Description
ClientHelloInfo.SupportsCertificate can report that a certificate is supported even when the later TLS 1.2 handshake path would reject it under the signature-algorithm policy. This can mislead GetCertificate callbacks or other certificate-selection logic that relies on SupportsCertificate.
The handshake fails closed, so this is an API consistency and protocol-policy issue rather than an authentication bypass.
Specification
RFC 5246 Section 7.4.2 and Section 7.4.4 define TLS 1.2 certificate and certificate-request behavior, including the signature algorithms a peer is prepared to verify. For TLS 1.2, certificate selection should be consistent with the advertised or default signature-algorithm policy.
Code references
go/src/crypto/tls/common.go:1536 defines CertificateRequestInfo.SupportsCertificate.go/src/crypto/tls/common.go:1540 calls selectSignatureScheme using the SignatureSchemes recorded in the request info.go/src/crypto/tls/handshake_client.go:1213 through go/src/crypto/tls/handshake_client.go:1234 synthesizes fallback signature schemes when the TLS 1.2 signature_algorithms extension is absent.go/src/crypto/tls/handshake_client.go:1265 through go/src/crypto/tls/handshake_client.go:1269 uses SupportsCertificate during client-certificate selection.
Test case
This should be a crypto/tls unit test, likely by adding cases to TestClientHelloInfo_SupportsCertificate, where SupportsCertificate and the handshake's TLS 1.2 signature policy currently disagree.
Description
ClientHelloInfo.SupportsCertificatecan report that a certificate is supported even when the later TLS 1.2 handshake path would reject it under the signature-algorithm policy. This can misleadGetCertificatecallbacks or other certificate-selection logic that relies onSupportsCertificate.The handshake fails closed, so this is an API consistency and protocol-policy issue rather than an authentication bypass.
Specification
RFC 5246 Section 7.4.2 and Section 7.4.4 define TLS 1.2 certificate and certificate-request behavior, including the signature algorithms a peer is prepared to verify. For TLS 1.2, certificate selection should be consistent with the advertised or default signature-algorithm policy.
Code references
go/src/crypto/tls/common.go:1536definesCertificateRequestInfo.SupportsCertificate.go/src/crypto/tls/common.go:1540callsselectSignatureSchemeusing theSignatureSchemesrecorded in the request info.go/src/crypto/tls/handshake_client.go:1213throughgo/src/crypto/tls/handshake_client.go:1234synthesizes fallback signature schemes when the TLS 1.2signature_algorithmsextension is absent.go/src/crypto/tls/handshake_client.go:1265throughgo/src/crypto/tls/handshake_client.go:1269usesSupportsCertificateduring client-certificate selection.Test case
This should be a
crypto/tlsunit test, likely by adding cases toTestClientHelloInfo_SupportsCertificate, whereSupportsCertificateand the handshake's TLS 1.2 signature policy currently disagree.