During TLS 1.2 handshakes, my server (2012 R2/IIS 8.5) seems to be choosing SHA1 as the signature algorithm for the ECDHE parameters despite the fact that the client(s) and server both support better SHA2 algorithms.
Handshake Protocol: Server Key Exchange
Handshake Type: Server Key Exchange (12)
Length: 361
EC Diffie-Hellman Server Params
Curve Type: named_curve (0x03)
Named Curve: secp384r1 (0x0018)
Pubkey Length: 97
Pubkey:
Signature Hash Algorithm: 0x0201
Signature Hash Algorithm Hash: SHA1 (2)
Signature Hash Algorithm Signature: RSA (1)
Signature Length: 256
Signature:
Handshake Protocol: Client Hello
Handshake Type: Client Hello (1)
Length: 175
Version: TLS 1.2 (0x0303)
...
Extension: signature_algorithms
Type: signature_algorithms (0x000d)
Length: 20
Signature Hash Algorithms Length: 18
Signature Hash Algorithms (9 algorithms)
Signature Hash Algorithm: 0x0601
Signature Hash Algorithm Hash: SHA512 (6)
Signature Hash Algorithm Signature: RSA (1)
Signature Hash Algorithm: 0x0401
Signature Hash Algorithm Hash: SHA256 (4)
Signature Hash Algorithm Signature: RSA (1)
Signature Hash Algorithm: 0x0501
Signature Hash Algorithm Hash: SHA384 (5)
Signature Hash Algorithm Signature: RSA (1)
Signature Hash Algorithm: 0x0201
Signature Hash Algorithm Hash: SHA1 (2)
Signature Hash Algorithm Signature: RSA (1)
I've tried all sorts of different clients, but SHA1 is always chosen during the handshake. This is what I see in the handshake when the clients connect to other servers and when my own server acts a client (to other IIS 8.5 servers even)...
EC Diffie-Hellman Server Params
Curve Type: named_curve (0x03)
Named Curve: secp256r1 (0x0017)
Pubkey Length: 65
Pubkey: ...
Signature Hash Algorithm: 0x0601
Signature Hash Algorithm Hash: SHA512 (6)
Signature Hash Algorithm Signature: RSA (1)
Signature Length: 256
Signature: ...
Any idea what could be causing my server to select this weaker SHA1 hash algorithm to be used for ECDHE instead of SHA2 hashes? I've double checked that it's not falling back to TLS 1.0. As far as I can tell, it's staying at TLS 1.2 throughout the handshake.
Thanks!