When GnuTLS is executed with DEFAULT policy and the following parameters:

gnutls-serv --priority NORMAL:-VERS-ALL:+VERS-TLS1.2:%NO_TICKETS_TLS12 --port 4433 --http --x509cafile ca/cert.pem --x509keyfile server/key.pem --x509certfile server/cert.pem

attempts at negotiating ciphersuites with RSA key exchange are rejected with a bad_record_mac Alert, both with openssl and tlsfuzzer, late in the handshake: after receiving the Client Key Exchange message.

If GnuTLS cannot negotiate RSA key exchange, it should reject a ClientHello advertising just RSA key exchanges with a handshake_failure instead of sending a ServerHello.

Affects:
gnutls-3.8.8-1.el10.x86_64
crypto-policies-20241128-1.git0dd441c.el10.noarch