target = "https://tools.ietf.org/rfc/rfc5246#section-7.4.2"

# 7.4.2.  Server Certificate
#
# When this message will be sent:
# 
#    The server MUST send a Certificate message whenever the agreed-
#    upon key exchange method uses certificates for authentication
#    (this includes all key exchange methods defined in this document
#    except DH_anon).  This message will always immediately follow the
#    ServerHello message.
# 
# Meaning of this message:
# 
#    This message conveys the server's certificate chain to the client.
# 
#    The certificate MUST be appropriate for the negotiated cipher
#    suite's key exchange algorithm and any negotiated extensions.
# 
# Structure of this message:
# 
#    opaque ASN.1Cert<1..2^24-1>;
# 
#    struct {
#        ASN.1Cert certificate_list<0..2^24-1>;
#    } Certificate;
# 
# certificate_list
#    This is a sequence (chain) of certificates.  The sender's
#    certificate MUST come first in the list.  Each following
#    certificate MUST directly certify the one preceding it.  Because
#    certificate validation requires that root keys be distributed
#    independently, the self-signed certificate that specifies the root
#    certificate authority MAY be omitted from the chain, under the
#    assumption that the remote end must already possess it in order to
#    validate it in any case.
# 
# The same message type and structure will be used for the client's
# response to a certificate request message.  Note that a client MAY
# send no certificates if it does not have an appropriate certificate
# to send in response to the server's authentication request.
# 
# Note: PKCS #7 [PKCS7] is not used as the format for the certificate
# vector because PKCS #6 [PKCS6] extended certificates are not used.
# Also, PKCS #7 defines a SET rather than a SEQUENCE, making the task
# of parsing the list more difficult.
# 
# The following rules apply to the certificates sent by the server:
# 
# -  The certificate type MUST be X.509v3, unless explicitly negotiated
#    otherwise (e.g., [TLSPGP]).
# 
# -  The end entity certificate's public key (and associated
#    restrictions) MUST be compatible with the selected key exchange
#    algorithm.
# 
#    Key Exchange Alg.  Certificate Key Type
# 
#    RSA                RSA public key; the certificate MUST allow the
#    RSA_PSK            key to be used for encryption (the
#                       keyEncipherment bit MUST be set if the key
#                       usage extension is present).
#                       Note: RSA_PSK is defined in [TLSPSK].
# 
#    DHE_RSA            RSA public key; the certificate MUST allow the
#    ECDHE_RSA          key to be used for signing (the
#                       digitalSignature bit MUST be set if the key
#                       usage extension is present) with the signature
#                       scheme and hash algorithm that will be employed
#                       in the server key exchange message.
#                       Note: ECDHE_RSA is defined in [TLSECC].
# 
#    DHE_DSS            DSA public key; the certificate MUST allow the
#                       key to be used for signing with the hash
#                       algorithm that will be employed in the server
#                       key exchange message.
# 
#    DH_DSS             Diffie-Hellman public key; the keyAgreement bit
#    DH_RSA             MUST be set if the key usage extension is
#                       present.
# 
#    ECDH_ECDSA         ECDH-capable public key; the public key MUST
#    ECDH_RSA           use a curve and point format supported by the
#                       client, as described in [TLSECC].
# 
#    ECDHE_ECDSA        ECDSA-capable public key; the certificate MUST
#                       allow the key to be used for signing with the
#                       hash algorithm that will be employed in the
#                       server key exchange message.  The public key
#                       MUST use a curve and point format supported by
#                       the client, as described in  [TLSECC].
# 
# -  The "server_name" and "trusted_ca_keys" extensions [TLSEXT] are
#    used to guide certificate selection.
# 
# If the client provided a "signature_algorithms" extension, then all
# certificates provided by the server MUST be signed by a
# hash/signature algorithm pair that appears in that extension.  Note
# that this implies that a certificate containing a key for one
# signature algorithm MAY be signed using a different signature
# algorithm (for instance, an RSA key signed with a DSA key).  This is
# a departure from TLS 1.1, which required that the algorithms be the
# same.  Note that this also implies that the DH_DSS, DH_RSA,
# ECDH_ECDSA, and ECDH_RSA key exchange algorithms do not restrict the
# algorithm used to sign the certificate.  Fixed DH certificates MAY be
# signed with any hash/signature algorithm pair appearing in the
# extension.  The names DH_DSS, DH_RSA, ECDH_ECDSA, and ECDH_RSA are
# historical.
# 
# If the server has multiple certificates, it chooses one of them based
# on the above-mentioned criteria (in addition to other criteria, such
# as transport layer endpoint, local configuration and preferences,
# etc.).  If the server has a single certificate, it SHOULD attempt to
# validate that it meets these criteria.
# 
# Note that there are certificates that use algorithms and/or algorithm
# combinations that cannot be currently used with TLS.  For example, a
# certificate with RSASSA-PSS signature key (id-RSASSA-PSS OID in
# SubjectPublicKeyInfo) cannot be used because TLS defines no
# corresponding signature algorithm.
# 
# As cipher suites that specify new key exchange methods are specified
# for the TLS protocol, they will imply the certificate format and the
# required encoded keying information.

[[spec]]
level = "MUST"
quote = '''
The server MUST send a Certificate message whenever the agreed-
upon key exchange method uses certificates for authentication
(this includes all key exchange methods defined in this document
except DH_anon).
'''

[[spec]]
level = "MUST"
quote = '''
The certificate MUST be appropriate for the negotiated cipher
suite's key exchange algorithm and any negotiated extensions.
'''

[[spec]]
level = "MUST"
quote = '''
The sender's
certificate MUST come first in the list.
'''

[[spec]]
level = "MUST"
quote = '''
Each following
certificate MUST directly certify the one preceding it.
'''

[[spec]]
level = "MAY"
quote = '''
Because
certificate validation requires that root keys be distributed
independently, the self-signed certificate that specifies the root
certificate authority MAY be omitted from the chain, under the
assumption that the remote end must already possess it in order to
validate it in any case.
'''

[[spec]]
level = "MAY"
quote = '''
Note that a client MAY
send no certificates if it does not have an appropriate certificate
to send in response to the server's authentication request.
'''

[[spec]]
level = "MUST"
quote = '''
-  The certificate type MUST be X.509v3, unless explicitly negotiated
otherwise (e.g., [TLSPGP]).
'''

[[spec]]
level = "MUST"
quote = '''
-  The end entity certificate's public key (and associated
restrictions) MUST be compatible with the selected key exchange
algorithm.
'''

[[spec]]
level = "MUST"
quote = '''
RSA                RSA public key; the certificate MUST allow the
RSA_PSK            key to be used for encryption (the
keyEncipherment bit MUST be set if the key
usage extension is present).
'''

[[spec]]
level = "MUST"
quote = '''
RSA                RSA public key; the certificate MUST allow the
RSA_PSK            key to be used for encryption (the
keyEncipherment bit MUST be set if the key
usage extension is present).
'''

[[spec]]
level = "MUST"
quote = '''
DHE_RSA            RSA public key; the certificate MUST allow the
ECDHE_RSA          key to be used for signing (the
digitalSignature bit MUST be set if the key
usage extension is present) with the signature
scheme and hash algorithm that will be employed
in the server key exchange message.
'''

[[spec]]
level = "MUST"
quote = '''
DHE_RSA            RSA public key; the certificate MUST allow the
ECDHE_RSA          key to be used for signing (the
digitalSignature bit MUST be set if the key
usage extension is present) with the signature
scheme and hash algorithm that will be employed
in the server key exchange message.
'''

[[spec]]
level = "MUST"
quote = '''
DHE_DSS            DSA public key; the certificate MUST allow the
key to be used for signing with the hash
algorithm that will be employed in the server
key exchange message.
'''

[[spec]]
level = "MUST"
quote = '''
DH_DSS             Diffie-Hellman public key; the keyAgreement bit
DH_RSA             MUST be set if the key usage extension is
present.
'''

[[spec]]
level = "MUST"
quote = '''
ECDH_ECDSA         ECDH-capable public key; the public key MUST
ECDH_RSA           use a curve and point format supported by the
client, as described in [TLSECC].
'''

[[spec]]
level = "MUST"
quote = '''
ECDHE_ECDSA        ECDSA-capable public key; the certificate MUST
allow the key to be used for signing with the
hash algorithm that will be employed in the
server key exchange message.
'''

[[spec]]
level = "MUST"
quote = '''
The public key
MUST use a curve and point format supported by
the client, as described in  [TLSECC].
'''

[[spec]]
level = "MUST"
quote = '''
If the client provided a "signature_algorithms" extension, then all
certificates provided by the server MUST be signed by a
hash/signature algorithm pair that appears in that extension.
'''

[[spec]]
level = "MAY"
quote = '''
Note
that this implies that a certificate containing a key for one
signature algorithm MAY be signed using a different signature
algorithm (for instance, an RSA key signed with a DSA key).
'''

[[spec]]
level = "MAY"
quote = '''
Fixed DH certificates MAY be
signed with any hash/signature algorithm pair appearing in the
extension.
'''

[[spec]]
level = "SHOULD"
quote = '''
If the server has a single certificate, it SHOULD attempt to
validate that it meets these criteria.
'''

