On Tue, 2021-01-19 at 21:21 +0100, Daniel Gustafsson wrote: > There is something iffy with these certs (the test fails > on mismatching ciphers and/or signature algorithms) that I haven't been able > to > pin down, but to get more eyes on this I'm posting the patch with the test > enabled.
Removing `--keyUsage keyEncipherment` from the native_server-* CSR generation seems to let the tests pass for me, but I'm wary of just pushing that as a solution because I don't understand why that would have anything to do with the failure mode (SSL_ERROR_NO_SUPPORTED_SIGNATURE_ALGORITHM). > The NSS toolchain requires interactive input which makes the Makefile > a bit hacky, ideas on cleaning that up are appreciated. Hm. I got nothing, short of a feature request to NSS... --Jacob
