Certificate signature algorithm

The algorithm the certificate is signed with. Current certificates use SHA-256; browsers refuse anything older.

• Help center

The issuer signs every certificate, and the signature algorithm says how: which hash function and which key type. Typical values are sha256WithRSAEncryption for RSA certificates and ecdsa-with-SHA256 or ecdsa-with-SHA384 for ECDSA ones. The report prints the name exactly as it appears in the certificate.

Why it matters. The signature is what prevents anyone from forging a certificate for your domain. MD5 and SHA-1 fell to practical collision attacks, public authorities stopped issuing SHA-1 certificates in 2016, and browsers reject them. SHA-256 or stronger is the norm.

How SiteScan shows it

The row is informational: it appears whenever a certificate was read and is marked as fine, because a certificate with a rejected algorithm would not have passed the scan's verified connection in the first place. RSA versus ECDSA is a choice, not a grade. ECDSA keys are smaller and make the handshake a little cheaper, RSA is the most compatible, and many servers serve both.

When to act

For a public certificate the authority picks the hash; you choose the key type when you create the request, for example --key-type ecdsa in Certbot. If an internal or self-signed certificate still uses SHA-1, reissue it with openssl req -new -sha256. More on the whole group: certificate expiry.