opened
agray256
username_0
## **Problem:**
RFC 8446 Section 4.4.2.2
We MUST ensure that TLS1.3 provides a cert chain that relies on SHA-1 signatures ONLY if it is the only option AND the client specifically indicates SHA-1 signatures are acceptable in signature_algorithms_cert.

## **Proposed Solution:**
Unit test and/or integration tests to verify correct behavior with cert selection given legacy signature algorithms.
Integration/Unit tests: TLS1.3 server does not send cert chain using SHA-1 unless client specifies it in signature_algorithms_cert
issue
created
agray256
username_0
Section 4.4.2.2 also says about Legacy algorithms: "Endpoints SHOULD NOT negotiate these algorithms but are permitted to do so solely for backward compatibility."

s2n has made a design decision not to support the SHA-1 legacy signature algorithms in TLS1.3

The strictest test keeping with the ban on SHA-1 in TLS1.3 would be to disallow all use of *SHA1 certs. The more lenient test would allow a *SHA1 cert to be sent by the server only if the client advertised only the legacy signature algorithms. Regardless of server support for backward compatibility, the s2n client must never receive a sha1 cert when connecting to an s2n server over TLS1.3, because it must never offer sha1 legacy algorithms as an option in that case.
comment