ecdsa_secp384r1_sha384
ecdsa_secp384r1_sha384 is ECDSA on the P-384 curve with SHA-384, used by many CA root and intermediate certificates.
What it is
ecdsa_secp384r1_sha384 (code 0x0503) is a TLS 1.3 signature scheme from RFC 8446: ECDSA on the NIST P-384 curve (secp384r1) with SHA-384. In TLS 1.3 the scheme fixes both the curve and the hash. In TLS 1.2 the same code meant ECDSA with SHA-384 on any supported curve.
P-384 offers a larger security margin than P-256 at a higher cost. Certificate authorities sometimes choose it for long-lived root and intermediate keys, where the extra margin is welcome, while leaf certificates more often use P-256.
A client that accepts P-384 signatures can therefore validate chains that include such CA certificates, which is why practically every TLS library lists it.
Leaf certificates with P-384 keys use the same scheme for their handshake signature, so servers with such certificates need clients to list it.
Who sends it
Measured on 2026-10-25 against our own test server: sent by 11 of 11 clients. Position counts from 1 and ignores GREASE values.
Why it matters for fingerprinting
Every client we recorded sends it: 2nd for Debian curl and the Firefox profile of curl-impersonate, 4th for the Chrome profile, 5th for Python requests, httpx, Node.js fetch and Guzzle, 6th for macOS curl, 7th for curl_cffi and 9th for Go net/http. Our Chrome capture did not record signature algorithms.
Check whether your client sends it
Open the test from your browser, or call it from your script, and look for ecdsa_secp384r1_sha384 in the TLS details.
Run the TLS fingerprint test