X-Git-Url: http://www.git.stargrave.org/?a=blobdiff_plain;f=tls.go;h=b2ad433d6ddc0bb3d16c2c0b391b4ae0fadfa8cb;hb=e05f6f8830b01d52cc21cd5f97cef6616a5334b9;hp=51470f37bb802ebe1f45cb10eefe0c1b2d24e74b;hpb=e057b4615b830e49508b76f722f1461755aafdda;p=godlighty.git

diff --git a/tls.go b/tls.go
index 51470f3..b2ad433 100644
--- a/tls.go
+++ b/tls.go
@@ -1,6 +1,6 @@
 /*
 godlighty -- highly-customizable HTTP, HTTP/2, HTTPS server
-Copyright (C) 2021-2022 Sergey Matveev <stargrave@stargrave.org>
+Copyright (C) 2021-2023 Sergey Matveev <stargrave@stargrave.org>
 
 This program is free software: you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
@@ -67,12 +67,17 @@ func GetCertificate(chi *tls.ClientHelloInfo) (*tls.Certificate, error) {
 			return cert, nil
 		}
 	}
-	if CHIHasEdDSA(chi) {
-		if cert := HostToEdDSACertificate[chi.ServerName]; cert != nil {
-			return cert, nil
+	var cert *tls.Certificate
+	if len(HostToECDSACertificate) == 0 {
+		cert = HostToEdDSACertificate[chi.ServerName]
+	} else {
+		if CHIHasEdDSA(chi) {
+			if cert := HostToEdDSACertificate[chi.ServerName]; cert != nil {
+				return cert, nil
+			}
 		}
+		cert = HostToECDSACertificate[chi.ServerName]
 	}
-	cert := HostToECDSACertificate[chi.ServerName]
 	if cert == nil {
 		return nil, errors.New("no certificate found")
 	}
@@ -84,7 +89,7 @@ func GetConfigForClient(chi *tls.ClientHelloInfo) (*tls.Config, error) {
 	if CHIHasGOST(chi) {
 		pool = HostGOSTClientAuth[chi.ServerName]
 	}
-	if pool == nil && CHIHasEdDSA(chi) {
+	if pool == nil && (CHIHasEdDSA(chi) || len(HostECDSAClientAuth) == 0) {
 		pool = HostEdDSAClientAuth[chi.ServerName]
 	}
 	if pool == nil {
@@ -149,11 +154,9 @@ func loadCertificates(
 				log.Fatalln(err)
 			}
 			pool.AddCert(ca)
+			(*hostClientAuth)[host] = pool
 		}
 	}
-	if len(pool.Subjects()) > 0 {
-		(*hostClientAuth)[host] = pool
-	}
 }
 
 func LoadCertificates() {