extendedMasterSecret:         true,
		ocspStapling:                 true,
		scts:                         true,
		serverName:                   hostnameInSNI(config.ServerName),
		supportedCurves:              config.curvePreferences(maxVersion),
		supportedPoints:              []uint8{pointFormatUncompressed},
		secureRenegotiationSupported: true,
		alpnProtocols:                config.NextProtos,
		supportedVersions:            supportedVersions,

		// because we currently only support it at all when CurvePreferences is
		// empty, which will cause us to also send a key share for it.
		//
		// This will have to change once we support selecting hybrid KEMs
		// without sending key shares for them.
		if _, ok := curveForCurveID(curveID); !ok {
			c.sendAlert(alertInternalError)
			return errors.New("tls: CurvePreferences includes unsupported curve")
		}

			break
		}
	}

	if curveID == 0 {
		return nil, errors.New("tls: no supported elliptic curves offered")
	}
	if _, ok := curveForCurveID(curveID); !ok {
		return nil, errors.New("tls: CurvePreferences includes unsupported curve")
	}

	key, err := generateECDHEKey(config.rand(), curveID)
	if err != nil {
		return nil, err
	}
	ka.key = key

	// See RFC 4492, Section 5.4.

	// priority to key shares, to avoid a HelloRetryRequest round-trip.
	var selectedGroup CurveID
	var clientKeyShare *keyShare
	preferredGroups := c.config.curvePreferences(c.vers)
	for _, preferredGroup := range preferredGroups {
		ki := slices.IndexFunc(hs.clientHello.keyShares, func(ks keyShare) bool {
			return ks.group == preferredGroup
		})
		if ki != -1 {

		Rand:               zeroSource{},
		Certificates:       make([]Certificate, 2),
		InsecureSkipVerify: true,
		CipherSuites:       allCipherSuites(),
		CurvePreferences:   []CurveID{X25519, CurveP256, CurveP384, CurveP521},
		MinVersion:         VersionTLS10,
		MaxVersion:         VersionTLS13,
	}
	testConfig.Certificates[0].Certificate = [][]byte{testRSACertificate}

		cert: testECDSACertificate,
		key:  testECDSAPrivateKey,
	}
	runClientTestTLS12(t, test)
}

func TestHandshakeClientX25519(t *testing.T) {
	config := testConfig.Clone()
	config.CurvePreferences = []CurveID{X25519}

	test := &clientTest{
		name:   "X25519-ECDHE",
		args:   []string{"-cipher", "ECDHE-RSA-AES128-GCM-SHA256", "-curves", "X25519"},
		config: config,
	}

Go 1.23 enabled the experimental post-quantum key exchange mechanism
X25519Kyber768Draft00 by default. The default can be reverted using the
[`tlskyber` setting](/pkg/crypto/tls/#Config.CurvePreferences).

Go 1.23 changed the behavior of
[crypto/x509.ParseCertificate](/pkg/crypto/x509/#ParseCertificate) to reject
serial numbers that are negative. This change can be reverted with

pkg crypto/tls, type ClientSessionState struct
pkg crypto/tls, type Config struct, ClientSessionCache ClientSessionCache
pkg crypto/tls, type Config struct, CurvePreferences []CurveID
pkg crypto/tls, type ConnectionState struct, Version uint16
pkg crypto/tls, type CurveID uint16
pkg crypto/x509, func CreateCertificateRequest(io.Reader, *CertificateRequest, interface{}) ([]uint8, error)

		{"Config.Certificates", Field, 0},
		{"Config.CipherSuites", Field, 0},
		{"Config.ClientAuth", Field, 0},
		{"Config.ClientCAs", Field, 0},
		{"Config.ClientSessionCache", Field, 3},
		{"Config.CurvePreferences", Field, 3},
		{"Config.DynamicRecordSizingDisabled", Field, 7},
		{"Config.GetCertificate", Field, 4},
		{"Config.GetClientCertificate", Field, 8},
		{"Config.GetConfigForClient", Field, 8},