I've the following scenario:

  • Root-CA: key algorithm is RSA-2048 and it's self-signed (Sha256WithRSA)
  • Server-Cert: key algorithm is ECDSA, based on secp384r1 and it's signed by Root-CA with Sha256WithRSA

Is it possible to use such a scenario within TLS-Communication or is it necessary to use the same key and signature algorithms every time?

I've set up a Tomcat Webserver with the mentioned server certificate but it doesn't work! It seems that the browser (Chrome) and the webserver (Tomcat 8) can't agree for a cipher suite. The error is "ERR_SSL_VERSION_OR_CIPHER_MISMATCH".

Any ideas or recommendations?

Browse other questions tagged or ask your own question.