If the output is:-
➜ $?=0 % openssl x509 -noout -in ./cert -text | grep Algo Signature Algorithm: sha256WithRSAEncryption Public Key Algorithm: id-ecPublicKey Signature Algorithm: sha256WithRSAEncryption
Does it mean it's an ECDSA cert?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
The Public Key Algorithm refers to the public key inside the certificate: This certificate is used together with the matching private key to prove the identity of the peer (authentication). In your case it is an ECC key (id-ecPublicKey) which means that this is an ECDSA certificate.
The Signature Algorithm refers to the signature of the certificate created by the issuer: This signature proves that the claimed issuer of the certificate is the real issuer since the signature can be verified by using the public key from the issuers certificate. By verifying the link to the issuer a verified trust chain can be built up to a locally trust certificate (i.e. local trust store, root CA). In your case sha256WithRSAEncryption is used which means that the issuer has an RSA public key inside its issuers certificate and that the hash used for signing the leaf certificate by the issuer is SHA-256.
The Output means this is ECC based certificate
ECDSA is just a digital signature algorithm employed by ECC based certificates which cannot be used in key exchanging
ECDH or DH algorithms are needed for key exchange
As far as identifier you mentioned and as steffen as mentioned :-
shows which signature alogithim CA has used to sign the certificate and the hashing mechanism used
Public Key Algorithm: id-ecPublicKey ( from rfc 5480)
id-ecPublicKey indicates that the algorithms that can be used with the subject public key are unrestricted. The key is only restricted by the values indicated in the key usage certificate extension . This value is also included in certificates when a public key is used with ECDSA.