From: Matt Caswell <matt@openssl.org>
Date: Mon, 5 Dec 2016 14:58:51 +0000 (+0000)
Subject: Add a TODO(TLS1.3) around certificate selection
X-Git-Tag: OpenSSL_1_1_1-pre1~2723
X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=3f305a80e9a449a1c8671f387ac3e0575dfdd9bf;p=oweals%2Fopenssl.git

Add a TODO(TLS1.3) around certificate selection

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2157)
---

diff --git a/ssl/ssl_lib.c b/ssl/ssl_lib.c
index 58873456c8..21ea2843f7 100644
--- a/ssl/ssl_lib.c
+++ b/ssl/ssl_lib.c
@@ -2823,6 +2823,12 @@ int ssl_check_srvr_ecc_cert_and_alg(X509 *x, SSL *s)
 static int ssl_get_server_cert_index(const SSL *s)
 {
     int idx;
+
+    /*
+     * TODO(TLS1.3): In TLS1.3 the selected certificate is not based on the
+     * ciphersuite. For now though it still is. Our only TLS1.3 ciphersuite
+     * forces the use of an RSA cert. This will need to change.
+     */
     idx = ssl_cipher_get_cert_index(s->s3->tmp.new_cipher);
     if (idx == SSL_PKEY_RSA_ENC && !s->cert->pkeys[SSL_PKEY_RSA_ENC].x509)
         idx = SSL_PKEY_RSA_SIGN;