Subject: [TLS] Intolerance for delegated credentials

From: "Martin Thomson" <[email-masked]>
Date: Tue, 24 Aug 2021 15:12:44 +1000

Hey,

We've found a server that is intolerant of our offer to use delegated credentials.  This seems to run a modern nginx and TLS 1.3, but it is not producing the same handshake keys as us, so I can't tell if it supports the extension or not (as the EncryptedExtensions message is indecipherable).  The TLS stack is unknown, but as it supports ARIA, CAMELLIA, and CCM_8 (!) that might narrow things down a little.

Is anyone deploying delegated credentials that I'm not aware of?  Or has the codepoint assignment (34) run afoul of an experiment we're not aware of?