grpc 1.84.0 → 1.85.0.pre1

data/third_party/boringssl-with-bazel/ssl/extensions.cc

@@ -20,11 +20,14 @@
 #include <string.h>
 
 #include <algorithm>
+#include <optional>
 #include <utility>
+#include <variant>
 
 #include <openssl/aead.h>
 #include <openssl/bytestring.h>
 #include <openssl/chacha.h>
+#include <openssl/cipher.h>
 #include <openssl/curve25519.h>
 #include <openssl/digest.h>
 #include <openssl/err.h>
@@ -33,9 +36,12 @@
 #include <openssl/hpke.h>
 #include <openssl/mem.h>
 #include <openssl/nid.h>
+#include <openssl/pool.h>
 #include <openssl/rand.h>
 
+#include "../crypto/bytestring/internal.h"
 #include "../crypto/internal.h"
+#include "../crypto/mem_internal.h"
 #include "../crypto/spake2plus/internal.h"
 #include "internal.h"
 
@@ -102,6 +108,7 @@ static bool is_post_quantum_group(uint16_t id) {
   switch (id) {
     case SSL_GROUP_X25519_KYBER768_DRAFT00:
     case SSL_GROUP_X25519_MLKEM768:
+    case SSL_GROUP_MLKEM1024:
       return true;
     default:
       return false;
@@ -199,19 +206,6 @@ bool ssl_client_hello_get_extension(const SSL_CLIENT_HELLO *client_hello,
   return false;
 }
 
-static const uint16_t kDefaultGroups[] = {
-    SSL_GROUP_X25519,
-    SSL_GROUP_SECP256R1,
-    SSL_GROUP_SECP384R1,
-};
-
-Span<const uint16_t> tls1_get_grouplist(const SSL_HANDSHAKE *hs) {
-  if (!hs->config->supported_group_list.empty()) {
-    return hs->config->supported_group_list;
-  }
-  return Span<const uint16_t>(kDefaultGroups);
-}
-
 bool tls1_get_shared_group(SSL_HANDSHAKE *hs, uint16_t *out_group_id) {
   SSL *const ssl = hs->ssl;
   assert(ssl->server);
@@ -222,33 +216,53 @@ bool tls1_get_shared_group(SSL_HANDSHAKE *hs, uint16_t *out_group_id) {
   //
   // However, in the interests of compatibility, we will skip ECDH if the
   // client didn't send an extension because we can't be sure that they'll
-  // support our favoured group. Thus we do not special-case an emtpy
-  // |peer_supported_group_list|.
+  // support our favoured group. Thus we do not special-case an empty
+  // `peer_supported_group_list`.
 
-  Span<const uint16_t> groups = tls1_get_grouplist(hs);
+  Span<const uint16_t> groups = hs->config->supported_group_list;
   Span<const uint16_t> pref, supp;
+  Span<const uint32_t> pref_flags;
   if (ssl->options & SSL_OP_CIPHER_SERVER_PREFERENCE) {
     pref = groups;
+    pref_flags = hs->config->supported_group_list_flags;
     supp = hs->peer_supported_group_list;
   } else {
     pref = hs->peer_supported_group_list;
     supp = groups;
   }
 
-  for (uint16_t pref_group : pref) {
-    for (uint16_t supp_group : supp) {
-      if (pref_group == supp_group &&
-          // Post-quantum key agreements don't fit in the u8-length-prefixed
-          // ECPoint field in TLS 1.2 and below.
-          (ssl_protocol_version(ssl) >= TLS1_3_VERSION ||
-           !is_post_quantum_group(pref_group))) {
-        *out_group_id = pref_group;
-        return true;
+  // Index within `supp` of the best matching group so far.
+  std::optional<size_t> best_match;
+  for (size_t i = 0u; i < pref.size(); ++i) {
+    uint16_t candidate_group = pref[i];
+    auto match_it = std::find(supp.begin(), supp.end(), candidate_group);
+    // Post-quantum key agreements don't fit in the u8-length-prefixed
+    // ECPoint field in TLS 1.2 and below.
+    if (ssl_protocol_version(ssl) < TLS1_3_VERSION &&
+        is_post_quantum_group(candidate_group)) {
+      match_it = supp.end();
+    }
+    if (match_it != supp.end()) {
+      size_t match_idx = match_it - supp.begin();
+      if (!best_match.has_value() || match_idx < *best_match) {
+        best_match = match_idx;
       }
     }
+
+    // If we found a match, stop at the current equipreference group.
+    bool equal_with_next =
+        !pref_flags.empty() &&
+        (pref_flags[i] & SSL_GROUP_FLAG_EQUAL_PREFERENCE_WITH_NEXT);
+    if (!equal_with_next && best_match.has_value()) {
+      break;
+    }
   }
 
-  return false;
+  if (!best_match.has_value()) {
+    return false;
+  }
+  *out_group_id = supp[*best_match];
+  return true;
 }
 
 bool tls1_check_group_id(const SSL_HANDSHAKE *hs, uint16_t group_id) {
@@ -263,7 +277,7 @@ bool tls1_check_group_id(const SSL_HANDSHAKE *hs, uint16_t group_id) {
     return false;
   }
 
-  for (uint16_t supported : tls1_get_grouplist(hs)) {
+  for (uint16_t supported : hs->config->supported_group_list) {
     if (supported == group_id) {
       return true;
     }
@@ -296,6 +310,11 @@ static const uint16_t kVerifySignatureAlgorithms[] = {
 // algorithms for signing.
 static const uint16_t kSignSignatureAlgorithms[] = {
     // List our preferred algorithms first.
+    SSL_SIGN_ML_DSA_44,
+    SSL_SIGN_ML_DSA_65,
+    SSL_SIGN_ML_DSA_87,
+
+    // Classical signature algorithms.
     SSL_SIGN_ED25519,
     SSL_SIGN_ECDSA_SECP256R1_SHA256,
     SSL_SIGN_RSA_PSS_RSAE_SHA256,
@@ -428,7 +447,7 @@ bool ssl_parse_flags_extension_response(const CBS *cbs, SSLFlags *out,
     return false;
   }
 
-  // Check for unsolicited flags that fit in |SSLFlags|.
+  // Check for unsolicited flags that fit in `SSLFlags`.
   if ((*out & allowed_flags) != *out) {
     OPENSSL_PUT_ERROR(SSL, SSL_R_UNEXPECTED_EXTENSION);
     *out_alert = SSL_AD_ILLEGAL_PARAMETER;
@@ -440,30 +459,30 @@ bool ssl_parse_flags_extension_response(const CBS *cbs, SSLFlags *out,
 
 // tls_extension represents a TLS extension that is handled internally.
 //
-// The parse callbacks receive a |CBS| that contains the contents of the
+// The parse callbacks receive a `CBS` that contains the contents of the
 // extension (i.e. not including the type and length bytes). If an extension is
 // not received then the parse callbacks will be called with a NULL CBS so that
 // they can do any processing needed to handle the absence of an extension.
 //
-// The add callbacks receive a |CBB| to which the extension can be appended but
+// The add callbacks receive a `CBB` to which the extension can be appended but
 // the function is responsible for appending the type and length bytes too.
 //
-// |add_clienthello| may be called multiple times and must not mutate |hs|. It
-// is additionally passed two output |CBB|s. If the extension is the same
-// independent of the value of |type|, the callback may write to
-// |out_compressible| instead of |out|. When serializing the ClientHelloInner,
-// all compressible extensions will be made continguous and replaced with
+// `add_clienthello` may be called multiple times and must not mutate `hs`. It
+// is additionally passed two output `CBB`s. If the extension is the same
+// independent of the value of `type`, the callback may write to
+// `out_compressible` instead of `out`. When serializing the ClientHelloInner,
+// all compressible extensions will be made contiguous and replaced with
 // ech_outer_extensions when encrypted. When serializing the ClientHelloOuter
-// or not offering ECH, |out| will be equal to |out_compressible|, so writing to
-// |out_compressible| still works.
+// or not offering ECH, `out` will be equal to `out_compressible`, so writing to
+// `out_compressible` still works.
 //
-// Note the |parse_serverhello| and |add_serverhello| callbacks refer to the
+// Note the `parse_serverhello` and `add_serverhello` callbacks refer to the
 // TLS 1.2 ServerHello. In TLS 1.3, these callbacks act on EncryptedExtensions,
 // with ServerHello extensions handled elsewhere in the handshake.
 //
 // All callbacks return true for success and false for error. If a parse
-// function returns zero then a fatal alert with value |*out_alert| will be
-// sent. If |*out_alert| isn't set, then a |decode_error| alert will be sent.
+// function returns zero then a fatal alert with value `*out_alert` will be
+// sent. If `*out_alert` isn't set, then a `decode_error` alert will be sent.
 struct tls_extension {
   uint16_t value;
 
@@ -479,7 +498,7 @@ struct tls_extension {
 
 static bool forbid_parse_serverhello(SSL_HANDSHAKE *hs, uint8_t *out_alert,
                                      CBS *contents) {
-  if (contents != NULL) {
+  if (contents != nullptr) {
     // Servers MUST NOT send this extension.
     *out_alert = SSL_AD_UNSUPPORTED_EXTENSION;
     OPENSSL_PUT_ERROR(SSL, SSL_R_UNEXPECTED_EXTENSION);
@@ -534,16 +553,18 @@ static bool ext_sni_parse_serverhello(SSL_HANDSHAKE *hs, uint8_t *out_alert,
                                       CBS *contents) {
   // The server may acknowledge SNI with an empty extension. We check the syntax
   // but otherwise ignore this signal.
-  return contents == NULL || CBS_len(contents) == 0;
+  return contents == nullptr || CBS_len(contents) == 0;
 }
 
 static bool ext_sni_parse_clienthello(SSL_HANDSHAKE *hs, uint8_t *out_alert,
                                       CBS *contents) {
-  // SNI has already been parsed earlier in the handshake. See |extract_sni|.
+  // SNI has already been parsed earlier in the handshake. See `extract_sni`.
   return true;
 }
 
 static bool ext_sni_add_serverhello(SSL_HANDSHAKE *hs, CBB *out) {
+  // RFC 6066 says "When resuming a session, the server MUST NOT include a
+  // server_name extension in the server hello."
   if (hs->ssl->s3->session_reused ||  //
       !hs->should_ack_sni) {
     return true;
@@ -560,7 +581,7 @@ static bool ext_sni_add_serverhello(SSL_HANDSHAKE *hs, CBB *out) {
 
 // Encrypted ClientHello (ECH)
 //
-// https://tools.ietf.org/html/draft-ietf-tls-esni-13
+// https://www.rfc-editor.org/rfc/rfc9849.html
 
 static bool ext_ech_add_clienthello(const SSL_HANDSHAKE *hs, CBB *out,
                                     CBB *out_compressible,
@@ -593,7 +614,7 @@ static bool ext_ech_add_clienthello(const SSL_HANDSHAKE *hs, CBB *out,
 static bool ext_ech_parse_serverhello(SSL_HANDSHAKE *hs, uint8_t *out_alert,
                                       CBS *contents) {
   SSL *const ssl = hs->ssl;
-  if (contents == NULL) {
+  if (contents == nullptr) {
     return true;
   }
 
@@ -651,8 +672,8 @@ static bool ext_ech_add_serverhello(SSL_HANDSHAKE *hs, CBB *out) {
     return true;
   }
 
-  // Write the list of retry configs to |out|. Note |SSL_CTX_set1_ech_keys|
-  // ensures |ech_keys| contains at least one retry config.
+  // Write the list of retry configs to `out`. Note `SSL_CTX_set1_ech_keys`
+  // ensures `ech_keys` contains at least one retry config.
   CBB body, retry_configs;
   if (!CBB_add_u16(out, TLSEXT_TYPE_encrypted_client_hello) ||
       !CBB_add_u16_length_prefixed(out, &body) ||
@@ -705,28 +726,34 @@ static bool ext_ri_add_clienthello(const SSL_HANDSHAKE *hs, CBB *out,
 static bool ext_ri_parse_serverhello(SSL_HANDSHAKE *hs, uint8_t *out_alert,
                                      CBS *contents) {
   SSL *const ssl = hs->ssl;
-  if (contents != NULL && ssl_protocol_version(ssl) >= TLS1_3_VERSION) {
-    *out_alert = SSL_AD_ILLEGAL_PARAMETER;
-    return false;
+  if (ssl_protocol_version(ssl) >= TLS1_3_VERSION) {
+    if (contents != nullptr) {
+      *out_alert = SSL_AD_ILLEGAL_PARAMETER;
+      return false;
+    }
+    return true;
   }
 
   // Servers may not switch between omitting the extension and supporting it.
   // See RFC 5746, sections 3.5 and 4.2.
   if (ssl->s3->initial_handshake_complete &&
-      (contents != NULL) != ssl->s3->send_connection_binding) {
+      (contents != nullptr) != ssl->s3->send_connection_binding) {
     *out_alert = SSL_AD_HANDSHAKE_FAILURE;
     OPENSSL_PUT_ERROR(SSL, SSL_R_RENEGOTIATION_MISMATCH);
     return false;
   }
 
-  if (contents == NULL) {
+  if (contents == nullptr) {
     // Strictly speaking, if we want to avoid an attack we should *always* see
     // RI even on initial ServerHello because the client doesn't see any
     // renegotiation during an attack. However this would mean we could not
-    // connect to any server which doesn't support RI.
-    //
-    // OpenSSL has |SSL_OP_LEGACY_SERVER_CONNECT| to control this, but in
-    // practical terms every client sets it so it's just assumed here.
+    // connect to any server which doesn't support RI. See RFC 5746,
+    // section 4.1.
+    if (!(ssl->options & SSL_OP_LEGACY_SERVER_CONNECT)) {
+      OPENSSL_PUT_ERROR(SSL, SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
+      *out_alert = SSL_AD_HANDSHAKE_FAILURE;
+      return false;
+    }
     return true;
   }
 
@@ -786,7 +813,8 @@ static bool ext_ri_parse_clienthello(SSL_HANDSHAKE *hs, uint8_t *out_alert,
     return true;
   }
 
-  if (contents == NULL) {
+  if (contents == nullptr) {
+    // Permit clients to omit the extension. We never renegotiate as a server.
     return true;
   }
 
@@ -854,7 +882,7 @@ static bool ext_ems_parse_serverhello(SSL_HANDSHAKE *hs, uint8_t *out_alert,
                                       CBS *contents) {
   SSL *const ssl = hs->ssl;
 
-  if (contents != NULL) {
+  if (contents != nullptr) {
     if (ssl_protocol_version(ssl) >= TLS1_3_VERSION ||  //
         CBS_len(contents) != 0) {
       return false;
@@ -881,7 +909,7 @@ static bool ext_ems_parse_clienthello(SSL_HANDSHAKE *hs, uint8_t *out_alert,
     return true;
   }
 
-  if (contents == NULL) {
+  if (contents == nullptr) {
     return true;
   }
 
@@ -946,7 +974,7 @@ static bool ext_ticket_add_clienthello(const SSL_HANDSHAKE *hs, CBB *out,
 static bool ext_ticket_parse_serverhello(SSL_HANDSHAKE *hs, uint8_t *out_alert,
                                          CBS *contents) {
   SSL *const ssl = hs->ssl;
-  if (contents == NULL) {
+  if (contents == nullptr) {
     return true;
   }
 
@@ -954,7 +982,7 @@ static bool ext_ticket_parse_serverhello(SSL_HANDSHAKE *hs, uint8_t *out_alert,
     return false;
   }
 
-  // If |SSL_OP_NO_TICKET| is set then no extension will have been sent and
+  // If `SSL_OP_NO_TICKET` is set then no extension will have been sent and
   // this function should never be called, even if the server tries to send the
   // extension.
   assert((SSL_get_options(ssl) & SSL_OP_NO_TICKET) == 0);
@@ -972,7 +1000,7 @@ static bool ext_ticket_add_serverhello(SSL_HANDSHAKE *hs, CBB *out) {
     return true;
   }
 
-  // If |SSL_OP_NO_TICKET| is set, |ticket_expected| should never be true.
+  // If `SSL_OP_NO_TICKET` is set, `ticket_expected` should never be true.
   assert((SSL_get_options(hs->ssl) & SSL_OP_NO_TICKET) == 0);
 
   if (!CBB_add_u16(out, TLSEXT_TYPE_session_ticket) ||
@@ -994,8 +1022,8 @@ static bool ext_sigalgs_add_clienthello(const SSL_HANDSHAKE *hs, CBB *out,
   if (hs->max_version < TLS1_2_VERSION) {
     return true;
   }
-  // In PAKE mode, signature_algorithms is not used.
-  if (hs->pake_prover != nullptr) {
+  // Skip signature_algorithms if we wouldn't accept a certificate mode anyway.
+  if (!ssl_accepts_server_certificate_auth(hs)) {
     return true;
   }
 
@@ -1014,7 +1042,7 @@ static bool ext_sigalgs_add_clienthello(const SSL_HANDSHAKE *hs, CBB *out,
 static bool ext_sigalgs_parse_clienthello(SSL_HANDSHAKE *hs, uint8_t *out_alert,
                                           CBS *contents) {
   hs->peer_sigalgs.Reset();
-  if (contents == NULL) {
+  if (contents == nullptr) {
     return true;
   }
 
@@ -1056,7 +1084,7 @@ static bool ext_ocsp_add_clienthello(const SSL_HANDSHAKE *hs, CBB *out,
 static bool ext_ocsp_parse_serverhello(SSL_HANDSHAKE *hs, uint8_t *out_alert,
                                        CBS *contents) {
   SSL *const ssl = hs->ssl;
-  if (contents == NULL) {
+  if (contents == nullptr) {
     return true;
   }
 
@@ -1081,7 +1109,7 @@ static bool ext_ocsp_parse_serverhello(SSL_HANDSHAKE *hs, uint8_t *out_alert,
 
 static bool ext_ocsp_parse_clienthello(SSL_HANDSHAKE *hs, uint8_t *out_alert,
                                        CBS *contents) {
-  if (contents == NULL) {
+  if (contents == nullptr) {
     return true;
   }
 
@@ -1121,7 +1149,7 @@ static bool ext_npn_add_clienthello(const SSL_HANDSHAKE *hs, CBB *out,
                                     CBB *out_compressible,
                                     ssl_client_hello_type_t type) {
   const SSL *const ssl = hs->ssl;
-  if (ssl->ctx->next_proto_select_cb == NULL ||
+  if (ssl->ctx->next_proto_select_cb == nullptr ||
       // Do not allow NPN to change on renegotiation.
       ssl->s3->initial_handshake_complete ||
       // NPN is not defined in DTLS or TLS 1.3.
@@ -1141,7 +1169,7 @@ static bool ext_npn_add_clienthello(const SSL_HANDSHAKE *hs, CBB *out,
 static bool ext_npn_parse_serverhello(SSL_HANDSHAKE *hs, uint8_t *out_alert,
                                       CBS *contents) {
   SSL *const ssl = hs->ssl;
-  if (contents == NULL) {
+  if (contents == nullptr) {
     return true;
   }
 
@@ -1154,7 +1182,7 @@ static bool ext_npn_parse_serverhello(SSL_HANDSHAKE *hs, uint8_t *out_alert,
   // called.
   assert(!ssl->s3->initial_handshake_complete);
   assert(!SSL_is_dtls(ssl));
-  assert(ssl->ctx->next_proto_select_cb != NULL);
+  assert(ssl->ctx->next_proto_select_cb != nullptr);
 
   if (!ssl->s3->alpn_selected.empty()) {
     // NPN and ALPN may not be negotiated in the same connection.
@@ -1174,7 +1202,7 @@ static bool ext_npn_parse_serverhello(SSL_HANDSHAKE *hs, uint8_t *out_alert,
     }
   }
 
-  // |orig_len| fits in |unsigned| because TLS extensions use 16-bit lengths.
+  // `orig_len` fits in `unsigned` because TLS extensions use 16-bit lengths.
   uint8_t *selected;
   uint8_t selected_len;
   if (ssl->ctx->next_proto_select_cb(
@@ -1197,13 +1225,13 @@ static bool ext_npn_parse_clienthello(SSL_HANDSHAKE *hs, uint8_t *out_alert,
     return true;
   }
 
-  if (contents != NULL && CBS_len(contents) != 0) {
+  if (contents != nullptr && CBS_len(contents) != 0) {
     return false;
   }
 
-  if (contents == NULL ||                             //
-      ssl->s3->initial_handshake_complete ||          //
-      ssl->ctx->next_protos_advertised_cb == NULL ||  //
+  if (contents == nullptr ||                             //
+      ssl->s3->initial_handshake_complete ||             //
+      ssl->ctx->next_protos_advertised_cb == nullptr ||  //
       SSL_is_dtls(ssl)) {
     return true;
   }
@@ -1214,7 +1242,7 @@ static bool ext_npn_parse_clienthello(SSL_HANDSHAKE *hs, uint8_t *out_alert,
 
 static bool ext_npn_add_serverhello(SSL_HANDSHAKE *hs, CBB *out) {
   SSL *const ssl = hs->ssl;
-  // |next_proto_neg_seen| might have been cleared when an ALPN extension was
+  // `next_proto_neg_seen` might have been cleared when an ALPN extension was
   // parsed.
   if (!hs->next_proto_neg_seen) {
     return true;
@@ -1264,7 +1292,7 @@ static bool ext_sct_add_clienthello(const SSL_HANDSHAKE *hs, CBB *out,
 static bool ext_sct_parse_serverhello(SSL_HANDSHAKE *hs, uint8_t *out_alert,
                                       CBS *contents) {
   SSL *const ssl = hs->ssl;
-  if (contents == NULL) {
+  if (contents == nullptr) {
     return true;
   }
 
@@ -1290,7 +1318,7 @@ static bool ext_sct_parse_serverhello(SSL_HANDSHAKE *hs, uint8_t *out_alert,
   // TODO(davidben): Enforce this anyway.
   if (!ssl->s3->session_reused) {
     hs->new_session->signed_cert_timestamp_list.reset(
-        CRYPTO_BUFFER_new_from_CBS(contents, ssl->ctx->pool));
+        CRYPTO_BUFFER_new_from_CBS(contents, ssl->ctx->pool.get()));
     if (hs->new_session->signed_cert_timestamp_list == nullptr) {
       *out_alert = SSL_AD_INTERNAL_ERROR;
       return false;
@@ -1302,7 +1330,7 @@ static bool ext_sct_parse_serverhello(SSL_HANDSHAKE *hs, uint8_t *out_alert,
 
 static bool ext_sct_parse_clienthello(SSL_HANDSHAKE *hs, uint8_t *out_alert,
                                       CBS *contents) {
-  if (contents == NULL) {
+  if (contents == nullptr) {
     return true;
   }
 
@@ -1372,7 +1400,7 @@ static bool ext_alpn_add_clienthello(const SSL_HANDSHAKE *hs, CBB *out,
 static bool ext_alpn_parse_serverhello(SSL_HANDSHAKE *hs, uint8_t *out_alert,
                                        CBS *contents) {
   SSL *const ssl = hs->ssl;
-  if (contents == NULL) {
+  if (contents == nullptr) {
     if (SSL_is_quic(ssl)) {
       // ALPN is required when QUIC is used.
       OPENSSL_PUT_ERROR(SSL, SSL_R_NO_APPLICATION_PROTOCOL);
@@ -1469,7 +1497,7 @@ bool ssl_negotiate_alpn(SSL_HANDSHAKE *hs, uint8_t *out_alert,
                         const SSL_CLIENT_HELLO *client_hello) {
   SSL *const ssl = hs->ssl;
   CBS contents;
-  if (ssl->ctx->alpn_select_cb == NULL ||
+  if (ssl->ctx->alpn_select_cb == nullptr ||
       !ssl_client_hello_get_extension(
           client_hello, &contents,
           TLSEXT_TYPE_application_layer_protocol_negotiation)) {
@@ -1495,7 +1523,7 @@ bool ssl_negotiate_alpn(SSL_HANDSHAKE *hs, uint8_t *out_alert,
     return false;
   }
 
-  // |protocol_name_list| fits in |unsigned| because TLS extensions use 16-bit
+  // `protocol_name_list` fits in `unsigned` because TLS extensions use 16-bit
   // lengths.
   const uint8_t *selected;
   uint8_t selected_len;
@@ -1571,8 +1599,8 @@ static bool ext_channel_id_add_clienthello(const SSL_HANDSHAKE *hs, CBB *out,
       // are not authenticated for the name that can learn the Channel ID.
       //
       // We could alternatively offer the extension but sign with a random key.
-      // For other extensions, we try to align |ssl_client_hello_outer| and
-      // |ssl_client_hello_unencrypted|, to improve the effectiveness of ECH
+      // For other extensions, we try to align `ssl_client_hello_outer` and
+      // `ssl_client_hello_unencrypted`, to improve the effectiveness of ECH
       // GREASE. However, Channel ID is deprecated and unlikely to be used with
       // ECH, so do the simplest thing.
       type == ssl_client_hello_outer) {
@@ -1590,7 +1618,7 @@ static bool ext_channel_id_add_clienthello(const SSL_HANDSHAKE *hs, CBB *out,
 static bool ext_channel_id_parse_serverhello(SSL_HANDSHAKE *hs,
                                              uint8_t *out_alert,
                                              CBS *contents) {
-  if (contents == NULL) {
+  if (contents == nullptr) {
     return true;
   }
 
@@ -1609,7 +1637,8 @@ static bool ext_channel_id_parse_clienthello(SSL_HANDSHAKE *hs,
                                              uint8_t *out_alert,
                                              CBS *contents) {
   SSL *const ssl = hs->ssl;
-  if (contents == NULL || !hs->config->channel_id_enabled || SSL_is_dtls(ssl)) {
+  if (contents == nullptr || !hs->config->channel_id_enabled ||
+      SSL_is_dtls(ssl)) {
     return true;
   }
 
@@ -1645,7 +1674,7 @@ static bool ext_srtp_add_clienthello(const SSL_HANDSHAKE *hs, CBB *out,
   const SSL *const ssl = hs->ssl;
   const STACK_OF(SRTP_PROTECTION_PROFILE) *profiles =
       SSL_get_srtp_profiles(ssl);
-  if (profiles == NULL ||                               //
+  if (profiles == nullptr ||                            //
       sk_SRTP_PROTECTION_PROFILE_num(profiles) == 0 ||  //
       !SSL_is_dtls(ssl)) {
     return true;
@@ -1675,7 +1704,7 @@ static bool ext_srtp_add_clienthello(const SSL_HANDSHAKE *hs, CBB *out,
 static bool ext_srtp_parse_serverhello(SSL_HANDSHAKE *hs, uint8_t *out_alert,
                                        CBS *contents) {
   SSL *const ssl = hs->ssl;
-  if (contents == NULL) {
+  if (contents == nullptr) {
     return true;
   }
 
@@ -1719,7 +1748,7 @@ static bool ext_srtp_parse_clienthello(SSL_HANDSHAKE *hs, uint8_t *out_alert,
                                        CBS *contents) {
   SSL *const ssl = hs->ssl;
   // DTLS-SRTP is only defined for DTLS.
-  if (contents == NULL || !SSL_is_dtls(ssl)) {
+  if (contents == nullptr || !SSL_is_dtls(ssl)) {
     return true;
   }
 
@@ -1759,7 +1788,7 @@ static bool ext_srtp_parse_clienthello(SSL_HANDSHAKE *hs, uint8_t *out_alert,
 
 static bool ext_srtp_add_serverhello(SSL_HANDSHAKE *hs, CBB *out) {
   SSL *const ssl = hs->ssl;
-  if (ssl->s3->srtp_profile == NULL) {
+  if (ssl->s3->srtp_profile == nullptr) {
     return true;
   }
 
@@ -1807,7 +1836,7 @@ static bool ext_ec_point_add_clienthello(const SSL_HANDSHAKE *hs, CBB *out,
 
 static bool ext_ec_point_parse_serverhello(SSL_HANDSHAKE *hs,
                                            uint8_t *out_alert, CBS *contents) {
-  if (contents == NULL) {
+  if (contents == nullptr) {
     return true;
   }
 
@@ -1825,7 +1854,7 @@ static bool ext_ec_point_parse_serverhello(SSL_HANDSHAKE *hs,
   // point format.
   if (OPENSSL_memchr(CBS_data(&ec_point_format_list),
                      TLSEXT_ECPOINTFORMAT_uncompressed,
-                     CBS_len(&ec_point_format_list)) == NULL) {
+                     CBS_len(&ec_point_format_list)) == nullptr) {
     *out_alert = SSL_AD_ILLEGAL_PARAMETER;
     return false;
   }
@@ -1864,174 +1893,320 @@ static bool ext_ec_point_add_serverhello(SSL_HANDSHAKE *hs, CBB *out) {
 //
 // https://tools.ietf.org/html/rfc8446#section-4.2.11
 
-static bool should_offer_psk(const SSL_HANDSHAKE *hs,
-                             ssl_client_hello_type_t type) {
+bool ssl_setup_pre_shared_keys(SSL_HANDSHAKE *hs) {
   const SSL *const ssl = hs->ssl;
-  if (hs->max_version < TLS1_3_VERSION || ssl->session == nullptr ||
-      ssl_session_get_type(ssl->session.get()) !=
-          SSLSessionType::kPreSharedKey ||
-      // TODO(https://crbug.com/boringssl/275): Should we synthesize a
-      // placeholder PSK, at least when we offer early data? Otherwise
-      // ClientHelloOuter will contain an early_data extension without a
-      // pre_shared_key extension and potentially break the recovery flow.
-      type == ssl_client_hello_outer) {
-    return false;
+  if (hs->max_version < TLS1_3_VERSION) {
+    return true;
   }
 
-  // Per RFC 8446 section 4.1.4, skip offering the session if the selected
-  // cipher in HelloRetryRequest does not match. This avoids performing the
-  // transcript hash transformation for multiple hashes.
-  if (ssl->s3->used_hello_retry_request &&
-      ssl->session->cipher->algorithm_prf != hs->new_cipher->algorithm_prf) {
+  if (SSL_SESSION *session = ssl->session.get();
+      session != nullptr &&
+      ssl_session_get_type(session) == SSLSessionType::kPreSharedKey &&
+      !hs->pre_shared_keys.Push(UpRef(session))) {
     return false;
   }
 
+  const uint16_t epsk_protocol =
+      SSL_is_dtls(ssl) ? DTLS1_3_VERSION : TLS1_3_VERSION;
+#if defined(TLS1_4_VERSION)
+#error "More imported PSKs may be needed when TLS 1.4 exists"
+#endif
+  for (const auto &cred : hs->config->cert->credentials) {
+    if (cred->type != SSLCredentialType::kPreSharedKey) {
+      continue;
+    }
+    // We need SHA-256 and SHA-384 variants to cover supported cipher suites.
+    for (const EVP_MD *md : {EVP_sha256(), EVP_sha384()}) {
+      std::optional<SSLImportedPSK> psk =
+          tls13_derive_imported_psk(hs, cred.get(), epsk_protocol, md);
+      if (!psk || !hs->pre_shared_keys.Push(*std::move(psk))) {
+        return false;
+      }
+    }
+  }
+
   return true;
 }
 
+static bool should_offer_psk(const SSL_HANDSHAKE *hs,
+                             ssl_client_hello_type_t type) {
+  // TODO(https://crbug.com/boringssl/275): Should we synthesize a placeholder
+  // PSK, at least when we offer early data? Otherwise ClientHelloOuter will
+  // contain an early_data extension without a pre_shared_key extension and
+  // potentially break the recovery flow.
+  return hs->max_version >= TLS1_3_VERSION && !hs->pre_shared_keys.empty() &&
+         type != ssl_client_hello_outer;
+}
+
 static size_t ext_pre_shared_key_clienthello_length(
     const SSL_HANDSHAKE *hs, ssl_client_hello_type_t type) {
-  const SSL *const ssl = hs->ssl;
   if (!should_offer_psk(hs, type)) {
     return 0;
   }
 
-  size_t binder_len = EVP_MD_size(ssl_session_get_digest(ssl->session.get()));
-  return 15 + ssl->session->ticket.size() + binder_len;
+  // extension value, extension length, identities length, binders length.
+  size_t ret = 2 + 2 + 2 + 2;
+  for (const auto &psk : hs->pre_shared_keys) {
+    // identity
+    ret += 2 + ssl_pre_shared_key_identity(psk).size();
+    // obfuscated_ticket_age
+    ret += 4;
+    // binder
+    ret += 1 + EVP_MD_size(ssl_pre_shared_key_hash(psk));
+  }
+  return ret;
 }
 
+// ext_pre_shared_key_add_clienthello writes a pre_shared_key extension to
+// `out_extensions` and flushes `out_client_hello`, invalidating
+// `out_extensions`. `out_extensions` must be a child of `out_client_hello`.
+//
+// This function differs from other `CBB` functions because it needs to
+// accommodate PSK binders. It must write the PSK extension, flush the `CBB` to
+// write out a length prefix, and then finally sample the whole ClientHello.
 static bool ext_pre_shared_key_add_clienthello(const SSL_HANDSHAKE *hs,
-                                               CBB *out, bool *out_needs_binder,
+                                               CBB *out_client_hello,
+                                               CBB *out_extensions,
+                                               size_t *out_psk_len,
                                                ssl_client_hello_type_t type) {
   const SSL *const ssl = hs->ssl;
-  *out_needs_binder = false;
   if (!should_offer_psk(hs, type)) {
-    return true;
+    *out_psk_len = 0;
+    // Discard empty extensions blocks.
+    if (CBB_len(out_extensions) == 0) {
+      CBB_discard_child(out_client_hello);
+    }
+    return CBB_flush(out_client_hello);
   }
 
-  OPENSSL_timeval now = ssl_ctx_get_current_time(ssl->ctx.get());
-  uint32_t ticket_age = 1000 * (now.tv_sec - ssl->session->time);
-  uint32_t obfuscated_ticket_age = ticket_age + ssl->session->ticket_age_add;
+  const size_t len_before = CBB_len(out_extensions);
+  CBB contents, identities, identity, binders, binder;
+  if (!CBB_add_u16(out_extensions, TLSEXT_TYPE_pre_shared_key) ||
+      !CBB_add_u16_length_prefixed(out_extensions, &contents) ||
+      !CBB_add_u16_length_prefixed(&contents, &identities)) {
+    return false;
+  }
+
+  // Fill in the PSK identities.
+  for (const auto &psk : hs->pre_shared_keys) {
+    if (const auto *imported = std::get_if<SSLImportedPSK>(&psk);
+        imported != nullptr) {
+      if (!CBB_add_u16_length_prefixed(&identities, &identity) ||
+          !CBB_add_bytes(&identity, imported->imported_identity.data(),
+                         imported->imported_identity.size()) ||
+          !CBB_add_u32(&identities, 0 /* obfuscated_ticket_age */)) {
+        return false;
+      }
+    } else {
+      const SSL_SESSION *session = std::get<UniquePtr<SSL_SESSION>>(psk).get();
+      // At most one PSK will be a session.
+      assert(session == ssl->session.get());
+      OPENSSL_timeval now = ssl_ctx_get_current_time(ssl->ctx.get());
+      uint32_t ticket_age = 1000 * (now.tv_sec - session->time);
+      uint32_t obfuscated_ticket_age = ticket_age + session->ticket_age_add;
+      if (!CBB_add_u16_length_prefixed(&identities, &identity) ||
+          !CBB_add_bytes(&identity, session->ticket.data(),
+                         session->ticket.size()) ||
+          !CBB_add_u32(&identities, obfuscated_ticket_age)) {
+        return false;
+      }
+    }
+  }
 
-  // Fill in a placeholder zero binder of the appropriate length. It will be
+  // Fill in placeholder zero binders of the appropriate length. They will be
   // computed and filled in later after length prefixes are computed.
-  size_t binder_len = EVP_MD_size(ssl_session_get_digest(ssl->session.get()));
+  if (!CBB_add_u16_length_prefixed(&contents, &binders)) {
+    return false;
+  }
+  for (const auto &psk : hs->pre_shared_keys) {
+    size_t binder_len = EVP_MD_size(ssl_pre_shared_key_hash(psk));
+    if (!CBB_add_u8_length_prefixed(&binders, &binder) ||
+        !CBB_add_zeros(&binder, binder_len)) {
+      return false;
+    }
+  }
+  if (!CBB_flush(&binders)) {
+    return false;
+  }
+  const size_t binders_len = CBB_len(&binders);
 
-  CBB contents, identity, ticket, binders, binder;
-  if (!CBB_add_u16(out, TLSEXT_TYPE_pre_shared_key) ||
-      !CBB_add_u16_length_prefixed(out, &contents) ||
-      !CBB_add_u16_length_prefixed(&contents, &identity) ||
-      !CBB_add_u16_length_prefixed(&identity, &ticket) ||
-      !CBB_add_bytes(&ticket, ssl->session->ticket.data(),
-                     ssl->session->ticket.size()) ||
-      !CBB_add_u32(&identity, obfuscated_ticket_age) ||
-      !CBB_add_u16_length_prefixed(&contents, &binders) ||
-      !CBB_add_u8_length_prefixed(&binders, &binder) ||
-      !CBB_add_zeros(&binder, binder_len)) {
+  // Finish the PSK extension and save the length.
+  if (!CBB_flush(out_extensions)) {
     return false;
   }
+  *out_psk_len = CBB_len(out_extensions) - len_before;
 
-  *out_needs_binder = true;
-  return CBB_flush(out);
+  // Fill in `out_extensions`'s length prefix.
+  if (!CBB_flush(out_client_hello)) {
+    return false;
+  }
+
+  // Fill in binders.
+  const auto client_hello = CBBAsSpan(out_client_hello);
+  auto remaining_binders_out = client_hello.last(binders_len);
+  const auto &transcript =
+      type == ssl_client_hello_inner ? hs->inner_transcript : hs->transcript;
+  for (const auto &psk : hs->pre_shared_keys) {
+    // Skip length prefix.
+    remaining_binders_out = remaining_binders_out.subspan(1);
+    size_t one_binder_len;
+    if (!tls13_psk_binder(hs, remaining_binders_out, &one_binder_len, psk,
+                          transcript, client_hello,
+                          2 /* length */ + binders_len)) {
+      return false;
+    }
+    remaining_binders_out = remaining_binders_out.subspan(one_binder_len);
+  }
+  assert(remaining_binders_out.empty());
+  return true;
 }
 
-bool ssl_ext_pre_shared_key_parse_serverhello(SSL_HANDSHAKE *hs,
-                                              uint8_t *out_alert,
-                                              CBS *contents) {
-  uint16_t psk_id;
-  if (!CBS_get_u16(contents, &psk_id) ||  //
+const SSLPreSharedKey *ssl_ext_pre_shared_key_parse_serverhello(
+    SSL_HANDSHAKE *hs, uint8_t *out_alert, CBS *contents) {
+  uint16_t selected_identity;
+  if (!CBS_get_u16(contents, &selected_identity) ||  //
       CBS_len(contents) != 0) {
     OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR);
     *out_alert = SSL_AD_DECODE_ERROR;
-    return false;
+    return nullptr;
   }
 
-  // We only advertise one PSK identity, so the only legal index is zero.
-  if (psk_id != 0) {
+  if (selected_identity >= hs->pre_shared_keys.size()) {
     OPENSSL_PUT_ERROR(SSL, SSL_R_PSK_IDENTITY_NOT_FOUND);
     *out_alert = SSL_AD_UNKNOWN_PSK_IDENTITY;
-    return false;
+    return nullptr;
   }
 
-  return true;
+  return &hs->pre_shared_keys[selected_identity];
 }
 
-bool ssl_ext_pre_shared_key_parse_clienthello(
-    SSL_HANDSHAKE *hs, CBS *out_ticket, CBS *out_binders,
-    uint32_t *out_obfuscated_ticket_age, uint8_t *out_alert,
-    const SSL_CLIENT_HELLO *client_hello, CBS *contents) {
+std::optional<SSLOfferedPSK> SSLOfferedPSKs::Next() {
+  if (CBS_len(&identities) == 0) {
+    return std::nullopt;
+  }
+  SSLOfferedPSK psk;
+  if (!CBS_get_u16_length_prefixed(&identities, &psk.identity) ||
+      CBS_len(&psk.identity) == 0 ||
+      !CBS_get_u32(&identities, &psk.obfuscated_ticket_age) ||
+      !CBS_get_u8_length_prefixed(&binders, &psk.binder) ||
+      CBS_len(&psk.binder) == 0) {
+    // After a successful parse, this should never happen.
+    return std::nullopt;
+  }
+  return psk;
+}
+
+std::optional<SSLOfferedPSKs> ssl_ext_pre_shared_key_parse_clienthello(
+    SSL_HANDSHAKE *hs, uint8_t *out_alert, const SSL_CLIENT_HELLO *client_hello,
+    CBS *contents) {
   // Verify that the pre_shared_key extension is the last extension in
   // ClientHello.
   if (CBS_data(contents) + CBS_len(contents) !=
       client_hello->extensions + client_hello->extensions_len) {
     OPENSSL_PUT_ERROR(SSL, SSL_R_PRE_SHARED_KEY_MUST_BE_LAST);
     *out_alert = SSL_AD_ILLEGAL_PARAMETER;
-    return false;
+    return std::nullopt;
   }
 
-  // We only process the first PSK identity since we don't support pure PSK.
-  CBS identities, binders;
-  if (!CBS_get_u16_length_prefixed(contents, &identities) ||    //
-      !CBS_get_u16_length_prefixed(&identities, out_ticket) ||  //
-      !CBS_get_u32(&identities, out_obfuscated_ticket_age) ||   //
-      !CBS_get_u16_length_prefixed(contents, &binders) ||       //
-      CBS_len(&binders) == 0 ||                                 //
+  SSLOfferedPSKs psks;
+  if (!CBS_get_u16_length_prefixed(contents, &psks.identities) ||
+      !CBS_get_u16_length_prefixed(contents, &psks.binders) ||
+      CBS_len(&psks.identities) == 0 ||  //
+      CBS_len(&psks.binders) == 0 ||     //
       CBS_len(contents) != 0) {
     OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR);
     *out_alert = SSL_AD_DECODE_ERROR;
-    return false;
+    return std::nullopt;
   }
 
-  *out_binders = binders;
-
-  // Check the syntax of the remaining identities, but do not process them.
-  size_t num_identities = 1;
-  while (CBS_len(&identities) != 0) {
-    CBS unused_ticket;
-    uint32_t unused_obfuscated_ticket_age;
-    if (!CBS_get_u16_length_prefixed(&identities, &unused_ticket) ||
-        !CBS_get_u32(&identities, &unused_obfuscated_ticket_age)) {
+  // Check the syntax of the extension.
+  SSLOfferedPSKs copy = psks;
+  while (CBS_len(&copy.identities) != 0 && CBS_len(&copy.binders) != 0) {
+    if (!copy.Next()) {
       OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR);
       *out_alert = SSL_AD_DECODE_ERROR;
-      return false;
+      return std::nullopt;
     }
+  }
 
-    num_identities++;
+  // We should have run out of identities and binders at the same time.
+  if (CBS_len(&copy.identities) != 0 || CBS_len(&copy.binders) != 0) {
+    OPENSSL_PUT_ERROR(SSL, SSL_R_PSK_IDENTITY_BINDER_COUNT_MISMATCH);
+    *out_alert = SSL_AD_ILLEGAL_PARAMETER;
+    return std::nullopt;
   }
 
-  // Check the syntax of the binders. The value will be checked later if
-  // resuming.
-  size_t num_binders = 0;
-  while (CBS_len(&binders) != 0) {
-    CBS binder;
-    if (!CBS_get_u8_length_prefixed(&binders, &binder)) {
-      OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR);
-      *out_alert = SSL_AD_DECODE_ERROR;
-      return false;
-    }
+  return psks;
+}
 
-    num_binders++;
+bool ssl_verify_psk_binder(SSL_HANDSHAKE *hs, uint8_t *out_alert,
+                           const SSLPreSharedKey &psk,
+                           const SSL_CLIENT_HELLO &client_hello) {
+  CBS pre_shared_key;
+  if (!ssl_client_hello_get_extension(&client_hello, &pre_shared_key,
+                                      TLSEXT_TYPE_pre_shared_key)) {
+    OPENSSL_PUT_ERROR(SSL, SSL_R_MISSING_EXTENSION);
+    *out_alert = SSL_AD_MISSING_EXTENSION;
+    return false;
   }
 
-  if (num_identities != num_binders) {
-    OPENSSL_PUT_ERROR(SSL, SSL_R_PSK_IDENTITY_BINDER_COUNT_MISMATCH);
-    *out_alert = SSL_AD_ILLEGAL_PARAMETER;
+  std::optional<SSLOfferedPSKs> offered_psks =
+      ssl_ext_pre_shared_key_parse_clienthello(hs, out_alert, &client_hello,
+                                               &pre_shared_key);
+  if (!offered_psks) {
     return false;
   }
+  const size_t binders_len =
+      2 /* length prefix */ + CBS_len(&offered_psks->binders);
 
-  return true;
+  Span<const uint8_t> identity = ssl_pre_shared_key_identity(psk);
+  for (uint16_t index = 0; true; index++) {
+    std::optional<SSLOfferedPSK> offered_psk = offered_psks->Next();
+    if (!offered_psk) {
+      OPENSSL_PUT_ERROR(SSL, SSL_R_PSK_IDENTITY_NOT_FOUND);
+      *out_alert = SSL_AD_ILLEGAL_PARAMETER;
+      return false;
+    }
+
+    if (offered_psk->identity != identity) {
+      continue;
+    }
+
+    hs->selected_psk_index = index;
+    uint8_t verify_data[EVP_MAX_MD_SIZE];
+    size_t verify_data_len;
+    if (!tls13_psk_binder(
+            hs, verify_data, &verify_data_len, psk, hs->transcript,
+            Span(client_hello.client_hello, client_hello.client_hello_len),
+            binders_len)) {
+      *out_alert = SSL_AD_INTERNAL_ERROR;
+      return false;
+    }
+
+    bool binder_ok = CBS_len(&offered_psk->binder) == verify_data_len &&
+                     CRYPTO_memcmp(CBS_data(&offered_psk->binder), verify_data,
+                                   verify_data_len) == 0;
+    if (CRYPTO_fuzzer_mode_enabled()) {
+      binder_ok = true;
+    }
+    if (!binder_ok) {
+      OPENSSL_PUT_ERROR(SSL, SSL_R_DIGEST_CHECK_FAILED);
+      *out_alert = SSL_AD_DECRYPT_ERROR;
+      return false;
+    }
+    return true;
+  }
 }
 
 bool ssl_ext_pre_shared_key_add_serverhello(SSL_HANDSHAKE *hs, CBB *out) {
-  if (!hs->ssl->s3->session_reused) {
+  if (!hs->selected_psk_index.has_value()) {
     return true;
   }
 
   CBB contents;
-  if (!CBB_add_u16(out, TLSEXT_TYPE_pre_shared_key) ||  //
-      !CBB_add_u16_length_prefixed(out, &contents) ||   //
-      // We only consider the first identity for resumption
-      !CBB_add_u16(&contents, 0) ||  //
+  if (!CBB_add_u16(out, TLSEXT_TYPE_pre_shared_key) ||
+      !CBB_add_u16_length_prefixed(out, &contents) ||
+      !CBB_add_u16(&contents, *hs->selected_psk_index) ||  //
       !CBB_flush(out)) {
     return false;
   }
@@ -2070,7 +2245,7 @@ static bool ext_psk_key_exchange_modes_add_clienthello(
 static bool ext_psk_key_exchange_modes_parse_clienthello(SSL_HANDSHAKE *hs,
                                                          uint8_t *out_alert,
                                                          CBS *contents) {
-  if (contents == NULL) {
+  if (contents == nullptr) {
     return true;
   }
 
@@ -2084,7 +2259,7 @@ static bool ext_psk_key_exchange_modes_parse_clienthello(SSL_HANDSHAKE *hs,
 
   // We only support tickets with PSK_DHE_KE.
   hs->accept_psk_mode = OPENSSL_memchr(CBS_data(&ke_modes), SSL_PSK_DHE_KE,
-                                       CBS_len(&ke_modes)) != NULL;
+                                       CBS_len(&ke_modes)) != nullptr;
 
   return true;
 }
@@ -2099,7 +2274,7 @@ static bool ext_early_data_add_clienthello(const SSL_HANDSHAKE *hs, CBB *out,
                                            ssl_client_hello_type_t type) {
   const SSL *const ssl = hs->ssl;
   // The second ClientHello never offers early data, and we must have already
-  // filled in |early_data_reason| by this point.
+  // filled in `early_data_reason` by this point.
   if (ssl->s3->used_hello_retry_request) {
     assert(ssl->s3->early_data_reason != ssl_early_data_unknown);
     return true;
@@ -2112,7 +2287,7 @@ static bool ext_early_data_add_clienthello(const SSL_HANDSHAKE *hs, CBB *out,
   // If offering ECH, the extension only applies to ClientHelloInner, but we
   // send the extension in both ClientHellos. This ensures that, if the server
   // handshakes with ClientHelloOuter, it can skip past early data. See
-  // draft-ietf-tls-esni-13, section 6.1.
+  // RFC 9849, section 6.1.
   if (!CBB_add_u16(out_compressible, TLSEXT_TYPE_early_data) ||  //
       !CBB_add_u16(out_compressible, 0) ||                       //
       !CBB_flush(out_compressible)) {
@@ -2126,13 +2301,13 @@ static bool ext_early_data_parse_serverhello(SSL_HANDSHAKE *hs,
                                              uint8_t *out_alert,
                                              CBS *contents) {
   SSL *const ssl = hs->ssl;
-  if (contents == NULL) {
+  if (contents == nullptr) {
     if (hs->early_data_offered && !ssl->s3->used_hello_retry_request) {
       ssl->s3->early_data_reason = ssl->s3->session_reused
                                        ? ssl_early_data_peer_declined
                                        : ssl_early_data_session_not_resumed;
     } else {
-      // We already filled in |early_data_reason| when declining to offer 0-RTT
+      // We already filled in `early_data_reason` when declining to offer 0-RTT
       // or handling the implicit HelloRetryRequest reject.
       assert(ssl->s3->early_data_reason != ssl_early_data_unknown);
     }
@@ -2164,7 +2339,7 @@ static bool ext_early_data_parse_clienthello(SSL_HANDSHAKE *hs,
                                              uint8_t *out_alert,
                                              CBS *contents) {
   SSL *const ssl = hs->ssl;
-  if (contents == NULL || ssl_protocol_version(ssl) < TLS1_3_VERSION) {
+  if (contents == nullptr || ssl_protocol_version(ssl) < TLS1_3_VERSION) {
     return true;
   }
 
@@ -2198,8 +2373,7 @@ static bool ext_early_data_add_serverhello(SSL_HANDSHAKE *hs, CBB *out) {
 
 bool ssl_setup_key_shares(SSL_HANDSHAKE *hs, uint16_t override_group_id) {
   SSL *const ssl = hs->ssl;
-  hs->key_shares[0].reset();
-  hs->key_shares[1].reset();
+  hs->key_shares.clear();
   hs->key_share_bytes.Reset();
 
   // If offering a PAKE, do not set up key shares. We do not currently support
@@ -2208,57 +2382,89 @@ bool ssl_setup_key_shares(SSL_HANDSHAKE *hs, uint16_t override_group_id) {
     return true;
   }
 
-  bssl::ScopedCBB cbb;
-  if (!CBB_init(cbb.get(), 64)) {
+  const Span<const uint16_t> supported_group_list =
+      hs->config->supported_group_list;
+  if (supported_group_list.empty()) {
+    OPENSSL_PUT_ERROR(SSL, SSL_R_NO_GROUPS_SPECIFIED);
     return false;
   }
 
-  if (override_group_id == 0 && ssl->ctx->grease_enabled) {
-    // Add a fake group. See RFC 8701.
-    if (!CBB_add_u16(cbb.get(), ssl_get_grease_value(hs, ssl_grease_group)) ||
-        !CBB_add_u16(cbb.get(), 1 /* length */) ||
-        !CBB_add_u8(cbb.get(), 0 /* one byte key share */)) {
-      return false;
-    }
+  std::optional<Span<const uint16_t>> selected_key_shares;
+
+  // This is used for HelloRetryRequest, where we have already been given the
+  // correct group to use.
+  if (override_group_id != 0) {
+    assert(std::find(supported_group_list.begin(), supported_group_list.end(),
+                     override_group_id) != supported_group_list.end());
+    selected_key_shares.emplace(&override_group_id, 1u);
   }
 
-  uint16_t group_id = override_group_id;
-  uint16_t second_group_id = 0;
-  if (override_group_id == 0) {
-    // Predict the most preferred group.
-    Span<const uint16_t> groups = tls1_get_grouplist(hs);
-    if (groups.empty()) {
-      OPENSSL_PUT_ERROR(SSL, SSL_R_NO_GROUPS_SPECIFIED);
-      return false;
+  // First try to predict the most preferred (by our preference order) group
+  // that was hinted by the server.
+  const auto &server_hint_list = ssl->config->server_supported_groups_hint;
+  if (!selected_key_shares.has_value() && !server_hint_list.empty()) {
+    for (const uint16_t &supported_group : supported_group_list) {
+      if (std::find(server_hint_list.begin(), server_hint_list.end(),
+                    supported_group) != server_hint_list.end()) {
+        selected_key_shares.emplace(&supported_group, 1u);
+        break;
+      }
     }
+  }
 
-    group_id = groups[0];
+  // Otherwise, try to use explicitly configured key shares from the caller.
+  if (!selected_key_shares.has_value() &&
+      ssl->config->client_key_share_selections.has_value()) {
+    selected_key_shares.emplace(*ssl->config->client_key_share_selections);
+  }
 
+  // Run the default selection if we don't have anything better.
+  InplaceVector<uint16_t, 2> default_key_shares;
+  if (!selected_key_shares.has_value()) {
+    // By default, predict the most preferred group.
+    if (!default_key_shares.TryPushBack(supported_group_list[0])) {
+      return false;
+    }
     // We'll try to include one post-quantum and one classical initial key
     // share.
-    for (size_t i = 1; i < groups.size() && second_group_id == 0; i++) {
-      if (is_post_quantum_group(group_id) != is_post_quantum_group(groups[i])) {
-        second_group_id = groups[i];
-        assert(second_group_id != group_id);
+    for (size_t i = 1; i < supported_group_list.size(); i++) {
+      if (is_post_quantum_group(default_key_shares[0]) ==
+          is_post_quantum_group(supported_group_list[i])) {
+        continue;
       }
+      if (!default_key_shares.TryPushBack(supported_group_list[i])) {
+        return false;
+      }
+      assert(default_key_shares[1] != default_key_shares[0]);
+      break;
     }
+    selected_key_shares.emplace(default_key_shares);
   }
 
-  CBB key_exchange;
-  hs->key_shares[0] = SSLKeyShare::Create(group_id);
-  if (!hs->key_shares[0] ||  //
-      !CBB_add_u16(cbb.get(), group_id) ||
-      !CBB_add_u16_length_prefixed(cbb.get(), &key_exchange) ||
-      !hs->key_shares[0]->Generate(&key_exchange)) {
+  assert(selected_key_shares.has_value());
+
+  bssl::ScopedCBB cbb;
+  if (!CBB_init(cbb.get(), 64)) {
     return false;
   }
 
-  if (second_group_id != 0) {
-    hs->key_shares[1] = SSLKeyShare::Create(second_group_id);
-    if (!hs->key_shares[1] ||  //
-        !CBB_add_u16(cbb.get(), second_group_id) ||
-        !CBB_add_u16_length_prefixed(cbb.get(), &key_exchange) ||
-        !hs->key_shares[1]->Generate(&key_exchange)) {
+  if (override_group_id == 0 && ssl->ctx->grease_enabled) {
+    // Add a fake group. See RFC 8701.
+    if (!CBB_add_u16(cbb.get(), ssl_get_grease_value(hs, ssl_grease_group)) ||
+        !CBB_add_u16(cbb.get(), 1 /* length */) ||
+        !CBB_add_u8(cbb.get(), 0 /* one byte key share */)) {
+      return false;
+    }
+  }
+
+  CBB key_exchange;
+  for (const uint16_t group_id : *selected_key_shares) {
+    UniquePtr<SSLKeyShare> key_share = SSLKeyShare::Create(group_id);
+    if (key_share == nullptr ||                                    //
+        !CBB_add_u16(cbb.get(), group_id) ||                       //
+        !CBB_add_u16_length_prefixed(cbb.get(), &key_exchange) ||  //
+        !key_share->Generate(&key_exchange) ||                     //
+        !hs->key_shares.TryPushBack(std::move(key_share))) {
       return false;
     }
   }
@@ -2275,7 +2481,12 @@ static bool ext_key_share_add_clienthello(const SSL_HANDSHAKE *hs, CBB *out,
     return true;
   }
 
-  assert(!hs->key_share_bytes.empty());
+  // The caller may explicitly configure empty key shares to request a
+  // HelloRetryRequest.
+  assert(!hs->key_share_bytes.empty() ||
+         (hs->config->client_key_share_selections.has_value() &&
+          hs->config->client_key_share_selections->empty()));
+
   CBB contents, kse_bytes;
   if (!CBB_add_u16(out_compressible, TLSEXT_TYPE_key_share) ||
       !CBB_add_u16_length_prefixed(out_compressible, &contents) ||
@@ -2292,13 +2503,9 @@ static bool ext_key_share_add_clienthello(const SSL_HANDSHAKE *hs, CBB *out,
 bool ssl_ext_key_share_parse_serverhello(SSL_HANDSHAKE *hs,
                                          Array<uint8_t> *out_secret,
                                          uint8_t *out_alert, CBS *contents) {
-  if (hs->key_shares[0] == nullptr) {
-    // If we did not offer key shares, the extension should have been rejected
-    // as unsolicited.
-    OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
-    *out_alert = SSL_AD_INTERNAL_ERROR;
-    return false;
-  }
+  // If we did not offer key shares, the extension should have been rejected
+  // as unsolicited.
+  assert(!hs->key_shares.empty());
 
   CBS ciphertext;
   uint16_t group_id;
@@ -2310,24 +2517,23 @@ bool ssl_ext_key_share_parse_serverhello(SSL_HANDSHAKE *hs,
     return false;
   }
 
-  SSLKeyShare *key_share = hs->key_shares[0].get();
-  if (key_share->GroupID() != group_id) {
-    if (!hs->key_shares[1] || hs->key_shares[1]->GroupID() != group_id) {
-      *out_alert = SSL_AD_ILLEGAL_PARAMETER;
-      OPENSSL_PUT_ERROR(SSL, SSL_R_WRONG_CURVE);
-      return false;
-    }
-    key_share = hs->key_shares[1].get();
+  const auto key_share_it =
+      std::find_if(hs->key_shares.begin(), hs->key_shares.end(),
+                   [group_id](const auto &key_share) {
+                     return key_share->GroupID() == group_id;
+                   });
+  if (key_share_it == hs->key_shares.end()) {
+    *out_alert = SSL_AD_ILLEGAL_PARAMETER;
+    OPENSSL_PUT_ERROR(SSL, SSL_R_WRONG_CURVE);
+    return false;
   }
-
-  if (!key_share->Decap(out_secret, out_alert, ciphertext)) {
+  if (!(*key_share_it)->Decap(out_secret, out_alert, ciphertext)) {
     *out_alert = SSL_AD_INTERNAL_ERROR;
     return false;
   }
 
   hs->new_session->group_id = group_id;
-  hs->key_shares[0].reset();
-  hs->key_shares[1].reset();
+  hs->key_shares.clear();
   return true;
 }
 
@@ -2518,7 +2724,7 @@ static bool ext_supported_groups_add_clienthello(const SSL_HANDSHAKE *hs,
     return false;
   }
 
-  for (uint16_t group : tls1_get_grouplist(hs)) {
+  for (uint16_t group : hs->config->supported_group_list) {
     if (is_post_quantum_group(group) && hs->max_version < TLS1_3_VERSION) {
       continue;
     }
@@ -2564,7 +2770,7 @@ static bool parse_u16_array(const CBS *cbs, Array<uint16_t> *out) {
 static bool ext_supported_groups_parse_clienthello(SSL_HANDSHAKE *hs,
                                                    uint8_t *out_alert,
                                                    CBS *contents) {
-  if (contents == NULL) {
+  if (contents == nullptr) {
     return true;
   }
 
@@ -2591,9 +2797,9 @@ static bool ext_certificate_authorities_add_clienthello(
   if (ssl_has_CA_names(hs->config)) {
     CBB ca_contents;
     if (!CBB_add_u16(out_compressible,
-                     TLSEXT_TYPE_certificate_authorities) ||  //
-        !CBB_add_u16_length_prefixed(out_compressible, &ca_contents) ||    //
-        !ssl_add_CA_names(hs, &ca_contents) ||                //
+                     TLSEXT_TYPE_certificate_authorities) ||             //
+        !CBB_add_u16_length_prefixed(out_compressible, &ca_contents) ||  //
+        !ssl_add_CA_names(hs, &ca_contents) ||                           //
         !CBB_flush(out_compressible)) {
       return false;
     }
@@ -2604,7 +2810,7 @@ static bool ext_certificate_authorities_add_clienthello(
 static bool ext_certificate_authorities_parse_clienthello(SSL_HANDSHAKE *hs,
                                                           uint8_t *out_alert,
                                                           CBS *contents) {
-  if (contents == NULL) {
+  if (contents == nullptr) {
     return true;
   }
 
@@ -2613,13 +2819,115 @@ static bool ext_certificate_authorities_parse_clienthello(SSL_HANDSHAKE *hs,
   }
 
   hs->ca_names = SSL_parse_CA_list(hs->ssl, out_alert, contents);
-  if (!hs->ca_names) {
+  if (!hs->ca_names || sk_CRYPTO_BUFFER_num(hs->ca_names.get()) == 0 ||
+      CBS_len(contents) != 0) {
     return false;
   }
 
   return true;
 }
 
+// Server Padding extension.
+//
+// Adds empty bytes to EncryptedExtensions for TLS 1.3 connections that request
+// it.
+
+// Limit max padding to 16k.
+constexpr uint16_t kMaxServerPadding = 16 * 1024;
+
+static bool ext_server_padding_add_clienthello(const SSL_HANDSHAKE *hs,
+                                               CBB *out, CBB *out_compressible,
+                                               ssl_client_hello_type_t type) {
+  if (!hs->config->server_padding_request.has_value()) {
+    return true;
+  }
+
+  CBB contents;
+  if (!CBB_add_u16(out_compressible, TLSEXT_TYPE_server_padding) ||
+      !CBB_add_u16_length_prefixed(out_compressible, &contents) ||
+      !CBB_add_u16(&contents, hs->config->server_padding_request.value()) ||
+      !CBB_flush(out_compressible)) {
+    return false;
+  }
+
+  return true;
+}
+
+static bool ext_server_padding_parse_clienthello(SSL_HANDSHAKE *hs,
+                                                 uint8_t *out_alert,
+                                                 CBS *contents) {
+  if (contents == nullptr) {
+    return true;
+  }
+
+  if (ssl_protocol_version(hs->ssl) < TLS1_3_VERSION) {
+    return true;
+  }
+
+  uint16_t padding_requested;
+  if (!CBS_get_u16(contents, &padding_requested) || CBS_len(contents) != 0) {
+    *out_alert = SSL_AD_DECODE_ERROR;
+    OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR);
+    return false;
+  }
+
+  hs->client_requested_server_padding_size = padding_requested;
+  return true;
+}
+
+static bool ext_server_padding_add_serverhello(SSL_HANDSHAKE *hs, CBB *out) {
+  SSL *const ssl = hs->ssl;
+  if (ssl_protocol_version(ssl) < TLS1_3_VERSION ||
+      !hs->client_requested_server_padding_size ||
+      !hs->config->server_padding_enabled) {
+    return true;
+  }
+
+  // The extension shouldn't be sent when resuming sessions.
+  if (ssl->s3->session_reused) {
+    return true;
+  }
+
+  // Limit max padding; if a client requests more than this, don't return any
+  // padding.
+  uint16_t padding_len = hs->client_requested_server_padding_size.value();
+  if (padding_len > kMaxServerPadding) {
+    return true;
+  }
+
+  CBB contents;
+  if (!CBB_add_u16(out, TLSEXT_TYPE_server_padding) ||
+      !CBB_add_u16_length_prefixed(out, &contents) ||
+      !CBB_add_zeros(&contents, padding_len) || !CBB_flush(out)) {
+    return false;
+  }
+
+  return true;
+}
+
+static bool ext_server_padding_parse_serverhello(SSL_HANDSHAKE *hs,
+                                                 uint8_t *out_alert,
+                                                 CBS *contents) {
+  if (contents == nullptr) {
+    return true;
+  }
+
+  if (ssl_protocol_version(hs->ssl) < TLS1_3_VERSION ||
+      !hs->config->server_padding_request) {
+    OPENSSL_PUT_ERROR(SSL, SSL_R_UNEXPECTED_EXTENSION);
+    *out_alert = SSL_AD_UNSUPPORTED_EXTENSION;
+    return false;
+  }
+
+  if (hs->config->server_padding_request.value() != CBS_len(contents)) {
+    OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR);
+    *out_alert = SSL_AD_DECODE_ERROR;
+    return false;
+  }
+
+  hs->ssl->s3->server_sent_requested_padding = true;
+  return true;
+}
 
 // Trust Anchor Identifiers
 //
@@ -2665,7 +2973,8 @@ static bool ext_trust_anchors_parse_clienthello(SSL_HANDSHAKE *hs,
 
   CBS child;
   if (!CBS_get_u16_length_prefixed(contents, &child) ||
-      !ssl_is_valid_trust_anchor_list(child)) {
+      !ssl_is_valid_trust_anchor_list(child) ||  //
+      CBS_len(contents) != 0) {
     *out_alert = SSL_AD_DECODE_ERROR;
     OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR);
     return false;
@@ -2681,24 +2990,35 @@ static bool ext_trust_anchors_parse_clienthello(SSL_HANDSHAKE *hs,
 
 static bool ext_trust_anchors_add_serverhello(SSL_HANDSHAKE *hs, CBB *out) {
   SSL *const ssl = hs->ssl;
-  const auto &creds = hs->config->cert->credentials;
-  if (ssl_protocol_version(ssl) < TLS1_3_VERSION ||
-      // Check if any credentials have trust anchor IDs.
-      std::none_of(creds.begin(), creds.end(), [](const auto &cred) {
-        return !cred->trust_anchor_id.empty();
-      })) {
+  if (ssl_protocol_version(ssl) < TLS1_3_VERSION) {
     return true;
   }
-  CBB contents, list;
-  if (!CBB_add_u16(out, TLSEXT_TYPE_trust_anchors) ||  //
-      !CBB_add_u16_length_prefixed(out, &contents) ||  //
+
+  const size_t old_len = CBB_len(out);
+  CBB contents, list, child;
+  if (!CBB_add_u16(out, TLSEXT_TYPE_trust_anchors) ||
+      !CBB_add_u16_length_prefixed(out, &contents) ||
       !CBB_add_u16_length_prefixed(&contents, &list)) {
     return false;
   }
-  for (const auto &cred : creds) {
+
+  // Use the caller-provided list if they overrode it.
+  if (!hs->config->cert->available_trust_anchors.empty()) {
+    return CBB_add_bytes(&list,
+                         hs->config->cert->available_trust_anchors.data(),
+                         hs->config->cert->available_trust_anchors.size()) &&
+           CBB_flush(out);
+  }
+
+  for (const auto &cred : hs->config->cert->credentials) {
     if (!cred->trust_anchor_id.empty()) {
-      CBB child;
-      if (!CBB_add_u8_length_prefixed(&list, &child) ||  //
+      uint16_t unused_sigalg;
+      if (!ssl_check_tls13_credential_ignoring_issuer(
+              hs, kAllCertTypes, cred.get(), &unused_sigalg)) {
+        ERR_clear_error();
+        continue;
+      }
+      if (!CBB_add_u8_length_prefixed(&list, &child) ||
           !CBB_add_bytes(&child, cred->trust_anchor_id.data(),
                          cred->trust_anchor_id.size()) ||
           !CBB_flush(&list)) {
@@ -2706,7 +3026,17 @@ static bool ext_trust_anchors_add_serverhello(SSL_HANDSHAKE *hs, CBB *out) {
       }
     }
   }
-  return CBB_flush(out);
+
+  bool empty = CBB_len(&list) == 0;
+  if (!CBB_flush(out)) {
+    return false;
+  }
+
+  // Don't send the extension if it would have been empty.
+  if (empty) {
+    CBB_discard(out, CBB_len(out) - old_len);
+  }
+  return true;
 }
 
 static bool ext_trust_anchors_parse_serverhello(SSL_HANDSHAKE *hs,
@@ -2725,8 +3055,9 @@ static bool ext_trust_anchors_parse_serverhello(SSL_HANDSHAKE *hs,
   CBS child;
   if (!CBS_get_u16_length_prefixed(contents, &child) ||
       // The list of available trust anchors may not be empty.
-      CBS_len(&child) == 0 ||  //
-      !ssl_is_valid_trust_anchor_list(child)) {
+      CBS_len(&child) == 0 ||                    //
+      !ssl_is_valid_trust_anchor_list(child) ||  //
+      CBS_len(contents) != 0) {
     *out_alert = SSL_AD_DECODE_ERROR;
     OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR);
     return false;
@@ -2834,7 +3165,7 @@ static bool ext_quic_transport_params_parse_clienthello_impl(
       if (hs->config->quic_transport_params.empty()) {
         return true;
       }
-      // QUIC transport parameters must not be set if |ssl| is not configured
+      // QUIC transport parameters must not be set if `ssl` is not configured
       // for QUIC.
       OPENSSL_PUT_ERROR(SSL, SSL_R_QUIC_TRANSPORT_PARAMETERS_MISCONFIGURED);
       *out_alert = SSL_AD_INTERNAL_ERROR;
@@ -3005,7 +3336,7 @@ static bool cert_compression_parse_clienthello(SSL_HANDSHAKE *hs,
     return true;
   }
 
-  const SSL_CTX *ctx = hs->ssl->ctx.get();
+  const SSLContext *ctx = hs->ssl->ctx.get();
   const size_t num_algs = ctx->cert_compression_algs.size();
 
   CBS alg_ids;
@@ -3090,7 +3421,7 @@ bool ssl_setup_pake_shares(SSL_HANDSHAKE *hs) {
     OPENSSL_PUT_ERROR(SSL, SSL_R_UNSUPPORTED_CREDENTIAL_LIST);
     return false;
   }
-  SSL_CREDENTIAL *cred = creds[0].get();
+  SSLCredential *cred = creds[0].get();
   assert(cred->type == SSLCredentialType::kSPAKE2PlusV1Client);
 
   hs->pake_prover = MakeUnique<spake2plus::Prover>();
@@ -3175,7 +3506,7 @@ bool ssl_ext_pake_parse_serverhello(SSL_HANDSHAKE *hs,
   }
   Span<const uint8_t> pake_msg_span = pake_msg;
 
-  // Releasing the result of |ComputeConfirmation| lets the client confirm one
+  // Releasing the result of `ComputeConfirmation` lets the client confirm one
   // PAKE guess. If all failures are used up, no more guesses are allowed.
   if (!hs->credential->HasPAKEAttempts()) {
     OPENSSL_PUT_ERROR(SSL, SSL_R_PAKE_EXHAUSTED);
@@ -3187,7 +3518,7 @@ bool ssl_ext_pake_parse_serverhello(SSL_HANDSHAKE *hs,
   uint8_t prover_secret[spake2plus::kSecretSize];
   if (!hs->pake_prover->ComputeConfirmation(
           prover_confirm, prover_secret,
-          pake_msg_span.subspan(0, spake2plus::kShareSize),
+          pake_msg_span.first<spake2plus::kShareSize>(),
           pake_msg_span.subspan(spake2plus::kShareSize))) {
     // Record a failure before releasing the answer to the client.
     hs->credential->ClaimPAKEAttempt();
@@ -3369,7 +3700,7 @@ static bool ext_alps_parse_serverhello_impl(SSL_HANDSHAKE *hs,
   }
 
   // Note extension callbacks may run in any order, so we defer checking
-  // consistency with ALPN to |ssl_check_serverhello_tlsext|.
+  // consistency with ALPN to `ssl_check_serverhello_tlsext`.
   if (!hs->new_session->peer_application_settings.CopyFrom(*contents)) {
     *out_alert = SSL_AD_INTERNAL_ERROR;
     return false;
@@ -3489,6 +3820,249 @@ bool ssl_negotiate_alps(SSL_HANDSHAKE *hs, uint8_t *out_alert,
   return true;
 }
 
+// Client certificate type & Server certificate type
+//
+// https://www.rfc-editor.org/rfc/rfc7250.html#section-3
+
+// parse_clienthello_cert_types_list returns a span containing the cert type
+// values from a client_certificate_type or server_certificate_type ClientHello
+// extension. Returns std::nullopt on error, or returns a nonempty span
+// containing the values. This rejects the invalid empty list and list
+// containing only the default X.509. This does not filter out unrecognized
+// values. We don't check for duplicates here, even though a list containing
+// duplicates should be considered invalid, to avoid quadratic behavior.
+static std::optional<Span<const uint8_t>> parse_clienthello_cert_types_list(
+    uint8_t *out_alert, CBS *contents) {
+  CBS cert_types;
+  if (!CBS_get_u8_length_prefixed(contents, &cert_types) ||
+      CBS_len(contents) != 0) {
+    OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR);
+    *out_alert = SSL_AD_ILLEGAL_PARAMETER;
+    return std::nullopt;
+  }
+  Span<const uint8_t> cert_types_list(cert_types);
+  // The client must omit the extension if the only type would be the default,
+  // X.509.
+  if (cert_types_list.empty() ||
+      (cert_types_list.size() == 1 && cert_types_list[0] == kDefaultCertType)) {
+    OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR);
+    *out_alert = SSL_AD_ILLEGAL_PARAMETER;
+    return std::nullopt;
+  }
+  return cert_types_list;
+}
+
+void ssl_setup_client_certificate_type(SSL_HANDSHAKE *hs) {
+  assert(!hs->ssl->server);
+  hs->offered_client_cert_types.clear();
+  InplaceVector<uint8_t, kNumCertTypes> available_cert_types;
+  if (!hs->ssl->config->available_client_cert_types.empty()) {
+    available_cert_types.CopyFrom(hs->ssl->config->available_client_cert_types);
+  } else {
+    // Compute the available cert types based on configured SSL_CREDENTIALs.
+    const auto append_if_not_present = [&](uint8_t cert_type) {
+      if (std::find(available_cert_types.begin(), available_cert_types.end(),
+                    cert_type) == available_cert_types.end()) {
+        available_cert_types.PushBack(cert_type);
+      }
+    };
+    for (const auto &credential : hs->config->cert->credentials) {
+      if (std::optional<uint8_t> cert_type =
+              ssl_credential_type_to_cert_type(credential->type);
+          cert_type.has_value()) {
+        append_if_not_present(*cert_type);
+      }
+    }
+  }
+  if (available_cert_types.empty() ||
+      // Omit extension if the only type would be the default, X.509.
+      (available_cert_types.size() == 1 &&
+       available_cert_types[0] == kDefaultCertType)) {
+    return;
+  }
+  hs->offered_client_cert_types = std::move(available_cert_types);
+}
+
+bool ssl_negotiate_client_certificate_type(
+    SSL_HANDSHAKE *hs, uint8_t *out_alert,
+    const SSL_CLIENT_HELLO *client_hello) {
+  assert(hs->ssl->server);
+  assert(!hs->config->accepted_peer_cert_types.empty());
+  CBS contents;
+  Span<const uint8_t> peer_available_client_cert_types;
+  if (ssl_client_hello_get_extension(client_hello, &contents,
+                                     TLSEXT_TYPE_client_cert_type)) {
+    std::optional<Span<const uint8_t>> client_hello_client_cert_types =
+        parse_clienthello_cert_types_list(out_alert, &contents);
+    if (!client_hello_client_cert_types.has_value()) {
+      return false;
+    }
+    peer_available_client_cert_types = *client_hello_client_cert_types;
+  }
+  if (!hs->cert_request) {
+    return true;
+  }
+  // If the client didn't send the extension, assume the client supports X.509
+  // only by default.
+  if (peer_available_client_cert_types.empty()) {
+    peer_available_client_cert_types =
+        Span<const uint8_t>(&kDefaultCertType, 1u);
+  }
+  for (const uint8_t cert_type : hs->config->accepted_peer_cert_types) {
+    if (std::find(peer_available_client_cert_types.begin(),
+                  peer_available_client_cert_types.end(),
+                  cert_type) == peer_available_client_cert_types.end()) {
+      continue;
+    }
+    hs->peer_cert_type = cert_type;
+    return true;
+  }
+  OPENSSL_PUT_ERROR(SSL, SSL_R_UNSUPPORTED_CERTIFICATE);
+  *out_alert = SSL_AD_UNSUPPORTED_CERTIFICATE;
+  return false;
+}
+
+static bool ext_client_cert_type_add_clienthello(const SSL_HANDSHAKE *hs,
+                                                 CBB *out,
+                                                 CBB *out_compressible,
+                                                 ssl_client_hello_type_t type) {
+  if (hs->offered_client_cert_types.empty()) {
+    return true;
+  }
+  CBB contents, client_cert_types;
+  if (!CBB_add_u16(out, TLSEXT_TYPE_client_cert_type) ||
+      !CBB_add_u16_length_prefixed(out, &contents) ||
+      !CBB_add_u8_length_prefixed(&contents, &client_cert_types) ||
+      !CBB_add_bytes(&client_cert_types, hs->offered_client_cert_types.data(),
+                     hs->offered_client_cert_types.size()) ||
+      !CBB_flush(out)) {
+    return false;
+  }
+  return true;
+}
+
+static bool ext_client_cert_type_parse_serverhello(SSL_HANDSHAKE *hs,
+                                                   uint8_t *out_alert,
+                                                   CBS *contents) {
+  if (contents == nullptr) {
+    return true;
+  }
+  uint8_t cert_type;
+  if (!CBS_get_u8(contents, &cert_type) || CBS_len(contents) != 0) {
+    OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR);
+    *out_alert = SSL_AD_DECODE_ERROR;
+    return false;
+  }
+  // Reject if the server picked a cert type that we didn't offer in the
+  // ClientHello.
+  if (std::find(hs->offered_client_cert_types.begin(),
+                hs->offered_client_cert_types.end(),
+                cert_type) == hs->offered_client_cert_types.end()) {
+    OPENSSL_PUT_ERROR(SSL, SSL_R_UNSUPPORTED_CERTIFICATE);
+    *out_alert = SSL_AD_UNSUPPORTED_CERTIFICATE;
+    return false;
+  }
+  hs->client_cert_type = cert_type;
+  return true;
+}
+
+static bool ext_client_cert_type_add_serverhello(SSL_HANDSHAKE *hs, CBB *out) {
+  // Only send client_certificate_type if we plan to send a CertificateRequest.
+  if (!hs->cert_request) {
+    return true;
+  }
+  CBB contents;
+  if (!CBB_add_u16(out, TLSEXT_TYPE_client_cert_type) ||
+      !CBB_add_u16_length_prefixed(out, &contents) ||
+      !CBB_add_u8(&contents, hs->peer_cert_type) ||  //
+      !CBB_flush(out)) {
+    return false;
+  }
+  return true;
+}
+
+std::optional<Span<const uint8_t>> ssl_get_allowed_server_cert_types(
+    const SSL_HANDSHAKE *hs, const SSL_CLIENT_HELLO *client_hello,
+    uint8_t *out_alert) {
+  assert(hs->ssl->server);
+  std::optional<Span<const uint8_t>> clienthello_server_cert_types;
+  CBS server_cert_types_ext;
+  if (ssl_client_hello_get_extension(client_hello, &server_cert_types_ext,
+                                     TLSEXT_TYPE_server_cert_type)) {
+    clienthello_server_cert_types =
+        parse_clienthello_cert_types_list(out_alert, &server_cert_types_ext);
+    if (!clienthello_server_cert_types.has_value()) {
+      OPENSSL_PUT_ERROR(SSL, SSL_R_ERROR_PARSING_EXTENSION);
+      return std::nullopt;
+    }
+  }
+  // Allow X.509 certificates by default.
+  return clienthello_server_cert_types.value_or(Span(&kDefaultCertType, 1u));
+}
+
+static bool ext_server_cert_type_add_clienthello(const SSL_HANDSHAKE *hs,
+                                                 CBB *out,
+                                                 CBB *out_compressible,
+                                                 ssl_client_hello_type_t type) {
+  assert(!hs->config->accepted_peer_cert_types.empty());
+  // Omit extension if the only type would be the default, X.509.
+  if (hs->config->accepted_peer_cert_types.size() == 1 &&
+      hs->config->accepted_peer_cert_types[0] == kDefaultCertType) {
+    return true;
+  }
+  CBB contents, server_cert_types;
+  if (!CBB_add_u16(out, TLSEXT_TYPE_server_cert_type) ||
+      !CBB_add_u16_length_prefixed(out, &contents) ||
+      !CBB_add_u8_length_prefixed(&contents, &server_cert_types) ||
+      !CBB_add_bytes(&server_cert_types,
+                     hs->config->accepted_peer_cert_types.data(),
+                     hs->config->accepted_peer_cert_types.size()) ||
+      !CBB_flush(out)) {
+    return false;
+  }
+  return true;
+}
+
+static bool ext_server_cert_type_parse_serverhello(SSL_HANDSHAKE *hs,
+                                                   uint8_t *out_alert,
+                                                   CBS *contents) {
+  assert(!hs->config->accepted_peer_cert_types.empty());
+  // Absence of an extension from the server implies the default, X.509.
+  uint8_t cert_type = kDefaultCertType;
+  if (contents != nullptr &&
+      (!CBS_get_u8(contents, &cert_type) || CBS_len(contents) != 0)) {
+    return false;
+  }
+  // Check that the server's chosen type is among the types we accept.
+  if (std::find(hs->config->accepted_peer_cert_types.begin(),
+                hs->config->accepted_peer_cert_types.end(),
+                cert_type) == hs->config->accepted_peer_cert_types.end()) {
+    OPENSSL_PUT_ERROR(SSL, SSL_R_UNSUPPORTED_CERTIFICATE);
+    *out_alert = SSL_AD_UNSUPPORTED_CERTIFICATE;
+    return false;
+  }
+  hs->peer_cert_type = cert_type;
+  return true;
+}
+
+static bool ext_server_cert_type_add_serverhello(SSL_HANDSHAKE *hs, CBB *out) {
+  if (hs->credential == nullptr) {
+    return true;
+  }
+  const auto cert_type = ssl_credential_type_to_cert_type(hs->credential->type);
+  if (!cert_type.has_value()) {
+    return true;
+  }
+  CBB contents;
+  if (!CBB_add_u16(out, TLSEXT_TYPE_server_cert_type) ||
+      !CBB_add_u16_length_prefixed(out, &contents) ||
+      !CBB_add_u8(&contents, *cert_type) ||  //
+      !CBB_flush(out)) {
+    return false;
+  }
+  return true;
+}
+
 // kExtensions contains all the supported extensions.
 static const struct tls_extension kExtensions[] = {
     {
@@ -3545,7 +4119,7 @@ static const struct tls_extension kExtensions[] = {
         TLSEXT_TYPE_application_layer_protocol_negotiation,
         ext_alpn_add_clienthello,
         ext_alpn_parse_serverhello,
-        // ALPN is negotiated late in |ssl_negotiate_alpn|.
+        // ALPN is negotiated late in `ssl_negotiate_alpn`.
         ignore_parse_clienthello,
         ext_alpn_add_serverhello,
     },
@@ -3658,7 +4232,7 @@ static const struct tls_extension kExtensions[] = {
         TLSEXT_TYPE_application_settings,
         ext_alps_add_clienthello,
         ext_alps_parse_serverhello,
-        // ALPS is negotiated late in |ssl_negotiate_alpn|.
+        // ALPS is negotiated late in `ssl_negotiate_alpn`.
         ignore_parse_clienthello,
         ext_alps_add_serverhello,
     },
@@ -3666,7 +4240,7 @@ static const struct tls_extension kExtensions[] = {
         TLSEXT_TYPE_application_settings_old,
         ext_alps_add_clienthello_old,
         ext_alps_parse_serverhello_old,
-        // ALPS is negotiated late in |ssl_negotiate_alpn|.
+        // ALPS is negotiated late in `ssl_negotiate_alpn`.
         ignore_parse_clienthello,
         ext_alps_add_serverhello_old,
     },
@@ -3693,15 +4267,40 @@ static const struct tls_extension kExtensions[] = {
         ext_trust_anchors_parse_clienthello,
         ext_trust_anchors_add_serverhello,
     },
+    {
+        TLSEXT_TYPE_client_cert_type,
+        ext_client_cert_type_add_clienthello,
+        ext_client_cert_type_parse_serverhello,
+        // client_certificate_type is negotiated late in
+        // `ssl_negotiate_client_cert_type`.
+        ignore_parse_clienthello,
+        ext_client_cert_type_add_serverhello,
+    },
+    {
+        TLSEXT_TYPE_server_cert_type,
+        ext_server_cert_type_add_clienthello,
+        ext_server_cert_type_parse_serverhello,
+        // The server_certificate_type list from the client is parsed later,
+        // during credential selection.
+        ignore_parse_clienthello,
+        ext_server_cert_type_add_serverhello,
+    },
+    {
+        TLSEXT_TYPE_server_padding,
+        ext_server_padding_add_clienthello,
+        ext_server_padding_parse_serverhello,
+        ext_server_padding_parse_clienthello,
+        ext_server_padding_add_serverhello,
+    },
 };
 
 #define kNumExtensions (sizeof(kExtensions) / sizeof(struct tls_extension))
 
 static_assert(kNumExtensions <=
-                  sizeof(((SSL_HANDSHAKE *)NULL)->extensions.sent) * 8,
+                  sizeof(((SSL_HANDSHAKE *)nullptr)->extensions.sent) * 8,
               "too many extensions for sent bitset");
 static_assert(kNumExtensions <=
-                  sizeof(((SSL_HANDSHAKE *)NULL)->extensions.received) * 8,
+                  sizeof(((SSL_HANDSHAKE *)nullptr)->extensions.received) * 8,
               "too many extensions for received bitset");
 
 bool ssl_setup_extension_permutation(SSL_HANDSHAKE *hs) {
@@ -3721,7 +4320,7 @@ bool ssl_setup_extension_permutation(SSL_HANDSHAKE *hs) {
     permutation[i] = i;
   }
   for (size_t i = kNumExtensions - 1; i > 0; i--) {
-    // Set element |i| to a randomly-selected element 0 <= j <= i.
+    // Set element `i` to a randomly-selected element 0 <= j <= i.
     std::swap(permutation[i], permutation[seeds[i - 1] % (i + 1)]);
   }
   hs->extension_permutation = std::move(permutation);
@@ -3738,7 +4337,7 @@ static const struct tls_extension *tls_extension_find(uint32_t *out_index,
     }
   }
 
-  return NULL;
+  return nullptr;
 }
 
 static bool add_padding_extension(CBB *cbb, uint16_t ext, size_t len) {
@@ -3753,13 +4352,12 @@ static bool add_padding_extension(CBB *cbb, uint16_t ext, size_t len) {
 }
 
 static bool ssl_add_clienthello_tlsext_inner(SSL_HANDSHAKE *hs, CBB *out,
-                                             CBB *out_encoded,
-                                             bool *out_needs_psk_binder) {
+                                             CBB *out_encoded) {
   // When writing ClientHelloInner, we construct the real and encoded
   // ClientHellos concurrently, to handle compression. Uncompressed extensions
-  // are written to |extensions| and copied to |extensions_encoded|. Compressed
-  // extensions are buffered in |compressed| and written to the end. (ECH can
-  // only compress continguous extensions.)
+  // are written to `extensions` and copied to `extensions_encoded`. Compressed
+  // extensions are buffered in `compressed` and written to the end. (ECH can
+  // only compress contiguous extensions.)
   SSL *const ssl = hs->ssl;
   bssl::ScopedCBB compressed, outer_extensions;
   CBB extensions, extensions_encoded;
@@ -3775,7 +4373,7 @@ static bool ssl_add_clienthello_tlsext_inner(SSL_HANDSHAKE *hs, CBB *out,
 
   if (ssl->ctx->grease_enabled) {
     // Add a fake empty extension. See RFC 8701. This always matches
-    // |ssl_add_clienthello_tlsext|, so compress it.
+    // `ssl_add_clienthello_tlsext`, so compress it.
     uint16_t grease_ext = ssl_get_grease_value(hs, ssl_grease_extension1);
     if (!add_padding_extension(compressed.get(), grease_ext, 0) ||
         !CBB_add_u16(outer_extensions.get(), grease_ext)) {
@@ -3813,7 +4411,7 @@ static bool ssl_add_clienthello_tlsext_inner(SSL_HANDSHAKE *hs, CBB *out,
 
   if (ssl->ctx->grease_enabled) {
     // Add a fake non-empty extension. See RFC 8701. This always matches
-    // |ssl_add_clienthello_tlsext|, so compress it.
+    // `ssl_add_clienthello_tlsext`, so compress it.
     uint16_t grease_ext = ssl_get_grease_value(hs, ssl_grease_extension2);
     if (!add_padding_extension(compressed.get(), grease_ext, 1) ||
         !CBB_add_u16(outer_extensions.get(), grease_ext)) {
@@ -3844,15 +4442,16 @@ static bool ssl_add_clienthello_tlsext_inner(SSL_HANDSHAKE *hs, CBB *out,
     }
   }
 
-  // The PSK extension must be last. It is never compressed. Note, if there is a
-  // binder, the caller will need to update both ClientHelloInner and
-  // EncodedClientHelloInner after computing it.
-  const size_t len_before = CBB_len(&extensions);
-  if (!ext_pre_shared_key_add_clienthello(hs, &extensions, out_needs_psk_binder,
-                                          ssl_client_hello_inner) ||
-      !CBB_add_bytes(&extensions_encoded, CBB_data(&extensions) + len_before,
-                     CBB_len(&extensions) - len_before) ||
-      !CBB_flush(out) ||  //
+  // The PSK extension must be last. It is never compressed.
+  size_t psk_len;
+  if (!ext_pre_shared_key_add_clienthello(hs, out, &extensions, &psk_len,
+                                          ssl_client_hello_inner)) {
+    return false;
+  }
+
+  // Copy the PSK extension to EncodedClientHelloInner.
+  auto psk = CBBAsSpan(out).last(psk_len);
+  if (!CBB_add_bytes(&extensions_encoded, psk.data(), psk.size()) ||
       !CBB_flush(out_encoded)) {
     return false;
   }
@@ -3861,16 +4460,19 @@ static bool ssl_add_clienthello_tlsext_inner(SSL_HANDSHAKE *hs, CBB *out,
 }
 
 bool ssl_add_clienthello_tlsext(SSL_HANDSHAKE *hs, CBB *out, CBB *out_encoded,
-                                bool *out_needs_psk_binder,
-                                ssl_client_hello_type_t type,
-                                size_t header_len) {
-  *out_needs_psk_binder = false;
+                                ssl_client_hello_type_t type) {
+  // `out` must contain the start of a ClientHello, which means it must begin
+  // with a TLS or DTLS version.
+  assert(CBB_len(out) != 0 && (CBB_data(out)[0] == SSL3_VERSION_MAJOR ||
+                               CBB_data(out)[0] == DTLS1_VERSION_MAJOR));
 
   if (type == ssl_client_hello_inner) {
-    return ssl_add_clienthello_tlsext_inner(hs, out, out_encoded,
-                                            out_needs_psk_binder);
+    return ssl_add_clienthello_tlsext_inner(hs, out, out_encoded);
   }
 
+  // Sample the length of the ClientHello thus far, including the message
+  // header.
+  size_t msg_len = SSL3_HM_HEADER_LENGTH + CBB_len(out);
   assert(out_encoded == nullptr);  // Only ClientHelloInner needs two outputs.
   SSL *const ssl = hs->ssl;
   CBB extensions;
@@ -3924,37 +4526,38 @@ bool ssl_add_clienthello_tlsext(SSL_HANDSHAKE *hs, CBB *out, CBB *out_encoded,
   // In cleartext ClientHellos, we add the padding extension to work around
   // bugs. We also apply this padding to ClientHelloOuter, to keep the wire
   // images aligned.
-  size_t psk_extension_len = ext_pre_shared_key_clienthello_length(hs, type);
+  size_t psk_len = ext_pre_shared_key_clienthello_length(hs, type);
   if (!SSL_is_dtls(ssl) && !SSL_is_quic(ssl) &&
       !ssl->s3->used_hello_retry_request) {
-    header_len +=
-        SSL3_HM_HEADER_LENGTH + 2 + CBB_len(&extensions) + psk_extension_len;
+    msg_len += 2 /* length prefix */ + CBB_len(&extensions) + psk_len;
+    // The length of the padding extension, excluding the four-byte extension
+    // header.
     size_t padding_len = 0;
 
     // The final extension must be non-empty. WebSphere Application
     // Server 7.0 is intolerant to the last extension being zero-length. See
     // https://crbug.com/363583.
-    if (last_was_empty && psk_extension_len == 0) {
+    if (last_was_empty && psk_len == 0) {
       padding_len = 1;
       // The addition of the padding extension may push us into the F5 bug.
-      header_len += 4 + padding_len;
+      msg_len += 4 + padding_len;
     }
 
     // Add padding to workaround bugs in F5 terminators. See RFC 7685.
     //
     // NB: because this code works out the length of all existing extensions
     // it MUST always appear last (save for any PSK extension).
-    if (header_len > 0xff && header_len < 0x200) {
+    if (msg_len > 0xff && msg_len < 0x200) {
       // If our calculations already included a padding extension, remove that
       // factor because we're about to change its length.
       if (padding_len != 0) {
-        header_len -= 4 + padding_len;
+        msg_len -= 4 + padding_len;
       }
-      padding_len = 0x200 - header_len;
-      // Extensions take at least four bytes to encode. Always include at least
-      // one byte of data if including the extension. WebSphere Application
-      // Server 7.0 is intolerant to the last extension being zero-length. See
-      // https://crbug.com/363583.
+      padding_len = 0x200 - msg_len;
+      // Extensions take at least four bytes to encode. WebSphere Application
+      // Server 7.0 is intolerant to the last extension being zero-length, so
+      // always include at least one byte of data if including the extension.
+      // See https://crbug.com/363583.
       if (padding_len >= 4 + 1) {
         padding_len -= 4;
       } else {
@@ -3969,21 +4572,13 @@ bool ssl_add_clienthello_tlsext(SSL_HANDSHAKE *hs, CBB *out, CBB *out_encoded,
   }
 
   // The PSK extension must be last, including after the padding.
-  const size_t len_before = CBB_len(&extensions);
-  if (!ext_pre_shared_key_add_clienthello(hs, &extensions, out_needs_psk_binder,
+  size_t psk_len_actual;
+  if (!ext_pre_shared_key_add_clienthello(hs, out, &extensions, &psk_len_actual,
                                           type)) {
-    OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
     return false;
   }
-  assert(psk_extension_len == CBB_len(&extensions) - len_before);
-  (void)len_before;  // |assert| is omitted in release builds.
-
-  // Discard empty extensions blocks.
-  if (CBB_len(&extensions) == 0) {
-    CBB_discard_child(out);
-  }
-
-  return CBB_flush(out);
+  assert(psk_len_actual == psk_len);
+  return true;
 }
 
 bool ssl_add_serverhello_tlsext(SSL_HANDSHAKE *hs, CBB *out) {
@@ -4039,7 +4634,7 @@ static bool ssl_scan_clienthello_tlsext(SSL_HANDSHAKE *hs,
     unsigned ext_index;
     const struct tls_extension *const ext =
         tls_extension_find(&ext_index, type);
-    if (ext == NULL) {
+    if (ext == nullptr) {
       continue;
     }
 
@@ -4058,11 +4653,11 @@ static bool ssl_scan_clienthello_tlsext(SSL_HANDSHAKE *hs,
       continue;
     }
 
-    CBS *contents = NULL, fake_contents;
+    CBS *contents = nullptr, fake_contents;
     static const uint8_t kFakeRenegotiateExtension[] = {0};
     if (kExtensions[i].value == TLSEXT_TYPE_renegotiate &&
-        ssl_client_cipher_list_contains_cipher(client_hello,
-                                               SSL3_CK_SCSV & 0xffff)) {
+        ssl_client_cipher_list_contains_cipher(
+            client_hello, SSL_CIPHER_EMPTY_RENEGOTIATION_INFO_SCSV)) {
       // The renegotiation SCSV was received so pretend that we received a
       // renegotiation extension.
       CBS_init(&fake_contents, kFakeRenegotiateExtension,
@@ -4126,7 +4721,7 @@ static bool ssl_scan_serverhello_tlsext(SSL_HANDSHAKE *hs, const CBS *cbs,
     const struct tls_extension *const ext =
         tls_extension_find(&ext_index, type);
 
-    if (ext == NULL) {
+    if (ext == nullptr) {
       OPENSSL_PUT_ERROR(SSL, SSL_R_UNEXPECTED_EXTENSION);
       ERR_add_error_dataf("extension %u", (unsigned)type);
       *out_alert = SSL_AD_UNSUPPORTED_EXTENSION;
@@ -4160,7 +4755,7 @@ static bool ssl_scan_serverhello_tlsext(SSL_HANDSHAKE *hs, const CBS *cbs,
       // Extension wasn't observed so call the callback with a NULL
       // parameter.
       uint8_t alert = SSL_AD_DECODE_ERROR;
-      if (!kExtensions[i].parse_serverhello(hs, &alert, NULL)) {
+      if (!kExtensions[i].parse_serverhello(hs, &alert, nullptr)) {
         OPENSSL_PUT_ERROR(SSL, SSL_R_MISSING_EXTENSION);
         ERR_add_error_dataf("extension %u", (unsigned)kExtensions[i].value);
         *out_alert = alert;
@@ -4176,9 +4771,9 @@ static bool ssl_check_clienthello_tlsext(SSL_HANDSHAKE *hs) {
   SSL *const ssl = hs->ssl;
   int ret = SSL_TLSEXT_ERR_NOACK;
   int al = SSL_AD_UNRECOGNIZED_NAME;
-  if (ssl->ctx->servername_callback != 0) {
+  if (ssl->ctx->servername_callback != nullptr) {
     ret = ssl->ctx->servername_callback(ssl, &al, ssl->ctx->servername_arg);
-  } else if (ssl->session_ctx->servername_callback != 0) {
+  } else if (ssl->session_ctx->servername_callback != nullptr) {
     ret = ssl->session_ctx->servername_callback(
         ssl, &al, ssl->session_ctx->servername_arg);
   }
@@ -4259,7 +4854,7 @@ static enum ssl_ticket_aead_result_t decrypt_ticket_with_cipher_ctx(
   auto ticket_mac = ticket.last(mac_len);
   ticket = ticket.first(ticket.size() - mac_len);
   HMAC_Update(hmac_ctx, ticket.data(), ticket.size());
-  HMAC_Final(hmac_ctx, mac, NULL);
+  HMAC_Final(hmac_ctx, mac, nullptr);
   assert(mac_len == ticket_mac.size());
   bool mac_ok = CRYPTO_memcmp(mac, ticket_mac.data(), mac_len) == 0;
   if (CRYPTO_fuzzer_mode_enabled()) {
@@ -4283,14 +4878,16 @@ static enum ssl_ticket_aead_result_t decrypt_ticket_with_cipher_ctx(
     if (!plaintext.InitForOverwrite(ciphertext.size())) {
       return ssl_ticket_aead_error;
     }
-    int len1, len2;
-    if (!EVP_DecryptUpdate(cipher_ctx, plaintext.data(), &len1,
-                           ciphertext.data(), (int)ciphertext.size()) ||
-        !EVP_DecryptFinal_ex(cipher_ctx, plaintext.data() + len1, &len2)) {
+    size_t len1, len2;
+    if (!EVP_DecryptUpdate_ex(cipher_ctx, plaintext.data(), &len1,
+                              plaintext.size(), ciphertext.data(),
+                              (int)ciphertext.size()) ||
+        !EVP_DecryptFinal_ex2(cipher_ctx, plaintext.data() + len1, &len2,
+                              plaintext.size() - len1)) {
       ERR_clear_error();
       return ssl_ticket_aead_ignore_ticket;
     }
-    plaintext.Shrink(static_cast<size_t>(len1) + len2);
+    plaintext.Shrink(len1 + len2);
   }
 
   *out = std::move(plaintext);
@@ -4303,11 +4900,11 @@ static enum ssl_ticket_aead_result_t ssl_decrypt_ticket_with_cb(
   assert(ticket.size() >= SSL_TICKET_KEY_NAME_LEN + EVP_MAX_IV_LENGTH);
   ScopedEVP_CIPHER_CTX cipher_ctx;
   ScopedHMAC_CTX hmac_ctx;
-  auto name = ticket.subspan(0, SSL_TICKET_KEY_NAME_LEN);
+  auto name = ticket.first<SSL_TICKET_KEY_NAME_LEN>();
   // The actual IV is shorter, but the length is determined by the callback's
-  // chosen cipher. Instead we pass in |EVP_MAX_IV_LENGTH| worth of IV to ensure
+  // chosen cipher. Instead we pass in `EVP_MAX_IV_LENGTH` worth of IV to ensure
   // the callback has enough.
-  auto iv = ticket.subspan(SSL_TICKET_KEY_NAME_LEN, EVP_MAX_IV_LENGTH);
+  auto iv = ticket.subspan<SSL_TICKET_KEY_NAME_LEN, EVP_MAX_IV_LENGTH>();
   int cb_ret = hs->ssl->session_ctx->ticket_key_cb(
       hs->ssl, const_cast<uint8_t *>(name.data()),
       const_cast<uint8_t *>(iv.data()), cipher_ctx.get(), hmac_ctx.get(),
@@ -4328,7 +4925,7 @@ static enum ssl_ticket_aead_result_t ssl_decrypt_ticket_with_cb(
 static enum ssl_ticket_aead_result_t ssl_decrypt_ticket_with_ticket_keys(
     SSL_HANDSHAKE *hs, Array<uint8_t> *out, Span<const uint8_t> ticket) {
   assert(ticket.size() >= SSL_TICKET_KEY_NAME_LEN + EVP_MAX_IV_LENGTH);
-  SSL_CTX *ctx = hs->ssl->session_ctx.get();
+  SSLContext *ctx = hs->ssl->session_ctx.get();
 
   // Rotate the ticket key if necessary.
   if (!ssl_ctx_rotate_ticket_encryption_key(ctx)) {
@@ -4336,7 +4933,7 @@ static enum ssl_ticket_aead_result_t ssl_decrypt_ticket_with_ticket_keys(
   }
 
   const EVP_CIPHER *cipher = EVP_aes_128_cbc();
-  auto name = ticket.subspan(0, SSL_TICKET_KEY_NAME_LEN);
+  auto name = ticket.first<SSL_TICKET_KEY_NAME_LEN>();
   auto iv =
       ticket.subspan(SSL_TICKET_KEY_NAME_LEN, EVP_CIPHER_iv_length(cipher));
 
@@ -4354,8 +4951,8 @@ static enum ssl_ticket_aead_result_t ssl_decrypt_ticket_with_ticket_keys(
       return ssl_ticket_aead_ignore_ticket;
     }
     if (!HMAC_Init_ex(hmac_ctx.get(), key->hmac_key, sizeof(key->hmac_key),
-                      tlsext_tick_md(), NULL) ||
-        !EVP_DecryptInit_ex(cipher_ctx.get(), cipher, NULL, key->aes_key,
+                      tlsext_tick_md(), nullptr) ||
+        !EVP_DecryptInit_ex(cipher_ctx.get(), cipher, nullptr, key->aes_key,
                             iv.data())) {
       return ssl_ticket_aead_error;
     }
@@ -4389,7 +4986,7 @@ static enum ssl_ticket_aead_result_t ssl_decrypt_ticket_with_method(
 enum ssl_ticket_aead_result_t ssl_process_ticket(
     SSL_HANDSHAKE *hs, UniquePtr<SSL_SESSION> *out_session,
     bool *out_renew_ticket, Span<const uint8_t> ticket,
-    Span<const uint8_t> session_id) {
+    Span<const uint8_t> session_id, bool save_ticket) {
   SSL *const ssl = hs->ssl;
   *out_renew_ticket = false;
   out_session->reset();
@@ -4400,7 +4997,7 @@ enum ssl_ticket_aead_result_t ssl_process_ticket(
   }
 
   // Tickets in TLS 1.3 are tied into pre-shared keys (PSKs), unlike in TLS 1.2
-  // where that concept doesn't exist. The |decrypted_psk| and |ignore_psk|
+  // where that concept doesn't exist. The `decrypted_psk` and `ignore_psk`
   // hints only apply to PSKs. We check the version to determine which this is.
   const bool is_psk = ssl_protocol_version(ssl) >= TLS1_3_VERSION;
 
@@ -4423,17 +5020,17 @@ enum ssl_ticket_aead_result_t ssl_process_ticket(
     }
   } else if (!is_psk && hints && !hs->hints_requested && hints->ignore_ticket) {
     result = ssl_ticket_aead_ignore_ticket;
-  } else if (ssl->session_ctx->ticket_aead_method != NULL) {
+  } else if (ssl->session_ctx->ticket_aead_method != nullptr) {
     result = ssl_decrypt_ticket_with_method(hs, &plaintext, out_renew_ticket,
                                             ticket);
   } else {
-    // Ensure there is room for the key name and the largest IV |ticket_key_cb|
+    // Ensure there is room for the key name and the largest IV `ticket_key_cb`
     // may try to consume. The real limit may be lower, but the maximum IV
     // length should be well under the minimum size for the session material and
     // HMAC.
     if (ticket.size() < SSL_TICKET_KEY_NAME_LEN + EVP_MAX_IV_LENGTH) {
       result = ssl_ticket_aead_ignore_ticket;
-    } else if (ssl->session_ctx->ticket_key_cb != NULL) {
+    } else if (ssl->session_ctx->ticket_key_cb != nullptr) {
       result =
           ssl_decrypt_ticket_with_cb(hs, &plaintext, out_renew_ticket, ticket);
     } else {
@@ -4474,6 +5071,10 @@ enum ssl_ticket_aead_result_t ssl_process_ticket(
     return ssl_ticket_aead_ignore_ticket;
   }
 
+  if (save_ticket && !session->ticket.CopyFrom(ticket)) {
+    return ssl_ticket_aead_error;
+  }
+
   // Envoy's tests expect the session to have a session ID that matches the
   // placeholder used by the client. It's unclear whether this is a good idea,
   // but we maintain it for now.
@@ -4510,8 +5111,7 @@ bool tls1_get_legacy_signature_algorithm(uint16_t *out, const EVP_PKEY *pkey) {
 }
 
 bool tls1_choose_signature_algorithm(SSL_HANDSHAKE *hs,
-                                     const SSL_CREDENTIAL *cred,
-                                     uint16_t *out) {
+                                     const SSLCredential *cred, uint16_t *out) {
   SSL *const ssl = hs->ssl;
   if (!cred->UsesPrivateKey()) {
     OPENSSL_PUT_ERROR(SSL, SSL_R_UNKNOWN_CERTIFICATE_TYPE);
@@ -4545,7 +5145,8 @@ bool tls1_choose_signature_algorithm(SSL_HANDSHAKE *hs,
   }
 
   Span<const uint16_t> sigalgs =
-      cred->sigalgs.empty() ? Span(kSignSignatureAlgorithms) : cred->sigalgs;
+      cred->sigalgs.empty() ? Span<const uint16_t>(kSignSignatureAlgorithms)
+                            : Span<const uint16_t>(cred->sigalgs);
   for (uint16_t sigalg : sigalgs) {
     if (!ssl_pkey_supports_algorithm(ssl, cred->pubkey.get(), sigalg,
                                      /*is_verify=*/false)) {
@@ -4587,10 +5188,10 @@ bool tls1_verify_channel_id(SSL_HANDSHAKE *hs, const SSLMessage &msg) {
   }
 
   const uint8_t *p = CBS_data(&extension);
-  if (BN_bin2bn(p + 0, 32, x.get()) == NULL ||
-      BN_bin2bn(p + 32, 32, y.get()) == NULL ||
-      BN_bin2bn(p + 64, 32, sig->r) == NULL ||
-      BN_bin2bn(p + 96, 32, sig->s) == NULL) {
+  if (BN_bin2bn(p + 0, 32, x.get()) == nullptr ||
+      BN_bin2bn(p + 32, 32, y.get()) == nullptr ||
+      BN_bin2bn(p + 64, 32, sig->r) == nullptr ||
+      BN_bin2bn(p + 96, 32, sig->s) == nullptr) {
     return false;
   }
 
@@ -4685,7 +5286,7 @@ bool tls1_channel_id_hash(SSL_HANDSHAKE *hs, uint8_t *out, size_t *out_len) {
   static const char kClientIDMagic[] = "TLS Channel ID signature";
   SHA256_Update(&ctx, kClientIDMagic, sizeof(kClientIDMagic));
 
-  if (ssl->session != NULL) {
+  if (ssl->session != nullptr) {
     static const char kResumptionMagic[] = "Resumption";
     SHA256_Update(&ctx, kResumptionMagic, sizeof(kResumptionMagic));
     if (ssl->session->original_handshake_hash.empty()) {
@@ -4712,7 +5313,7 @@ bool tls1_record_handshake_hashes_for_channel_id(SSL_HANDSHAKE *hs) {
   // This function should never be called for a resumed session because the
   // handshake hashes that we wish to record are for the original, full
   // handshake.
-  if (ssl->session != NULL) {
+  if (ssl->session != nullptr) {
     return false;
   }