# ECC Certificate Request with --CSR option

**URL:** <https://community.letsencrypt.org/t/ecc-certificate-request-with-csr-option/213749>\
**Category:** Help\
**Created:** [February 22, 2024, 5:28pm UTC](https://community.letsencrypt.org/t/ecc-certificate-request-with-csr-option/213749 "2024-02-22T17:28:56Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![phil26271](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/phil26271/32/77901_2.png) [@phil26271](https://community.letsencrypt.org/u/phil26271)\
**Post date:** [February 22, 2024, 5:28pm UTC](https://community.letsencrypt.org/t/ecc-certificate-request-with-csr-option/213749/1 "2024-02-22T17:28:56Z")

</div>

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. [crt.sh | example.com](https://crt.sh/?q=example.com)), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is:

[test.test.com](http://test.test.com)

I ran this command:

certbot certonly --standalone --key-type ecdsa --elliptic-curve=secp256r1 --preferred-challenges http --agree-tos --server [https://acmeserver/ejbca/acme/eccacme/directory](https://acmeserver/ejbca/acme/eccacme/directory) --domain [test.testsite.com](http://test.testsite.com)

It produced this output:  
acme.messages.Error: urn:ietf:params:acme:error:badCSR :: The CSR is unacceptable (e.g., due to a short key) :: Key algorithm was not one of '[RSA]'.  
2024-02-22 10:30:39,703:ERROR:certbot.\_internal.log:An unexpected error occurred:  
2024-02-22 10:30:39,703:ERROR:certbot.\_internal.log:Key algorithm was not one of '[RSA]'.

My web server is (include version):

The operating system my web server runs on is (include version):

Redhat 8.7

My hosting provider, if applicable, is:

not applicable

I can login to a root shell on my machine (yes or no, or I don't know):

yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel):

no

The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you're using Certbot):

certbot 2.9.0

Hello,

I am new-ish to certbot and I am trying to come up with a solution to obtain a certificate for our on-prem devices from our EJBCA ACME internal CA. (just a model now). I was able to obtain a cert with RSA, but I see the following error when requesting a cert for ECDSA. Does certbot support requesting an ECDSA cert without the --CSR option? I was able to obtain an ECDSA cert using the --CSR option. I apologize in advance if my problem is confusing as I have started becoming familiar with certbot a few months ago where it was RSA cert requests.

Thank you

---

<div class="post-metadata">

**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\
**Post date:** [February 22, 2024, 5:33pm UTC](https://community.letsencrypt.org/t/ecc-certificate-request-with-csr-option/213749/2 "2024-02-22T17:33:02Z")

</div>

> [@phil26271](#):
>
> Does certbot support requesting an ECDSA cert without the --CSR option?

Yes.

> [@phil26271](#):
>
> I was able to obtain an ECDSA cert using the --CSR option.

Are you sure? Because the ACME server seems to reply with an error specifically saying it only accepts RSA CSRs.

---

<div class="post-metadata">

**Author:** ![phil26271](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/phil26271/32/77901_2.png) [@phil26271](https://community.letsencrypt.org/u/phil26271)\
**Post date:** [February 22, 2024, 9:47pm UTC](https://community.letsencrypt.org/t/ecc-certificate-request-with-csr-option/213749/3 "2024-02-22T21:47:12Z")

</div>

Nevermind. I figured it out. The issue was with EJBCA, not with Certbot. Thanks for your prompt response.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\
**Post date:** [March 23, 2024, 9:47pm UTC](https://community.letsencrypt.org/t/ecc-certificate-request-with-csr-option/213749/4 "2024-03-23T21:47:48Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.