If the output is:-

➜ $?=0 % openssl x509 -noout -in ./cert -text | grep Algo
        Signature Algorithm: sha256WithRSAEncryption
            Public Key Algorithm: id-ecPublicKey
    Signature Algorithm: sha256WithRSAEncryption

Does it mean it's an ECDSA cert?

  • There is no standard term as ECDSA certificate – Arjun sharma Nov 3 '16 at 8:58
  • @8zero2.ops: there is a wide use of the term ECDSA certificate so it does not really matter if there is a formalized definition for it or not as long as all talk about the same thing. – Steffen Ullrich Nov 3 '16 at 11:28

The Public Key Algorithm refers to the public key inside the certificate: This certificate is used together with the matching private key to prove the identity of the peer (authentication). In your case it is an ECC key (id-ecPublicKey) which means that this is an ECDSA certificate.

The Signature Algorithm refers to the signature of the certificate created by the issuer: This signature proves that the claimed issuer of the certificate is the real issuer since the signature can be verified by using the public key from the issuers certificate. By verifying the link to the issuer a verified trust chain can be built up to a locally trust certificate (i.e. local trust store, root CA). In your case sha256WithRSAEncryption is used which means that the issuer has an RSA public key inside its issuers certificate and that the hash used for signing the leaf certificate by the issuer is SHA-256.

  • hello steffen , as per my understanding it is not correct to say a certificate as ECDSA ,check my post – Arjun sharma Nov 3 '16 at 11:18
  • @8zero2.ops: since the process of authentication using the certificate involves creating a digital signature and the signature algorithm used with ECC keys for this is ECDSA I would call it an ECDSA certificate. The ECC based TLS key exchange you mention in your answer has nothing to do with the public key of the certificate, i.e. ECDH can be used with RSA certificates too. Key exchange algorithm is also unrelated to the algorithm used for the issuers signature. – Steffen Ullrich Nov 3 '16 at 11:22
  • yes of-course i agree with your second part of reply , but what are the key exchange methods available if you use ECDSA for authentication ? – Arjun sharma Nov 3 '16 at 11:27
  • @8zero2.ops: if you are talking about the cipher suites for TLS which are defined with ECDSA authentication then you will find only ECDHE key exchange in use. – Steffen Ullrich Nov 3 '16 at 11:33
  • ohk i got it . most of the places it is called ecdsa certificate only . – Arjun sharma Nov 3 '16 at 11:48
  1. The Output means this is ECC based certificate

  2. ECDSA is just a digital signature algorithm employed by ECC based certificates which cannot be used in key exchanging

  3. ECDH or DH algorithms are needed for key exchange

As far as identifier you mentioned and as steffen as mentioned :-

Signature Algorithm

shows which signature alogithim CA has used to sign the certificate and the hashing mechanism used

Public Key Algorithm: id-ecPublicKey ( from rfc 5480)

    id-ecPublicKey indicates that the algorithms that can be used
    with the subject public key are unrestricted.  The key is only
    restricted by the values indicated in the key usage certificate
    extension . This value is also included in certificates
    when a public key is used with ECDSA.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.