[erlang-questions] TLS: Choosing a server certificate based on client's accepted algorithms

Roger Lipscombe <>
Wed Jul 12 18:49:51 CEST 2017


Apparently, nginx allows you to specify multiple server certificates
(e.g. RSA and ECDHE), and it'll choose the appropriate one based on
the client's preference.

See, for example:
https://scotthelme.co.uk/hybrid-rsa-and-ecdsa-certificates-with-nginx/

I find myself needing something similar. Historically, my server's
used SHA1 certificates, and I want to move to SHA256 certificate, but
I've got embedded clients which are hard to change, so I need to
support both, at least for a while.

Can I persuade OTP to offer a different server certificate depending
on the client?

I can't use (e.g.) SNI, because the client doesn't provide the
server_name extension.

Thanks,
Roger.


More information about the erlang-questions mailing list