Which Wireshark field shows the server certificate’s signature algorithm during the TLS handshake?

• A. dns.server_certificate.signature
• B. ssl.certificate.sign_algorithm
• C. tls.handshake.algorithm
• D. tls.server_certificate.signature_algorithm

Answer: (C)

During the TLS handshake, the server sends its certificate, which is signed with a particular signature algorithm. Wireshark exposes that algorithm in the field tls.handshake.algorithm. This field corresponds to the signature algorithm used to sign the certificate in the Certificate message, so it reliably tells you whether the certificate was signed with, for example, sha256WithRSAEncryption or another hash/signature combo. Other field paths like dns.server_certificate.signature or ssl.certificate.sign_algorithm don't map to the TLS certificate's signature algorithm in Wireshark's dissector, and a path like tls.server_certificate.signature_algorithm isn't the standard field name. Thus tls.handshake.algorithm is the correct field to inspect for the server certificate’s signature algorithm.