Home / server / Questions / 926618
Accepted
Fionn
Asked: 2018-08-16 18:12:14 +0800 CST

IIS Windows 2016 ecdsa signed certificate

  • 772

Does anyone know if IIS supports certificates signed with sha256ecdsa?

If viewed with openssl, i have the following parameters: Signature Algorithm: ecdsa-with-SHA256 Public Key Info: NIST CURVE: P-384

The problem is with this certificate I can't get a successful TLS handshake. I wonder if the problem is the signature algorithm or the ECDSA curve (both the certificate and the CA use P-384 public keys).

iis

1 Answers

  1. Best Answer

    The problem was that P384 cipher suits are not enabled by default it seems.

    I solved it using GPO with a set "Computer Configuration->Administrative Templates->Network/SSL Configuration Settings->SSL Cipher Suite Order"

    I added ciphers such as "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384_P384".

    After this it could use the certificate as expected.

    • 1