In TLS 1.2, when client authentication is carried out, digital signatures are utilized. However, at what point is the specific signature algorithm communicated to the server? It seems to me that the server cannot perform verification without receiving a unique algorithm from the client.

From what I understand, what is included in the certificate is the signature algorithm by the root CA, which I believe is different from the cipher suite pertaining to the message authentication code (MAC) algorithm.

Furthermore, I think that the signature_hash_algorithms presented during the 'client hello' phase are listed and not unique.

  • $\begingroup$ The client certificate would indicate (by the OID included with the public key) what public key algorithm it is certifying (for example, if it is a signature algorithm, which signature algorithm). However, I am uncertain if TLS 1.2 implementations use that, or do they also rely on something else... $\endgroup$
    – poncho
    Sep 20, 2023 at 12:28
  • $\begingroup$ Does that information allow one to know up to the hash algorithm? I am curious not just about the details of the public key, but also about which hash algorithm is being used. Additionally, isn't the signature algorithm contained within the certificate indicative of how the digital signature is carried out with the root certification authority's private key? $\endgroup$
    – dusk
    Sep 20, 2023 at 22:51
  • $\begingroup$ @poncho: all versions of TLS constrain the keypair in the cert to some extext: 1.0 through 1.2 by the ciphersuite and 1.3 by the sigalgs and supported_groups extensions; but only in a few cases does that fully determine the signature scheme used $\endgroup$ Sep 21, 2023 at 0:21

1 Answer 1


In TLS 1.2, the sigalgs extension in ClientHello lists signature schemes the server is allowed to use; a similar but separate field in CertRequest lists thost the client may use, and the actual (chosen) scheme is identified in the CertVerify message as part of the digitally-signed primitive. Note the type name SignatureAndHashAlgorithm -- yes this does specify the hash, except for EdDSA which does not use a separate hash.

In other words: read the instructions before turning on the product.

And yes-ish, the signatureAlgorithm field in a certificate describes the signature on the body of the certificate by the issuing (parent) CA, but that is usually an intermediate CA not the root CA; it does not describe (or limit) the signatures performed by the cert subject, such as a TLS server or client, using the key(pair) in the EE cert. As poncho comments, the algorithm field in SubjectPublicKeyInfo does identify the keypair, but in most cases that doesn't fully specify the signature scheme the keypair can be used for (it does for EdDSA and it can for RSA-PSS).


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.