Why is RSA+SHA1 in the "TLS 1.2 sig.algs offered" list about testssl.sh

[dcooper16]

I would suggest looking at NIST Special Publication 800-52. Appendix B.1 explains how to interpret TLS 1.2 cipher suite names, and the example at the end of the section is very similar the one you mentioned. Section 3.4.1.4 talks about the signature algorithms extension.

[dcooper16]

It is not a bug. If your server supports a cipher suite that uses RSA signatures, such as ones of the form TLS_ECDHE_RSA..., then it needs to support RSA signatures (RSA+... and/or RSA-PSS-RSAE+...). What hash function is used to create the RSA signature is not determined by the cipher suite. It is negotiated separately.

[Charles1000Chen]

@dcooper16 Thank you. I'm still a bit confused. Even though the hash function is negotiated separately, why I have clearly specified the "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384" algorithm but the testssh tells that SHA1 hash function is used? Shouldn't the hash function be SHA384? Any suggestion on how to eliminate weak SHA1 from the "TLS 1.2 sig.algs offered" list will be appreciated.