ECDHE-ECDSA-AES128-GCM-SHA256
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
ECDHE-ECDSA-AES128-GCM-SHA256 uses ECDSA (Elliptic Curve DSA) for server authentication instead of RSA. ECDSA certificates are smaller and faster to verify than RSA certificates at equivalent security levels. Requires an ECDSA certificate on the server (P-256 curve). Used by Cloudflare, Fastly, and other performance-focused CDNs.
Key Exchange
ECDHE
Authentication
ECDSA
Encryption
AES-128-GCM
MAC / Integrity
SHA-256 (AEAD – integrated)
Details
ECDSA authentication uses elliptic curve cryptography for the certificate signature. A 256-bit ECDSA key (P-256) provides equivalent security to a 3072-bit RSA key, with smaller certificate size and faster signature verification. This makes ECDHE-ECDSA cipher suites faster overall than their RSA equivalents. To use this cipher suite, the server needs an ECDSA certificate rather than (or in addition to) an RSA certificate.