Bug: Alpine certbot package (docker) generates Private-Key: (256 bit)

Help
1

For some odd reason the cli ignored the specified key length and nginx won't load the cert.

My domain is: clients-eu.devel.ca

I ran this command (shortened as I call the temp container):
certbot
certonly
--webroot
--webroot-path /var/www/html
--noninteractive --verbose --rsa-key-size 4096
--email admin+apps+clients@orbisius.com
--verbose --text --agree-tos
-d clients-eu.devel.ca
-d www.clients-eu.devel.ca 2>&1 \

It produced this output:
all was successfully issued.

My web server is (include version):
nginx. v1.26.0

The operating system my web server runs on is (include version):
Ubuntu 22

My hosting provider, if applicable, is:
contabo

I can login to a root shell on my machine (yes or no, or I don't know):
yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel):
no

The version of my client is
certbot 2.10.0

2

I revoked the SSL cert and then requested a new one and have the same problem

3

Hi @lordspace,

Certbot changed to default ECDSA certificates by default and other upcoming changes in Certbot 2.0 and Existing RSA key/cert renewed as ECDSA on Certbot upgrade - #7 by _az

If you want RSA I believe you still need one more option set see User Guide — Certbot 2.11.0 documentation

3 Likes
4

Thanks for the quick reply!
If I omit the key size would it fix this?

2 Likes
5

I believe to keep RSA you likely want to add the option --key-type rsa

5 Likes
6

Indeed. Just specifying the key size without telling Certbot which type you want isn't enough.

One could think: "Hey, but if I mention --rsa-key-size on the command line, that would imply using RSA, right?" Well, I guess, but Certbot isn't that smart..

Revoking isn't really necessary unless the private key got leaked.

4 Likes
7

That command line with --rsa-key-size used to work perfectly for the last 4-6 years. Would certbot upgrade the key to 4096?

8

Certbot changed the default key type to ECDSA with Certbot v2.0.0. And in between 2.0.0 and 2.somewhat there was a bug that it did not detect properly if an already existing certificate was RSA and simply used ECDSA without the user knowing.

1 Like
9

It's a brand new certificate for a new staging site

10

I tried certbot renew --key-type ecdsa --cert-name example.com --force-renewal
from the docs: User Guide — Certbot 2.11.0 documentation

The private key is super short 241 bytes! my other key is 1.7K.

I think certbot should be smart to auto detect the type based on the key size parameter if key type wasn't passed. I can't believe nobody thought of that.

11

ECSDA private keys and certificates are substantially shorter than their RSA counterparts.

2 Likes
12

Yeah, certbot assumes that if you care about the key type at all, then you'd pass the key type argument. It probably should warn if you pass an RSA key size when you're not using an RSA key, but really it's uncommon that one needs an RSA key nowadays. As you've noticed, ECDSA keys are much smaller.

4 Likes
13

I would probably care but I have scripts and tools that automatically generate certificates.
Thank you all for helping me and answering my questions!

3 Likes
14

I'm not really following. Is your complaint that your private key is small or that you're getting ECDSA certificates instead of RSA?

What did you expect when you typed --key-type ecdsa? An RSA key type somehow?

1 Like
15

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.