Clean up signature algorithm handling.

Now that we no longer support TLSv1.0 and TLSv1.1, SSL_USE_SIGALGS()
is always true - remove all of the code that handles the non-sigalgs
path, along with SSL_USE_SIGALGS() and the related flags.

Also remove SIGALG_RSA_PKCS1_MD5_SHA1 and references to it, since this
is also now unused.

ok kenjiro@ tb@

5 files changed, 66 insertions, 261 deletions

diff --git a/src/lib/libssl/ssl_clnt.c b/src/lib/libssl/ssl_clnt.c
index 6ef81a1706..b59ffa0eff 100644
--- a/src/lib/libssl/ssl_clnt.c
+++ b/src/lib/libssl/ssl_clnt.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl_clnt.c,v 1.171 2026/04/03 12:58:19 jsing Exp $ */
+/* $OpenBSD: ssl_clnt.c,v 1.172 2026/05/31 14:34:44 jsing Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -1034,13 +1034,6 @@ ssl3_get_server_hello(SSL *s)
         if (!tls1_transcript_hash_init(s))
                 goto err;
 
-        /*
-         * Don't digest cached records if no sigalgs: we may need them for
-         * client authentication.
-         */
-        if (!SSL_USE_SIGALGS(s))
-                tls1_transcript_free(s);
-
         if (!CBS_get_u8(&cbs, &compression_method))
                 goto decode_err;
 
@@ -1384,10 +1377,9 @@ ssl3_get_server_key_exchange(SSL *s)
                         goto fatal_err;
                 }
 
-                if (SSL_USE_SIGALGS(s)) {
-                        if (!CBS_get_u16(&cbs, &sigalg_value))
-                                goto decode_err;
-                }
+                if (!CBS_get_u16(&cbs, &sigalg_value))
+                        goto decode_err;
+
                 if (!CBS_get_u16_length_prefixed(&cbs, &signature))
                         goto decode_err;
                 if (CBS_len(&signature) > EVP_PKEY_size(pkey)) {
@@ -1448,7 +1440,7 @@ ssl3_get_server_key_exchange(SSL *s)
 static int
 ssl3_get_certificate_request(SSL *s)
 {
-        CBS cert_request, cert_types, rdn_list;
+        CBS cert_request, cert_types, rdn_list, sigalgs;
         X509_NAME *xn = NULL;
         const unsigned char *q;
         STACK_OF(X509_NAME) *ca_sk = NULL;
@@ -1497,27 +1489,23 @@ ssl3_get_certificate_request(SSL *s)
         if (!CBS_get_u8_length_prefixed(&cert_request, &cert_types))
                 goto decode_err;
 
-        if (SSL_USE_SIGALGS(s)) {
-                CBS sigalgs;
-
-                if (CBS_len(&cert_request) < 2) {
-                        SSLerror(s, SSL_R_DATA_LENGTH_TOO_LONG);
-                        goto err;
-                }
-                if (!CBS_get_u16_length_prefixed(&cert_request, &sigalgs)) {
-                        ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR);
-                        SSLerror(s, SSL_R_DATA_LENGTH_TOO_LONG);
-                        goto err;
-                }
-                if (CBS_len(&sigalgs) % 2 != 0 || CBS_len(&sigalgs) > 64) {
-                        ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR);
-                        SSLerror(s, SSL_R_SIGNATURE_ALGORITHMS_ERROR);
-                        goto err;
-                }
-                if (!CBS_stow(&sigalgs, &s->s3->hs.sigalgs,
-                    &s->s3->hs.sigalgs_len))
-                        goto err;
+        if (CBS_len(&cert_request) < 2) {
+                SSLerror(s, SSL_R_DATA_LENGTH_TOO_LONG);
+                goto err;
+        }
+        if (!CBS_get_u16_length_prefixed(&cert_request, &sigalgs)) {
+                ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR);
+                SSLerror(s, SSL_R_DATA_LENGTH_TOO_LONG);
+                goto err;
         }
+        if (CBS_len(&sigalgs) % 2 != 0 || CBS_len(&sigalgs) > 64) {
+                ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR);
+                SSLerror(s, SSL_R_SIGNATURE_ALGORITHMS_ERROR);
+                goto err;
+        }
+        if (!CBS_stow(&sigalgs, &s->s3->hs.sigalgs,
+            &s->s3->hs.sigalgs_len))
+                goto err;
 
         /* get the CA RDNs */
         if (CBS_len(&cert_request) < 2) {
@@ -2035,77 +2023,6 @@ ssl3_send_client_verify_sigalgs(SSL *s, EVP_PKEY *pkey,
 }
 
 static int
-ssl3_send_client_verify_rsa(SSL *s, EVP_PKEY *pkey, CBB *cert_verify)
-{
-        CBB cbb_signature;
-        RSA *rsa;
-        unsigned char data[EVP_MAX_MD_SIZE];
-        unsigned char *signature = NULL;
-        unsigned int signature_len;
-        size_t data_len;
-        int ret = 0;
-
-        if (!tls1_transcript_hash_value(s, data, sizeof(data), &data_len))
-                goto err;
-        if ((signature = calloc(1, EVP_PKEY_size(pkey))) == NULL)
-                goto err;
-        if ((rsa = EVP_PKEY_get0_RSA(pkey)) == NULL)
-                goto err;
-        if (RSA_sign(NID_md5_sha1, data, data_len, signature, &signature_len,
-            rsa) <= 0 ) {
-                SSLerror(s, ERR_R_RSA_LIB);
-                goto err;
-        }
-
-        if (!CBB_add_u16_length_prefixed(cert_verify, &cbb_signature))
-                goto err;
-        if (!CBB_add_bytes(&cbb_signature, signature, signature_len))
-                goto err;
-        if (!CBB_flush(cert_verify))
-                goto err;
-
-        ret = 1;
- err:
-        free(signature);
-        return ret;
-}
-
-static int
-ssl3_send_client_verify_ec(SSL *s, EVP_PKEY *pkey, CBB *cert_verify)
-{
-        CBB cbb_signature;
-        EC_KEY *eckey;
-        unsigned char data[EVP_MAX_MD_SIZE];
-        unsigned char *signature = NULL;
-        unsigned int signature_len;
-        int ret = 0;
-
-        if (!tls1_transcript_hash_value(s, data, sizeof(data), NULL))
-                goto err;
-        if ((signature = calloc(1, EVP_PKEY_size(pkey))) == NULL)
-                goto err;
-        if ((eckey = EVP_PKEY_get0_EC_KEY(pkey)) == NULL)
-                goto err;
-        if (!ECDSA_sign(0, &data[MD5_DIGEST_LENGTH], SHA_DIGEST_LENGTH,
-            signature, &signature_len, eckey)) {
-                SSLerror(s, ERR_R_ECDSA_LIB);
-                goto err;
-        }
-
-        if (!CBB_add_u16_length_prefixed(cert_verify, &cbb_signature))
-                goto err;
-        if (!CBB_add_bytes(&cbb_signature, signature, signature_len))
-                goto err;
-        if (!CBB_flush(cert_verify))
-                goto err;
-
-        ret = 1;
- err:
-        free(signature);
-        return ret;
-}
-
-static int
 ssl3_send_client_verify(SSL *s)
 {
         const struct ssl_sigalg *sigalg;
@@ -2130,20 +2047,9 @@ ssl3_send_client_verify(SSL *s)
                  * For TLS v1.2 send signature algorithm and signature using
                  * agreed digest and cached handshake records.
                  */
-                if (SSL_USE_SIGALGS(s)) {
-                        if (!ssl3_send_client_verify_sigalgs(s, pkey, sigalg,
-                            &cert_verify))
-                                goto err;
-                } else if (EVP_PKEY_id(pkey) == EVP_PKEY_RSA) {
-                        if (!ssl3_send_client_verify_rsa(s, pkey, &cert_verify))
-                                goto err;
-                } else if (EVP_PKEY_id(pkey) == EVP_PKEY_EC) {
-                        if (!ssl3_send_client_verify_ec(s, pkey, &cert_verify))
-                                goto err;
-                } else {
-                        SSLerror(s, ERR_R_INTERNAL_ERROR);
+                if (!ssl3_send_client_verify_sigalgs(s, pkey, sigalg,
+                    &cert_verify))
                         goto err;
-                }
 
                 tls1_transcript_free(s);
 
diff --git a/src/lib/libssl/ssl_local.h b/src/lib/libssl/ssl_local.h
index ec8a52d703..df4c0dc357 100644
--- a/src/lib/libssl/ssl_local.h
+++ b/src/lib/libssl/ssl_local.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl_local.h,v 1.38 2026/05/25 09:09:34 jsing Exp $ */
+/* $OpenBSD: ssl_local.h,v 1.39 2026/05/31 14:34:44 jsing Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -263,10 +263,6 @@ __BEGIN_HIDDEN_DECLS
  */
 #define SSL_C_PKEYLENGTH(c)     1024
 
-/* See if we use signature algorithms extension. */
-#define SSL_USE_SIGALGS(s) \
-        (s->method->enc_flags & SSL_ENC_FLAG_SIGALGS)
-
 /* Allow TLS 1.2 ciphersuites: applies to DTLS 1.2 as well as TLS 1.2. */
 #define SSL_USE_TLS1_2_CIPHERS(s) \
         (s->method->enc_flags & SSL_ENC_FLAG_TLS1_2_CIPHERS)
@@ -1163,9 +1159,6 @@ typedef struct ssl3_state_st {
  * Flag values for enc_flags.
  */
 
-/* Uses signature algorithms extension. */
-#define SSL_ENC_FLAG_SIGALGS            (1 << 1)
-
 /* Allow TLS 1.2 ciphersuites: applies to DTLS 1.2 as well as TLS 1.2. */
 #define SSL_ENC_FLAG_TLS1_2_CIPHERS     (1 << 4)
 
@@ -1174,10 +1167,8 @@ typedef struct ssl3_state_st {
 
 #define TLSV1_ENC_FLAGS         0
 #define TLSV1_1_ENC_FLAGS       0
-#define TLSV1_2_ENC_FLAGS       (SSL_ENC_FLAG_SIGALGS           | \
-                                 SSL_ENC_FLAG_TLS1_2_CIPHERS)
-#define TLSV1_3_ENC_FLAGS       (SSL_ENC_FLAG_SIGALGS           | \
-                                 SSL_ENC_FLAG_TLS1_3_CIPHERS)
+#define TLSV1_2_ENC_FLAGS       SSL_ENC_FLAG_TLS1_2_CIPHERS
+#define TLSV1_3_ENC_FLAGS       SSL_ENC_FLAG_TLS1_3_CIPHERS
 
 extern const SSL_CIPHER ssl3_ciphers[];
 
diff --git a/src/lib/libssl/ssl_sigalgs.c b/src/lib/libssl/ssl_sigalgs.c
index ee4088f6ab..779d47985a 100644
--- a/src/lib/libssl/ssl_sigalgs.c
+++ b/src/lib/libssl/ssl_sigalgs.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl_sigalgs.c,v 1.53 2026/03/30 06:20:08 tb Exp $ */
+/* $OpenBSD: ssl_sigalgs.c,v 1.54 2026/05/31 14:34:44 jsing Exp $ */
 /*
  * Copyright (c) 2018-2020 Bob Beck <beck@openbsd.org>
  * Copyright (c) 2021 Joel Sing <jsing@openbsd.org>
@@ -134,12 +134,6 @@ const struct ssl_sigalg sigalgs[] = {
                 .security_level = 1,
         },
         {
-                .value = SIGALG_RSA_PKCS1_MD5_SHA1,
-                .key_type = EVP_PKEY_RSA,
-                .md = EVP_md5_sha1,
-                .security_level = 1,
-        },
-        {
                 .value = SIGALG_NONE,
         },
 };
@@ -237,9 +231,6 @@ ssl_sigalgs_build(uint16_t tls_version, CBB *cbb, int security_level)
 
         /* Add values in order as long as they are supported. */
         for (i = 0; i < len; i++) {
-                /* Do not allow the legacy value for < 1.2 to be used. */
-                if (values[i] == SIGALG_RSA_PKCS1_MD5_SHA1)
-                        return 0;
                 if ((sigalg = ssl_sigalg_lookup(values[i])) == NULL)
                         return 0;
                 if (sigalg->security_level < security_level)
@@ -262,8 +253,6 @@ ssl_sigalg_for_legacy(SSL *s, EVP_PKEY *pkey)
         /* Default signature algorithms used for TLSv1.2 and earlier. */
         switch (EVP_PKEY_id(pkey)) {
         case EVP_PKEY_RSA:
-                if (s->s3->hs.negotiated_tls_version < TLS1_2_VERSION)
-                        return ssl_sigalg_lookup(SIGALG_RSA_PKCS1_MD5_SHA1);
                 return ssl_sigalg_lookup(SIGALG_RSA_PKCS1_SHA1);
         case EVP_PKEY_EC:
                 return ssl_sigalg_lookup(SIGALG_ECDSA_SHA1);
@@ -317,9 +306,6 @@ ssl_sigalg_select(SSL *s, EVP_PKEY *pkey)
 {
         CBS cbs;
 
-        if (!SSL_USE_SIGALGS(s))
-                return ssl_sigalg_for_legacy(s, pkey);
-
         /*
          * RFC 5246 allows a TLS 1.2 client to send no sigalgs extension,
          * in which case the server must use the default.
@@ -353,9 +339,6 @@ ssl_sigalg_for_peer(SSL *s, EVP_PKEY *pkey, uint16_t sigalg_value)
 {
         const struct ssl_sigalg *sigalg;
 
-        if (!SSL_USE_SIGALGS(s))
-                return ssl_sigalg_for_legacy(s, pkey);
-
         if ((sigalg = ssl_sigalg_from_value(s, sigalg_value)) == NULL) {
                 SSLerror(s, SSL_R_UNKNOWN_DIGEST);
                 return NULL;
diff --git a/src/lib/libssl/ssl_sigalgs.h b/src/lib/libssl/ssl_sigalgs.h
index 5211ec6b62..775842a093 100644
--- a/src/lib/libssl/ssl_sigalgs.h
+++ b/src/lib/libssl/ssl_sigalgs.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl_sigalgs.h,v 1.27 2024/02/03 15:58:34 beck Exp $ */
+/* $OpenBSD: ssl_sigalgs.h,v 1.28 2026/05/31 14:34:44 jsing Exp $ */
 /*
  * Copyright (c) 2018-2019 Bob Beck <beck@openbsd.org>
  *
@@ -47,9 +47,6 @@ __BEGIN_HIDDEN_DECLS
 #define SIGALG_PRIVATE_START            0xFE00
 #define SIGALG_PRIVATE_END              0xFFFF
 
-/* Legacy sigalg for < TLSv1.2 same value as BoringSSL uses. */
-#define SIGALG_RSA_PKCS1_MD5_SHA1       0xFF01
-
 #define SIGALG_FLAG_RSA_PSS     0x00000001
 
 struct ssl_sigalg {
diff --git a/src/lib/libssl/ssl_srvr.c b/src/lib/libssl/ssl_srvr.c
index af4b20f6ce..f9c4ef918a 100644
--- a/src/lib/libssl/ssl_srvr.c
+++ b/src/lib/libssl/ssl_srvr.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl_srvr.c,v 1.168 2026/04/03 12:58:19 jsing Exp $ */
+/* $OpenBSD: ssl_srvr.c,v 1.169 2026/05/31 14:34:44 jsing Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -568,33 +568,14 @@ ssl3_accept(SSL *s)
                         }
 
                         alg_k = s->s3->hs.cipher->algorithm_mkey;
-                        if (SSL_USE_SIGALGS(s)) {
-                                s->s3->hs.state = SSL3_ST_SR_CERT_VRFY_A;
-                                s->init_num = 0;
-                                if (!s->session->peer_cert)
-                                        break;
+                        s->s3->hs.state = SSL3_ST_SR_CERT_VRFY_A;
+                        s->init_num = 0;
+                        if (s->session->peer_cert != NULL) {
                                 /*
                                  * Freeze the transcript for use during client
                                  * certificate verification.
                                  */
                                 tls1_transcript_freeze(s);
-                        } else {
-                                s->s3->hs.state = SSL3_ST_SR_CERT_VRFY_A;
-                                s->init_num = 0;
-
-                                tls1_transcript_free(s);
-
-                                /*
-                                 * We need to get hashes here so if there is
-                                 * a client cert, it can be verified.
-                                 */
-                                if (!tls1_transcript_hash_value(s,
-                                    s->s3->hs.tls12.cert_verify,
-                                    sizeof(s->s3->hs.tls12.cert_verify),
-                                    NULL)) {
-                                        ret = -1;
-                                        goto end;
-                                }
                         }
                         break;
 
@@ -1142,7 +1123,7 @@ ssl3_get_client_hello(SSL *s)
         if (!tls1_transcript_hash_init(s))
                 goto err;
 
-        if (!SSL_USE_SIGALGS(s) || !(s->verify_mode & SSL_VERIFY_PEER))
+        if (!(s->verify_mode & SSL_VERIFY_PEER))
                 tls1_transcript_free(s);
 
         /*
@@ -1501,12 +1482,10 @@ ssl3_send_server_key_exchange(SSL *s)
                         s->s3->hs.our_sigalg = sigalg;
 
                         /* Send signature algorithm. */
-                        if (SSL_USE_SIGALGS(s)) {
-                                if (!CBB_add_u16(&server_kex, sigalg->value)) {
-                                        al = SSL_AD_INTERNAL_ERROR;
-                                        SSLerror(s, ERR_R_INTERNAL_ERROR);
-                                        goto fatal_err;
-                                }
+                        if (!CBB_add_u16(&server_kex, sigalg->value)) {
+                                al = SSL_AD_INTERNAL_ERROR;
+                                SSLerror(s, ERR_R_INTERNAL_ERROR);
+                                goto fatal_err;
                         }
 
                         if (!EVP_DigestSignInit(md_ctx, &pctx, md, NULL, pkey)) {
@@ -1591,14 +1570,11 @@ ssl3_send_certificate_request(SSL *s)
                 if (!ssl3_get_req_cert_types(s, &cert_types))
                         goto err;
 
-                if (SSL_USE_SIGALGS(s)) {
-                        if (!CBB_add_u16_length_prefixed(&cert_request,
-                            &sigalgs))
-                                goto err;
-                        if (!ssl_sigalgs_build(s->s3->hs.negotiated_tls_version,
-                            &sigalgs, SSL_get_security_level(s)))
-                                goto err;
-                }
+                if (!CBB_add_u16_length_prefixed(&cert_request, &sigalgs))
+                        goto err;
+                if (!ssl_sigalgs_build(s->s3->hs.negotiated_tls_version,
+                    &sigalgs, SSL_get_security_level(s)))
+                        goto err;
 
                 if (!CBB_add_u16_length_prefixed(&cert_request, &cert_auth))
                         goto err;
@@ -1879,7 +1855,8 @@ ssl3_get_cert_verify(SSL *s)
         EVP_PKEY *pkey;
         X509 *peer_cert = NULL;
         EVP_MD_CTX *mctx = NULL;
-        int al, verify;
+        EVP_PKEY_CTX *pctx;
+        int al;
         const unsigned char *hdata;
         size_t hdatalen;
         int type = 0;
@@ -1932,10 +1909,9 @@ ssl3_get_cert_verify(SSL *s)
                 goto fatal_err;
         }
 
-        if (SSL_USE_SIGALGS(s)) {
-                if (!CBS_get_u16(&cbs, &sigalg_value))
-                        goto decode_err;
-        }
+        if (!CBS_get_u16(&cbs, &sigalg_value))
+                goto decode_err;
+
         if (!CBS_get_u16_length_prefixed(&cbs, &signature))
                 goto err;
         if (CBS_len(&cbs) != 0) {
@@ -1957,74 +1933,26 @@ ssl3_get_cert_verify(SSL *s)
         }
         s->s3->hs.peer_sigalg = sigalg;
 
-        if (SSL_USE_SIGALGS(s)) {
-                EVP_PKEY_CTX *pctx;
-
-                if (!tls1_transcript_data(s, &hdata, &hdatalen)) {
-                        SSLerror(s, ERR_R_INTERNAL_ERROR);
-                        al = SSL_AD_INTERNAL_ERROR;
-                        goto fatal_err;
-                }
-                if (!EVP_DigestVerifyInit(mctx, &pctx, sigalg->md(),
-                    NULL, pkey)) {
-                        SSLerror(s, ERR_R_EVP_LIB);
-                        al = SSL_AD_INTERNAL_ERROR;
-                        goto fatal_err;
-                }
-                if ((sigalg->flags & SIGALG_FLAG_RSA_PSS) &&
-                    (!EVP_PKEY_CTX_set_rsa_padding(pctx,
-                        RSA_PKCS1_PSS_PADDING) ||
-                    !EVP_PKEY_CTX_set_rsa_pss_saltlen(pctx, -1))) {
-                        al = SSL_AD_INTERNAL_ERROR;
-                        goto fatal_err;
-                }
-                if (EVP_DigestVerify(mctx, CBS_data(&signature),
-                    CBS_len(&signature), hdata, hdatalen) <= 0) {
-                        SSLerror(s, ERR_R_EVP_LIB);
-                        al = SSL_AD_INTERNAL_ERROR;
-                        goto fatal_err;
-                }
-        } else if (EVP_PKEY_id(pkey) == EVP_PKEY_RSA) {
-                RSA *rsa;
-
-                if ((rsa = EVP_PKEY_get0_RSA(pkey)) == NULL) {
-                        al = SSL_AD_INTERNAL_ERROR;
-                        SSLerror(s, ERR_R_EVP_LIB);
-                        goto fatal_err;
-                }
-                verify = RSA_verify(NID_md5_sha1, s->s3->hs.tls12.cert_verify,
-                    MD5_DIGEST_LENGTH + SHA_DIGEST_LENGTH, CBS_data(&signature),
-                    CBS_len(&signature), rsa);
-                if (verify < 0) {
-                        al = SSL_AD_DECRYPT_ERROR;
-                        SSLerror(s, SSL_R_BAD_RSA_DECRYPT);
-                        goto fatal_err;
-                }
-                if (verify == 0) {
-                        al = SSL_AD_DECRYPT_ERROR;
-                        SSLerror(s, SSL_R_BAD_RSA_SIGNATURE);
-                        goto fatal_err;
-                }
-        } else if (EVP_PKEY_id(pkey) == EVP_PKEY_EC) {
-                EC_KEY *eckey;
-
-                if ((eckey = EVP_PKEY_get0_EC_KEY(pkey)) == NULL) {
-                        al = SSL_AD_INTERNAL_ERROR;
-                        SSLerror(s, ERR_R_EVP_LIB);
-                        goto fatal_err;
-                }
-                verify = ECDSA_verify(0,
-                    &(s->s3->hs.tls12.cert_verify[MD5_DIGEST_LENGTH]),
-                    SHA_DIGEST_LENGTH, CBS_data(&signature),
-                    CBS_len(&signature), eckey);
-                if (verify <= 0) {
-                        al = SSL_AD_DECRYPT_ERROR;
-                        SSLerror(s, SSL_R_BAD_ECDSA_SIGNATURE);
-                        goto fatal_err;
-                }
-        } else {
+        if (!tls1_transcript_data(s, &hdata, &hdatalen)) {
                 SSLerror(s, ERR_R_INTERNAL_ERROR);
-                al = SSL_AD_UNSUPPORTED_CERTIFICATE;
+                al = SSL_AD_INTERNAL_ERROR;
+                goto fatal_err;
+        }
+        if (!EVP_DigestVerifyInit(mctx, &pctx, sigalg->md(), NULL, pkey)) {
+                SSLerror(s, ERR_R_EVP_LIB);
+                al = SSL_AD_INTERNAL_ERROR;
+                goto fatal_err;
+        }
+        if ((sigalg->flags & SIGALG_FLAG_RSA_PSS) &&
+            (!EVP_PKEY_CTX_set_rsa_padding(pctx, RSA_PKCS1_PSS_PADDING) ||
+            !EVP_PKEY_CTX_set_rsa_pss_saltlen(pctx, -1))) {
+                al = SSL_AD_INTERNAL_ERROR;
+                goto fatal_err;
+        }
+        if (EVP_DigestVerify(mctx, CBS_data(&signature), CBS_len(&signature),
+            hdata, hdatalen) <= 0) {
+                SSLerror(s, ERR_R_EVP_LIB);
+                al = SSL_AD_INTERNAL_ERROR;
                 goto fatal_err;
         }