In the specification for TLS 1.2, it says the following RFC5246 :
If the client provided a "signature_algorithms" extension, then all certificates provided by the server MUST be signed by a hash/signature algorithm pair that appears in that extension.
However, when I tried the following command in OpenSSL (As a server) it runs without any issue:
openssl s_server -accept 443 -cert ecdsa-cert.crt -key ecdsa-key.key -debug -msg -state -HTTP -cipher ECDHE-RSA-AES128-SHA
Then, I run another command for client:
openssl s_client -connect 127.0.0.1:443 -debug -cipher ECDHE-RSA-AES128-SHA
It can't proceeed any further on the server console, it says "no shared cipher". However, when I used wireshark and inspect the ClientHello.signature_algorithms, it did indeed has ECDSA pair in it. So I'm wondering is it me that misinterpret the specification?