Question about TLS v1.2 Ciphers on my Web Server

Question

I need some help to understand the Ciphers being used by my web server running TLS v1.2.

What I understand is that my web server is configured to use only the listed methods of encryption. I suspect that it is telling the clients that it uses TLs v1.2, but my questions are:

• How is DHE, ECDHE being used with RSA?
• How is CBC, GCM being used with SHA?
• Which one is the better one to use?
• Should I used ECDSA instead of ECDHE?

ciphers:
|       TLS_DHE_RSA_WITH_AES_128_CBC_SHA (dh 1024) - A
|       TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 (dh 1024) - A
|       TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 (dh 1024) - A
|       TLS_DHE_RSA_WITH_AES_256_CBC_SHA (dh 1024) - A
|       TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 (dh 1024) - A
|       TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 (dh 1024) - A
|       TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (secp256r1) - A
|       TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (secp256r1) - A
|       TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (secp256r1) - A
|       TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (secp256r1) - A
|       TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (secp256r1) - A
|       TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (secp256r1) - A
|       TLS_RSA_WITH_AES_128_CBC_SHA (rsa 2048) - A
|       TLS_RSA_WITH_AES_128_CBC_SHA256 (rsa 2048) - A
|       TLS_RSA_WITH_AES_128_GCM_SHA256 (rsa 2048) - A
|       TLS_RSA_WITH_AES_256_CBC_SHA (rsa 2048) - A
|       TLS_RSA_WITH_AES_256_CBC_SHA256 (rsa 2048) - A
|       TLS_RSA_WITH_AES_256_GCM_SHA384 (rsa 2048) - A

Answer 1

How is DHE, ECDHE being used with RSA?

[EC]DHE means ephemeral Diffie-Hellman, so the master key is negotiated using DH parameters generated for the session. The server will generate these parameters and sign them via RSA using the private key corresponding to the servers long-term certificate.

How is CBC, GCM being used with SHA?

CBC and GCM are the modes that the block cipher (AES) will operate in. SHA is the hash function used in the pseudo-random function (generally HMAC) that derives keys from the master key, and in the case of CBC mode also provides message integrity.

Which one is the better one to use?

GCM is preferred, in general prefer using an AEAD mode of operation (more info on authenticated encryption here).

Should I used ECDSA instead of ECDHE?

ECDSA is for signing data while ECDHE is for establishing a shared secret e.g. the master key. To use ECDSA you would need a server certificate that uses an ECDSA keypair. These are not very common currently. But if you did have an ECDSA certificate you would use it in conjunction with ECDHE, e.g. ECDHE-ECDSA-AES128-GCM-SHA256.