$ openssl version
OpenSSL 1.0.2h 3 May 2016
$ openssl s_client -connect winkel.vpro.nl:443 < /dev/null 2>/dev/null | openssl x509 -text -in /dev/stdin | grep -i sha
Signature Algorithm: sha1WithRSAEncryption
Signature Algorithm: sha1WithRSAEncryption
But Chrome says SHA-256:
(Chrome version 51.0.2704.84 (64-bit))
Why do Chrome and openssl disagree over signature algorithm?
Because they get different certificates. The reason for this is that Chrome uses Server Name Indication (SNI) whileopenssl s_client does not, at least not by default.
If you look close not only the signature algorithm is different but also the subject of the certificate:
$ openssl s_client -connect winkel.vpro.nl:443 | openssl x509 -text
...
Subject: ... CN=_default_.omroep.nl/[email protected]
...
Signature Algorithm: sha1WithRSAEncryption
If you instead use SNI by using the -servername argument you get the same certificate you got with Chrome:
$ openssl s_client -connect winkel.vpro.nl:443 -servername winkel.vpro.nl | \
openssl x509 -text
...
Subject: C=NL, ST=Noord-Holland, L=Hilversum, O=VPRO, OU=ICT, CN=*.vpro.nl
...
Signature Algorithm: sha256WithRSAEncryption
