What browsers/percent of users/legacy clients can't do ECDSA certs these days?
A few years back AWS Cloudfront couldn't, but I assume that's been upgraded?
Anything else?
Conversation
Replying to
For an idea of how widely it's supported by clients, Cloudflare only supports ECDSA for the Free plan used by the vast majority of sites making use of it. They have a compatibility list at developers.cloudflare.com/ssl/ssl-tls/br for browsers with SNI + ECDSA.
1
4
ECDSA is better if you care about compatibility with the oldest still supported clients. Internet Explorer 11 only supports ECDHE with an ECDSA certificate. If you use an RSA certificate and care about compatibility, you have to enable the DHE ciphers and configure it properly.
1
DHE ciphers aren't supported with ECDSA. If you use the Mozilla Intermediate cipher configuration with ECDSA, you end up using 3 ciphers for TLS < 1.3:
ECDHE-ECDSA-AES256-GCM-SHA384
ECDHE-ECDSA-CHACHA20-POLY1305
ECDHE-ECDSA-AES128-GCM-SHA256
Matches the 3 usual TLS 1.3 ciphers.