I know it is possible to use RSASSA-PKCS1-v1_5 with client certificates in TLS 1.3. But what about the other way around: using RSASSA-PSS with client certificates in TLS 1.2?

Is it possible to use RSASSA-PSS signed certificates with TLS 1.2 at all? Do I have to fall-back to RSASSA-PKCS1-v1_5 during handshake?

I searched through the RFC5246 but was not able to find anything that answers my questions.

  • 2
    $\begingroup$ You didn't miss anything; RFC 5246 did not have PSS. RFC8446 4.2.3 requires 1.3 implementations that negotiate down to 1.2 support PSS; dupe crypto.stackexchange.com/questions/79665/… . For Java in particular, see stackoverflow.com/questions/61676711/… stackoverflow.com/questions/62688276/… $\endgroup$ Aug 11, 2020 at 3:32
  • 2
    $\begingroup$ I've not closed it as a dupe as I think an even more detailed answer would be possible. Client auth is more or less an add-on to the handshake. Generally you would need to discuss with the other party to include client auth anyway (due to the trust of specific client certificate chains). I don't see any specific problems by just using PSS in TLS 1.2 in that case... just test if it works on both sides. $\endgroup$
    – Maarten Bodewes
    Aug 11, 2020 at 8:19

1 Answer 1


If the client announces in the Signature Algorithm Extension that it supports one of the RSA-PSS:


then server may choose this even in TLS1.2. => Yes, it's possible to use RSA-PSS with TLS1.2.

The main difference beside the different preencoding is, that RSA-PSS in TLS1.2 needs the handshake message content instead of the constructed data (containing TLS 1.3, server CertificateVerify).

If the client does not announce these RSA-PSS signature algorithms, the server must not use these.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.