()
| 572 | } |
| 573 | |
| 574 | func (hs *serverHandshakeStateTLS13) sendServerCertificate() error { |
| 575 | c := hs.c |
| 576 | |
| 577 | // Only one of PSK and certificates are used at a time. |
| 578 | if hs.usingPSK { |
| 579 | return nil |
| 580 | } |
| 581 | |
| 582 | if hs.requestClientCert() { |
| 583 | // Request a client certificate |
| 584 | certReq := new(certificateRequestMsgTLS13) |
| 585 | certReq.ocspStapling = true |
| 586 | certReq.scts = true |
| 587 | certReq.supportedSignatureAlgorithms = supportedSignatureAlgorithms |
| 588 | if c.config.ClientCAs != nil { |
| 589 | certReq.certificateAuthorities = c.config.ClientCAs.Subjects() |
| 590 | } |
| 591 | |
| 592 | hs.transcript.Write(certReq.marshal()) |
| 593 | if _, err := c.writeRecord(recordTypeHandshake, certReq.marshal()); err != nil { |
| 594 | return err |
| 595 | } |
| 596 | } |
| 597 | |
| 598 | certMsg := new(certificateMsgTLS13) |
| 599 | |
| 600 | certMsg.certificate = *hs.cert |
| 601 | certMsg.scts = hs.clientHello.scts && len(hs.cert.SignedCertificateTimestamps) > 0 |
| 602 | certMsg.ocspStapling = hs.clientHello.ocspStapling && len(hs.cert.OCSPStaple) > 0 |
| 603 | |
| 604 | hs.transcript.Write(certMsg.marshal()) |
| 605 | if _, err := c.writeRecord(recordTypeHandshake, certMsg.marshal()); err != nil { |
| 606 | return err |
| 607 | } |
| 608 | |
| 609 | certVerifyMsg := new(certificateVerifyMsg) |
| 610 | certVerifyMsg.hasSignatureAlgorithm = true |
| 611 | certVerifyMsg.signatureAlgorithm = hs.sigAlg |
| 612 | |
| 613 | sigType, sigHash, err := typeAndHashFromSignatureScheme(hs.sigAlg) |
| 614 | if err != nil { |
| 615 | return c.sendAlert(alertInternalError) |
| 616 | } |
| 617 | |
| 618 | signed := signedMessage(sigHash, serverSignatureContext, hs.transcript) |
| 619 | signOpts := crypto.SignerOpts(sigHash) |
| 620 | if sigType == signatureRSAPSS { |
| 621 | signOpts = &rsa.PSSOptions{SaltLength: rsa.PSSSaltLengthEqualsHash, Hash: sigHash} |
| 622 | } |
| 623 | sig, err := hs.cert.PrivateKey.(crypto.Signer).Sign(c.config.rand(), signed, signOpts) |
| 624 | if err != nil { |
| 625 | public := hs.cert.PrivateKey.(crypto.Signer).Public() |
| 626 | if rsaKey, ok := public.(*rsa.PublicKey); ok && sigType == signatureRSAPSS && |
| 627 | rsaKey.N.BitLen()/8 < sigHash.Size()*2+2 { // key too small for RSA-PSS |
| 628 | c.sendAlert(alertHandshakeFailure) |
| 629 | } else { |
| 630 | c.sendAlert(alertInternalError) |
| 631 | } |
no test coverage detected