I'm using HAProxy 1.7.5 and openssl 1.1.0f (from Debian 9.5 stabel) to serve TLS connections. Now there are clients offering SHA-384 and SHA-512 based signature algorithms in the client hello message. So HAProxy uses RSA+SHA512 in the DH key agreement. Unfortunately due to a software bug the clients crash when choosing any signature algorithm using a hash algorithm beyond SHA-256.

This cannot easily be fixed on the client side as we are talking about hardware devices. So I need a server-side workaround to disable SHA-384 and SHA-512 based signature algorithms in Haproxy. Up to now we could do so because we were using IIS which in turn uses SCHANNEL (the Windows TLS implementation). With this solution it is possible to deactive signature algorithms.

Is there a way to deactivate specific TLS signature algorithms in HAProxy?

Essentially this is a repost of this question - hoping that is has been answered meanwhile: HAProxy configure TLS 1.2 signature algorithms extension

  • haproxy uses openssl not schannel. See here how to configure the ciphers in haproxy. And simply don't use the SHA384 and SHA512 ciphers in your configuration. – Steffen Ullrich Jan 17 '19 at 14:44
  • The signature algorithm is specified in the signature_algorithms extension of the client hello message. It is independant from the cipher suite. So I cannot influence the signature algorithm by chosing cipher suites. Please refer to: crypto.stackexchange.com/questions/31479/… and tools.ietf.org/html/rfc5246#page-45, paragraph – C.Scharfenberg Jan 17 '19 at 15:04
  • Where exactly is haproxy using these algorithms outside of ciphers where the client cannot deal with? PRF should use SHA-256 only. And signature algorithm in the certificate can not be negotiated anyway since the certificate is already fixed at time of TLS handshake. – Steffen Ullrich Jan 17 '19 at 15:19
  • "The verification of the certificate and the signatures in the TLS handshake use the hash / signature pair negotiated in the signature_algorithms extension" (crypto.stackexchange.com/questions/31479/…) – C.Scharfenberg Jan 17 '19 at 15:29
  • "If the client provided a "signature_algorithms" extension, then all certificates provided by the server MUST be signed by a hash/signature algorithm pair that appears in that extension. Note that this implies that a certificate containing a key for one signature algorithm MAY be signed using a different signature algorithm (for instance, an RSA key signed with a DSA key)." (tools.ietf.org/html/rfc5246#section-7.4.2) – C.Scharfenberg Jan 17 '19 at 15:29

The solution for me is: install haproxy 1.8.17 with openssl 1.1.1a from Debian testing. For some reason this combination uses RSA+SHA256 as signature algorithm in the DH key exchange.

The intention was to use the openssl configuration file (/etc/ssl/openssl.cnf) to set the signature algorithm E.g.

[ system_default_sect ]
SignatureAlgorithms       = RSA+SHA256
ClientSignatureAlgorithms = RSA+SHA256

This setting is only available since openssl 1.1.1. But it does not show any effect for me. Anyway, the above-mentioned software combination seems to be sufficient.

I would be grateful if anybody could offer me an explanation for this behaviour.

  • I still don't know why openssl 1.1.1a chooses RSA+SHA256 by default. But the settings in system_default_sect are respected if I build my openssl.cfg correctly. I needed to add these lines before the section:[default_conf] ssl_conf = ssl_sect [ssl_sect] system_default = system_default_sect – C.Scharfenberg Jan 22 '19 at 13:21
  • Scharfenberg - Thanks for this post...! I was pointing to the wrong direction as Steffen was too. The signature algorithm is set by OpenSSl and not by the ciphers suits. So the output from openssl s_client -connect your_host:your_port Requested Signature Algorithms: RSA+SHA512:DSA+SHA512:ECDSA+SHA512:RSA+SHA384:DSA+SHA384:ECDSA+SHA384:RSA+SHA256:DSA+SHA256:ECDSA+SHA256:RSA+SHA224:DSA+SHA224:ECDSA+SHA224:RSA+SHA1:DSA+SHA1:ECDSA+SHA1 Shared Requested Signature Algorithms: RSA+SHA512:DSA+SHA512:ECDSA+SHA512:RSA+SHA384:DSA+SHA384:ECDSA+SHA384:RSA+SHA256:DSA+SHA256:ECDSA+SHA256:RSA+SHA224:DSA+SHA – Nestor Sep 12 '19 at 6:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.