In this image can someone tell me if a standard RSA certificate can support the EC*_RSA ciphers listed? If so do you create the typical RSA keys when you are creating the CSR?

Also I am fairly certain that the EC*_ECDSA ciphers require the use of an ECDSA certificate. Is that correct?



You can only use the ECDHE-RSA ciphers from that list if all you have is an RSA certificate. Same thing for ECDSA certificates, which only can be used with the ECDHE-ECDSA ciphers on that list.

ECDH-* is fixed in the sense that your certificate contains the fixed public parameters for and key, which can be used for the key exchange. This certificate is then signed by a CA with either RSA or ECDSA, which leads to either ECDH-RSA-* or ECDH-ECDSA-* ciphers.

That being said, ECDH is not used much. I don't know what is your reasoning behind listing the ECDH(E) ciphers, but if you want forward secrecy, you should only use the ECDHE-* ciphers, as they generate different keys for every session.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.