ecdsa_secp256r1_sha256
ecdsa_secp256r1_sha256: ECDSA signatures on the P-256 curve with SHA-256, the most common scheme for ECDSA certificates.
What it is
ecdsa_secp256r1_sha256 (code 0x0403) is a TLS signature scheme from RFC 8446: ECDSA on the NIST P-256 curve (secp256r1) with SHA-256 as the hash. The client lists it in the signature_algorithms extension to say it can verify such signatures, both in the server certificate chain and in the TLS 1.3 CertificateVerify message.
P-256 ECDSA certificates are smaller and faster to verify than RSA certificates of similar strength, so many large sites and CDNs serve them, often alongside an RSA certificate for older clients.
In TLS 1.3 the scheme is tied to the P-256 curve; in TLS 1.2 the same code meant ECDSA with SHA-256 on any curve. RFC 8446 requires TLS 1.3 implementations to support it, together with rsa_pkcs1_sha256 and rsa_pss_rsae_sha256.
Who sends it
Measured on 2026-10-25 against our own test server: sent by 11 of 11 clients. Position counts from 1 and ignores GREASE values.
Why it matters for fingerprinting
Every client we recorded sends it, but at different positions: first for Debian curl and curl-impersonate, second for Go net/http, fourth for curl_cffi, Python requests, httpx, Node.js fetch and Guzzle, and ninth for macOS curl. Our Chrome capture did not record the signature algorithms list.
JA4 includes the signature algorithms in the hash of its third part, in the order sent, so this ordering changes a client's JA4.
Check whether your client sends it
Open the test from your browser, or call it from your script, and look for ecdsa_secp256r1_sha256 in the TLS details.
Run the TLS fingerprint test