TLS 1.3 Certificate entry extensions must now correspond to ones in the ClientHello or CertificateRequest (unsupported_extension), and a server requires the client's certificate_request_context to match its CertificateRequest (illegal_parameter).

Author: peterdettman

docs/releasenotes.md

@@ -79,6 +79,7 @@ Date: 2026, TBD
 - TLS: A TLS 1.3 client rejected every server certificate whose TLS feature extension (RFC 7633) listed status_request ("must-staple") whenever it had offered status_request itself, since the feature was looked for only in EncryptedExtensions, where RFC 8446 does not permit it; TLS 1.3 carries the OCSP response in the end-entity certificate's CertificateEntry. A feature is now also satisfied by the extensions of that CertificateEntry, and a feature whose extension has no place in TLS 1.3, such as status_request_v2, is no longer enforced once TLS 1.3 is negotiated (github #2458).
 - (D)TLS: A server certificate whose TLS feature extension listed status_request or status_request_v2 was accepted without any OCSP response for it when the server acknowledged the status request but then sent no CertificateStatus message, which RFC 6066 permits, or sent an ocsp_multi list with no response for the end-entity certificate. Such a certificate now requires a stapled OCSP response for the end-entity certificate, in every protocol version. A TLS feature in force against a (D)TLS 1.2 ServerHello that carried no extensions at all now fails with a certificate_unknown alert rather than a NullPointerException.
 - TLS: A TLS 1.3 client aborted the handshake with an illegal_parameter alert when the server sent the cached_info or record_size_limit extension in EncryptedExtensions, or the server_name extension in a CertificateRequest, since these were missing from the table of extensions permitted in each TLS 1.3 message.
+- TLS: The extensions of the CertificateEntry list in a TLS 1.3 Certificate message were not checked against what the receiving endpoint had asked for, although RFC 8446 sec. 4.4.2 requires those in a server's Certificate to correspond to extensions in the ClientHello and those in a client's Certificate to extensions in the CertificateRequest: a client ignored an OCSP response the server stapled without being asked, and a server accepted whatever a client attached. An unrequested extension in any entry now aborts the handshake with an unsupported_extension alert, as RFC 8446 sec. 4.2 requires. A TLS 1.3 server also now rejects a client Certificate whose certificate_request_context differs from that of its CertificateRequest, with an illegal_parameter alert.
 
 ### 2.1.3 Additional Features and Functionality
 

tls/src/main/java/org/bouncycastle/tls/CertificateRequest.java

@@ -173,20 +173,7 @@ public void encode(TlsContext context, OutputStream output)
         {
             TlsUtils.writeOpaque8(certificateRequestContext, output);
 
-            Hashtable extensions = new Hashtable();
-            TlsExtensionsUtils.addSignatureAlgorithmsExtension(extensions, supportedSignatureAlgorithms);
-
-            if (null != supportedSignatureAlgorithmsCert)
-            {
-                TlsExtensionsUtils.addSignatureAlgorithmsCertExtension(extensions, supportedSignatureAlgorithmsCert);
-            }
-
-            if (null != certificateAuthorities)
-            {
-                TlsExtensionsUtils.addCertificateAuthoritiesExtension(extensions, certificateAuthorities);
-            }
-
-            byte[] extEncoding = TlsProtocol.writeExtensionsData(extensions);
+            byte[] extEncoding = TlsProtocol.writeExtensionsData(createExtensions13());
 
             TlsUtils.writeOpaque16(extEncoding, output);
             return;
@@ -227,6 +214,28 @@ public void encode(TlsContext context, OutputStream output)
         }
     }
 
+    /**
+     * The extensions of this (TLS 1.3) CertificateRequest, as {@link #encode(TlsContext, OutputStream)}
+     * sends them.
+     */
+    Hashtable createExtensions13() throws IOException
+    {
+        Hashtable extensions = new Hashtable();
+        TlsExtensionsUtils.addSignatureAlgorithmsExtension(extensions, supportedSignatureAlgorithms);
+
+        if (null != supportedSignatureAlgorithmsCert)
+        {
+            TlsExtensionsUtils.addSignatureAlgorithmsCertExtension(extensions, supportedSignatureAlgorithmsCert);
+        }
+
+        if (null != certificateAuthorities)
+        {
+            TlsExtensionsUtils.addCertificateAuthoritiesExtension(extensions, certificateAuthorities);
+        }
+
+        return extensions;
+    }
+
     /**
      * Parse a {@link CertificateRequest} from an {@link InputStream}.
      * 

tls/src/main/java/org/bouncycastle/tls/DTLSServerProtocol.java

@@ -793,11 +793,6 @@ protected void invalidateSession(ServerHandshakeState state)
     protected void notifyClientCertificate(ServerHandshakeState state, Certificate clientCertificate)
         throws IOException
     {
-        if (null == state.certificateRequest)
-        {
-            throw new TlsFatalAlert(AlertDescription.internal_error);
-        }
-
         TlsUtils.processClientCertificate(state.serverContext, clientCertificate, state.keyExchange, state.server);
     }
 

tls/src/main/java/org/bouncycastle/tls/TlsClientProtocol.java

@@ -1643,7 +1643,8 @@ protected void receive13ServerCertificate(ByteArrayInputStream buf)
             throw new TlsFatalAlert(AlertDescription.unexpected_message);
         }
 
-        this.authentication = TlsUtils.receive13ServerCertificate(tlsClientContext, tlsClient, buf);
+        this.authentication = TlsUtils.receive13ServerCertificate(tlsClientContext, tlsClient, clientExtensions,
+            buf);
 
         // NOTE: In TLS 1.3 we don't have to wait for a possible CertificateStatus message.
         handleServerCertificate();

tls/src/main/java/org/bouncycastle/tls/TlsServerProtocol.java

@@ -1441,11 +1441,6 @@ protected void handleAlertWarningMessage(short alertDescription)
     protected void notifyClientCertificate(Certificate clientCertificate)
         throws IOException
     {
-        if (null == certificateRequest)
-        {
-            throw new TlsFatalAlert(AlertDescription.internal_error);
-        }
-
         TlsUtils.processClientCertificate(tlsServerContext, clientCertificate, keyExchange, tlsServer);
     }
 
@@ -1467,6 +1462,17 @@ protected void receive13ClientCertificate(ByteArrayInputStream buf)
 
         assertEmpty(buf);
 
+        /*
+         * RFC 8446 4.4.2. If this message is in response to a CertificateRequest, the value of
+         * certificate_request_context in that message.
+         */
+        if (!certificateRequest.hasCertificateRequestContext(clientCertificate.getCertificateRequestContext()))
+        {
+            throw new TlsFatalAlert(AlertDescription.illegal_parameter);
+        }
+
+        TlsUtils.check13CertificateEntryExtensions(clientCertificate, certificateRequest.createExtensions13());
+
         notifyClientCertificate(clientCertificate);
     }
 

tls/src/main/java/org/bouncycastle/tls/TlsUtils.java

@@ -5406,7 +5406,7 @@ static TlsAuthentication receiveServerCertificate(TlsClientContext clientContext
     }
 
     static TlsAuthentication receive13ServerCertificate(TlsClientContext clientContext, TlsClient client,
-        ByteArrayInputStream buf) throws IOException
+        Hashtable clientExtensions, ByteArrayInputStream buf) throws IOException
     {
         SecurityParameters securityParameters = clientContext.getSecurityParametersHandshake();
         if (null != securityParameters.getPeerCertificate())
@@ -5432,6 +5432,8 @@ static TlsAuthentication receive13ServerCertificate(TlsClientContext clientConte
             throw new TlsFatalAlert(AlertDescription.decode_error);
         }
 
+        check13CertificateEntryExtensions(serverCertificate, clientExtensions);
+
         securityParameters.peerCertificate = serverCertificate;
         securityParameters.tlsServerEndPoint = null;
 
@@ -6378,6 +6380,47 @@ static void checkExtensionData13(Hashtable extensions, int handshakeType, short
         }
     }
 
+    /**
+     * RFC 8446 4.4.2. Extensions in the Certificate message from the server MUST correspond to ones
+     * from the ClientHello message. Extensions in the Certificate message from the client MUST
+     * correspond to extensions in the CertificateRequest message from the server.
+     *
+     * @param certificate       a TLS 1.3 Certificate message received from the peer.
+     * @param requestExtensions the extensions of the ClientHello (for a server Certificate) or the
+     *                          CertificateRequest (for a client Certificate) that this endpoint sent.
+     */
+    static void check13CertificateEntryExtensions(Certificate certificate, Hashtable requestExtensions)
+        throws IOException
+    {
+        int count = certificate.getLength();
+        for (int i = 0; i < count; ++i)
+        {
+            Hashtable extensions = certificate.getCertificateEntryAt(i).getExtensions();
+            if (null == extensions)
+            {
+                continue;
+            }
+
+            Enumeration e = extensions.keys();
+            while (e.hasMoreElements())
+            {
+                Integer extensionType = (Integer)e.nextElement();
+
+                /*
+                 * RFC 8446 4.2. Implementations MUST NOT send extension responses if the remote
+                 * endpoint did not send the corresponding extension requests [..]. Upon receiving
+                 * such an extension, an endpoint MUST abort the handshake with an
+                 * "unsupported_extension" alert.
+                 */
+                if (!hasExtension(requestExtensions, extensionType))
+                {
+                    throw new TlsFatalAlert(AlertDescription.unsupported_extension,
+                        "Unrequested extension in CertificateEntry: " + ExtensionType.getText(extensionType.intValue()));
+                }
+            }
+        }
+    }
+
     /**
      * Generate a pre_master_secret and send it encrypted to the server.
      */

tls/src/test/java/org/bouncycastle/tls/test/AllTests.java

@@ -40,6 +40,7 @@ public static Test suite()
         suite.addTestSuite(OCSPTest.class);
         suite.addTestSuite(PRFTest.class);
         suite.addTestSuite(Tls13CertificateStatusTest.class);
+        suite.addTestSuite(Tls13ClientCertificateTest.class);
         suite.addTestSuite(Tls13PSKProtocolTest.class);
         suite.addTestSuite(TlsHandshakeTimeoutTest.class);
         suite.addTestSuite(TlsProtocolNonBlockingTest.class);

tls/src/test/java/org/bouncycastle/tls/test/Tls13CertificateStatusTest.java

@@ -218,24 +218,47 @@ public void testClientReadsNullOutsideTheChain()
     }
 
     /**
-     * RFC 8446 sec. 4.2: a server answers only the extensions the client sent, so a staple the client
-     * never asked for is ignored - not read, and not a reason to fail the handshake. The staple has to
-     * be attached to the Certificate by hand here, the protocol declining to consult
-     * getCertificateStatus() for a client that did not ask.
+     * RFC 8446 sec. 4.2: a server answers only the extensions the client sent, and an endpoint
+     * receiving any other MUST abort the handshake with unsupported_extension - so a staple the client
+     * never asked for fails it. The staple has to be attached to the Certificate by hand here, the
+     * protocol declining to consult getCertificateStatus() for a client that did not ask.
      */
-    public void testClientIgnoresAnUnsolicitedStaple()
+    public void testClientRejectsAnUnsolicitedStaple()
         throws Exception
     {
         byte[] extensionData = TlsExtensionsUtils.createStatusRequestExtension13(
             new CertificateStatus(CertificateStatusType.ocsp, ocspResponse("unsolicited")));
 
-        CapturingTlsClient client = runHandshake(null, false, false, extensionData);
+        CapturingTlsClient client = new CapturingTlsClient(false);
 
-        assertEquals("the staple should still have been on the wire", "unsolicited",
-            getStapledMarker(client.certificateEntryList[0]));
+        try
+        {
+            runHandshake(client, null, false, extensionData);
+            fail("expected an unsupported_extension");
+        }
+        catch (Exception e)
+        {
+            assertClientFailedWith(client, AlertDescription.unsupported_extension);
+        }
+    }
 
-        assertNull(client.serverCertificate.getCertificateStatus());
-        assertNull(client.serverCertificate.getCertificateStatusAt(0));
+    /**
+     * Every CertificateEntry is held to the ClientHello, not just the end-entity certificate's.
+     */
+    public void testClientRejectsAnUnsolicitedStapleOnAnIntermediate()
+        throws Exception
+    {
+        CapturingTlsClient client = new CapturingTlsClient(false);
+
+        try
+        {
+            runHandshake(client, null, true, null);
+            fail("expected an unsupported_extension");
+        }
+        catch (Exception e)
+        {
+            assertClientFailedWith(client, AlertDescription.unsupported_extension);
+        }
     }
 
     /**