secp384r1
secp384r1, also called NIST P-384, is a larger NIST elliptic curve for TLS key exchange. Every measured client offers it.
What it is
secp384r1 (group 24), known as NIST P-384, is a NIST elliptic curve used for ECDHE key exchange and ECDSA signatures in TLS, specified in RFC 8422. It offers about 192 bits of security, more than P-256 and x25519, at a higher computational cost.
Some security policies ask for P-384 instead of P-256 because of its larger margin, and some certificate authorities use P-384 keys for their root and intermediate certificates.
For ordinary web traffic it offers no practical advantage over x25519 or P-256, so clients offer it after those curves.
Like P-256, it is a prime-field curve from the NIST and SECG standards and is supported by every major TLS library. In TLS 1.3 it can be used for key exchange through supported_groups and for signatures through the ecdsa_secp384r1_sha384 scheme. Servers rarely choose it for key exchange when the client also offers x25519 or P-256.
Who sends it
Measured on 2026-10-25 against our own test server: sent by 12 of 12 clients. Position counts from 1 and ignores GREASE values.
Why it matters for fingerprinting
All measured clients offer it. Chrome, curl_cffi, Go net/http list it 4th, Python requests, httpx, Node.js fetch, Guzzle and Debian curl 5th, and curl-impersonate and macOS curl 3rd. Its position mainly reflects whether the client lists X25519MLKEM768, x448 or secp521r1 ahead of it.
Check whether your client sends it
Open the test from your browser, or call it from your script, and look for secp384r1 in the TLS details.
Run the TLS fingerprint test