3

In this image can someone tell me if a standard RSA certificate can support the EC*_RSA ciphers listed? If so do you create the typical RSA keys when you are creating the CSR?

Also I am fairly certain that the EC*_ECDSA ciphers require the use of an ECDSA certificate. Is that correct?

Ciphers

1 Answer 1

8

You can only use the ECDHE-RSA ciphers from that list if all you have is an RSA certificate. Same thing for ECDSA certificates, which only can be used with the ECDHE-ECDSA ciphers on that list.

ECDH-* is fixed in the sense that your certificate contains the fixed public parameters for and key, which can be used for the key exchange. This certificate is then signed by a CA with either RSA or ECDSA, which leads to either ECDH-RSA-* or ECDH-ECDSA-* ciphers.

That being said, ECDH is not used much. I don't know what is your reasoning behind listing the ECDH(E) ciphers, but if you want forward secrecy, you should only use the ECDHE-* ciphers, as they generate different keys for every session.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .