using openssl s_client to force the usage of the RSA certificate with TLSv1.3:
vgutierrez@traffic-cache-upload-bullseye:~$ echo -e "GET /\r\nHost: 127.0.0.1:443\r\n\r\n" | openssl s_client -tls1_3 -sigalgs "RSA-PSS+SHA512:RSA-PSS+SHA384:RSA-PSS+SHA256:RSA+SHA512:RSA+SHA256:RSA+SHA384:RSA+SHA224:RSA+SHA1" -connect 127.0.0.1:443 2>&1 |grep -i "Peer Signature Type" Peer signature type: RSA-PSS
haproxy sends the following x-analytics-tls header:
ReqHeader x-analytics-tls: vers=TLSv1.3;keyx=unknown;auth=ECDSA;ciph=AES-256-GCM-SHA384;prot=h1;sess=new
for varnish the same issue is there given that it's only using X-Connection-Properties header and right now it attempts to infer the authentication mechanism from the ciphersuite and that's no longer possible with TLSv1.3