tls-server: Use correct error alerts if client doesn't send a certificate

TLS 1.3 defines a specific alert for this and for TLS 1.2, RFC 5246, section 7.4.6 defines handshake_failure as correct response.
2022-03-01 10:05:26 +01:00
parent 3eecd40cec
commit 2ade4311bc
1 changed files with 3 additions and 1 deletions
@@ -713,7 +713,9 @@ static status_t process_certificate(private_tls_server_t *this,
 		else
 		{
 			DBG1(DBG_TLS, "no certificate sent by peer");
-			this->alert->add(this->alert, TLS_FATAL, TLS_DECODE_ERROR);
+			this->alert->add(this->alert, TLS_FATAL,
+							 this->tls->get_version_max(this->tls) > TLS_1_2 ?
+							 TLS_CERTIFICATE_REQUIRED : TLS_HANDSHAKE_FAILURE);
 			return NEED_MORE;
 		}
 	}