Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm having trouble getting Firefox to send an encrypted message using a certificate, and I've found that the only difference between this one and others that work fine are that this one has a DSA public key while the others have an RSA key. The signature algorithm still says "sha512WithRSAEncryption". I'm wondering if that is causing a problem since the public key algorithm is not RSA.

share|improve this question
If the public key uses DSA but the signature is created using RSA (out at least claims this), how could that work? – mkl Mar 24 '13 at 17:04
I do not know. I got the request, imported it into XCA, signed it, exported the resulting cert in PEM format, inspected with openssl x509 and that's what it shows - a DSA key, but a signature algorithm that says RSA. – Shawn J. Goff Mar 24 '13 at 17:08
Could it be that the user certificat itself has a DSA key and the CA certificate uses a RSA key? That would be Ok. – mkl Mar 24 '13 at 19:06
@mkl That's probably what's happening. The CA key is definitely RSA. The openssl output isn't very clear. – Shawn J. Goff Mar 24 '13 at 19:33
up vote 3 down vote accepted

The signature in the certificate is computed by the CA, and must match the public key of the CA. There is no problem with having a certificate which contains a DSA key while being signed by a CA which uses a RSA key.

There is a big problem, though, with trying to encrypt some data with a DSA key. DSA is only for digital signatures.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.