I've a tomcat server with RSA certificate and connector X with a following suite: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256

My openssl client has the same suite: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256

Client connects to connector X. There is a handshake failure (on server hello step) BEFORE the authentication phase.

Is it possible that server certificate (RSA) is taken into account during the cipher suite negotiation phase? Or maybe the handshake should be successful but the authentication phase fail?

  • ECDSA is using EC, but you are referring to RSA cert, you need to figure out if you use EC or RSA.
    – VovCA
    Mar 20 '18 at 21:19

Your cipher says *_ECDSA_* which means that the authentication is done using ECDSA which requires a certificate with an ECC public key. But you have a certificate with a RSA public key only. Thus, this cipher and this certificate will not work together. If this is the only cipher configured at the server or client the handshake will fail with no shared ciphers.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.