How to Read a Signature Algorithm in an SSL Certificate

The signature algorithm field in an SSL certificate records how the issuing CA cryptographically signed the certificate. Understanding it helps you assess whether a certificate uses current security standards — and flag certificates that might trigger a weak signature algorithm warning.

What the Algorithm Field Contains

The algorithm name is actually a composite: it names both the hash function and the signing algorithm together. Common values:

• sha256WithRSAEncryption — SHA-256 hash, RSA signature. Current standard.
• sha384WithRSAEncryption — SHA-384 hash, RSA signature. More conservative.
• ecdsa-with-SHA256 — SHA-256 hash, ECDSA signature. Used with EC keys.
• ecdsa-with-SHA384 — SHA-384 hash, ECDSA signature.
• sha1WithRSAEncryption — deprecated. SHA-1 is no longer considered collision-resistant.
• md5WithRSAEncryption — broken. MD5 has been cryptographically broken since 2004.

The Hash Function's Role

The hash function condenses the certificate's content into a fixed-length digest. The CA signs that digest, not the full certificate. If an attacker can create two certificates with the same hash (a collision), they might be able to forge a signature. SHA-1's known collision vulnerabilities are why it was deprecated — SHA-256 and above are still considered secure.

RSA vs ECDSA

The signing algorithm choice affects performance and key size. RSA-2048 and RSA-4096 are widely supported and understood. ECDSA with P-256 provides equivalent security to RSA-3072 with much smaller keys — meaning faster handshakes and smaller certificates. Modern CAs increasingly offer ECDSA issuance alongside RSA.

What to Look For

When you decode a certificate with the SSL Certificate Decoder, the signature algorithm field appears in the overview section. Any certificate showing SHA-1 or MD5 should be replaced immediately — browsers will show certificate errors for these. The public key algorithm section shows the key type separately.