From a3ae8be611dc31792d80c266664ff093e2070dc4 Mon Sep 17 00:00:00 2001 From: Valerio Setti Date: Fri, 15 May 2026 11:44:18 +0200 Subject: [PATCH] ssl: improve documentation of mbedtls_ssl_conf_sig_algs() Clarify that the 'sig_algs' set through this function are only enforced during the key exchange and that 'mbedtls_ssl_conf_cert_profile()' should instead be used to enforce the same algorithms when verifying certificates. Signed-off-by: Valerio Setti --- include/mbedtls/ssl.h | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/include/mbedtls/ssl.h b/include/mbedtls/ssl.h index 3a69df5466..2a6d98ab1c 100644 --- a/include/mbedtls/ssl.h +++ b/include/mbedtls/ssl.h @@ -3411,7 +3411,7 @@ int mbedtls_ssl_conf_cid(mbedtls_ssl_config *conf, size_t len, * * \note The restrictions are enforced for all certificates in the * chain. However, signatures in the handshake are not covered - * by this setting but by \b mbedtls_ssl_conf_sig_algs(). + * by this setting but by \c mbedtls_ssl_conf_sig_algs(). * * \param conf SSL configuration * \param profile Profile to use @@ -3899,7 +3899,12 @@ void mbedtls_ssl_conf_groups(mbedtls_ssl_config *conf, #if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED) /** - * \brief Configure allowed signature algorithms for use in TLS + * \brief Configure allowed signature algorithms for use in TLS key + * exchange. + * + * \note This only covers signature algorithms used in the key + * exchange. To also enforce restrictions in certificate verification + * refer to \c mbedtls_ssl_conf_cert_profile(). * * \param conf The SSL configuration to use. * \param sig_algs List of allowed IANA values for TLS 1.3 signature algorithms,