Re: [TLS] Deprecate SHA1 for signatures in TLS 1.3 (was Re: TLS 1.3 draft-07 sneak peek)

[Viktor Dukhovni <[e-mail]>]

On Sat, Jul 11, 2015 at 09:55:45AM -0400, Eric Rescorla wrote:

> This makes a certain amount of sense (though I wonder how often it's really
> an issue that a server declines to send a certificate that would otherwise
> have worked to a compliant client [0]).

Every time with Schannel, Exchange SMTP servers, and opportunistic
TLS SMTP clients.

> Perhaps the right text here is that if you have a conformant certificate,
> you MUST send it, but if not, you MAY send a nonconformant one?

Correct.  It is important to try to match a supported algorithm,
but failing that, send what you have.  It may well work just fine
for the client, since the signatures in question are not made in
real-time by the server, but rather at some previous time by some
CA, which the client may not care about (pinned leaf cert, DANE
leaf cert, opportunistic TLS, ...).

And the point about debugging also makes sense.  The client
administrator can much more easily determine which additional
algorithm is required to interoperate with the server.

-- 
	Viktor.