Question about handshake error

[Viktor Dukhovni]

On Wed, Mar 11, 2020 at 12:15:32PM +0000, Matt Caswell wrote:

> I would recommend that the server operator removes both copies of the
> root cert from its cert chain. Hopefully this should then mean that it
> does not see the SHA1 root and will therefore continue the handshake. If
> you can't get the server operator to make this change then, as a
> workaround, you'd have to change your application configuration to add
> back in the missing sigalgs and switch the security level to 0.

The signature algorithm security level is not expected to be enforced
on self-signed certificates (root CAs).  How is it happening here?

-- 
    Viktor.