4

I have a server which is configured to use TLS 1.0, 1.1 and 1.2. The server is configured with a certificate siged by SHA-512. The server supports only these cipher suites:

• TLS_RSA_WITH_AES_256_GCM_SHA384
• TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
• TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
• TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
• TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
• TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

The client (browser) requested for the handshake and offer these cipher suites: 

• TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
• TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

The server has accepted TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 and presented it's certificates, which has has algorithm identifier SHA512RSAEncryption.

Does this mean the browser is able to verify SHA512 cert without any cipher suites in common?

Improve this question
1

1 Answer 1

Reset to default
6

The signature algorithm used for the validation of the certificate (SHA-512 in your case) is independent from the algorithm used as the HMAC in the ciphers, i.e. for the encryption (SHA-256, SHA-384 in your case).

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .