ecdsa_sha1
ecdsa_sha1 is ECDSA with SHA-1, deprecated in TLS. Only macOS curl, Go net/http and the Firefox profile still list it.
What it is
ecdsa_sha1 (code 0x0203) is the TLS 1.2 pair of SHA-1 with ECDSA. RFC 8446 keeps the code only as a legacy value for verifying old certificates, and RFC 9155 deprecated SHA-1 signatures in TLS 1.2 handshakes as well.
SHA-1 is no longer collision resistant, which undermines any signature that relies on it. RFC 9155 gives this as the reason for removing SHA-1 from TLS signatures.
It is the ECDSA counterpart of rsa_pkcs1_sha1. Clients that still list these codes keep them for old servers or private systems that were never migrated, and servers should not rely on them.
RFC 9155 also covers rsa_pkcs1_sha1 and the MD5 codes, so all SHA-1 and MD5 signatures are deprecated in TLS 1.2 as well as in TLS 1.3. Removing ecdsa_sha1 from a server costs nothing for modern clients, because every client we recorded also offers SHA-256 based ECDSA.
Who sends it
Measured on 2026-10-25 against our own test server: sent by 3 of 11 clients. Position counts from 1 and ignores GREASE values.
Why it matters for fingerprinting
In our measurements macOS curl sends it 11th, Go net/http 12th and the Firefox profile of curl-impersonate 10th. Python requests, httpx, Node.js fetch, Guzzle, Debian curl, curl_cffi and the Chrome profile of curl-impersonate do not. The same three clients also send rsa_pkcs1_sha1.
Check whether your client sends it
Open the test from your browser, or call it from your script, and look for ecdsa_sha1 in the TLS details.
Run the TLS fingerprint test