# Signature algorithm restrictions not enforced on certificate chain (CVE-2026-54441)

**Title** | Signature algorithm restrictions not enforced on certificate chain
--------- | ----------------------------------------------------------
**CVE** | CVE-2026-54441
**Date** | 7th of July, 2026
**Affects** | Mbed TLS up to 3.6.6 and earlier; Mbed TLS 4.0.0 and 4.1.0
**Not affected** | Mbed TLS 3.6.7 and later, Mbed TLS 4.1.1 and later, Mbed TLS 4.2.0 and later
**Impact** | An application may accept certificate chains signed with algorithms that were not intended to be allowed
**Severity** | LOW
**Credits** | Xiangdong Li, Beijing University of Posts and Telecommunications (BUPT)

## Vulnerability

Mbed TLS provides two separate API functions that affect which signature algorithms are accepted during a TLS handshake:

- `mbedtls_ssl_conf_sig_algs()`: configures the list of signature algorithms advertised in the TLS `signature_algorithms` extension, which is enforced for handshake signatures.
- `mbedtls_ssl_conf_cert_profile()`: controls which signature algorithms are accepted when verifying the certificate chain.

In the TLS 1.3 protocol, the `signature_algorithms` extension covers both handshake signatures and certificate chain signatures unless a separate `signature_algorithms_cert` extension is also sent. Mbed TLS does not send `signature_algorithms_cert`, so the same list is advertised for both purposes. This makes it reasonable to expect that `mbedtls_ssl_conf_sig_algs()` would also restrict which signature algorithms are accepted in the certificate chain.

However, Mbed TLS enforces these two settings independently: `mbedtls_ssl_conf_sig_algs()` only affects handshake signatures, while certificate chain verification is governed solely by `mbedtls_ssl_conf_cert_profile()`. The documentation for `mbedtls_ssl_conf_sig_algs()` did not make this separation explicit, which could lead developers to believe that configuring `sig_algs` alone is sufficient to enforce signature algorithm restrictions across the entire handshake, including certificate verification.

An application is vulnerable if it calls `mbedtls_ssl_conf_sig_algs()` to configure a restricted set of algorithms and assumes that the certificate chain will also be verified against that restriction, without also calling `mbedtls_ssl_conf_cert_profile()` with a suitably restrictive profile.

## Impact

A peer may present a certificate chain signed with a signature algorithm that the application intended to reject. If the application relies solely on `mbedtls_ssl_conf_sig_algs()` and does not configure a certificate profile via `mbedtls_ssl_conf_cert_profile()`, the certificate chain signature will be accepted regardless of the configured `sig_algs`. This may allow a peer to use certificates with signature algorithms the developer intended to forbid, potentially weakening the security posture of the application.

## Affected versions

Mbed TLS 3.6.6 and earlier; Mbed TLS 4.0.0 and 4.1.0.

## Resolution

Applications can protect themselves by explicitly calling `mbedtls_ssl_conf_cert_profile()` with an X.509 certificate profile that restricts the accepted signature algorithms to match the intended policy. For example, use one of the built-in profiles such as `mbedtls_x509_crt_profile_suiteb` or define a custom `mbedtls_x509_crt_profile` structure.

## Fix commits

Updated documentation can be found at following commits:

| Branch | Mbed TLS 3.6.x | Mbed TLS 4.1.x | Mbed TLS 4.x (x>1) |
| ------ | -------------- | ------------------- | -------------------------- |
| Updated documentation | aecc26ac7c523e741dd62d94890278326fe7c230..b9c8c9c4275bf8e5e88aa9e1e8f6d518fa78367b | b2e36d7d7aa9968087eac0a40457783c61c90720..bd57fb5e8afe003ed24a2ae9e8ca487ecdc4c3f4 | 4a1d150cdf441d0b1d984ea825a21d5770a9f94a..147ad72669797947bef12a0bdbe5dec0ed805c58 |