I'm using HAProxy 1.7.5 and openssl 1.1.0f (from Debian 9.5 stabel) to serve TLS connections. Now there are clients offering SHA-384 and SHA-512 based signature algorithms in the client hello message. So HAProxy uses RSA+SHA512 in the DH key agreement. Unfortunately due to a software bug the clients crash when choosing any signature algorithm using a hash algorithm beyond SHA-256.
This cannot easily be fixed on the client side as we are talking about hardware devices. So I need a server-side workaround to disable SHA-384 and SHA-512 based signature algorithms in Haproxy. Up to now we could do so because we were using IIS which in turn uses SCHANNEL (the Windows TLS implementation). With this solution it is possible to deactive signature algorithms.
Is there a way to deactivate specific TLS signature algorithms in HAProxy?
Essentially this is a repost of this question - hoping that is has been answered meanwhile: HAProxy configure TLS 1.2 signature algorithms extension