[TLS 1.2, TLS 1.3] Fail immediately if server sends empty certificate message for TLS 1.2 and beyond

[AlexLanzano]

Description

For TLS 1.2, the client accepts an empty certificate message from the server. This violates RFC 5246 section 7.4.2. However, for TLS 1.3 the client will properly fail immediately when receiving an empty certificate message from the server.

So to fix this, I modified the empty cert check to include both TLS 1.2 and TLS 1.3.

Fixes #9651

Testing

Reproduction steps in #9651

[SparkiDev]

How is accepting an empty ServerCertificate message violating RFC 5246 7.4.2?
I think you mean for non-anonymous cipher suites this is invalid. Which means you need to check the cipher suite before failing in the TLS 1.2 case.

[AlexLanzano]

@SparkiDev Here's the ServerCertificate message structure from the RFC

   Structure of this message:

      opaque ASN.1Cert<1..2^24-1>;

      struct {
          ASN.1Cert certificate_list<0..2^24-1>;
      } Certificate;

My understanding of this is that whenever the server sends this message there needs to be at least one cert with length 1 to 2^24-1 in order to be valid.

[SparkiDev]

OK.
I'm remembering TLS 1.1 and the fact that the minimum is 0.
Static DH/ECDH used to have an empty certificate message in older versions of the protocol. For TLS 1.2 it appears you don't send a certificate.