Function fipsAllowedChains

common.go:1777–1794

fipsAllowedChains returns chains that are allowed to be used in a TLS connection based on the current fips140tls enforcement setting. If fips140tls is not required, the chains are returned as-is with no processing. Otherwise, the returned chains are filtered to only those allowed by FIPS 140-3. If

(chains [][]*x509.Certificate)

// Otherwise, the returned chains are filtered to only those allowed by FIPS 140-3.
// If this results in no chains it returns an error.
func fipsAllowedChains(chains [][]*x509.Certificate) ([][]*x509.Certificate, error) {
	if !fips140tls.Required() {
		return chains, nil
	}

	permittedChains := make([][]*x509.Certificate, 0, len(chains))
	for _, chain := range chains {
		if fipsAllowChain(chain) {
			permittedChains = append(permittedChains, chain)
		}
	}

	if len(permittedChains) == 0 {
		return nil, errors.New("tls: no FIPS compatible certificate chains found")
	}

	return permittedChains, nil
}

func fipsAllowChain(chain []*x509.Certificate) bool {
	if len(chain) == 0 {