$ openssl version
OpenSSL 1.0.2h  3 May 2016

$ openssl s_client -connect winkel.vpro.nl:443 < /dev/null 2>/dev/null | openssl x509 -text -in /dev/stdin | grep -i sha
    Signature Algorithm: sha1WithRSAEncryption
    Signature Algorithm: sha1WithRSAEncryption

But Chrome says SHA-256:

chrome certificate view of *.vpro.nl

(Chrome version 51.0.2704.84 (64-bit))


Why do Chrome and openssl disagree over signature algorithm?

Because they get different certificates. The reason for this is that Chrome uses Server Name Indication (SNI) whileopenssl s_client does not, at least not by default.

If you look close not only the signature algorithm is different but also the subject of the certificate:

$ openssl s_client -connect winkel.vpro.nl:443 | openssl x509 -text
Subject: ... CN=_default_.omroep.nl/emailAddress=beheer@omroep.nl
Signature Algorithm: sha1WithRSAEncryption

If you instead use SNI by using the -servername argument you get the same certificate you got with Chrome:

$ openssl s_client -connect winkel.vpro.nl:443 -servername winkel.vpro.nl | \
     openssl x509 -text
Subject: C=NL, ST=Noord-Holland, L=Hilversum, O=VPRO, OU=ICT, CN=*.vpro.nl
Signature Algorithm: sha256WithRSAEncryption

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.