I have two Windows 2008 R2 domain controllers configured with TLS 1.2. Both certificates are SHA1-RSA. I captured network traffic between two DCs while running LDAPS (LDP.EXE). It seems TLS 1.2 was agreed but the cipher it was used TLSCipherSuite: TLS_RSA_WITH_AES_128_CBC_SHA256 { 0x00, 0x3C }

So by looking at it, is it going to use SHA1 certificate to sign SHA256 hash? Will that work? Why it didn't pick up SHA1 cipher?

  • Note: SHA256 and SHA1 are not ciphers (but they may be part of a cipher suite)
    – user253751
    Nov 26, 2015 at 6:00

1 Answer 1


That's fine. It used SHA256 because that's stronger than SHA1. The signature in the cert is only used during validation of the cert and doesn't have any direct effect on the chosen cipher.

That said, SHA1 is being phased out as this Google Chrome blog post explains.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .