$ openssl version
OpenSSL 1.0.2h  3 May 2016

$ openssl s_client -connect winkel.vpro.nl:443 < /dev/null 2>/dev/null | openssl x509 -text -in /dev/stdin | grep -i sha
    Signature Algorithm: sha1WithRSAEncryption
    Signature Algorithm: sha1WithRSAEncryption

But Chrome says SHA-256:

chrome certificate view of *.vpro.nl

(Chrome version 51.0.2704.84 (64-bit))

1 Answer 1


Why do Chrome and openssl disagree over signature algorithm?

Because they get different certificates. The reason for this is that Chrome uses Server Name Indication (SNI) whileopenssl s_client does not, at least not by default.

If you look close not only the signature algorithm is different but also the subject of the certificate:

$ openssl s_client -connect winkel.vpro.nl:443 | openssl x509 -text
Subject: ... CN=_default_.omroep.nl/[email protected]
Signature Algorithm: sha1WithRSAEncryption

If you instead use SNI by using the -servername argument you get the same certificate you got with Chrome:

$ openssl s_client -connect winkel.vpro.nl:443 -servername winkel.vpro.nl | \
     openssl x509 -text
Subject: C=NL, ST=Noord-Holland, L=Hilversum, O=VPRO, OU=ICT, CN=*.vpro.nl
Signature Algorithm: sha256WithRSAEncryption

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .