RFC7250 - RawPublicKey - No Suitable Certificate?

[boaks]

I'm currently on testing the interoperability of the OpenSSL - RPK PR.

If the client has "no suitable certificate", the current implementation in "main" branch aborts the handshake.

dtls.c: check_server_hellodone

An alternative approach would be, to implement RFC 5246 - 7.4.6 - Client Certificate :

If no suitable certificate is available, the client MUST send a certificate message containing no certificates. That is, the certificate_list structure has a length of zero.

That enables an server to decide to continue or abort.

Any opinions?

[mrdeep1]

Empty client certificate list back to the server works for me.