7

At the time the Cloudflare blog post “ECDSA: The digital signature algorithm of a better internet” was authored, Cloudflare was apparently one of "fewer than fifty" users of ECDSA certificates on the web. It seems they have since stopped (via ssllabs.com test).

I briefly surveyed several other major web properties using that tool (Google, Yahoo, Microsoft, Facebook, Amazon, Tumblr). Only Google seems to offer an EC key and ECDSA suites.

When I test locally, though (with cipherscan or openssl s_client -connect google.com:443 -cipher ECDHE-ECDSA-AES256-GCM-SHA384), I seem unable to handshake ("no peer certificate available").

Is anyone able to connect to Google (or another popular site) using an ECDSA ciphersuite?

jrr
  • 171
  • 2

2 Answers2

3

Facebook

They have deployed both ECDSA and RSA certs.

See SSL Labs report

Update 2015-11-10

About 7% ECDSA support.

Hubert Kario of Red Hat Security scans (used to scan?) the Alexa Top 1 Million sites using the cipherscan tool. This is the relevant table from his 2015-06 scan:

Certificate sig alg       Count     Percent 
-------------------------+---------+--------
None                      18593     3.7038   
ecdsa-with-SHA256         33851     6.7433   
sha1WithRSAEncryption     147349    29.3529  
sha256WithRSAEncryption   320910    63.9273  
sha384WithRSAEncryption   4         0.0008   
sha512WithRSAEncryption   9         0.0018

Alexa Top 10: 5/5 split

Here's a snapshot of the Alexa Top 10.

  1. Google.com: Yes.
  2. Facebook.com: Yes.
  3. Youtube.com: Yes.
  4. Baidu.com: No.
  5. Yahoo.com: No.
  6. Amazon.com: No.
  7. Wikipedia.org: Yes.
  8. Qq.com: No. No SSL/TLS at all
  9. Twitter.com: No.
  10. Google.co.in: Yes.
StackzOfZtuff
  • 17,923
  • 1
  • 51
  • 86
1

Besides Couldflare also Wikipedia supports it since it supports HTTPS by default. And do not forget https://security.stackexchange.com: They also support TLS_ECDHE_ECDSA.

BTW here are some statistic about the ciphers used by Wikipedia (and its users): https://grafana.wikimedia.org/dashboard/db/tls-ciphers

rugk
  • 1,257
  • 1
  • 13
  • 26