Client credential selection for TLS 1.3
@@ -208,17 +208,12 @@ public TlsCredentials getClientCredentials(CertificateRequest certificateRequest
@SuppressWarnings("unchecked")
Principal[] issuers = JsseUtils.toX500Principals(certificateRequest.getCertificateAuthorities());
- ProtocolVersion negotiatedVersion = context.getServerVersion();
- if (TlsUtils.isTLSv13(negotiatedVersion))
- {
- return chooseClientCredentials13(issuers);
- }
-
+ // TODO[tls13] Should be null from TLS 1.3
short[] certificateTypes = certificateRequest.getCertificateTypes();
- if (TlsUtils.isTLSv12(negotiatedVersion))
+ if (TlsUtils.isTLSv12(context))
{
- return chooseClientCredentials12(issuers, certificateTypes);
+ return chooseClientCredentials(issuers, certificateTypes);
}
return chooseClientCredentialsLegacy(issuers, certificateTypes);
@@ -453,7 +448,7 @@ protected TlsCredentials chooseClientCredentialsLegacy(Principal[] issuers, shor
return createCredentialedSigner(x509Key.getPrivateKey(), tlsCertificate, null);
}
- protected TlsCredentials chooseClientCredentials12(Principal[] issuers, short[] certificateTypes)
+ protected TlsCredentials chooseClientCredentials(Principal[] issuers, short[] certificateTypes)
throws IOException
{
/*
@@ -473,12 +468,15 @@ protected TlsCredentials chooseClientCredentials12(Principal[] issuers, short[]
continue;
}
+ if (null != certificateTypes)
+ {
short signatureAlgorithm = signatureSchemeInfo.getSignatureAlgorithm();
short certificateType = SignatureAlgorithm.getClientCertificateType(signatureAlgorithm);
if (certificateType < 0 || !Arrays.contains(certificateTypes, certificateType))
{
continue;
}
+ }
if (!signatureSchemeInfo.isActive(algorithmConstraints))
{
@@ -505,12 +503,6 @@ protected TlsCredentials chooseClientCredentials12(Principal[] issuers, short[]
return null;
}
- protected TlsCredentials chooseClientCredentials13(Principal[] issuers) throws IOException
- {
- // TODO[tls13]
- throw new TlsFatalAlert(AlertDescription.internal_error);
- }
-
protected TlsCredentialedSigner createCredentialedSigner(PrivateKey privateKey, Certificate certificate,
SignatureAndHashAlgorithm sigAndHashAlg)
{
