ML-DSA certificates cannot be used with QUIC and HTTP/3
Open
area-System.Net.Quic
disabled-test
tracking-external-issue
- Dominant language
- C#
- Stars
- 18.3k
- Forks
- 5.6k
- PR merge metrics
- PR metrics pending
Description
Discoverd during https://github.com/dotnet/runtime/pull/119265.
On linux, statically linked libssl does not recognize ML-DSA certificates as valid for TLS purposes. This introduces situation on OpenSSL 3.5.0+ systems where HTTP/1.1 and HTTP/2 can use ML-DSA certs (as they go through system libssl), but not with QUIC and by extension HTTP/3 (as they go through statically linked quictls which is pre 3.5.0 fork of OpenSSL.
This should get eventually resolved with MsQuic builds that use system libssl, as those expose APIs necessary to support MsQUic without need for a fork.
Contributor guide
Assessment
This issue has not been assessed yet.