Reduce TLS Handshake Certificate Request Types and Hash Algorithms?

10 Jun 2021

      In a TLS handshake the Server Certificate Request contains 3 types RSA Sign, DSS Sign, and ECDSA Sign along with 20 Signature Hash Algorithms.

Is it possible to configure freeradius to allow only ECDSA and one Hash Algorithm, or is this dictated by openssl/libopenssl reporting supported types.

Here's an example *shark capture of the certificate request handshake message:
TLSv1.2 Record Layer: Handshake Protocol: Certificate Request
    Content Type: Handshake (22)
    Version: TLS 1.2 (0x0303)
    Length: 668
    Handshake Protocol: Certificate Request
        Handshake Type: Certificate Request (13)
        Length: 664
        Certificate types count: 3
        Certificate types (3 types)
            Certificate type: RSA Sign (1)
            Certificate type: DSS Sign (2)
            Certificate type: ECDSA Sign (64)
        Signature Hash Algorithms Length: 40
        Signature Hash Algorithms (20 algorithms)
            Signature Algorithm: ecdsa_secp256r1_sha256 (0x0403)
                Signature Hash Algorithm Hash: SHA256 (4)
                Signature Hash Algorithm Signature: ECDSA (3)
            Signature Algorithm: ecdsa_secp384r1_sha384 (0x0503)
                Signature Hash Algorithm Hash: SHA384 (5)
                Signature Hash Algorithm Signature: ECDSA (3)
            Signature Algorithm: ecdsa_secp521r1_sha512 (0x0603)
                Signature Hash Algorithm Hash: SHA512 (6)
                Signature Hash Algorithm Signature: ECDSA (3)
            Signature Algorithm: ed25519 (0x0807)
                Signature Hash Algorithm Hash: Unknown (8)
                Signature Hash Algorithm Signature: Unknown (7)
            Signature Algorithm: ed448 (0x0808)
                Signature Hash Algorithm Hash: Unknown (8)
                Signature Hash Algorithm Signature: Unknown (8)
            Signature Algorithm: rsa_pss_pss_sha256 (0x0809)
                Signature Hash Algorithm Hash: Unknown (8)
                Signature Hash Algorithm Signature: Unknown (9)
            Signature Algorithm: rsa_pss_pss_sha384 (0x080a)
                Signature Hash Algorithm Hash: Unknown (8)
                Signature Hash Algorithm Signature: Unknown (10)
            Signature Algorithm: rsa_pss_pss_sha512 (0x080b)
                Signature Hash Algorithm Hash: Unknown (8)
                Signature Hash Algorithm Signature: Unknown (11)
            Signature Algorithm: rsa_pss_rsae_sha256 (0x0804)
                Signature Hash Algorithm Hash: Unknown (8)
                Signature Hash Algorithm Signature: Unknown (4)
            Signature Algorithm: rsa_pss_rsae_sha384 (0x0805)
                Signature Hash Algorithm Hash: Unknown (8)
                Signature Hash Algorithm Signature: Unknown (5)
            Signature Algorithm: rsa_pss_rsae_sha512 (0x0806)
                Signature Hash Algorithm Hash: Unknown (8)
                Signature Hash Algorithm Signature: Unknown (6)
            Signature Algorithm: rsa_pkcs1_sha256 (0x0401)
                Signature Hash Algorithm Hash: SHA256 (4)
                Signature Hash Algorithm Signature: RSA (1)
            Signature Algorithm: rsa_pkcs1_sha384 (0x0501)
                Signature Hash Algorithm Hash: SHA384 (5)
                Signature Hash Algorithm Signature: RSA (1)
            Signature Algorithm: rsa_pkcs1_sha512 (0x0601)
                Signature Hash Algorithm Hash: SHA512 (6)
                Signature Hash Algorithm Signature: RSA (1)
            Signature Algorithm: SHA224 ECDSA (0x0303)
                Signature Hash Algorithm Hash: SHA224 (3)
                Signature Hash Algorithm Signature: ECDSA (3)
            Signature Algorithm: SHA224 RSA (0x0301)
                Signature Hash Algorithm Hash: SHA224 (3)
                Signature Hash Algorithm Signature: RSA (1)
            Signature Algorithm: SHA224 DSA (0x0302)
                Signature Hash Algorithm Hash: SHA224 (3)
                Signature Hash Algorithm Signature: DSA (2)
            Signature Algorithm: SHA256 DSA (0x0402)
                Signature Hash Algorithm Hash: SHA256 (4)
                Signature Hash Algorithm Signature: DSA (2)
            Signature Algorithm: SHA384 DSA (0x0502)
                Signature Hash Algorithm Hash: SHA384 (5)
                Signature Hash Algorithm Signature: DSA (2)
            Signature Algorithm: SHA512 DSA (0x0602)
                Signature Hash Algorithm Hash: SHA512 (6)
                Signature Hash Algorithm Signature: DSA (2)

Thanks,
Jim

Reduce TLS Handshake Certificate Request Types and Hash Algorithms?

James Ko