Re: [TLS] TLS 1.3 certificate delegation?

[Johannes Merkle <[e-mail]>]

>>
>> FWIW, there's precedent for using new TLS versions to expand the set
>> of allowable certificates.  If I"m reading it correctly, TLS 1.2
>> allows ECDSA certificates that are signed with RSA; TLS 1.1 and below
>> will reject those.
> 
> TLSv1.1 will certainly not reject those.
> It is only rfc4492 that incorrectly alleges that those should be rejected.

I think you are wrong: Section 7.4.2 of RFC 4346 states

                              Unless otherwise specified, the signing
      algorithm for the certificate MUST be the same as the algorithm
      for the certificate key.


Section 7.4.2 of RFC 5246 states
                                                                  Note
   that this implies that a certificate containing a key for one
   signature algorithm MAY be signed using a different signature
   algorithm (for instance, an RSA key signed with a DSA key).  This is
   a departure from TLS 1.1, which required that the algorithms be the
   same.

Johannes