diff --git a/lib/config.ml b/lib/config.ml
index 89a8f12c..cccbc000 100644
--- a/lib/config.ml
+++ b/lib/config.ml
@@ -485,6 +485,29 @@ let validate_server config =
     | _ -> () );
   { config with ciphers }
 
+let validate_keys_sig_algs config =
+  let _, v_max = config.protocol_versions in
+  if v_max = `TLS_1_2 || v_max = `TLS_1_3 then
+    let certificate_chains =
+      match config.own_certificates with
+      | `Single c                 -> [c]
+      | `Multiple cs              -> cs
+      | `Multiple_default (c, cs) -> c :: cs
+      | `None                     -> invalid "no server certificate provided"
+    in
+    let server_keys =
+      List.map (function
+          | (s::_,_) -> X509.Certificate.public_key s
+          | _ -> invalid "empty certificate chain")
+        certificate_chains
+    in
+    if not
+        (List.for_all (fun cert ->
+             List.exists (pk_matches_sa cert) config.signature_algorithms)
+            server_keys)
+    then
+      invalid "certificate provided which does not allow any signature algorithm"
+
 type client = config [@@deriving sexp_of]
 type server = config [@@deriving sexp_of]
 
@@ -550,6 +573,7 @@ let server
     } in
   let config = validate_server config in
   let config = validate_common config in
+  validate_keys_sig_algs config;
   Log.debug (fun m -> m "server with %s"
                 (Sexplib.Sexp.to_string_hum (sexp_of_config config)));
   config