From 43927bb46cedfcd5b13bb22f4014b7dee0d4777f Mon Sep 17 00:00:00 2001 From: Adam Langley Date: Mon, 19 Mar 2012 12:34:35 -0400 Subject: [PATCH] crypto/tls: always send a Certificate message if one was requested. If a CertificateRequest is received we have to reply with a Certificate message, even if we don't have a certificate to offer. Fixes #3339. R=golang-dev, r, ality CC=golang-dev https://golang.org/cl/5845067 --- handshake_client.go | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/handshake_client.go b/handshake_client.go index 266eb8f..2877f17 100644 --- a/handshake_client.go +++ b/handshake_client.go @@ -166,8 +166,11 @@ func (c *Conn) clientHandshake() error { } var certToSend *Certificate + var certRequested bool certReq, ok := msg.(*certificateRequestMsg) if ok { + certRequested = true + // RFC 4346 on the certificateAuthorities field: // A list of the distinguished names of acceptable certificate // authorities. These distinguished names may specify a desired @@ -238,9 +241,14 @@ func (c *Conn) clientHandshake() error { } finishedHash.Write(shd.marshal()) - if certToSend != nil { + // If the server requested a certificate then we have to send a + // Certificate message, even if it's empty because we don't have a + // certificate to send. + if certRequested { certMsg = new(certificateMsg) - certMsg.certificates = certToSend.Certificate + if certToSend != nil { + certMsg.certificates = certToSend.Certificate + } finishedHash.Write(certMsg.marshal()) c.writeRecord(recordTypeHandshake, certMsg.marshal()) }