TLS 1.3 certificate_authorities extension in ClientHello

[mattia-moffa]

This adds an example for the TLS 1.3 certificate_authorities extension in ClientHello.

This was newly implemented in wolfSSL/wolfssl#9209. Should wait for that to be merged before this.

[Copilot]

Pull Request Overview

This PR adds example implementations showcasing the TLS 1.3 certificate_authorities extension in ClientHello messages. The examples demonstrate how clients can indicate supported certificate authorities to guide server certificate selection.

• Adds a complete TLS 1.3 server example that responds to certificate_authorities extensions
• Adds a corresponding client example that sends certificate_authorities extensions
• Implements dynamic certificate selection based on client-provided CA names

Reviewed Changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated 3 comments.

File	Description
tls/server-tls13-certauth-c2s.c	Server implementation with certificate selection callback based on client CA names
tls/client-tls13-certauth-c2s.c	Client implementation that sends certificate_authorities extension in ClientHello

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[julek-wolfssl]

Examples should be minimal pieces of code showcasing only a set of features. Comments about "bloat" refer to features that are not relevant to CA lists.

I ran the examples and everything looks to work.

[mattia-moffa]

@julek-wolfssl That's not code written by me. I took client-tls13.c and server-tls13.c and modified them to showcase the new feature. I tried to follow the guideline in wolfssl-examples/tls/README.md that says:

In general, the naming convention of these files mean that if a file is named in the form X-Y.c, then it's a copy of X.c intended to demonstrate Y. The exceptions being server-tls.c and client-tls.c, as noted above. Furthermore, the files is formatted such that using a diff tool such as vimdiff to compare X-Y.c to X.c should highlight only the relevant changes required to convert X.c into X-Y.c

The changes you're suggesting are not on things that I added, they're also present in client-tls13.c and server-tls13.c.

[julek-wolfssl]

Thanks for pointing that out. I still think that its better to remove these sections because we already have default secret callbacks in wolfssl so these callbacks are not necessary. Removing the callbacks cuts out ~80 lines from each example.

[mattia-moffa]

Alright. Should I do that on these new files only or on other files that do this too?

[julek-wolfssl]

Only on new files for now. You can add a note to the README if you want to be extra thoughtful.