From a3ae8be611dc31792d80c266664ff093e2070dc4 Mon Sep 17 00:00:00 2001 From: Valerio Setti Date: Fri, 15 May 2026 11:44:18 +0200 Subject: [PATCH 1/3] ssl: improve documentation of mbedtls_ssl_conf_sig_algs() Clarify that the 'sig_algs' set through this function are only enforced during the key exchange and that 'mbedtls_ssl_conf_cert_profile()' should instead be used to enforce the same algorithms when verifying certificates. Signed-off-by: Valerio Setti --- include/mbedtls/ssl.h | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/include/mbedtls/ssl.h b/include/mbedtls/ssl.h index 3a69df5466..2a6d98ab1c 100644 --- a/include/mbedtls/ssl.h +++ b/include/mbedtls/ssl.h @@ -3411,7 +3411,7 @@ int mbedtls_ssl_conf_cid(mbedtls_ssl_config *conf, size_t len, * * \note The restrictions are enforced for all certificates in the * chain. However, signatures in the handshake are not covered - * by this setting but by \b mbedtls_ssl_conf_sig_algs(). + * by this setting but by \c mbedtls_ssl_conf_sig_algs(). * * \param conf SSL configuration * \param profile Profile to use @@ -3899,7 +3899,12 @@ void mbedtls_ssl_conf_groups(mbedtls_ssl_config *conf, #if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED) /** - * \brief Configure allowed signature algorithms for use in TLS + * \brief Configure allowed signature algorithms for use in TLS key + * exchange. + * + * \note This only covers signature algorithms used in the key + * exchange. To also enforce restrictions in certificate verification + * refer to \c mbedtls_ssl_conf_cert_profile(). * * \param conf The SSL configuration to use. * \param sig_algs List of allowed IANA values for TLS 1.3 signature algorithms, From c53e78796a10da69b8f7feb668628bfa4d3168fb Mon Sep 17 00:00:00 2001 From: Valerio Setti Date: Mon, 18 May 2026 11:08:23 +0200 Subject: [PATCH 2/3] changelog: add note about issue 1569 resolution Signed-off-by: Valerio Setti --- ChangeLog.d/security-issue1569.txt | 4 ++++ 1 file changed, 4 insertions(+) create mode 100644 ChangeLog.d/security-issue1569.txt diff --git a/ChangeLog.d/security-issue1569.txt b/ChangeLog.d/security-issue1569.txt new file mode 100644 index 0000000000..320947ec90 --- /dev/null +++ b/ChangeLog.d/security-issue1569.txt @@ -0,0 +1,4 @@ +Security + * Improved documentation of mbedtls_ssl_conf_sig_algs() to emphasize that + this function only set signature algorithms that are enforced during + TLS key exchange and not only on certificate verification. From 147ad72669797947bef12a0bdbe5dec0ed805c58 Mon Sep 17 00:00:00 2001 From: Valerio Setti Date: Tue, 19 May 2026 12:37:30 +0200 Subject: [PATCH 3/3] changelog: fix typos Signed-off-by: Valerio Setti --- ChangeLog.d/security-issue1569.txt | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ChangeLog.d/security-issue1569.txt b/ChangeLog.d/security-issue1569.txt index 320947ec90..c7d3ca0782 100644 --- a/ChangeLog.d/security-issue1569.txt +++ b/ChangeLog.d/security-issue1569.txt @@ -1,4 +1,4 @@ Security * Improved documentation of mbedtls_ssl_conf_sig_algs() to emphasize that - this function only set signature algorithms that are enforced during - TLS key exchange and not only on certificate verification. + this function only sets signature algorithms that are enforced during + TLS key exchange and not on certificate verification.