rsa_pss_rsae_sha256
rsa_pss_rsae_sha256 is RSA-PSS with SHA-256 for ordinary RSA keys, the signature scheme TLS 1.3 servers with RSA certificates use.
What it is
rsa_pss_rsae_sha256 (code 0x0804) is a signature scheme from RFC 8446. It uses RSASSA-PSS, the probabilistic RSA signature padding, with SHA-256. The rsae part means the key is a normal rsaEncryption key, the kind found in nearly all RSA certificates, as opposed to rsa_pss_pss schemes that need a dedicated RSA-PSS key.
TLS 1.3 forbids the old PKCS#1 v1.5 padding for handshake signatures, so a TLS 1.3 server with an RSA certificate signs its CertificateVerify message with RSA-PSS. Any TLS 1.3 server with an ordinary RSA certificate therefore uses this scheme or one of its SHA-384 and SHA-512 variants. RFC 8446 requires clients to support it.
The certificates themselves are still usually signed with PKCS#1 v1.5 by the certificate authority, which is why clients also list rsa_pkcs1_sha256.
Who sends it
Measured on 2026-10-25 against our own test server: sent by 11 of 11 clients. Position counts from 1 and ignores GREASE values.
Why it matters for fingerprinting
Every client we recorded sends it, at very different positions: 1st for Go net/http, 2nd for curl-impersonate chrome116, 4th for the ff117 profile, 5th for curl_cffi, 7th for macOS curl, 9th for Debian curl, and 15th for Python requests, httpx, Node.js fetch and Guzzle, which list many other schemes first. Our Chrome capture did not record the signature algorithms list.
Check whether your client sends it
Open the test from your browser, or call it from your script, and look for rsa_pss_rsae_sha256 in the TLS details.
Run the TLS fingerprint test