SHA2 / SHA256 certificates

Hi Kurt, I appreciate the reply, but unfortunately I don't think either option will work. I've done a bit more investigation since my first post - and to confirm my thoughts, I ran a quick (successful) test to an SSL site with SHA2 cert... the Client Hello contains the following Cipher Suites (36 suites) presented by my browser:

 

 

Cipher Suite: TLS_EMPTY_RENEGOTIATION_INFO_SCSV (0x00ff)

 

Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA (0xc00a)

 

Cipher Suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (0xc014)

 

Cipher Suite: TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA (0x0088)

 

Cipher Suite: TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA (0x0087)

 

Cipher Suite: TLS_DHE_DSS_WITH_AES_256_CBC_SHA (0x0038)

 

Cipher Suite: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA (0xc00f)

 

Cipher Suite: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA (0xc005)

 

Cipher Suite: TLS_RSA_WITH_CAMELLIA_256_CBC_SHA (0x0084)

 

Cipher Suite: TLS_RSA_WITH_AES_256_CBC_SHA (0x0035)

 

Cipher Suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA (0x0039)

 

Cipher Suite: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA (0xc007)

 

Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA (0xc009)

 

Cipher Suite: TLS_ECDHE_RSA_WITH_RC4_128_SHA (0xc011)

 

Cipher Suite: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (0xc013)

 

Cipher Suite: TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA (0x0045)

 

Cipher Suite: TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA (0x0044)

 

Cipher Suite: TLS_DHE_RSA_WITH_AES_128_CBC_SHA (0x0033)

 

Cipher Suite: TLS_DHE_DSS_WITH_AES_128_CBC_SHA (0x0032)

 

Cipher Suite: TLS_ECDH_RSA_WITH_RC4_128_SHA (0xc00c)

 

Cipher Suite: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA (0xc00e)

 

Cipher Suite: TLS_ECDH_ECDSA_WITH_RC4_128_SHA (0xc002)

 

Cipher Suite: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA (0xc004)

 

Cipher Suite: TLS_RSA_WITH_SEED_CBC_SHA (0x0096)

 

Cipher Suite: TLS_RSA_WITH_CAMELLIA_128_CBC_SHA (0x0041)

 

Cipher Suite: TLS_RSA_WITH_RC4_128_MD5 (0x0004)

 

Cipher Suite: TLS_RSA_WITH_RC4_128_SHA (0x0005)

 

Cipher Suite: TLS_RSA_WITH_AES_128_CBC_SHA (0x002f)

 

Cipher Suite: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA (0xc008)

 

Cipher Suite: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA (0xc012)

 

Cipher Suite: TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA (0x0016)

 

Cipher Suite: TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA (0x0013)

 

Cipher Suite: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA (0xc00d)

 

Cipher Suite: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA (0xc003)

 

Cipher Suite: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA (0xfeff)

 

Cipher Suite: TLS_RSA_WITH_3DES_EDE_CBC_SHA (0x000a)

 

 

...as you can see, SHA2 is not listed. The Server Hello then shows the selected suite:

 

 

Cipher Suite: TLS_RSA_WITH_AES_256_CBC_SHA (0x0035)

 

 

... the certificate sent by the server shows the following information:

 

 

Certificates Length: 3714

 

Certificates (3714 bytes)

 

Certificate Length: 2083

 

Certificate (id-at-commonName=*detail removed*)

 

signedCertificate

 

algorithmIdentifier (sha256WithRSAEncryption)

 

Algorithm Id: 1.2.840.113549.1.1.11 (sha256WithRSAEncryption)

 

Padding: 0

 

encrypted: 54f056b0f5ec7b2a15d6e756c058d3df65d22cfaf8ed4e20...

 

Certificate Length: 1625

 

Certificate (id-at-commonName=*detail removed*)

 

signedCertificate

 

algorithmIdentifier (shaWithRSAEncryption)

 

Algorithm Id: 1.2.840.113549.1.1.5 (shaWithRSAEncryption)

 

Padding: 0

 

encrypted: 5d4f84f1a888d3a3b2bc9c6de5294977e1e7d6dca9d835ae...

 

 

You can see that the algorithmIdentifier is sha256WithRSAEncryption. So, in summary, my browser/OS was able to verify the SHA256 cert, but did not present any cipher suites with SHA256 included.

 

 

I guess this means that LTM SSL profiles plays no part in the certificate verification process, has no view of it, and therefore this problem can not be solved.

 

 

I hope I'm wrong :)