ECDSA (Elliptic Curve Digital Signature Algorithm)

ECDSA is the elliptic-curve version of the Digital Signature Algorithm, standardized by NIST in FIPS 186. In TLS certificates it is used with the P-256 and P-384 curves. A P-256 key offers about 128-bit security, comparable to 3072-bit RSA, while the raw signature is only 64 bytes. Every ECDSA signature uses a secret per-signature nonce; if a nonce is ever reused or predictable, the private key can be computed from the signatures, which is why RFC 6979 defines deterministic nonce generation.

Why it matters

ECDSA certificates make handshakes smaller and server-side signing much cheaper than RSA at a similar or higher security level. As of November 2026, WebPKI CAs issue TLS certificates with RSA or ECDSA (P-256/P-384) keys, and many ACME clients can request ECDSA keys. The main trade-off is compatibility with very old clients that only support RSA, which servers can handle by installing both an ECDSA and an RSA certificate.

Example

Generate a P-256 key and CSR, then serve ECDSA and RSA certificates side by side in nginx:

openssl ecparam -name prime256v1 -genkey -noout -out example.com.ecdsa.key
openssl req -new -key example.com.ecdsa.key -out example.com.csr -subj "/CN=example.com"

ssl_certificate     /etc/nginx/certs/example.com.ecdsa.crt;
ssl_certificate_key /etc/nginx/certs/example.com.ecdsa.key;
ssl_certificate     /etc/nginx/certs/example.com.rsa.crt;
ssl_certificate_key /etc/nginx/certs/example.com.rsa.key;

Common misconceptions

• "An ECDSA certificate must be issued by an ECDSA CA." Chains can mix algorithms; an ECDSA leaf signed by an RSA intermediate is common.
• "256-bit ECDSA is weaker than 2048-bit RSA." Key lengths are not comparable across algorithms; P-256 is the stronger of the two.
• "Signature randomness is a minor detail." A repeated or biased nonce leaks the private key, so use well-tested libraries rather than custom code.