I was reviewing some information about SSL certificates and came across an explanation I believe to be incorrect.
The explanation is of how signatures and hashing algorithms work in the context of connection using SSL.
This is a small section cut from the material:
"When a secure connection is initially requested by a client, and I've told you in previous chapters that the server sends a whole bunch of information to that client about itself along with its own public certificate. The information that is sent includes information about which HASH functions are supported, which encryption technologies are supported, etc.
And so if both the client and the server support SHA-2 for example, they'll choose SHA-2."
From my understanding, there is no negotiation of a certificate's signature. It is true that the client and server will trade information about protocol version, encryption ciphers, etc, to decide on what to use.
But the server's certificate is signed by the CA during issuance, and that signature is fixed and uses whatever algorithm the user (or CA) choose during the issuance process. If you were to go get a certificate today, you would probably have a SHA-256 signature.
If the client does not support SHA-256 there is no "negotiation" about other hashing algorithms is there? Wouldnt the connection just fail?