TLS Signature Algorithms List
Signature algorithms, sent in the signature_algorithms extension, tell the server which signature schemes the client can verify. The server uses one of them to sign the handshake (in TLS 1.3, the CertificateVerify message), and its certificate chain should use schemes from the list as well.
Each scheme combines a public key algorithm with a hash: ecdsa_secp256r1_sha256 is ECDSA on the P-256 curve with SHA-256, rsa_pss_rsae_sha256 is RSA-PSS with SHA-256, rsa_pkcs1_sha256 is classic RSA PKCS#1 v1.5. TLS 1.3 requires support for ECDSA P-256, RSA-PSS and RSA PKCS#1 with SHA-256, and newer stacks add EdDSA (ed25519) and post-quantum ML-DSA schemes.
The list is long and its order is set by the TLS library, so it is a good signal of which library a client uses. JA4 hashes the signature algorithms, in the order sent, together with the sorted extensions in the third part of the fingerprint, so two clients with identical ciphers and extensions can still have different JA4 values because of this list.
| Name | Code | What it does | Status | Sent by measured clients |
|---|---|---|---|---|
| dsa_sha256 | 1026 | dsa_sha256 is a TLS 1.2 code for DSA signatures with SHA-256. TLS 1.3 removed DSA, but OpenSSL clients still list it. | insecure | 6 of 11 |
| ecdsa_brainpoolP256r1tls13_sha256 | 2074 | ecdsa_brainpoolP256r1tls13_sha256 is ECDSA on the Brainpool P-256 curve for TLS 1.3. Only OpenSSL clients offer it. | — | 5 of 11 |
| ecdsa_secp256r1_sha256 | 1027 | ecdsa_secp256r1_sha256: ECDSA signatures on the P-256 curve with SHA-256, the most common scheme for ECDSA certificates. | recommended | 11 of 11 |
| ecdsa_secp384r1_sha384 | 1283 | ecdsa_secp384r1_sha384 is ECDSA on the P-384 curve with SHA-384, used by many CA root and intermediate certificates. | recommended | 11 of 11 |
| ecdsa_secp521r1_sha512 | 1539 | ecdsa_secp521r1_sha512 is ECDSA on P-521 with SHA-512. Libraries accept it; the Chrome-like clients we measured do not. | recommended | 9 of 11 |
| ecdsa_sha1 | 515 | ecdsa_sha1 is ECDSA with SHA-1, deprecated in TLS. Only macOS curl, Go net/http and the Firefox profile still list it. | insecure | 3 of 11 |
| ed25519 | 2055 | ed25519 is the EdDSA signature scheme on Curve25519. Libraries offer it for TLS; Chrome-like clients do not. | recommended | 7 of 11 |
| ed448 | 2056 | ed448 is the EdDSA signature scheme on Curve448. Only OpenSSL-based clients offer it in our measurements. | recommended | 6 of 11 |
| mldsa44 | 2308 | mldsa44 is the ML-DSA-44 post-quantum signature scheme for TLS 1.3. curl_cffi and the OpenSSL-based Python, Node.js and PHP clients already offer it. | — | 6 of 11 |
| mldsa65 | 2309 | mldsa65 is the ML-DSA-65 post-quantum signature scheme for TLS 1.3, offered first by recent OpenSSL clients. | — | 6 of 11 |
| rsa_pkcs1_sha1 | 513 | rsa_pkcs1_sha1 is a legacy RSA signature scheme with SHA-1, deprecated for TLS. Only a few measured clients still offer it. | insecure | 3 of 11 |
| rsa_pkcs1_sha256 | 1025 | rsa_pkcs1_sha256 is classic RSA PKCS#1 v1.5 with SHA-256, still the common signature on RSA certificates. | recommended | 11 of 11 |
| rsa_pkcs1_sha384 | 1281 | rsa_pkcs1_sha384 is RSA PKCS#1 v1.5 with SHA-384, accepted for certificate signatures. Every client we recorded sends it. | recommended | 11 of 11 |
| rsa_pss_pss_sha256 | 2057 | rsa_pss_pss_sha256 is RSA-PSS with SHA-256 for dedicated RSA-PSS keys, a rare certificate type. OpenSSL clients accept it. | recommended | 6 of 11 |
| rsa_pss_rsae_sha256 | 2052 | rsa_pss_rsae_sha256 is RSA-PSS with SHA-256 for ordinary RSA keys, the signature scheme TLS 1.3 servers with RSA certificates use. | recommended | 11 of 11 |
| rsa_pss_rsae_sha384 | 2053 | rsa_pss_rsae_sha384 is RSA-PSS with SHA-384 for ordinary RSA keys. Every client we recorded offers it. | recommended | 11 of 11 |