Does anyone know if IIS supports certificates signed with sha256ecdsa?

If viewed with openssl, i have the following parameters: Signature Algorithm: ecdsa-with-SHA256 Public Key Info: NIST CURVE: P-384

The problem is with this certificate I can't get a successful TLS handshake. I wonder if the problem is the signature algorithm or the ECDSA curve (both the certificate and the CA use P-384 public keys).

  • IIS in Windows supports ECC keys for 11 years (since Windows Vista and Windows Server 2008 RTM). There are no algorithm support problems. – Crypt32 Aug 16 '18 at 4:21

The problem was that P384 cipher suits are not enabled by default it seems.

I solved it using GPO with a set "Computer Configuration->Administrative Templates->Network/SSL Configuration Settings->SSL Cipher Suite Order"

I added ciphers such as "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384_P384".

After this it could use the certificate as expected.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.