# What is the Peer Signing digest on an OpenSSL s_client connection?

For a little background, I am trying resolve an issue with an ISAM (reverse proxy) appliance not being able to connect to a server due to it failing to complete a TLS connection.

A server that is connecting just fine is using ECDHE-RSA-AES256-GCM-SHA384, with peer signing digest of SHA512. This is on a tomcat server.

The on that's having trouble is using ECDHE-RSA-AES256-SHA384, with a peer signing digest of SHA1. This is on Microsoft IIS.

Based on my research, Windows doesn't support ECDHE-RSA-AES256-GCM-SHA384 as a cipher suite (which is fine), but what I don't understand is what the peer signing digest is and why, even with SHA1 hashes disabled on windows, is SHA1 being used.

This may not solve my server issue, but I would like to understand what the peer signing digest is.

• Note this is a new feature in TLSv1.2. For earlier versions, this field does not exist in the protocol and s_client output does not include it. (But ciphersuites using GCM or other AEAD, or SHA2 hashes, require 1.2.) – dave_thompson_085 Feb 24 '18 at 3:42