rsa_pss_pss_sha256
rsa_pss_pss_sha256 is RSA-PSS with SHA-256 for dedicated RSA-PSS keys, a rare certificate type. OpenSSL clients accept it.
What it is
rsa_pss_pss_sha256 (code 0x0809) is a TLS 1.3 signature scheme from RFC 8446: RSASSA-PSS with SHA-256, used with a key whose certificate declares it as an RSASSA-PSS key. That is the difference from rsa_pss_rsae_sha256, which uses an ordinary rsaEncryption key with the same padding.
A dedicated RSA-PSS key can only be used for PSS signatures, which rules out mixing it with older padding schemes. In practice such certificates are rare: public certificate authorities issue rsaEncryption keys, so the pss_pss schemes matter mostly in private PKI.
RFC 8446 defines SHA-256, SHA-384 and SHA-512 variants of the scheme.
A server with such a key can only complete a TLS 1.3 handshake with clients that list one of the rsa_pss_pss schemes, which is why browsers that never see these keys can leave them out.
Who sends it
Measured on 2026-10-25 against our own test server: sent by 6 of 11 clients. Position counts from 1 and ignores GREASE values.
Why it matters for fingerprinting
Python requests, httpx, Node.js fetch, Guzzle and Debian curl, all built on OpenSSL, send it, while curl_cffi, curl-impersonate, macOS curl and Go net/http do not. Our Chrome capture did not record signature algorithms.
Debian curl sends it 6th, the other OpenSSL clients 12th. Its presence, together with the SHA-384 and SHA-512 variants, is a typical OpenSSL default.
Check whether your client sends it
Open the test from your browser, or call it from your script, and look for rsa_pss_pss_sha256 in the TLS details.
Run the TLS fingerprint test