Skip certificate lookup for single cert
Avoid spending extra computation matching a certificate with a domain
name if there aren't multiple choices.
@@ -165,13 +165,14 @@ int s2n_conn_update_required_handshake_hashes(struct s2n_connection *conn)
*/
int s2n_conn_find_name_matching_certs(struct s2n_connection *conn)
{
- if (!s2n_server_received_server_name(conn)) {
+ struct s2n_array *certs = conn->config->cert_and_key_pairs;
+ const uint32_t num_certs = s2n_array_num_elements(certs);
+ if (!s2n_server_received_server_name(conn) || num_certs < 2) {
return 0;
}
const char *name = conn->server_name;
- struct s2n_array *certs = conn->config->cert_and_key_pairs;
- for (int i = 0; i < s2n_array_num_elements(certs); i++) {
+ for (int i = 0; i < num_certs; i++) {
struct s2n_cert_chain_and_key *chain_and_key = *((struct s2n_cert_chain_and_key**) s2n_array_get(certs, i));
s2n_authentication_method auth_method = s2n_cert_chain_and_key_get_auth_method(chain_and_key);
/* Add the match if there isn't already an existing match for the certificate key type */
