diff --git a/library/ssl_misc.h b/library/ssl_misc.h
index bea84c3a4b..3b01db19fc 100644
--- a/library/ssl_misc.h
+++ b/library/ssl_misc.h
@@ -2028,7 +2028,9 @@ static inline int mbedtls_ssl_tls13_get_pk_type_and_md_alg_from_sig_alg(
 
 #endif /* MBEDTLS_X509_RSASSA_PSS_SUPPORT */
 
-#if 0 && defined(MBEDTLS_PKCS1_V15) && defined(MBEDTLS_RSA_C)
+#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
+    defined(MBEDTLS_PKCS1_V15) && \
+    defined(MBEDTLS_RSA_C)
 
 #if defined(MBEDTLS_SHA256_C)
         case MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA256:
@@ -2051,7 +2053,9 @@ static inline int mbedtls_ssl_tls13_get_pk_type_and_md_alg_from_sig_alg(
             break;
 #endif /* MBEDTLS_SHA512_C */
 
-#endif /* MBEDTLS_PKCS1_V15 && MBEDTLS_RSA_C */
+#endif /* MBEDTLS_SSL_PROTO_TLS1_2 &&
+          MBEDTLS_PKCS1_V15 &&
+          MBEDTLS_RSA_C */
 
             default:
                 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
@@ -2149,7 +2153,7 @@ static inline int mbedtls_ssl_sig_alg_is_supported(
 #if defined(MBEDTLS_SSL_PROTO_TLS1_3)
     if( ssl->tls_version == MBEDTLS_SSL_VERSION_TLS1_3 )
     {
-        return( mbedtls_ssl_tls13_sig_alg_is_supported( sig_alg ) );
+       return( mbedtls_ssl_tls13_sig_alg_is_supported( sig_alg ) );
     }
 #endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
     ((void) ssl);
diff --git a/library/ssl_tls13_generic.c b/library/ssl_tls13_generic.c
index 3ab6cc2076..3d5baa2a14 100644
--- a/library/ssl_tls13_generic.c
+++ b/library/ssl_tls13_generic.c
@@ -864,6 +864,12 @@ static int ssl_tls13_get_sig_alg_from_pk( mbedtls_ssl_context *ssl,
     *algorithm = MBEDTLS_TLS1_3_SIG_NONE;
     for( ; *sig_alg != MBEDTLS_TLS1_3_SIG_NONE ; sig_alg++ )
     {
+        if( *sig_alg == MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA256 ||
+            *sig_alg == MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA384 ||
+            *sig_alg == MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA512 )
+        {
+            continue;
+        }
         if( mbedtls_ssl_sig_alg_is_supported( ssl, *sig_alg) &&
             mbedtls_ssl_tls13_sig_alg_is_available_for_pk(
                                               ssl, *sig_alg, own_key ) )
diff --git a/tests/ssl-opt.sh b/tests/ssl-opt.sh
index afabb64529..a7d6fbfcea 100755
--- a/tests/ssl-opt.sh
+++ b/tests/ssl-opt.sh
@@ -1600,7 +1600,7 @@ requires_config_enabled MBEDTLS_SHA512_C # "signature_algorithm ext: 6"
 requires_config_enabled MBEDTLS_ECP_DP_CURVE25519_ENABLED
 run_test    "Default" \
             "$P_SRV debug_level=3" \
-            "$P_CLI" \
+            "$P_CLI debug_level=4" \
             0 \
             -s "Protocol is TLSv1.2" \
             -s "Ciphersuite is TLS-ECDHE-RSA-WITH-CHACHA20-POLY1305-SHA256" \
@@ -11483,7 +11483,7 @@ requires_config_enabled MBEDTLS_DEBUG_C
 requires_config_enabled MBEDTLS_SSL_SRV_C
 requires_config_enabled MBEDTLS_SSL_CLI_C
 run_test    "TLS 1.3: Server side check - mbedtls with sni" \
-            "$P_SRV debug_level=4 auth_mode=required crt_file=data_files/server5.crt key_file=data_files/server5.key force_version=tls13 tickets=0 \
+            "$P_SRV debug_level=4 allow_sha1=0 auth_mode=required crt_file=data_files/server5.crt key_file=data_files/server5.key force_version=tls13 tickets=0 \
              sni=localhost,data_files/server2.crt,data_files/server2.key,-,-,-,polarssl.example,data_files/server1-nospace.crt,data_files/server1.key,-,-,-" \
             "$P_CLI debug_level=4 server_name=localhost crt_file=data_files/server5.crt key_file=data_files/server5.key \
             force_version=tls13" \