1

I've seen this but the related answers don't answer my question.

For TLS 1.2 is the hashing algorithm specified in an X.509 certificate's cipher suite used for the signature inside the certificate or the TLS handshake/communication process or both?

I'm in the process of replacing an old self-signed certificate used for WCF client/service authentication (not encryption) because it doesn't work with TLS 1.2 with SChannel.

The old certificate has the following parameters in the Details tab in Windows:

Signature algorithm: md5RSA
Signature hash algorithm: md5
Public key: RSA (1024bit)
Thumbprint algorithm: sha1

Is the Signature algorithm above the same as the hashing algorithm of the certificate's cipher suite or it's unrelated?

If it is then does it mandate the hashing algorithm used during the client server handshake / communication or is it just for the signature in the certificate itself or both?

Improve this question

1 Answer 1

Reset to default
2

The two are unrelated. It's possible for the hash function used for the certificate signature to be different from the hash function used for data integrity during the TLS handshake. However, SHA256 is often used for both nowadays, as earlier hash functions (e.g. SHA1, MD5, etc.) are thought to have weaknesses, and SHA256 is now widely supported for both uses cases.

Improve this answer
2
  • Thanks! Is it correct that the hash function used during the handshake is NOT specified anywhere inside the certificate?
    – axk
    Commented Dec 10, 2020 at 18:59
  • 1
    Yes, that's correct. The hash function used during the TLS handshake is determined by the SSL/TLS protocols and cipher suites supported by the client and the web server. You can see the hash function used during the TLS handshake in your web browser, when you surf to a page by SSL/TLS. Click the padlock icon, then view the TLS connection details. You'll see something like 'TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256'. The last value (SHA256 in this case) is the hash function used during the TLS handshake.
    – mti2935
    Commented Dec 10, 2020 at 20:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .