dsa_sha256
dsa_sha256 is a TLS 1.2 code for DSA signatures with SHA-256. TLS 1.3 removed DSA, but OpenSSL clients still list it.
What it is
dsa_sha256 (code 0x0402) is a TLS 1.2 signature algorithm pair: the hash SHA-256 (0x04) with the DSA signature algorithm (0x02). In TLS 1.2, RFC 5246 encodes each entry of signature_algorithms as such a hash and signature pair.
TLS 1.3 removed DSA entirely. RFC 8446 deprecates the DSA codes: they MUST NOT be offered or negotiated by any implementation, and a TLS 1.3 handshake can never use them. DSA certificates were never common on the web, and NIST no longer approves DSA for generating new signatures in FIPS 186-5.
Clients that still send these codes do so to stay compatible with TLS 1.2 servers that might use DSA keys, which today are practically nonexistent.
The DSA codes take up space in the ClientHello but have no effect on modern connections.
Who sends it
Measured on 2026-10-25 against our own test server: sent by 6 of 11 clients. Position counts from 1 and ignores GREASE values.
Why it matters for fingerprinting
Python requests, httpx, Node.js fetch, Guzzle and Debian curl send it, together with dsa_sha224, dsa_sha384 and dsa_sha512, near the end of their lists: position 18 for Debian curl and 24 for the others. curl_cffi, curl-impersonate, macOS curl and Go net/http do not. A run of four DSA codes is a classic OpenSSL signature in the ClientHello.
Check whether your client sends it
Open the test from your browser, or call it from your script, and look for dsa_sha256 in the TLS details.
Run the TLS fingerprint test