From 873890316c3acbc48926f184e9bcabd02f309be9 Mon Sep 17 00:00:00 2001 From: Kareem Date: Wed, 20 Jul 2022 12:08:20 -0700 Subject: [PATCH] Don't require digital signature bit for static RSA cipher suites. --- src/internal.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/internal.c b/src/internal.c index 56eac2df9..1dbd49afe 100644 --- a/src/internal.c +++ b/src/internal.c @@ -13379,7 +13379,8 @@ int ProcessPeerCerts(WOLFSSL* ssl, byte* input, word32* inOutIdx, (args->dCert->extKeyUsage & KEYUSE_KEY_ENCIPHER) == 0) { ret = KEYUSE_ENCIPHER_E; } - if ((ssl->specs.sig_algo == rsa_sa_algo || + if ((ssl->specs.kea != rsa_kea) && + (ssl->specs.sig_algo == rsa_sa_algo || (ssl->specs.sig_algo == ecc_dsa_sa_algo && !ssl->specs.static_ecdh)) && (args->dCert->extKeyUsage & KEYUSE_DIGITAL_SIG) == 0) {