diff --git a/modules/common-security/src/main/java/org/dcache/ssl/CanlContextFactory.java b/modules/common-security/src/main/java/org/dcache/ssl/CanlContextFactory.java
index 8e36345ce67..cdeda661020 100644
--- a/modules/common-security/src/main/java/org/dcache/ssl/CanlContextFactory.java
+++ b/modules/common-security/src/main/java/org/dcache/ssl/CanlContextFactory.java
@@ -400,13 +400,19 @@ public KeyAndCertCredential0(PrivateKey privateKey, X509Certificate[] certificat
             }
 
             PublicKey pubKey = certificateChain[0].getPublicKey();
-            String pubKeyAlgorithm = pubKey.getAlgorithm();
-            // REVISIT: BouncyCastle uses "ECDSA" as the private key algorithm and "EC" as the public key algorithm names for elliptic curve keys.
-            if (!privateKey.getAlgorithm().equals(pubKeyAlgorithm) && !(privateKey.getAlgorithm().equals("ECDSA") && pubKeyAlgorithm.equals("EC")))
+            String pubAlg = pubKey.getAlgorithm();
+            String privAlg = privateKey.getAlgorithm();
+            // "EC" and "ECDSA" are both used for elliptic-curve keys depending on the
+            // provider and BouncyCastle version — treat them as equivalent.
+            boolean privIsEC = privAlg.equals("EC") || privAlg.equals("ECDSA");
+            boolean pubIsEC  = pubAlg.equals("EC")  || pubAlg.equals("ECDSA");
+
+            if (!privAlg.equals(pubAlg) && !(privIsEC && pubIsEC)) {
                 throw new KeyStoreException("Private and public keys are not matching: different algorithms: "
-                        + privateKey.getAlgorithm() + " vs. " + pubKeyAlgorithm);
+                        + privAlg + " vs. " + pubAlg);
+            }
 
-            switch (pubKeyAlgorithm) {
+            switch (pubAlg) {
                 case "DSA":
                     if (!checkKeysViaSignature("SHA1withDSA", privateKey, pubKey))
                         throw new KeyStoreException("Private and public keys are not matching: DSA");
@@ -425,8 +431,9 @@ public KeyAndCertCredential0(PrivateKey privateKey, X509Certificate[] certificat
                     if (!checkKeysViaSignature("GOST3411withECGOST3410", privateKey, pubKey))
                         throw new KeyStoreException("Private and public keys are not matching: EC GOST 34.10");
                     break;
+                case "EC":
                 case "ECDSA":
-                    if (!checkKeysViaSignature("SHA1withECDSA", privateKey, pubKey))
+                    if (!checkKeysViaSignature("SHA256withECDSA", privateKey, pubKey))
                         throw new KeyStoreException("Private and public keys are not matching: EC DSA");
                     break;
             }