From 544c86b8e41746ee793fdf0c4f401a572131dd82 Mon Sep 17 00:00:00 2001
From: Chris Conlon <chris@wolfssl.com>
Date: Fri, 20 Jun 2014 10:16:07 -0600
Subject: [PATCH 1/2] update taoCerts.txt to use 1024 RSA by default, SHA1
 instead of MD5

---
 certs/taoCert.txt | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/certs/taoCert.txt b/certs/taoCert.txt
index 15a12c059..798660767 100644
--- a/certs/taoCert.txt
+++ b/certs/taoCert.txt
@@ -1,11 +1,11 @@
 
 ***** Create a self signed cert ************
 
-1) openssl genrsa 512 > client-key.pem
+1) openssl genrsa 1024 > client-key.pem
 
-2) openssl req -new -x509 -nodes -md5 -days 1000 -key client-key.pem > client-cert.pem
+2) openssl req -new -x509 -nodes -sha1 -days 1000 -key client-key.pem > client-cert.pem
 
-3) note sha1 would be -sha1
+3) note md5 would be -md5
 
 -- adding metadata to beginning
 
@@ -21,13 +21,13 @@ same as self signed, use ca prefix instead of client
 
 ***** Create a cert signed by CA **************
 
-1) openssl req -newkey rsa:512 -md5 -days 1000 -nodes -keyout server-key.pem > server-req.pem
+1) openssl req -newkey rsa:1024 -sha1 -days 1000 -nodes -keyout server-key.pem > server-req.pem
 
 * note if using exisitng key do: -new -key keyName
 
 2) copy ca-key.pem ca-cert.srl   (why ????)
 
-3) openssl x509 -req -in server-req.pem -days 1000 -md5 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 01 > server-cert.pem
+3) openssl x509 -req -in server-req.pem -days 1000 -sha1 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 01 > server-cert.pem
 
 
 ***** Adding Subject Key ID and Authentication Key ID extensions to a cert *****

From 6371b3c262b6dcdb4158e54bf10e8ea3357d377f Mon Sep 17 00:00:00 2001
From: toddouska <todd@wolfssl.com>
Date: Fri, 20 Jun 2014 09:22:40 -0700
Subject: [PATCH 2/2] send ecdsa_sign for client cert request type is sig algo
 ecdsa

---
 cyassl/internal.h |  5 ++++-
 src/internal.c    | 12 ++++++++++--
 2 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/cyassl/internal.h b/cyassl/internal.h
index 9b6c95a58..59329a75e 100644
--- a/cyassl/internal.h
+++ b/cyassl/internal.h
@@ -1438,7 +1438,10 @@ enum ClientCertificateType {
     dss_fixed_dh        = 4,
     rsa_ephemeral_dh    = 5,
     dss_ephemeral_dh    = 6,
-    fortezza_kea_cert   = 20
+    fortezza_kea_cert   = 20,
+    ecdsa_sign          = 64,
+    rsa_fixed_ecdh      = 65,
+    ecdsa_fixed_ecdh    = 66
 };
 
 
diff --git a/src/internal.c b/src/internal.c
index f84225940..f2565bdb2 100644
--- a/src/internal.c
+++ b/src/internal.c
@@ -6009,7 +6009,7 @@ int SendCertificateRequest(CYASSL* ssl)
     int    sendSz;
     word32 i = RECORD_HEADER_SZ + HANDSHAKE_HEADER_SZ;
     
-    int  typeTotal = 1;  /* only rsa for now */
+    int  typeTotal = 1;  /* only 1 for now */
     int  reqSz = ENUM_LEN + typeTotal + REQ_HEADER_SZ;  /* add auth later */
 
     if (IsAtLeastTLSv1_2(ssl))
@@ -6037,7 +6037,15 @@ int SendCertificateRequest(CYASSL* ssl)
 
     /* write to output */
     output[i++] = (byte)typeTotal;  /* # of types */
-    output[i++] = rsa_sign;
+#ifdef HAVE_ECC
+    if (ssl->options.cipherSuite0 == ECC_BYTE &&
+                     ssl->specs.sig_algo == ecc_dsa_sa_algo) {
+        output[i++] = ecdsa_sign;
+    } else
+#endif /* HAVE_ECC */
+    {
+        output[i++] = rsa_sign;
+    }
 
     /* supported hash/sig */
     if (IsAtLeastTLSv1_2(ssl)) {