Reduce TLS Handshake Certificate Request Types and Hash Algorithms?
James Ko
jim.list at hotmail.com
Thu Jun 10 21:15:12 CEST 2021
> See "cipher_list" in mods-enabled/eap. The string contents are passed directly to OpenSSL. See the OpenSSL documentation for what names to use, and how to format them.
I have cipher_list="ECDHE-ECDSA-AES128-CCM8" and it is the only Cipher Suites listed in the Server Hello portion of the message as captured below. I would like to also reduce the supported Certificate Hash Algorithms reported in the Certificate Request portion of the TLS message.
Transport Layer Security
TLSv1.2 Record Layer: Handshake Protocol: Server Hello
Content Type: Handshake (22)
Version: TLS 1.2 (0x0303)
Length: 66
Handshake Protocol: Server Hello
Handshake Type: Server Hello (2)
Length: 62
Version: TLS 1.2 (0x0303)
Random: 12747cfe9804564023feaacaed5b3d9be5a06c4b2e7943cfa035166f8c2b5312
Session ID Length: 0
Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 (0xc0ae)
Compression Method: null (0)
Extensions Length: 22
Extension: renegotiation_info (len=1)
Type: renegotiation_info (65281)
Length: 1
Renegotiation Info extension
Extension: max_fragment_length (len=1)
Type: max_fragment_length (1)
Length: 1
Maximum Fragment Length: 2048 (3)
Extension: ec_point_formats (len=4)
Type: ec_point_formats (11)
Length: 4
EC point formats Length: 3
Elliptic curves point formats (3)
EC point format: uncompressed (0)
EC point format: ansiX962_compressed_prime (1)
EC point format: ansiX962_compressed_char2 (2)
Extension: extended_master_secret (len=0)
Type: extended_master_secret (23)
Length: 0
Thanks,
Jim
More information about the Freeradius-Users
mailing list