0

Is it possible to send an EC certificate to a client if it supports it or send a regular certificate if it doesn't?

1 Answer 1

4

ECDSA certificates can only be used together with the *_ECDSA_* ciphers, i.e. ciphers like TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA_P256. The client sends the list of supported ciphers within the ClientHello initiating the TLS handshake, so it is in theory possible for a server to decide based on these ciphers which certificate to send.

In practice support for this feature varies, but there is support in Apache 2.4 and support was added to nginx in version 1.11.0. In both cases you need at OpenSSL with at least version 1.0.2.

3
  • "Support for parallel ECDSA / RSA certificates " - exactly what I've searched for. For nginx, it was ready just 4 weeks ago. Jun 18, 2016 at 10:47
  • How does selection work for Apache? Any documentation? Jun 18, 2016 at 10:51
  • @SmitJohnth: I don't find any documentation but I don't know what else apart from the offered client ciphers they could reliably use to find out what the client supports. Jun 18, 2016 at 11:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .