProtocolIsMutual:true ServerName:test.defo.ie PeerCertificates:[] VerifiedChains:[] SignedCertificateTimestamps:[] OCSPResponse:[48 130 1 52 10 1 0 160 130 1 45 48 130 1 41 6 9 43 6 1 5 5 7 48 1 1 4 130 1 26 48 130 1 22 48 129 158 162 22 4 20 10 188 8 41 23 140 165 57 109 122 14 206 51 199 46 179 237 251 195 122 24 15 50 48 50 53 48 56 51 48 50 49 48 49 51 51 90 48 115 48 113 48 73 48 9 6 5 43 14 3 2 26 5 0 4 20 43 29 30 152 204 243 118 4 214 193 200 189 21 162 36 200 4 19 0 56 4 20 10 188 8 41 23 140 165 57 109 122 14 206 51 199 46 179 237 251 195 122 2 16 10 104 174 217 200 97 246 117 233 137 207 239 166 251 207 173 128 0 24 15 50 48 50 53 48 56 51 48 50 48 52 53 48 50 90 160 17 24 15 50 48 50 53 48 57 48 54 49 57 52 53 48 50 90 48 10 6 8 42 134 72 206 61 4 3 3 3 103 0 48 100 2 48 46 52 191 238 235 247 171 224 185 134 199 221 220 198 150 93 68 246 138 53 196 184 125 244 76 12 11 248 11 127 2 106 28 176 171 241 72 232 211 203 68 142 194 25 86 238 47 39 2 48 58 112 173 74 222 243 78 171 53 109 73 118 90 86 112 241 25 251 20 199 71 33 186 117 249 53 134 202 168 97 221 173 56 142 38 93 13 186 190 107 59 179 21 126 207 207 82 97] TLSUnique:[] ECHAccepted:false ekm: testingOnlyDidHRR:false testingOnlyPeerSignatureAlgorithm:0}

[gabyhelp]

Related Issues

• crypto/tls: client should not fail if it sets an ECH config and the server rejects it #75240 (closed)
• crypto/tls: encryptedExtensions.echRetryConfigs not returned to client #70915 (closed)
• crypto/tls: After the ech key verification fails, the new key sent by the ech server will not be used for handshake. #70073 (closed)
• crypto/tls: server should send a `illegal_parameter` alert when it received an invalid `ECHClientHello.type` #71061 (closed)
• tls.Config.VerifyPeerCertificate should have serverHandshakeState or tls.Conn argument #29895 (closed)
• crypto/tls: VerifyClientCertIfGiven with "bad" client certificate #70783

_{(Emoji vote if this was helpful or unhelpful; more detailed feedback welcome in this discussion.)}

[prattmic]

cc @golang/security