From 4620095cdd5f12175d03aa993a86cac0a6d5ea61 Mon Sep 17 00:00:00 2001 From: Valerio Setti Date: Fri, 15 May 2026 11:44:18 +0200 Subject: [PATCH 1/3] ssl: improve documentation of mbedtls_ssl_conf_sig_algs() Clarify that the 'sig_algs' set through this function are only enforced during the key exchange and that 'mbedtls_ssl_conf_cert_profile()' should instead be used to enforce the same algorithms when verifying certificates. Signed-off-by: Valerio Setti --- include/mbedtls/ssl.h | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/include/mbedtls/ssl.h b/include/mbedtls/ssl.h index 43d8175988..422b08cd12 100644 --- a/include/mbedtls/ssl.h +++ b/include/mbedtls/ssl.h @@ -3594,7 +3594,7 @@ int mbedtls_ssl_conf_cid(mbedtls_ssl_config *conf, size_t len, * * \note The restrictions are enforced for all certificates in the * chain. However, signatures in the handshake are not covered - * by this setting but by \b mbedtls_ssl_conf_sig_hashes(). + * by this setting but by \c mbedtls_ssl_conf_sig_hashes(). * * \param conf SSL configuration * \param profile Profile to use @@ -4075,7 +4075,12 @@ void MBEDTLS_DEPRECATED mbedtls_ssl_conf_sig_hashes(mbedtls_ssl_config *conf, #endif /* !MBEDTLS_DEPRECATED_REMOVED && MBEDTLS_SSL_PROTO_TLS1_2 */ /** - * \brief Configure allowed signature algorithms for use in TLS + * \brief Configure allowed signature algorithms for use in TLS key + * exchange. + * + * \note This only covers signature algorithms used in the key + * exchange. To also enforce restrictions in certificate verification + * refer to \c mbedtls_ssl_conf_cert_profile(). * * \param conf The SSL configuration to use. * \param sig_algs List of allowed IANA values for TLS 1.3 signature algorithms, From b66d56bc5fe232b5ff5026204fb323ce2fd0122b Mon Sep 17 00:00:00 2001 From: Valerio Setti Date: Mon, 18 May 2026 11:08:23 +0200 Subject: [PATCH 2/3] changelog: add note about issue 1569 resolution Signed-off-by: Valerio Setti --- ChangeLog.d/security-issue1569.txt | 4 ++++ 1 file changed, 4 insertions(+) create mode 100644 ChangeLog.d/security-issue1569.txt diff --git a/ChangeLog.d/security-issue1569.txt b/ChangeLog.d/security-issue1569.txt new file mode 100644 index 0000000000..320947ec90 --- /dev/null +++ b/ChangeLog.d/security-issue1569.txt @@ -0,0 +1,4 @@ +Security + * Improved documentation of mbedtls_ssl_conf_sig_algs() to emphasize that + this function only set signature algorithms that are enforced during + TLS key exchange and not only on certificate verification. From b9c8c9c4275bf8e5e88aa9e1e8f6d518fa78367b Mon Sep 17 00:00:00 2001 From: Valerio Setti Date: Tue, 19 May 2026 12:37:30 +0200 Subject: [PATCH 3/3] changelog: fix typos Signed-off-by: Valerio Setti --- ChangeLog.d/security-issue1569.txt | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ChangeLog.d/security-issue1569.txt b/ChangeLog.d/security-issue1569.txt index 320947ec90..c7d3ca0782 100644 --- a/ChangeLog.d/security-issue1569.txt +++ b/ChangeLog.d/security-issue1569.txt @@ -1,4 +1,4 @@ Security * Improved documentation of mbedtls_ssl_conf_sig_algs() to emphasize that - this function only set signature algorithms that are enforced during - TLS key exchange and not only on certificate verification. + this function only sets signature algorithms that are enforced during + TLS key exchange and not on certificate verification.