SSL: signature variables $ssl_sigalg and $ssl_client_sigalg #545
Conversation
The variable contains the signature algorithm used for signing messages during the handshake.
The variable contains the signature algorithm the remote peer used for signing messages during the handshake and at the local side, we can use it to verify the peer's signature.
|
Perhaps |
There was a problem hiding this comment.
For the server side, I don't see the added value: whoever made a setup is used to know which certificates he is willing to use;
that's why there's no similar server-side variables in nginx.
So, what the change usefully aims to add is ability to obtain the name of the signature
used by the client to sign TLS messages.
Note that it can be only useful with client certificate validation enabled as this information is served (indirectly) from a passed client certificate.
That said, the variable name should be prefixed with "$ssl_client_", similar to other such.
Further, I see a little benefit in using ASN1 object naming, which can be rather cryptic, such as for "id-ecPublicKey".
In this regard, IANA names are preferred and would be nice to have instead.
This is possible by using SSL_get0_peer_signature_name() introduced in OpenSSL 3.5 specifically for this purpose, i.e. logging.
It is useful for servers to have and log, when offering multiple certificates (RSA and ECC, or future PQC certificates), to know which of them are negotiated by clients, as with TLS 1.3, the signature algorithm is no longer part of the |
@ghen2 you're right, it's not part of the |
Actually, this can be usable for other purposes, such as logging client-supported scheme(s).
With these comments applied: #932 |
|
✅ All required contributors have signed the F5 CLA for this PR. Thank you! |
|
I have hereby read the F5 CLA and agree to its terms |
|
Thank you for the proposal and initial work, @willmafh ! |
Proposed changes
feature: #554
Add $ssl_sigalg variable to get signature algorithm used for signing messages during tls handshake
Add $ssl_peer_sigalg variable to get signature algorithm the peer used for signing messages during tls handshake
we can use both of them in log to know more details about the tls handshake